subterfugue.org Open in urlscan Pro
2606:4700:3035::6815:25c2 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://kartaplovdiv.com/sexdating.php
Effective URL:
https://subterfugue.org/
Submission: On January 17 via manual (January 17th 2022, 12:00:39 am UTC) from FR — Scanned from FR

Summary HTTP 473 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 45 IPs in 11 countries across 54 domains to perform 473 HTTP transactions. The main IP is 2606:4700:3035::6815:25c2, located in United States and belongs to CLOUDFLARENET, US. The main domain is subterfugue.org.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 9th 2021. Valid for: a year.

This is the only time subterfugue.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3036::ac43:8f96	13335 (CLOUDFLAR...) (CLOUDFLARENET)
57	2606:4700:303... 2606:4700:3035::6815:25c2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
87	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
5	104.75.88.126 104.75.88.126	16625 (AKAMAI-AS) (AKAMAI-AS)
9	45.133.44.25 45.133.44.25	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
2	2600:9000:206... 2600:9000:206f:8e00:11:a4de:2580:93a1	16509 (AMAZON-02) (AMAZON-02)
1	188.166.135.13 188.166.135.13	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
3	2a00:1450:400... 2a00:1450:4001:811::200a	15169 (GOOGLE) (GOOGLE)
24	104.19.135.78 104.19.135.78	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS)
3	151.101.1.195 151.101.1.195	54113 (FASTLY) (FASTLY)
1 9	2a02:6b8::1:119 2a02:6b8::1:119	208722 (YNDX) (YNDX)
1 2	88.212.201.204 88.212.201.204	39134 (UNITEDNET) (UNITEDNET)
5	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:5514	13335 (CLOUDFLAR...) (CLOUDFLARENET)
44	2a00:1450:400... 2a00:1450:4001:80f::2001	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
121	2a00:1450:400... 2a00:1450:4001:801::2006	15169 (GOOGLE) (GOOGLE)
14	142.250.186.66 142.250.186.66	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82b::2001	15169 (GOOGLE) (GOOGLE)
2 2	35.186.231.97 35.186.231.97	15169 (GOOGLE) (GOOGLE)
2	65.9.58.6 65.9.58.6	16509 (AMAZON-02) (AMAZON-02)
13 26	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
5 11	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
5 7	37.252.172.45 37.252.172.45	29990 (ASN-APPNEX) (ASN-APPNEX)
1 6	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
2 2	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1 2	104.111.242.245 104.111.242.245	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	185.94.180.125 185.94.180.125	35220 (SPOTX-AMS) (SPOTX-AMS)
1	2a00:1288:80:... 2a00:1288:80:800::7000	203220 (YAHOO-DEB) (YAHOO-DEB)
2 2	18.185.129.183 18.185.129.183	16509 (AMAZON-02) (AMAZON-02)
3 3	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
1 2	2.18.234.233 2.18.234.233	16625 (AKAMAI-AS) (AKAMAI-AS)
1 3	185.86.139.89 185.86.139.89	201081 (SMARTADSE...) (SMARTADSERVER)
12	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
6	104.19.136.78 104.19.136.78	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	23.37.42.132 23.37.42.132	16625 (AKAMAI-AS) (AKAMAI-AS)
2	104.117.200.100 104.117.200.100	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a0c:5c81:513... 2a0c:5c81:5139::2	55081 (24SHELLS) (24SHELLS)
5 5	18.184.241.76 18.184.241.76	16509 (AMAZON-02) (AMAZON-02)
2 2	35.210.178.101 35.210.178.101	19527 (GOOGLE-2) (GOOGLE-2)
2 2	35.212.212.222 35.212.212.222	15169 (GOOGLE) (GOOGLE)
2 2	3.251.21.8 3.251.21.8	16509 (AMAZON-02) (AMAZON-02)
2 2	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
1	51.89.9.251 51.89.9.251	16276 (OVH) (OVH)
1	2606:4700:10:... 2606:4700:10::6816:1957	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	109.206.161.21 109.206.161.21	50245 (SERVEREL-AS) (SERVEREL-AS)
1 1	185.86.139.103 185.86.139.103	201081 (SMARTADSE...) (SMARTADSERVER)
1	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	185.184.8.65 185.184.8.65	204995 (RTB-HOUSE...) (RTB-HOUSE-AMS)
1	104.19.217.61 104.19.217.61	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.16.199.73 104.16.199.73	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	62.149.0.72 62.149.0.72	15497 (COLOCALL ...) (COLOCALL Internet Data Center ColoCALL)
1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
1	8.39.36.142 8.39.36.142	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	2a01:4f8:252:... 2a01:4f8:252:564d::2	24940 (HETZNER-AS) (HETZNER-AS)
1 1	2a02:128:7:47... 2a02:128:7:4715::2	50245 (SERVEREL-AS) (SERVEREL-AS)
473	45

1 2606:4700:3036::ac43:8f96 (United States)

ASN13335 (CLOUDFLARENET, US)

kartaplovdiv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

57 2606:4700:3035::6815:25c2 (United States)

ASN13335 (CLOUDFLARENET, US)

subterfugue.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

87 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.75.88.126 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-88-126.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 45.133.44.25 (Philadelphia, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

js.wpadmngr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
na.nawpush.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
17052e5944.1691ba9d92.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js.cabnnr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js.natsdk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js.wpushsdk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.1vag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:206f:8e00:11:a4de:2580:93a1 (United States)

ASN16509 (AMAZON-02, US)

get.optad360.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.166.135.13 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)

go9s.biz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 104.19.135.78 (None, )

ASN13335 (CLOUDFLARENET, US)

jsc.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
servicer.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.235.40 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.1.195 (United States)

ASN54113 (FASTLY, US)

cdn.zx-adnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a02:6b8::1:119 (Moscow, Russian Federation) 1 redirects

ASN208722 (YNDX, FI)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.212.201.204 (Russian Federation) 1 redirects

ASN39134 (UNITEDNET, RU)
PTR: host204.rax.ru

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5514 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

44 2a00:1450:4001:80f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

121 2a00:1450:4001:801::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 142.250.186.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.186.231.97 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 97.231.186.35.bc.googleusercontent.com

impes.tradedoubler.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 65.9.58.6 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-58-6.fra56.r.cloudfront.net

vht.tradedoubler.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 216.58.212.162 (United States) 13 redirects

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f162.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2.18.234.21 (Frankfurt am Main, Germany) 5 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 37.252.172.45 (Frankfurt am Main, Germany) 5 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.242.245 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-245.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.94.180.125 (Amsterdam, Netherlands) 2 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:80:800::7000 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.185.129.183 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-185-129-183.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.126.56.137 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.234.233 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-233.deploy.static.akamaitechnologies.com

ads.stickyadstv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.86.139.89 (France) 1 redirects

ASN201081 (SMARTADSERVER, FR)

rtb-csync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.19.136.78 (None, )

ASN13335 (CLOUDFLARENET, US)

s-img.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.37.42.132 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-42-132.deploy.static.akamaitechnologies.com

secure-assets.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.117.200.100 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-117-200-100.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a0c:5c81:5139::2 (London, United Kingdom)

ASN55081 (24SHELLS, US)

s.adtelligent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 18.184.241.76 (Frankfurt am Main, Germany) 5 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-184-241-76.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.210.178.101 (Brussels, Belgium) 2 redirects

ASN19527 (GOOGLE-2, US)
PTR: 101.178.210.35.bc.googleusercontent.com

a.volvelle.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.212.212.222 (The Dalles, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 222.212.212.35.bc.googleusercontent.com

rtb-usw.mfadsrvr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.251.21.8 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-251-21-8.eu-west-1.compute.amazonaws.com

ad.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.223.40.198 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.89.9.251 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ip251.ip-51-89-9.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:1957 (United States)

ASN13335 (CLOUDFLARENET, US)

mwzeom.zeotap.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 109.206.161.21 (Netherlands) 2 redirects

ASN50245 (SERVEREL-AS, NL)
PTR: 109.206.161.21.serverel.net

sync.e-volution.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.86.139.103 (France) 1 redirects

ASN201081 (SMARTADSERVER, FR)

ssbsync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.184.8.65 (Amsterdam, Netherlands) 2 redirects

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-65.rtbhouse.net

creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.217.61 (None, )

ASN13335 (CLOUDFLARENET, US)

cm.lentainform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.199.73 (None, )

ASN13335 (CLOUDFLARENET, US)

cm.idealmedia.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 62.149.0.72 (Ukraine) 1 redirects

ASN15497 (COLOCALL Internet Data Center ColoCALL, UA)
PTR: 0-72.cc86365-03-tmp.cc.colocall.com

sync.adtelligent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.39.36.142 (United States)

ASN26667 (RUBICONPROJECT, US)

pixel-us-west.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a01:4f8:252:564d::2 (Germany) 2 redirects

ASN24940 (HETZNER-AS, DE)

rtbbnr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:128:7:4715::2 (Czech Republic) 1 redirects

ASN50245 (SERVEREL-AS, NL)

btds.zog.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
121	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 245	2 MB
101	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 94 tpc.googlesyndication.com — Cisco Umbrella Rank: 127 d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com	764 KB
74	doubleclick.net 13 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 44 securepubads.g.doubleclick.net — Cisco Umbrella Rank: 175 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 276 cm.g.doubleclick.net — Cisco Umbrella Rank: 169	505 KB
57	subterfugue.org subterfugue.org	3 MB
30	mgid.com jsc.mgid.com — Cisco Umbrella Rank: 7907 c.mgid.com — Cisco Umbrella Rank: 5816 cdn.mgid.com — Cisco Umbrella Rank: 10239 servicer.mgid.com — Cisco Umbrella Rank: 8010 s-img.mgid.com — Cisco Umbrella Rank: 6938 cm.mgid.com — Cisco Umbrella Rank: 1447	237 KB
12	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 202	270 KB
11	casalemedia.com 5 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 496	11 KB
10	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 151	371 KB
9	google.com 1 redirects adservice.google.com — Cisco Umbrella Rank: 69 www.google.com — Cisco Umbrella Rank: 8	1 KB
9	yandex.ru 1 redirects mc.yandex.ru — Cisco Umbrella Rank: 3317	69 KB
8	gstatic.com www.gstatic.com fonts.gstatic.com	55 KB
7	adnxs.com 5 redirects ib.adnxs.com — Cisco Umbrella Rank: 210	7 KB
6	rubiconproject.com 1 redirects secure-assets.rubiconproject.com — Cisco Umbrella Rank: 906 eus.rubiconproject.com — Cisco Umbrella Rank: 503 pixel.rubiconproject.com — Cisco Umbrella Rank: 270 token.rubiconproject.com — Cisco Umbrella Rank: 583 pixel-us-west.rubiconproject.com — Cisco Umbrella Rank: 4017	12 KB
5	bidswitch.net 5 redirects x.bidswitch.net — Cisco Umbrella Rank: 254	3 KB
4	smartadserver.com 2 redirects rtb-csync.smartadserver.com — Cisco Umbrella Rank: 532 ssbsync.smartadserver.com — Cisco Umbrella Rank: 1138	2 KB
4	yahoo.com 3 redirects ads.yahoo.com — Cisco Umbrella Rank: 722 ups.analytics.yahoo.com — Cisco Umbrella Rank: 249	3 KB
4	tradedoubler.com 2 redirects impes.tradedoubler.com — Cisco Umbrella Rank: 71615 vht.tradedoubler.com — Cisco Umbrella Rank: 101154	64 KB
4	addthis.com s7.addthis.com — Cisco Umbrella Rank: 1343 m.addthis.com — Cisco Umbrella Rank: 1311	217 KB
3	google.fr adservice.google.fr — Cisco Umbrella Rank: 29086	1 KB
3	zx-adnet.com cdn.zx-adnet.com — Cisco Umbrella Rank: 139412	112 KB
3	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 258 fonts.googleapis.com — Cisco Umbrella Rank: 37	35 KB
3	wpadmngr.com js.wpadmngr.com — Cisco Umbrella Rank: 27231	30 KB
2	rtbbnr.com 2 redirects rtbbnr.com — Cisco Umbrella Rank: 31249	1 KB
2	creativecdn.com 2 redirects creativecdn.com — Cisco Umbrella Rank: 666	687 B
2	e-volution.ai 2 redirects sync.e-volution.ai — Cisco Umbrella Rank: 2517	918 B
2	adsrvr.org 2 redirects match.adsrvr.org — Cisco Umbrella Rank: 295	906 B
2	360yield.com 2 redirects ad.360yield.com — Cisco Umbrella Rank: 620	612 B
2	mfadsrvr.com 2 redirects rtb-usw.mfadsrvr.com — Cisco Umbrella Rank: 7031	755 B
2	volvelle.tech 2 redirects a.volvelle.tech — Cisco Umbrella Rank: 23145	1 KB
2	adtelligent.com 1 redirects s.adtelligent.com — Cisco Umbrella Rank: 3942 sync.adtelligent.com — Cisco Umbrella Rank: 2578	1 KB
2	stickyadstv.com 1 redirects ads.stickyadstv.com — Cisco Umbrella Rank: 601	1 KB
2	advertising.com 2 redirects pixel.advertising.com — Cisco Umbrella Rank: 293	2 KB
2	spotxchange.com 2 redirects sync.search.spotxchange.com — Cisco Umbrella Rank: 418	2 KB
2	teads.tv 1 redirects sync.teads.tv — Cisco Umbrella Rank: 750	942 B
2	openx.net 2 redirects us-u.openx.net — Cisco Umbrella Rank: 316	1 KB
2	yadro.ru 1 redirects counter.yadro.ru — Cisco Umbrella Rank: 9433	1 KB
2	optad360.io get.optad360.io — Cisco Umbrella Rank: 23154	231 KB
1	1vag.com cdn.1vag.com — Cisco Umbrella Rank: 49414	334 B
1	zog.link 1 redirects btds.zog.link — Cisco Umbrella Rank: 39177	222 B
1	idealmedia.io cm.idealmedia.io — Cisco Umbrella Rank: 16149	412 B
1	lentainform.com cm.lentainform.com — Cisco Umbrella Rank: 14841	495 B
1	zeotap.com mwzeom.zeotap.com — Cisco Umbrella Rank: 1443	455 B
1	onetag-sys.com onetag-sys.com — Cisco Umbrella Rank: 888	151 B
1	wpushsdk.com js.wpushsdk.com — Cisco Umbrella Rank: 37847	5 KB
1	natsdk.com js.natsdk.com — Cisco Umbrella Rank: 136941	14 KB
1	cabnnr.com js.cabnnr.com — Cisco Umbrella Rank: 40631	10 KB
1	1691ba9d92.com 17052e5944.1691ba9d92.com	199 B
1	nawpush.com na.nawpush.com — Cisco Umbrella Rank: 38053	882 B
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 398	1 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 745	647 B
1	addthisedge.com v1.addthisedge.com — Cisco Umbrella Rank: 1539	874 B
1	moatads.com z.moatads.com — Cisco Umbrella Rank: 348	1 KB
1	go9s.biz go9s.biz — Cisco Umbrella Rank: 883815	15 KB
1	kartaplovdiv.com kartaplovdiv.com — Cisco Umbrella Rank: 757610	1 KB
473	54

	Domain	Requested by
121	s0.2mdn.net	googleads.g.doubleclick.net kartaplovdiv.com s0.2mdn.net
57	subterfugue.org	subterfugue.org
55	pagead2.googlesyndication.com	subterfugue.org pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com kartaplovdiv.com www.gstatic.com www.googletagservices.com
44	tpc.googlesyndication.com	googleads.g.doubleclick.net tpc.googlesyndication.com kartaplovdiv.com d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com pagead2.googlesyndication.com
30	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net kartaplovdiv.com
26	cm.g.doubleclick.net	13 redirects googleads.g.doubleclick.net
14	googleads4.g.doubleclick.net	googleads.g.doubleclick.net kartaplovdiv.com
12	cdnjs.cloudflare.com	s0.2mdn.net
11	dsum-sec.casalemedia.com	5 redirects googleads.g.doubleclick.net
10	www.googletagservices.com	googleads.g.doubleclick.net kartaplovdiv.com
9	cm.mgid.com	jsc.mgid.com s.adtelligent.com
9	mc.yandex.ru	1 redirects subterfugue.org mc.yandex.ru
8	cdn.mgid.com	jsc.mgid.com
7	ib.adnxs.com	5 redirects googleads.g.doubleclick.net
6	s-img.mgid.com
6	www.gstatic.com	googleads.g.doubleclick.net
6	www.google.com	1 redirects googleads.g.doubleclick.net tpc.googlesyndication.com
5	x.bidswitch.net	5 redirects
4	securepubads.g.doubleclick.net	get.optad360.io securepubads.g.doubleclick.net
4	jsc.mgid.com	subterfugue.org jsc.mgid.com
3	rtb-csync.smartadserver.com	1 redirects googleads.g.doubleclick.net
3	ups.analytics.yahoo.com	3 redirects
3	adservice.google.com	pagead2.googlesyndication.com
3	adservice.google.fr	pagead2.googlesyndication.com
3	cdn.zx-adnet.com	subterfugue.org cdn.zx-adnet.com
3	js.wpadmngr.com	subterfugue.org js.wpadmngr.com
3	s7.addthis.com	subterfugue.org s7.addthis.com
2	rtbbnr.com	2 redirects
2	creativecdn.com	2 redirects
2	sync.e-volution.ai	2 redirects
2	match.adsrvr.org	2 redirects
2	ad.360yield.com	2 redirects
2	rtb-usw.mfadsrvr.com	2 redirects
2	a.volvelle.tech	2 redirects
2	eus.rubiconproject.com	cm.mgid.com eus.rubiconproject.com
2	servicer.mgid.com	jsc.mgid.com
2	fonts.gstatic.com	subterfugue.org
2	ads.stickyadstv.com	1 redirects googleads.g.doubleclick.net
2	pixel.advertising.com	2 redirects
2	sync.search.spotxchange.com	2 redirects
2	sync.teads.tv	1 redirects googleads.g.doubleclick.net
2	us-u.openx.net	2 redirects
2	fonts.googleapis.com	googleads.g.doubleclick.net
2	vht.tradedoubler.com	googleads.g.doubleclick.net
2	impes.tradedoubler.com	2 redirects
2	d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	counter.yadro.ru	1 redirects subterfugue.org
2	get.optad360.io	subterfugue.org get.optad360.io
1	cdn.1vag.com	js.cabnnr.com
1	btds.zog.link	1 redirects
1	pixel-us-west.rubiconproject.com	eus.rubiconproject.com
1	token.rubiconproject.com	eus.rubiconproject.com
1	sync.adtelligent.com	1 redirects
1	cm.idealmedia.io
1	cm.lentainform.com
1	pixel.rubiconproject.com
1	ssbsync.smartadserver.com	1 redirects
1	mwzeom.zeotap.com
1	onetag-sys.com
1	s.adtelligent.com	cm.mgid.com
1	secure-assets.rubiconproject.com	1 redirects
1	c.mgid.com	jsc.mgid.com
1	js.wpushsdk.com	js.wpadmngr.com
1	js.natsdk.com	js.wpadmngr.com
1	js.cabnnr.com	js.wpadmngr.com
1	17052e5944.1691ba9d92.com	js.wpadmngr.com
1	ads.yahoo.com	googleads.g.doubleclick.net
1	na.nawpush.com	js.wpadmngr.com
1	cdn.jsdelivr.net	get.optad360.io
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	m.addthis.com	s7.addthis.com
1	v1.addthisedge.com	s7.addthis.com
1	z.moatads.com	s7.addthis.com
1	ajax.googleapis.com	subterfugue.org
1	go9s.biz	subterfugue.org
1	kartaplovdiv.com
473	76

This site contains links to these domains. Also see Links.

Domain
www.dynadot.com
www.mgid.com
widgets.mgid.com
sd.subterfugue.org
cv.subterfugue.org
www.addthis.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-11` - `2022-06-10`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
odc-addthis-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2021-04-25` - `2022-04-27`	a year	crt.sh
js.wpadmngr.com R3	`2021-11-18` - `2022-02-16`	3 months	crt.sh
*.optad360.io Amazon	`2021-11-17` - `2022-12-15`	a year	crt.sh
go1s.biz R3	`2022-01-10` - `2022-04-10`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-11-27` - `2022-11-29`	a year	crt.sh
www.drivermanager.club GTS CA 1D4	`2022-01-07` - `2022-04-07`	3 months	crt.sh
mc.yandex.ru Yandex CA	`2021-12-22` - `2022-06-03`	5 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.google.fr GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
na.nawpush.com R3	`2021-12-12` - `2022-03-12`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
ui.aps.ads.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-01-07` - `2022-02-23`	2 months	crt.sh
17052e5944.1691ba9d92.com R3	`2021-12-21` - `2022-03-21`	3 months	crt.sh
js.cabnnr.com R3	`2021-12-28` - `2022-03-28`	3 months	crt.sh
js.natsdk.com R3	`2021-11-28` - `2022-02-26`	3 months	crt.sh
js.wpushsdk.com R3	`2021-11-18` - `2022-02-16`	3 months	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-04-01` - `2022-04-04`	a year	crt.sh
s.adtelligent.com ZeroSSL ECC Domain Secure Site CA	`2021-12-03` - `2022-03-03`	3 months	crt.sh
cdn.1vag.com R3	`2021-12-02` - `2022-03-02`	3 months	crt.sh

This page contains 57 frames:

Primary Page: https://subterfugue.org/
Frame ID: FB7A2661EFDB793FA8BDEA107E589F13
Requests: 141 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20190131/zrt_lookup.html
Frame ID: D6D37CCB74B6D370A335DA97AE5E5039
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: E1339C9FA697D7C85BC6DE30E076D8F3
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 7537D4AD893B1A88B9F8C4C44B154433
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7268067865878173&output=html&adk=1812271804&adf=3025194257&lmt=1642377629&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fsubterfugue.org%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629308&bpp=3&bdt=834&idt=279&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5674816328801&frm=20&pv=2&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=309
Frame ID: 59D75EF538ABF6E60443F2E0C31E2DC0
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4145494359&adf=4100368324&pi=t.ma~as.9187253983&w=336&lmt=1642377629&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629311&bpp=2&bdt=837&idt=379&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=460&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=80iXDl1sOT&p=https%3A//subterfugue.org&dtd=388
Frame ID: 854B03416243DC6EF1449C7C72BEA126
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4064271541&adf=2759310875&pi=t.ma~as.9187253983&w=336&lmt=1642377629&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629313&bpp=1&bdt=838&idt=398&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=9kSavseIl6&p=https%3A//subterfugue.org&dtd=406
Frame ID: F9DAA5A87B3A7B622E256C7140E107C4
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4117114381&adf=3954608419&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=845&idt=526&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=267&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=ZV10ewvAkC&p=https%3A//subterfugue.org&dtd=1206
Frame ID: ECF009869D7FD9E148FCA2DBD21964E8
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2495647230&adf=1404796083&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=609&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=607&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=75wf9xBgZQ&p=https%3A//subterfugue.org&dtd=1212
Frame ID: 60EE81A15099CCFCC8B71DE187A368A1
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=462507153&adf=1780082840&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=685&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1027&ady=2049&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=9oRAN23ZSu&p=https%3A//subterfugue.org&dtd=1217
Frame ID: 98EE498675ECBA9403EEC30E4ED5D7C9
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2732065616&adf=629078454&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=2&bdt=844&idt=805&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=2936&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=hlAYMT9mzg&p=https%3A//subterfugue.org&dtd=1221
Frame ID: ED835B9FEC6720CB48759D6A149A201B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=3107299941&adf=2927141728&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=976&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=3223&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=03TIDHTNwq&p=https%3A//subterfugue.org&dtd=1225
Frame ID: AD747447587EDE0B90942CE8E78B2223
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIr22QEQ242E8gIYnvKyvAEwAQ&v=APEucNWcgm_92W_rv8rLerZ665SWtxKIt1gjs6syMzWmwjV6JZHDSwYlkqactoDjY-zfXBOgeUceGieFH3yPk6k9UtfoSgHJuWJeo2DJz_0ZTsqzdSmy-rfepclEJ60ukmCGaUy75sE41R23HZKv4hPxtyEoufig4m0qk1NvG-xcwpeQkPH02RI
Frame ID: BCC9D1EF7F0D0A26333982AA3CA1BDA8
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B4frtsltdRnlAdnrky2swm4uHNuzrKCMGwgbYTECYycu-TCr4ipJC9l5pb5R28Dk-QD9xNaJtjpT-Xn-_fyVoc_gn4xQj9-yeUDMY-ohzlgdF6FUbA7dmjT-lIAL3pqOofGTn-qHMZ_DldhA0mO6CA9Cro3g&cry=1&dbm_d=AKAmf-BJ61SeLSoQX-BTjwPy7h7um7E5Ayh9_enea1dDm2NQlDWBCRB8iCUBfEea-tY_10AW9kSjkBIQwoJ2hSpDqAa3JmFfNbmSGjPYGMDguJK-1dhF7ByAgHunp8EftSooLWAsXV_K9Be1P6j3voWS9hg1qgczlchf_W9tIGNI2dslPu5UO8-vohfxUDTqiA7jOY4-w2k-ld0YcQ9IR_QgoqWbpFJZjA9ly3qbpq3jhgG9KleIaO1DWoGDF5lAmLs67PMpNHgkItfHB-XJ5TYvV3G2f2cbi5g1MFGeWGItSRbOLEttV-j53AojxYPKzn80G39gPbXghw1Qzx0XCL3Vs-eQQ2ZikRqC0pCaeTbO356LbSWj_Uh74xn3mZ-sOCk2L1uKigX4lnC5B_BGqXJleiiwYMdxlQ0JFKF8QB8Gw9nUbEhYmAHrcHWnwg7N1bSE1r5IhToS19N3eVhmp3w9qYjmDaAcoWwW63RSwfcOn1sDJv_ESsGgaae-Iqqhy0EeCRaRT9Zg_VTAmYNWYeKKFWKKwJ4Rpf7R5aQq3TZiv7P6RIb49xsE0_tv2NihTcxu9BRsak2djztEPQxWkRYadlgaaYEY6-N6vxRs6YnskqCa41SG3IcLZc7PBJTcxvU2v8Y-qdiPXQ2BP0pJ86C_FwCzHf3kgPu2jubJ1_qtfEoFFWbavoQJQl6C14izwXOMpHW3KJdoHABGSxeks1ulSwpBAC5i-InM6T7ETVTHgs9wJZPh8tqQtiEEspiiI8oJ87FUYk_C52k1CFRvtfJER6sD3iYsnaCaciI3AhXD9aljQfYA790VBdNEvkuzJ6MKdskvnF10A0w8lmVpAXJXdeZ7WCcIKZTapp1XZSK-jY83Y3NP1Abu79TukcLYhlC1xb-rrZ_R5LNAbhQUQXPO4425dBf-T3F9Wu4l2UjXeCJKSxpHvzqpbhltaT_KyvDbeNUl6oIm_49gcKdIL3cSOjIrA7h3tQsO6TvQu0SnW5_PYDaPxmAU88TeiH_tQKFaH4bpF_hq_0_p-f1JxxWNFHB3pjH2BP3IGJfcJ2Ck81BLUkj-4QM2yBY9CEwym2WWxwkGvBmgS0bp9_0vacJl9Z9CcvZ0DJSlBL9vn-IAvqW6wQSPsNRExnUW-lyWMUJZDtzIE6wNzXlvP4hnOrhiQHjkl8sVhJirdpmhHNLCcGXXHHeWbVEEiXTrMAarBetcEQbuu3lj4j8qUPXR3W3Sw0XUB32sz3xg77m6ZupFFkjrIwlEf0QGdGyBpL46626gk6iGB82fe5GmqiBTinqsRpbOkw2DrfgmySu12peHKVEcQ2AGR9afOVyLONGqQEAEKcpbJa-YXNXF4Qr--wqnTE1dwxOw0qwBsWSOURFPEHi2xDGLjs94CqTbMXrwLRaGkwd8a4aljr9WpTQHNgp1X_R-mXXQ37R2duuk2becuJax4XxJulizQEAj3RKZ8C7cUSp5IvHoa-zfkrEm4z1m3PWvmljWU07nV74E3JkPC0Lv7JlmpVf9Dh0g4Ww6S3QLDZ7X7LuLNtNFu4fsAfU5J2-odPxa_wfx4JTgHIDKTViaSHFk29FUuU64sNtwg1Y7BnYKYaOYlerjT5VGXDvxFUSjuzde1FnvI5e4P1Yz8VS_sO-68hMr4jOHvJ4QXl7GHqPJxNutZ3ghSTwd2PRSR9wsKIkPw-Xuh921eqJ7rIaJsAS7WEYXLd7wHJrEOLvPYK65ou5YkCAXdgzdIS4s2mtNepBBbbNGthesXr8UMkRoBdw-d25EvHjVAtcwHW_fdnvIL_sn7fc5mWP5MGN6i1Ux0mmTeHj62IWmcT_I5xKtmyemLSlsAZk4cDB3iFnVt3GgjA8PmVW5A4ZYiROf3oyYTNI-mvFfImpqUsy1vIXhLrqn2IHz5Ml53Dc6RAO64MFp6lXdCBcqriT0_XRHQDD68Uk1pOel4ndSg5gEsTmezgzwCiEBzubRjeDS8P7WrpOAj3rtHwGDsq5G89_CHTEpA60X2pB_C0WOBX5Qz4YgMMayniFBppWG4dJTGMHJJrZSlQZdNNVlKnoz2PiIgZK3Pn4ZLjrU23GnWoeHgoo2VSyqhIw4-sA6bOeoTFkCOShT-WXEPiTM1BViOTd6Mt40fffz9Op-S48Qae63Wjw1Aru7nRRqH4h2ESFZJdtvoBDHx19_nPjmKvFLP9CCkCO8lmdJN04gw0PWOWbjaT2bgn6_W_nXkyHHHUD1ga0WVHpX3nBvOnRXbF5qxh8dh-qrYb_Bd0dZapcUU93icBYynD2pQ4cM5sRBqXXGdGzjdU-oN1yeti_QJJePQWnuGSRSX0x9tpoksgVvQ1yeo_gMbLJoBYnM4WEVWN9P62igsAy1YeZYCFLM6s9xZYmzskdIur8sSlWsHQjFfMnNskiftPRN7c0P5ATCvCe6lFRaZxI0uE02Sj7rsN273xMh1YZ1NkNUDLh6oeIkik0iXNzDsNa296bcZ71kKKkj990ALpiFsQm32bThBWULUMRacVrwLj_F1wXtGcjnS4xj4QLeLFK3HRSwRcnhcglk-fj8D70002G58QtZKpchHU5fcQ6fJSpiUCEHWeKJEJWTmsRIrrI54ChqJCnCSN9k12oHdFhACkasvaGPrwvBJH19L0-uIru10jCvmNmVrWBIYsSNoJC5F66SzIfJ4akb4RoorgMeWXRBuCiAc2yrdFyHPANXqMNbZrrTv7qaO83S1i7OB-6D8mnnCxhwqkGb-I3P7sLe6XFGfMiZIcWs8UrlXzfrpc1Rjq6m8cxU6QwpuzaZOOjKec-hQ3UChUX5khSzSnBDDxRQg5cEgObbDuj15Evl_zDkxz75krKlZA4cSPd7dzi8BmIPfKlINRQBNQ4yySxaYUsi&cid=CAASBORoEaE&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240
Frame ID: 7E4C42522977188EC9C779ED30B6F19D
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHR6uYCELDS8uoCGPTC770BMAE&v=APEucNXxdhFv1NjfEf-S-l3-myLnWK47JALLAv4xlyiZ_d0Hu7im6H93EjblFKUzBdB8phR1CtMbQkWOCxmpof1AL25huQJI7NUR6tk6MpNU8HzDT9gNaj6GaDEfu4Hx-gK_eE4Fr5XwaX40ej0zrirb9Ndg6sRonxKJRzOSG3KOmJKkBcBvLiE
Frame ID: 077D0E936439A6507917966284577EFB
Requests: 5 HTTP requests in this frame

Frame: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 2604104F7D429340FBAD0A0B2E520B91
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: DE39F5CADBE9CA9B7D5CC229D9245BC2
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 41BCACC4E2DB97B5BE3ABEAA5DFD6278
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1
Frame ID: 5C779750A4D704E1CE44A284C0591E9C
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1
Frame ID: F7467C5C73BE597C0853E2CFF7F59322
Requests: 1 HTTP requests in this frame

Frame: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 960964524126510F051A86361606F10B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNUbqMieeuxPDwG3V0VHdqHsLcOrnYgVCC-hhwvzQpqSRuDAdrTHJ-gAbmN3VU4oY1D9XuGM3sY9LgvvEI3A5qVGbByaoaE3xp6FjdMXNUXKqwRFxyR-35fTt2QzJoMG3yMHz5UQlplnCL90lL_OeeGwHjh2hmWX4l0MKa2qTxwclPB-KKWt0uo6wHEjjoyL27ZZhc8VfSBGphdJr_JpgcALGoNC_oQLfz4Pi-rJh4mUBSFqVmHgcw7ibtintAtogOYno1pakaxW9BAV57l8RwO1D0ExIlk7-J8D8In7xNxXB0GkLcBoScN63aP5Ut2klV-pGDTUR_QAwCUwyk_GjTbS9qLYDDBXHXhEXEyLrbSgeNPWlyMskBthnLv4wqosRFsLfPNxiOgqxcINn2K78Dm3rHDLShhOZ5NRQh5vw6uJaJFZ5Qv2vWB6EKVCXaWl8Xa6AltJF4GTcldX4mZ5CIeEnMahKNSyTFDtDKfGD1Nbw0FzGHHEbvzs7Eb5zBnG0jtvQa1eHUuEGQlXeCXcydjbB5bLXhRUlHXO885G0X-wmw9qN-Z7Uz9lq7vBouniiyL6mQhDzPQw-OuOs1-b4QwGJ4u4RA7I6Ev_n0RZVyvASagCB5bn-wgEFAuu0NGYIoQTEQUYEc9kGV7lyXj3a8UWDwGVOx6EB4K8nkOfvbTBAxy9wu0kw4OvAdM3GAk85-PgSBDIfetmsyxR30Kpsy6SZnlMdNqL9g49-MRYi04Au3viE-2ofYsAClt93zGeJrPGK5BZRICz2bDHoV1pl7nC8OLLBnmH_zeZzajnfzB1LRUBzij6CsgOT5PKChGONd3C4X9PaKPIcsNOG_GCa3_duTze5_J4FkzFfYw5G1z7MHxrPYlQ4CtlkCko9slCtx4jjMGbFD4vzFG9CGfEYcAVnMyEuzDDxiJr915OB4XQjWF7Wow_esyzTBV_piCl7AFmMbAi-1_f8Kl9lA6sm2SNJpWIVW1jPBXzxnzXS6EGdeTC2WAh-sZt8KP1oDnU8IlVHurt1zkrLYeAqfzmUQQdUYO5tw
Frame ID: 023E0C6A39FEC661BBD153A2E8D7ADC0
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cg9_s87AEcBdprzDHJAVDQKAWAfjmGQc_x_-JRv5jCoh3DEODEtTCwHiqcwfVwnt1LfAtcxehMMlzCvc81s7ai8D-Cd4lTzG6VKUqV7S1FGPWNhHMY7UNhMcJGYVr9cz1iwHKYotA0ESHdWIyngPZw3y6ZkA&dbm_d=AKAmf-Bc9-aq65gk1Iyzk5iwOZ-fG_-Awt1LlfBweAXaHIPcdo0myOhy9SR3PCHJ-yT9WSpAIzYcBaoyuPwxpBnHl7Wkj08foF2S30pPjChMXtQCxYbSxbVEBJ_tPZL-KbmoaOff1o7aqQA4wSdxAEhqF2VsTIKWN8JUwr0ZldKwIHuForN2Vfl_v9p9pSsM348WmGpIEzf9eXQ0_KwQuswNgLwHtUjmb2-Sjs13K36j978DI0wpcxHMX8iDfMUTHdem0ehpCFVRwhtm5UmtHXScrsfmpxGz-qAdIOe0eHiA3VNjuTeRxyWpN17zYtWQn0deyuyI4Pk2mjyoXH5QtZ8sxtSseypQ08DN4Y4zmAySfuDXFRqINTG-g0Kxzq9M5cRfIsbt-Kg5w7qcOyCPsVIUXE4L2xy5dVjQ6cBIVoZkHWrX5tPqXuLd7w2IGX3lHI34yfFAc_Y5CiL75rpH_uC67CPj0qBdbU8Ej_vvU05Z3pUnCTXn4mUdX075IYWqAedod5CgNGOg8Sm1A_4Yu72xb-EIA6j5njOLua0P8v66XZr3z794SI5OMg3rQpZaIXuTNWMLeo9ztfXUIZ5pv_0RGNP5-ihFvIS-WS9pwXTeGJ1-Uzj-5VXuWnT1hqtozu1DoG1l-Q1Q7QeaZr8aamJAK-jFKxpQzmBNFrAEhD5k_BMRkKhE-mMQUf2Dw9MUiuSosb58qBxMk7OZFp4fhm-iVDgNX3wkX5d3OzDeVj5_WA3P7-rbqgODt3G9jM-BBQkW0vkWF8F64ZNr-bxNJoP1biLA8tYaDr3ABHdhEiJckUD_ybjNzkorCO01ABn6X-o4zWBXS97CLormo6DjFIktH0-Cs3-ScTv8s_F4zzs1qtHFFsHwQih8--J0gsVYf1BoPhLLFfEDIJz0CCAfhK5NOZ4zdmj5tuwwcKnboNSABlKn5mK6KWHZDThod834EH3gd_byKvOTNKJL9xQ3u8KA1u72Urv0smty8_hd2-6kg19pBYSWFWBgVnFvcbm73fGSdObDX09gdgsj_EgOitZ0_9K9GMaXiKJWx-S0ZG4MbFQ_mVCGkQzsE-4JNpwP45Kyoj8iIh8VWgAGUCx6yVilYG_uBRu8kvLfh_GNOb3AYjOccdUDLWvCAYknvzznxiQpQVRS-sD5w2xKFfOytplV95xis9fyR279G1Ctf6BHDFo_gMnGYUK74hZHegtjK5zHQiOnwstFHNB4L7LV8AiINZne8G1k-T-1co67CiLU_gyFOyjKm0VJrUT4dzjcNO4Gq7Jb0a2cWZJEZV1Ms984gSRDQF5pSXQqh5a4NqLbVc41ch5higi50zeg6rkk12xMLwcK1jIRSeRiULdDbvWo1uykSRiHD7H8DW4-SuIauwLDZUjUIOZ2r5Jkjxv8YnH_ZfmSvsEPtX3PzieruScIiVPPIkjuJROKpcfD3A6c-EK6ayvKiKSh_x0oHuyyIeEkC_x5FfoXtRFL_0P-6cTcvpFSkKh7SX-sm_pxQMzHZw-3_us4Fv247WwEo0RrVNaHfkGqccw0Ay-ou0cJTnadw8CiiWHQ89XiJmlaiZ97wQ8sLJ7h8p6Aup8y6FCn_1KMX-MBD6tB1cEtyo4KKldeJ2cx8l4FzCUi6NcGoR4vbnDKZRaBiCi_ijQU2yLf5fou_U2BI3jO4XH_rs5W_5G1s6vt8-r6SIR2F9J7tO4Hx3W4EBGgurDcmkhWLh1PsfEPe3x0dc0wdt_MzA_owOAsUlqyRkXsHd_KJqw6Y0Ujl2dyUhTe_dGgASpJVhBj3DIncW0OfV6z3YBaJE-edYAFYhrSLDv4HeM23SX5yl8ytMme2zkb14NDwzFjcO-7Vtlq_32fPxQcHclpQZu4buFpqtodk3fsuBYI99eHAHiKUa2aYOPq0nxlih5TOYu-ME_TdlrqAuLf0AYmhEfF0k01abNgbVpcBZmLu9OyGsZOetsyB-3cd3N8tj4xufS6nYWb4obkkdBiUsO3NhR5s0gCLjYIhaD7gfvLd5Z7ary4kT5ND7RNSIiA4EZ5sJaaDWqYXcQjIz9kUFIVNHKyIQkz_1do1AsBTYiEx80-KJ7R5UfQkzEWEMhQ-xczRpFrRi4XCq62rdC_nOZbWuc7Q_nzbf9sghpvwa97vgz5PKakVmaHq2yGUFa3utpxihWqWV-ia-tI7nKP27ALj3miKIjejUXpkL4E6Z9cZsnfMiPOKHmibtsGdUMXA6kJ9EhMUNK4QFKarG2R7QWCl9T88-cRLtVB-3CLu8TN6oFvHzDk_245qWu6MJ5AuyE_GDP2Edy6OwjI4EUA8cf06Q2QiXD-t-HaNamSB6CpzmZZD4lM11g2mOD6-aFJudEPyROCKLbAGAziKELnWG8Ptjvuz2htd_jXViWDxu0ONeePlgTm0oHDEkg0OROfACYlqYSa4yoDWU50LgY5j9tBdlwWLAYxE_YbE9eBBZorj95ZlUoWH536aLpA46OL2Rh3Xf6p9fTdZdfUUEHpDGTkAC5KJg_sDfwHPbkK3B8MN6YBQkt5HdTnjHAr5H7kVmjxPST6siirAzCExADR8t0qG1Hdm9qd5spiiCMr67K6-RJF8vVAAe2uXD-bqDFFIXfP50rOUtxMYAX4m0cyAVl3dwKWFtcyyqUGYNa8ybzzdMLIDVl_PGT5O1iX57zMfGviO866y2ZypoN5S7keVbVcS6hqVzpNfDgkQ3zXoT5xhz3KTfqRaGOKBXGNQrVdAs6jS0mJQayRIx14KUqP6WxnQQppzfbZzHgKfP6vAh2hitjpjg2eo9qtF_RJ2ko1faMbN5snTEPtWrMavm3Idvpojf5Pvh1lXZz9bRI8d-SnNhV5BbHr9NgBUzINbumFRPkG0BvKiHja-s0JtT077eVWfhHBsb9GCsv6VzoImo-vI-bBiDqjxjN8WKWtOVKkbelfk2qY5tNZImwwfuCt60rKtw8UFP1GVC1Y8eErXDjESdAU4FFQV9kjZ3bAUxD4v0MoiO4ZItSyEmoOp9k7hltdh8q1eC6p16_z2ZlFVAutJIVkUNwSfvBLaVjuOlPQgVAH0NGK3ajNmUgUwA0D0nCzBZYbtfKXQccSiZWxNBiSOZsLb3sMI2zZe14Q1U-WWO2umYu9WBmVy7edIWTucQlqY_0IOueetA8qN7Z78ZdZyfcd97-LscRs03G-j72mD5TIxEHWjJCRj0s5AGtrpmsRRFJCuq8eTj4fRyeu1fV_wjfpAJtlpQnNqOvkAJHRpN1zWEc8tTn6iZCdmkUOv7DNMu4Qjf1zh9GFmzJozFkVE601uTbISl5_K0oaKmDr7vgStbuiTcw5sVoM_Aes-H6Ib3awd8EC1wRDWNgx-P-9FiSbNUBo_c7t0cF1qXWCTHnaHXzdbyaQJDqrLL2i4iXXUJwRkILGj6s__lOETpiYRwIUy8ewMOdj96OxXuuO1LmX_1OTfSaOigFO9djxkyBN4is_n30GxlXzNsyqEeaMvp0TWfYwCPQwV_C4Nfnq0s_BGRYZ_wbIg3oc-jKNMQf8IeQfEwpZ821z-FPsL3gkWTILT_azgxmWUcAWe9Ks7fhT7vXJszlJpAcrRmuRnDnEIuFhW2_pt5eA0P4PTFZ9hkfZJAikItWvg92bSgQ_i0Mu8jLfQD568argcl3yx5YKHUwYswulQIW7Jn--TfAqoPAvEwndrOFzV5WNskdHSsKLYp3PB3xwNaQZ84byvSVHXW5r_AUDfc--2gCVwWYLhpmcSbyG6aEwMwUf3gZGg1hCgE_5lbbXX6ZqKEQr7dic5_at7ChaxnN3pfSkfstDQzj_TnrUh5UEWNa6MJ-dPhpIceEA0UdMQWN3bKcB&cid=CAASEuRob9PbO8Edfo32w0ppFeRn7w&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240
Frame ID: 0E3EE0716081694FCDC740523C98C2D2
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNUFwg7otpgOWy5UrHLkVr1ZHOoiQU9ZW0krdPN7NX8x9lY3-yiHcqKoZac_PpAsphhmquG-wg2wtDtCO0O6hWs6qtM50091snPL813ne98hO64cRAbBGx8J6SHBd7i5tmLsLVHPzKK0MjGPnjxukxxM-OrEonODZndvX9zo1x1Knx43xftEOhJt-j6_OhSN4e-cRQnZGF8Ry-JimbUweEroJ13FThxr6XIpBkYmDUqeTgL5WgRh9J7mYlYZUt47Hw6AsGqH4GQmwFw12WQJRBwxXug3G26j7B5nTktzE198ZBtZrBbZktrWffyui3IWvUL1_vLsnWrHwqi41rNN6T1FZz32jdXmto7W79Qlziv5I70CfApBH49eFcx8QmhYMVgpeIkWXVCu2w9zi3YiqWB0oTiHqA6z2RiHIybPsSdiZBHgB87gOO6fkWKuN2ZN62b22t525C_QseMEfUwhJfsc0Mt_FyjlokuypX5xfojX4RDvY4Rvhwl_GW2Ki93MKJBu9NWidiWWq0PJPvWtNDPyDyu3h7tDyF8GxxNaNB3prCbBFc4tcheo24EQvUCYIuaUusnE3FpNxxDyBLoAbCk-tceFWQ8jW5ne8-VorXOP-OWMY1HUgQ9ReIkkuExmrMvyM7yL9X5QqdHs5fnwjE_HxXILCC5h12eu5_P1YBXUhR6_Js93aYU37uJbsOk2MhGXf_LLh-lny4G60p_WSrHGlJhHqwfnBGcV564HMLsmMQCtbvTis5br2vhq7SbRZ7mn2Pb0Gg-9pHXT_-s7GbWJNWyelkIXBRNiOEoZm9PuHkxLgORTLWjMx-MDfXjBWL7VFjptkQkkQkxMaT0neXFdGxR88GMhdRuGVzWQkPh-MRwKUBP-lh2cpRYGPgT__Xe-rAPwlBPm-FcDMKOOo-RcuBZa5NmXsLWmsnYw9sk0W_LW_3xH7Lpw9EnGK2gArPTWTy9LEVX6M-b2oPM0kLw2c8KtWSO9rFe-9cVSdcGQIRY6DI5luaWhjcY7P78TfVe1rkKPacQqjEe7gtWaSDpYRJm0Iw
Frame ID: DC6179D92425A8F7DF556E471F23EDB5
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DsCEYdDGYw9z0uLhkoLY2oOj72NRxCOnAUBOFU3b-W_FpJrecVRxPP9Sp3hVueAIEcwIZQcz99QgP8GZJ3vTV-Uy7bzH-Vn5YzYEncWJS4zo9JeeoSULnctXzpSWXFwnOKdPWE2jaev2ZNm44_ppriVo0I0w&dbm_d=AKAmf-CmO53bZMnRA2Cf_h5yTDRe3ulaeFZDgFO2LNl0dQtNIJNYNtgAPQmgI2OYd94QCGb1oWo20Uuob04BSR9BmaA2TLE1M0rzuCTpJgMEo0bt-Y626Y4sKmK1w3duQTgd6d5Ab_n95Jr2LgQvGgZHUcnAQhYGX0ITGfTdvJaYtC6Ztm0dGmbZW-tLqMxCjkGOvDEd7TgFJhruzuLYfXHHcGoKS_va029RljVKg8-g3Q8LQBpUsmvHZd5FBxw9yUr_fqxpMnCgZ0Q-HF1H60mTqhctvQfNVwbfvzuL27SF9kAxGJjl0Cw_FZZ8zFvp7Ft8YOCBBp4GSiqKcN0BDkDiYf6NJlo2KJNUwuKA-bqPB9gmR0D1PXGMwsUZwaWZ4Ib1qreiOLyvanXPaiRJjPQfgONIwydfvOs4NY9Ux7H_MQ16BNA3zMsHJP6Yyk8Cp5JgnudBgxRWb4cjCcLXtmgPtMhtP35rMK1QbH6e-UFHA2iKGJSKetgnngh_oRzTqo9atudJYmvjRWfBJoce5WNlglyOdzhml99BSW3Cynmp-PthS0lxh4XvB9h261N-DCLT_aB2jJB3d__Mbwh3WlI4qBpPOQiRwwVsbpUwt0EM80qaWy8PEwXa1UQ7QFQqN8UBlUsZ2pX1LwiR0u2embPT4p9DYQ2elfNKXB44sl6jjBF2tDy0WdBS7KlGzvRUIfijBvlD947Fz44q_BHCUGubaPYqESq916sll2V13LmRrF8r6tTEhTTHa5d1NqxTszgPXNA6Fzo-HRnheO7TBMM3zIpdZRI2opBR7IgDrlLzxKGWyYzJjiYg58phebB2jJRPazWBVAl6YijiEefXBK39ekChBihU8kADjw3vzIipJvkXQX-CBHKFo6aF6FlIOY4BR7h8t_3pBYOgYw1i51QTI8YXf4Ur0mR03XVm-nRCPDaK8HJwTrcYTnTnLgdVlPXdzhe-0WyjD5quYozw5kAKg3nUzMM5R49eHria5RhaixG5jwQ3TM5Bf6dVioFfWHag4k_h8kgCCGlARd5D5Q_cZ6nORr4Gpn1SC_oRpHaqqwfc8QDlLsbHyCPpZTJKdkyENXbHJVlY4Eu11uPu35TtMHWVETccMRh4iWqwnje0USTZtuArGeRPfwvBfzLz09JmWPv27yq7oePKZpXmyjYh5PY908kmr_ndPmgaVuNerQ_pbieOygY2-MAchlvg8bunDcadqM3vzumCSs9U4p92n9MdUqgVTWqH8ymhRkvzLpqBwwMQ8rHqcJg2NllvJUx52isVabyelNq84fJ1su-4nOC9XDuBWiLbxNzjKP8DR_ZTO6vTEJRDpJk7yOAqG2qSgE1ukHNqpp90oeDmTIdWSei-CMW4dEUr7suUj_icqt77Y91a7E5SxzSGuxJIVp7XqsrgbOz9mrr3_b0k8bfRxppYT2XDJ07-fb6BvBhxXEuWrvqqvaH5jFa4d_qeAZ_zL1_WMNNtapKohPIt-iUDlkU2jL8qTtEpD79J_MrhwwMtavh5adk8n0epJyHBBK9QlCuC8vTrKBRmrcMNvzQCJ1mtqmnEfp0U9I7Ea1d0dGBYkgpBfKQxJhsWa2YnTTI3b8iJnidotJx4HgOubECuoHO4Xc_kTP-nLrOG1LanyV9LBVJTfkNiCpu7mDKXU_IMBWXdoqnLbNZ1ptxkADLS9mFvn-SuZh0pmlLvAqCqyi5l0bDVdV7BuhXaKNaAD2zSQWt6frQiKqWnrc1AirX_KioRV3rEot8CL-6iH2K3JOfp6BsXPX4qvxbOC1VHD5OnT1dc27Hi0E-CehlCb4uYi25GaxDeEPItvNRqjugtIa79rbtgW5Qjye4Fd1zND-YAXa0jokd6ztzWvrGllF6KAxO-vKc_MfBbS2qMaSAdy93HmIvuV8cI0xkOqGn5wz6esVzEGyfkv8VvI1DXAQCA9WvW450YdZMOTw8zNVnxCbGeRb0YKjaLtxkqlv_RKX38WPKq9MN3QNc06G_EL2MjhtTN5hYinF6NPnqZpiF_8cGSh6omijb6MY4rRwbka9uaIIjv9v14CguOfCkItPavL_CzCdwwNZe5Ho8x-AQwNwi8WIuuCvPqwFoEOX2gqro12sG2J4Anfi08xOzNVrHlfu9tabudkI6emRLLqvIIQqwBvo2r9T5qz3pAtbm6Eeb7WiRfdQnykxOVUQXjU2JwXWTLmmVOr9FtELakEcin33elADFqOj4lQIicUBvyoPMUj_UMxBw31j6OfZ24rxbTLgmLbSm98xYzX-VN57r0FxIMr780oM452BxCC19NukyfRabw0OHiGsUKV9Vd0TuQV4gVWWA4jSnKS-DLUwBX7DbVm7sFJ2QjD8u50DhM1L-5CBqwGt86OOnZz1EkHZbIEDQJIZRN8BwG9XYPvIIsr3DDxZJiFqxdnKXVxOKpEsWpxZAVGSmwCu_aMs9ZoDajGfxvShYOY8st_jCl4-z3nJCgGSwOruHG-7Ki9wYuQVdZB4ex6c4qrliUnH2w-LbMfYHM5KowoOEuoEmf9dU8whMAM0pD91C42PVSI7pxDyGJq-guPYnCysgbMEK9Qg796RNW7UDxvgqCYLbOcGvjAFprp4EMKii-hbs5UUmJ-LfDv4NMqmspHz3eDB7auUmU59yAsDWDORQBynD32u9uS2oHs6gVcVMwE7K6Bd964Nevjf3VD44EB377-_jKIPHLqFomtGtvY-1WSlrXUA7H8EdoFG1tw8_9XW2RV3xLH0cpzMwiKFeV8gBR7Zys2sdZpg2DHWJf9Oc6SRU_BqR98iseC9vLKI8c8gd8--ODw7CHC-BXVJfLg0ZxWjZZY6eiHji1dUq7fG5AsToAjlSda61tVOrP8rOk1OLvDFBf4T54Uqn_FZ99wC2p2bMJ_mc1ng_vIp5vGNwug176TmFHLzqBei3jkrxys4qNGVAGf2kfMddwA12jNhBXSE-te1cG4rS6AYB7LBpTIrBAnGEhuR1wpL8kk_hlkZYpIkYwwNVpDrC-EstLAdxZtNF8C2dPH7JYZ5-pj8YexIhVT-Bqh2mCrQmzjaw-dWNjOwGc1YPQZ5zU0wUAmIc8DfFI01NTewcsNGZRWpQp3F04cdbBAynd3F6z1sjoPS_QSdgad1T4qJ9Cd4j0oHimkM5JxU3EUrqfJ_2c9IrZA77qcNT3zFSHpaOzNxGeLFW0tELqhdsUNKAlOUk5y2miGGwVFg__gtDimj4W4CrtJX2MXsq0kw6fQqjjhS1gOgl78vZqrBgMglYoaE6ksfb8Da1HZFSW3996hEe7TVCc_LnrKOYp59Jab0VE1MCdZOXclIFEd7DJeqmBpMui4mBN6h0L5zWW_zq-uP4baQnSWdcmyzpV7d1ZL20diKmcoyXsICj298ICNKCoZMk06APlm26A_g_cCxTlOLzqxKh90cVEJn-d7d4uz_K3c9MQC_WGXtnheGiy7CslBUUBmGaz6xbe0A7I2uhQChciJVnHw9BE4tLOclS-63EziW6MglyPM5_-SqtiAPgsMAIydu6WaS6s6M_thkt8aB2EEDUYepouS433D3gKlKqpu0FgjdqQLAoH5EoP6uUwLXXpDSYcgTU5ugO2k7KZfWN5vruVybM1-ptWRDQy50wP7OkgqB3OYMqXar_ftWDQWZPS-lyCjZwlKuFTd3u7lZvzTlZL0j-2dHqE_QEai1rPXhw6YP0llcThn_vJdHxJPoa9v0zz314xstN34j9p224iubkOQrS5rdI4rCAD-z03C3XvH04-tGcSSgKcbSCJ8LLO4JUZ5kxYVIkJW2Ou-Fr1xQN8rsmoXoytDX46tnPDtJU&cid=CAASEuRo2LvuGs6gtlkyLrxL_zzWow&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240
Frame ID: 9076ADE6C9E1D98FB0A81C4408CA0438
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNXAgitvkuGwkLqNOy_M7IVc6kfppdg_2VVm3ZSV44iOYTEQ9aCUpii8ebZ6LgLtgXJnYci9eMxQpoKiGuuyoEqjjNXzMjJMAZIbuBNf0xaIEZla92uvbzcqS050NPYhP3YxqPIcyn7kVV67zwPGiCsSd0YYOfib_kgJvnJAS5yzv8l2d3jRppW-EFzVDwinjdVdVaW8WnapjTPd0RYdwHa2ffpY-htqxvoYovwKkNcdYKV5bl9k3dyTiL_2kWk34AbljVIHBAsGk7VkLs46qHrITuyg1DBsjEzFUZOoKW9ilq2PQK2T_F4xI0sgkNtQaN0-H_bNBXj2N0Cmd2L6Ft-VOWFZwTQdYGQRzOcTLZRTCi2CQAM8QwTlSs6rJJt4qfg5IPTceOfZIG0vLX97or4pn7w3mgzcZFebbQ0CqfUkKKj99KeR46C9iBDSZnhxm_pftNgPxNOSyOwVeyaYfx48wKIdXbiBWcT6IdZL-2BO1yZ_AdYMh6wz0tNxwDcFh4b8zN33ioZ7iN2SSe9Z6PTeFgUfKZXV7BLKuJtVMb7zgbrvYusEPqnD0MiHs3WXCzv6noE0YWccAozP6V5ydehNSnwsba8a1XSUXSRL1eEAqXJJ3JajsWbq4_YSRoTLQdCHWpnR7sBemrB1xYt9YtqlxXScTDxcGA1FtIlKH76BqKjfytWAziePKWW8T6AworZOYBBaG3QO3j3j6Gl-ZuLs1zHcIF-KMdVG875xpZyfMamzwza1t2iqpCvk3a3xcSOqHis1wXibSPs1OCy3uSKeXmtzo2PZtTaDEwIQIJ3QAAlrDpAGoAMCIDvoM1JoUgeXQmqx6puk8qifL8bakjIjuDieQPTEC-omQ1RaAUbYLI23cRLXJ6XjYOiDt255xzlU0LmThTp3vz2GjHm-nrNCGnEU2vkRXT0xZBXkhdfFWavpZ5WUSEcZ930xJWIT96LO7jcyVIHV3SotZyfx4T9x2jjQrElKL4nAFTfdriGx73DUTRkrtfbjlSbdjwORY57W0yY-fP0N-EnzxMtv4XML1hqdjA
Frame ID: D0C908C9DA8394CEA9750E2406922D77
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CVLYWPPzrftYHFwOnnWJgQcrBLADYBGU00RL_27utjPSXlE4a7rhwISbKUHMlf1eJPX_T98k4QG_N6nUN8r3KefpKsefswsaataYETlQlW_XW92ucyiw453kcBJtGy6IFvwir5bV9knVs7MJj1po2fxgLUiQ&dbm_d=AKAmf-CHRsx3C5oWZT1vaNkmpEwl992jX7tQyseih75eFFeGgMgdLN-AKJTrmFxcFg7UmDlkYmSElFxy2riHDToZOsOhC_hYp68m16_xMxrFOcucYXR1Yx5ZTm9OcQ8a7cI4ByVhv-RfKRRVkargwVLe41TBKaZEbz7MfBVLwrKS_VKRpzjE5IS0iTB9XEvbSlTBBD19MtlDx7kiYJLM1dLXEVzcZM1mXCyaHiVGS_iCYingxvEOY6pGn3Sov4ff3FQtAJfyYPE9EXCzVc4wnE9ncbYPHZ4FLiWtw8kjeIPLgDr7hs2VoRacQO_-LNIdMAx1iz7RDTEytZdaQAm6ITJREcAm8XVa8ptOa8Onp1pd46FxnyXHm1RqOxA5QFNM1wZhw8czaMqHavLR_b9zE7YNZYvuRtmZpxdUoMDPR_EIvObWotPw7T9AgWpuQ8tCrjKIPoWQ89tiW7DtK5qdp4sT-o-yARcLz3yX_RJ-9R-5dsLebkL4AcF0ZqMBt2o7lq_4vre2cnhdpqDTvNnH0cnbXbAdb2e2oVA35HA06c4X609ti-OmsfDMcvWoLDz-9rdQVNz_WlK224QPBj8nl7kP_O03c10xCwvFmFJaBwUS_El5ABIg_20O6x0Xb2Cfbk_3V5Kw5BiUjBNFrlIzl53nn1jmx9JoolfeS5X8Z5Usn1x0shZCJQZSRyFYLBhkvnRCKv0PpwXZqzbUFdDCZcbj5beqtU_9AzmfgSbRL1AXMZuBzG1mXwuvN9LKJB--dLuUXcO9-BsQ4V-G4S0PwxY5tCYVyRPYnCq9A-wLhA2fi4EhPtbJHyKRe_8JEWfe1AC-ZzdOzdIZy0-eVw54xUWy7C03BB77CxxyNNa8jpOxvh4ynCEOj5JNY-T3dXi5OcliCb0B_O1coO1q32XWJlPM46sWgimtySp4zdpSV4JD2ifYSPw9A03BqkrqxlAONs5FggwCUoaH9zY9-fMdQTfIBqrpfaFWPtaLHQc_nndYFA-XSdOuraARtSIqnXavCa_KEmJ2CTd02CMOxWDOicBKI2SeEZlaBVdVLpZ7kx8uTV0LyxRZHaW3hmLBW-f71yl-Mv2zEwhlHAaYarhakCI7x40OwQU8WtDnZjUi8OzsAk1XzAurvcPyz4GYllxLXLfQv9zBli3eC-JBzuzI7-34zCrH87H46tsF6XdzyQqKvGdXqM5ONByyyzDJ3M2jsKFXlPlpSjOlB36UjCEASsQWPwKHxrrV0RQTQD499Rsy6fMLSaqeJg0_w4LzL0zQF8b-k6SslEqqReaAeyd6HHzMoELeOJEfRbFtc0KG8oDxwGRAVlvuEPEVnzDYXbmGyVTm8-GJ_sU2S-Rjqm3JPJgvYOs96ylbZVoI1t1NTSgpy9HRmcz8KX09CpAKnbUF663txd6yBY515lRFxl1Es1HB3wf91runOOxlacPjq9mp0BwbCH0buzhILc6nYmabu-PwpKRyyMG931d1YTUuQkJNODNQl9Rk_ikjoUrHnRrkQgWOHPbaNte0G_JFMsNWnqosGO36_zYKOhLC4J9WsHWEdolzDGQsVZRqbv5CDjxpc2C31E9CMibF4Rxz_CkzDYS7sDcFzkdR0ip73tAwMiY6RfShKwoyK-apuyGpDihlQKtkaATWLHszqN9aWHsIeJp67_Vhc1pNY3avb6rR3Rhqes2SMO4SxAfnJ_cngLEX9cO-Ve0TL0SEJ7rOykgRZDRG_s5nKnLleg5TJjIqWTpjspKRPlYjA7K66x2Ro14acWyNCqfnClHmjEK7g9Wi8J2arpb9kVTUf74Nir_cRDejokBmPQOkITy15uaIHM3MB1UcpVmuTdSkdcfBQzZIy0LyVZPONoLdGyrlaIL5Q9Q8fkqKod98uvJssXa0FlCxdL1K7TdOmijMsIWHBoQYFdhcaBSmiNDd9jqs-HBwodd5Zm9irkB4FtQOsJrdYqj6Ld-Dihv_Pk9DgE4Z45nbPh-aSh9OV7WCmHczN7OG-F6kizY-KpMvMB_ile5_rnEOIBAFoYBh3fti-TqFPWXMx5nX4aKjEWYA3Q-6CvdaLKm3LClfPDmy-qQ69mF-lO4N5YZ5NGu31OjvATGiOO4fgrkiK9SUBolGUUgEOSd9Qj1ZTSw7je5bvxcQ3rUUGwCX9605ekAieYE5KBTmmGDHErSlZuYCd1X5d04ea-yNgKc3s13X6Co1fCqKZ0B7zJe7Fjsohm3XY0Oipiv3xIATpoAPSh0Nt1XEkJy0WgCiqRd4-BDQhh150zVTTf5ZMZDBqu4xZpxTbfXbV6qwbLQpoB_aMcyjayn7naeA0UCA60RBvmxms-kXlefYjxd1yOpP43laqWeCxA-OxvPmi2OG3BoCFsDjQcArpr_aUwTX1r7mnALGRqopRYVrI5ShAWktMk3_aTouUZSQiTuii8KjCQ43YoBx-EOYsjv7rRPbVIl8-ArgehXGTfRIrE5REg8wRvSuGQwmvrSxDnCEoJohiVYCNHER4taP3B8yrFoHvzVz2r6G5jSnEBp5vYUwSivui3Kzz88dgge9Pfw_rXUTiKmNj3cAp1qeOkO7NRWMLUyao4BdmwtN7Cfm0XnILrvyLZCtULa_cG1xTWCyzcSSqt7V4oy7efOr_A0-1E-UUJrAc6q9AF64d-lJvqSfGYxyKd_Q0yYif7Oe_uzYD4NFv4cqey7pVOSlBvDIdApvx23NQ50kuONLjMf2fA6cZoHUFmZkYKjidT5-aNUtX50y59597fTu2aT7f69MacN4wl8wV2rab8xzEC8scDZKDoIAvc7lNEktwVGXZYPKDoffaWRS7C7MxPASVj3W20kdrXzWrnPozyw9R8sHdvGJr5oQZoOfSxcQlaDTq6tx3sZW34IhnN0a2tNN97Rk4RRN9ZoB4xT1qHKeWEKWxnZ5rq5adG4Owqv73LE4V60vXqc-rHBshmgNJyMgCLWVpCNkxzVm87UpEtg98okEoWdndW9ODr8juS2aSpubjT3EaNxUeiKTiGIo_MV8cFPOjU1buYi5GfO-di0WQUa4zSkgKPv6TeCdBGfQDoiENpbXXYPTjtDBZ7aNhnI6Wr430YbqGJIsrmzVK2h894VyxM5nPGIu1fYYTHxOpeoZffdXQ10rgF9q5ExV4JhM85HPvO9gkDYJHjdaTm5YaFnIcGO59S5Lm2-RcIVEprjR-raMzsDLV5pE3-b0GYCKNYVn7MOBA8mwNqXsJvq_wmLRAR_qrQeHLdVSl_W9vrCNTL-JRYRwsxhI_8tJUftDdyITSVedU431L_wLVn-JD0y9tcavuvrhh_xHfYczCgv6Qq3tQvp0dVVBZf5Af_SZ4Vj6CHPe8tLno1f6RHjaktcgCEVqq64Rzv9TSmRkt5uX3KoOUlUgvdGkpPw5ryEh21ykkcMOw9jiJxVuBIGUrCyRQKozmQJAwyucUob4iE9D9mS96SA8B7KCsEzCm5q_i9QkCUBSk26sRpoklbQ9YUZc4EUPlo7T9BdSP5TXGG4Es0EtfomP4n6TorkwLANnQAY_c6CSlNLW_1qH_NSRLEoHLX5FNsqH7S0FKFL6gvwsPqTLpRPlYGJhEKiFiQtTUl7qaFajn6e-tKZINxslBYx8tGvH2Iz_dJ1F7JceobXyEcXdWbfXZYopr0HUEBv8dsIIn8m9Ro7huII4jhtILqszqBOZ62aBlt_ALnzPIkxP5b8PvcUVmBah-Y2yyMdT7QXPCIHoZ-jg2ffeZ_05K_oLsExKxzhsU9NQCAeO9zid9bROL6L4wXExC2CuOXO7t-wEB1MOjQ1hZf9yQvG7GOGgpaxWqUq4WYc6Q8vuEEM&cid=CAASEuRoVLgiYEQ_h7xKrKG3BjkZrg&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240
Frame ID: 14A7B4A81B0E29D1316E9B2C9646E2BC
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNUoR-8HAUsRWlg-UPtFlCR1w9IKDKd805HhGMqlGDkfL0pERZgZCRPLwE5AuZ_u9CQeaoD0ajNZEVvKLJaZQi94E-nJ_8tC573fI58uCTVUZ35H4RCAiNpFuIZ8OX4j34pUUut8KboBiK6VThvVzA61dFEVKmvmxzbaOtFur1IgfVKt1SCGv0GDrJM33ngHWUx3TRXzg8McanUeye5ZMcHLItcafSadsX19_WWNQUZ1_2gwyV6m6TUwf0ZsTo9_i7gAz7TnxkeK-a3Hao5uClAbPYcwknsJ_dNQ_z7nisnVYpyqRWFyV2K9rXoTipuT2g_hdUZTWzmypS9TxOjbLmlLHJu-SBy-9qVTpAzQLC_mNckOayjJeMWlkb2Oe1nNclvlDj4SPTYsFWVLoI_qajEIqBA4j6yh1hviO-5GuHnjxZkC84sbG_Ls7Cij83sqr3DohbY_aJTUWTPMNFFCqK7Ln8-pPKqfqmfpmzFPvteTI_W8QFxtJGfiy5ci9g50Ij3CjYWTPMNwRSrLbUk1q3HiqlpPH0bLxo_G__99dpqmYU9eGa9WGc-QSrVtjtAiKlSYmHicSmfOGimRMSyn4Hvq7kHuaok6_7isXm4ZNRYgfG7WVNV06F53wWbPSXGcgW2cdakGWP3qMRBzsulVgBMwNkmfDiBI8bl9VLLpZptczPxpUDPKUxL5QNUD9_2Y6pHGgbLuMlMZ3tlAHtEqKTcADK_YCyKqVATwZkIian4qsXfMf0U2xP66-KtBM8LPgf433OpA1VMIn0GiJ8CKpNAGZlm_yZP6gifId1WY2Z0q7hUwd8cg_KggNLK2n8TCzfNAqDR6_UVmhLG0sbDhgb0oF_AcY6Lr9PBzduTg3LZdTW0URQyxvoGc1fZmNTYcDXeB7eOugMDjG31Tuc5A482zPPLVkyAV-NdsCLw4x6I5J5GpN3Z4tCFWFKSunqyEiaJ18CP5xieLsiDuJB9MmvRXEBSebjARmq0w1irYqcpop9sjQ2PUZYQ07jRNzZnsARRPQMt8vBzSKyyC2WT-vRtZ5SxTAg
Frame ID: 8DCE6B44CFD07D09C478C183B0613401
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BTOgsbrDFXqvZhSqP5EACYKUQsRQVMdn94Bo_Sd8wPzC8dGCdgIDWWxz5PRe_p0UQ7ZI9h0276pLWx0yjoqBVULdSjZlgEZJciAdvJhxkZmZ74TwRtLS4hVi23I82zBdubXr2tltk2Zks97gue324JfqNrpw&dbm_d=AKAmf-DLOBH0K1P-zX0FjVeBwvOfMMJUHSXtAW0G2VDo9yGL6vI_Qfxvy2AU5OCBN1p-yf9HCl3DRbtimPvqqptHfXnogqKPU82vchyiZ1Z1axMukFk9KVrMOV-_aqJMrUOwK7vgoLKSbXaQTTZ-_qsvvNDZJTUgwKow1b3htWR0mlThqXDXAbC6CHSv16Lck-PgOqytJVp5XtWmpew-X-Uk7BlzGaIEEqCCOV5gg8kLzcN8maCxC-_ag5lWVsXghtwUbhnS8DrZKd45Zik24DIyxuecU8klvNMAw3IqbAHmKGRU-kqYqZSt8d-Zmqq47mgyYUsNuDKePGUrhvzdgtCkrk_3sRzqc6pfIK96VeUuQ_JIKwbxx2wmZa3sFmqcClZrj9dHTpH_uQOU42NZuD6QTCuJURXio5rElZ8Fti5Gkj0yVIZayAzUGXPCzpPRQpEQ2DG3Bb8m76VpeyPp8fGvDz_qzj_ASowD0iiZwKfwBK7mFPcaAx3FHtR7dy_apEWVZYtBw3DEFZEX9A5v0CUvLcXhVpBehjLz3LNRoWYKEY3zD0HNu3_dmK6EpVRO2HsaRn6z35ikU5k9_DdpCydzZOXyhPzVu1eJ8InPLsSeP4BOH39hGjqKOVg2BmQS3cSdCCuMbSYreDUL2TMeWvy1dxRZm8l64Kcam7HQCAe8eDWzHyVw9MEoSOBkfj1W-dE4rcOgpY1M115mbtWkVhDRhKDC7MILsUHY2xNP6cN29xZfKQ763OjH0AQN2y6DFkeoxax4ta_WXRYGEWGLG9C-m9_UgP4BhFzed5nyOEgVWpr51P2dkFpTmYtbXc8mPz67lLyNmqaE5n21bcYN-Q6NKyX0bNY1ve98K84OKwHZriP79iE-Zh5lbpaatMwOqgT5PQIU4llZaflqXNS--TuanSC-bAWE3mbwyzvar8KgLA-oVD5u1eb6-KVWm2OeZQXL3XRFX4fjxFIVBXamZ0dtVZCVu-mHOuqDjoKHHmR4ntzecf1FW62Rb4OhqjuABfHTVzxw6iV_kWBjfEhNlC1glXSpiP56nm6vtcXQ31Kgbxa7sMy87B2qMCkRbW1JMscbpbXP9Iztc0AUJaVQLgzevmdSP__Zf7YE65TFIcabmMaO_B6VaNILOVzfxe_xIi2nLC-gb5XFA7jETfLpdl2MmmoLOPWEdoEpE_VQ7IvfHVZgtmfMqkLfE1ao2fis9ydUVKYy24qmXOYurdOSI2GKCWviFTxZVE0JWkcD-UMZjqv8_ARhiHQh3KXwykgBR0Skpo4X0QOrG29mQNxK1t1k_ZhsbrkYolhA8BeIfvDIpY1J_itcruwOp771DgLl8-2WBP2VofkLn4HLpuBKPXub-Xemf_Je2gljZo_S-GRLh2iQHuDo7JiHzCU-BJYyhHvEboyMR87b8mBYb5NeN8dGCU7P4I9nn_Ut98gNr5s0mNAq8Ug0arzx6Gfogt4_bzOzy6gRFTscGTpUAYen1QqbvGUyZy_2PF83p7rAIuy_bmgs1f4Yc_IikmFdf8XBP6z66lVFJ6Az267957sFYLYVtAJ02IGAcluDRqIpgsmUNexaTAXUDIsYCQK_h9G6MUoA_KZEn2eU74qY5AjiB_ghpWYqoqMlkTfjXNl-FhHrIvP-gsLhpu8mrA7Wp2L5C08TS9XCz8R7t1E6RKjxO0YBPtqjD3BA52ZG1epLqM4lMbIpMcMa81xQ6cLsp5DhdXkK3a-ZKWJVJlznzJ5-shYjWf5JEfFWlBkyhr0uc6SFj94GY-elwivulp5g5IulWh2WkIjuOPvA7lorhh4UO-s9zBQj_nRHygoz7zCQjI9Z-gOXqtdojjxJhNE9x4Dci4BWpD3UVKd1UKQy3ClAkxGIOVygM5mmHPFAnk6UbO42rroQGyY9FahYcME6ASB0fVWTu5kOUwT9r_k5L4WEmXJ6lNzOP3SsO7ifJ5VQxcezw66OiAyavVct5hG3qGmWk5xYa4ySea4SLrvcEuVw8zi9mqnwSCLbbN6IoJvT3DyYGa4Ap4qjrLtFxAG4N3dl6gIJUrVG2pJWs4TUX_o21rBdJXt58rjw9fZNyV4tD4N_IoO8XziWExQsz12dmyTQvoCj5EHzp9iN0uOp8nWmxZjnvw1Aiw4D8jcaltF9vVL4tupyG1-PuPx2_MDUsOSMJ78mFYHFpxKIz64P1nzQY912QwBkg92KEpvxfORpB3-TEg2hw8F1UyKhOj5_zWXjxRcoOrfEG-kMKtO1chXzGQMzMyun3IO8rnXhJ2kqPn1Uf1RHFPxWtK7WQmkT1wgW9cG3ZZRChjVi60F8rrSOG0-DPXyM9Fw9uBwZudl5Y4vFnhStI-TStWHL4dxAkWd8beIIkxfA82tXAzyOYktptzfyz4Sk7kMSz5zbsVb3wnfux0BojLgsqkNGBFOzKYVDVDKdNic8X8sfI0WJv142PPrIXq7ywuD9cerkJWgiztWfAnCCnXtaEzDVdW1E0_vNMpTHq1y0oepwD_HLo8yu_pn6oTlWge5VJn4pGCrW33uNq5OolzoBsOZVXOAfDekIAzL8vOIJoAxuY8635BLMf4bZVEIgPyvIW5S7KgMB2ribc0DWS4sJA5PvPH0dtlmINHJBYZSNEnM-Y9gQ3FpDK2E26OOStaSW2sVyg8vQd_zM95JkIcE1boISeqpPRW7T_nv8WplGOeW45qBWy1thiPFSdLSWJlAaw5uwNnesV4OwQxkNUjf_yIHsGUazUpzW5jjAx8Pwm_TO4cp_u00FK35inzqWraUNpz4kVGhYaWVu-mD7kEUB7e1rkhuXLwuGPJ3ILEK8i-tnRf_iPKkuhfuScytmXPfpHx06O__ZVfOTIHwmQyHQiP3pjtmXhF-qo9ATWVSuAKe107avl5qgUNfkBXbGGhqlM79WJ35kCbJIEEC2lD7BP4YnLbRhYHaz1U2ZBdqeNJQAq3IYj8NHt41TXiegGxiWW5wMsTnhWP8cAuU6pnFtXD7Bcyu0cs6QW0TVqSLl-pIoCl7PmIvoq0VtulIlHM-rE4BLLAVHuoAt7PLxkYRCb3a-YeYNp8Gv_5UT0JEpM3Le6sTlEX3VrT47PjGSSoyd1JhjUnnvJI_Xqv5aZ-wqINAX_x6RX-yYlVQXPiGUSLO_-P4tC8TQ_KkH6OmzgTExugOjnueqhPKay-eeSK8JQf6HIrV-jPwNLF81r7BcKguhgFno0cvmr0GbL_IPv5iHkMthdgbT9OUweKTOcqvgvBUtlzKT69Jc7IUVZi3Z--Z99Wzp7PWsQkqVeNoaqzEZb24VjhmpU926JMBchzeRtPJeO5Qy1nNY7DM81Lb10vpXAjtiACfBrwHFnyQPfNPjuVqrdXionSo94G7X4ZvM5D_CZvd5LSO2CDi53avNLasVKJRmIYp9FoR76Vmcy70SCAvQNX8jRdwzC4NWuk2m0pdbZaH_gW4Ftqqi4Op8dvFmVi4YxKDrEyXiuErxd99_dK5Qdp0cCUtVZNn11sLKYvf3voxiLou0nf3RKjOOCcy1dwcIdZV1SbMC5CjIjeOxcSrk8zAH682wCDm6SPxxzoJ9m1Cv2trVjVpzInHYJ6-C6AzDL4758j5f2x65FEm1pkJgHf4osxccCEHrjwi6Gb_Ya9Va1O3NzhAig_d8upxXjvhTuz6kbfqfzJutRPpY5EE0XNK66oNITfKg-lcbWI_l_4_mmeYZbnSHNtzTKjdwrxYqfvjj2Vzy3C9IaRRvPFTy8KBzR0tnWKgyU29YZQkyGXZY1i3DoT-s2oxqn0lWD1Ns9LijR7S9pxdwQQ06zTz13VENVS2_LtUffTBpf1g&cid=CAASEuRolEjkgglHm3ZSIZCmZSoV9Q&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240
Frame ID: 3BE6B7FC766C43D88B947A5E4033BDDC
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNXZ9omZAAfJv9VxJ6XZGIj9MiKVTABXumUhGZS2wmGJWhrxXJXbp71eur28tkKXYx9tcigz__TGoGTg4vgJFpx1X9aTn5m67COpjd_H2lTmSLgxO-DfrEscgr48wp4SPBdg3yNfXDKyTQ7IJn1LEsMPl4lg76pWEjfJvjfqHKa1RsesmJx8trIl68Z4QN304aXDLbYAI6AtO3g5PvxJamLnmzNCK8XiTIkMFXUHBtpzf7E-Dt3CjVQZh9kpS4aP0f8hDXjKg4OCD-qbHzMt6kfnLXRKsX7JjmS3OSQPpgTDSTVsckDwnHkEseL-lOXVvb3ZRwTigNGGp7raSpOZ2GvthERGyWaoV-BpLz4wsS3hCHJ5OD2ltqh43OoizbVeckuT7Pq6Cbc_QCRdoFmsBaYZY8ZQ7mv0Ci4wAazo8iFnPKxPiEdk-mvyXIFo7FxHx9yvWo8ia6zHuwrORpo3A8PPeXx8DHPjDb9JAMSG_xzj75RTk03oCsz5TPOl7Rtzyyu2_O69Xp7pnd2JNt437CQ25hpdTlS4bIlBuh6dEa8VUz1YY4iGuBmojvbgKyR-e0GBuYtvc1Dvky-26GJ89vRAi9lLOrf2oAw_lzSGgwm8NCznP3tg-gYzHP0ssgdChECbl8_89haFHwrbNxFLeK_GLSMb-yfE8v3NZOWRVxgSWMDQVRy6ka3dykLpJ92o8fmSlIyssuI5Qe8iuS1vpOezJq9HAX1VKmfbK4dIximg6p3Ocg_-eX3R_isXT7fybo96rMRniA9gqvh_EPjXEVCh9DQ01LCr2HytUS0idHO5K7TMm_-11JAVYRLby7EgPgxbV0VvhnVGFpgY3i4kZ_Uc0jvSSCowOWHt_lvRvD21MlsY5kEyqR7Z6PcqW-P8vA9ubSZHJX-MIJ5RPLGanmjIu_s2riJejTI7PWfqwz0Nxf_clMwR7r1pw8qtzO_l4f_6EldBwKY0CVRfGs8nzGY_-_xU1o9u_rPG3o5Htn9ao-6YVdKvMC7xnFF7a10hZ-pWsUzTUG2MwyDabmUupF3rGn9sKg
Frame ID: EB9BF653A8EB3BD85F0FF5206F068E7A
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D8Ml26DgrUy3IwUmk6SrTY2YR052r_bgbR649RybtEOdnBwQJaBnWcAS2QmXEbtggwvexxJN7EbIZejTRbTu49j97vv4OZellgbOqlyZcVqqX3_dTlV69UyZapXPa7u9xyqfWyvrQvt3pkm3p7JiyjDu6anQ&dbm_d=AKAmf-CSnV7Dbgyo7bq5Mup6fJ7vEobTlXrMrKnj45tplppyxZmmY9GRlWhG5NXxieZdPYnzj9rHLLbVNzdOLMqkwoeRD7CUP8YhxqebxxUvSj9Wnui3C1DbnFEXp1FCJc5D_yoB7KVBfwrHYor5nQYVVZvWj-hdXUTmmlrnxQ3ucHTry4hmJXB7ae4DGp9UWXapRLUvWwyN85uFp2wMhjtEzBo5YJ-IqlT9lKtdPyNG7jRYasEv3yXBv44y1eXuCauJ1Pze2G-0qhJSmj8BT36kO-QyyS5O1c0JnY4pecxr9RCFkC16lm2a0vIl87gaKrc2tRcWeZvB-FLvTw80xkpXzPCD8IoxprL1TKjKIOUUpLLOrl_E9tj7of7OucI7yuU909TMPHlNx8kthSEFHzS0OBYyrgBfDriAVwd6eEhYEyU3zpbViY4h02S_IfYX3jflFiUaQNEKb65is4UNhbtLWwidCIhgcnBInTcG7_aZBamWcKDF83SJ3xSYmivGv9-kR7WLUA4Jvm0FwZikMQ7SLSiNygsf9rwuhjnjXg7ydEr667A76lqJ2W6UuocLxoMrrqxMQzJOKoIpOo2y_WeiWHPmvHWZjDYiMDu2w-Dl8LIUoD_xBnEiznDpveAFtFZPK4oBlFcG9jpSdkKhEyLr2G9Ixo5CKSLIKPUVqzMWjoIKo6mJo4MsPehMVIf3oA9js09U7OaeSgqFhKRc83baqXHw9Ul26pfVkT_kFg248QvMxDki9tl0D-KgQh46_tn8HKa0hRDnnZKxzwuKwCXlDZELPxmig5gutsbRNUuaOjUo1GoiNgigibu88CgI1XE3uVsP53MzTvcR1wxZO4utR86YYWqzYvM4uvDJ2IuRD7C9M_gp0R_M3G6sp6gvxyTEoXVxPY8eItVo6vyQXF1bq7zNSscjSxMCHAWeIw6RzrTHWoDvup8JJ3bO5GT6SqT7Rj3vp0qnbD3ZGGnETi1ZJfHaEp_gEJIyvJ3n5gUJzOaBHzhvTQHopes0u0kFxZw27pfXKmAiKvSKZGLrMshytyEFrIX6VhvZv06RgyJXqnerE4b0qg3Pit-rwLJSx4it4qAjh79RHJy_SFAToYyu-kf7_tnG8xdqbMFQwB5MI-mLmNrFjFnkEA0ArACR5d-uIJ_VZeAhcRyIbhAlSgqGseq_q0biU9aL4XIIMFo0njx6LSE7btumZDqjYqh4HboNQTRThJLsDPY3PXW_UxCnzk2gZHB67LtRe6EUUxgmotd03i1AjWTSdDlOBQhWD95O35JC61WKOBJAlVb0epDkODAgycVbeOJxVXTbwp8WTJTIWI48L9Z9DlLn1Qm6gqTp8Y4C34LQU3lx4mpr0uQb4WP9EKhZrfJ1v3lVCr8mCiXp6vxJ6UuoHcJEUjkwzItayFbZIzRD27KgO9KsOSbSZ9CinyFpTMqdZ7jhrWtJijJDV2RY2HMsYceVUStiRFwDwucdv4KNuz0wZy-k78adSwRrwiIFR03hwo0ShT3juNStFySJH8tOTfUEB8EgNAlTUtl_Blw1BxgYbGZf7ySL8Wyi9QmVn2EofazYOy6JlYUNwS8W65Ig_yZS_H4yTQ20xAt74s6k2LQeKTVcBXoHj9_o5kiMK5i9LRt_M0RB5YFkgffxoTy-9xZTuhCaShEZsOgBMndDnCzl7IvscbSQfMhlcuMZrYnk9efg9EUx_ov4tsQ0klTEUeg23g90NkD-4zNDbFur-cR2k3lgAW1jAi7Or1nbIUwPSWZyqTFyP8vqtkCFijvsOXcrK2szUbOJdo2tWvbByhoH3VZPIvRTzZXExcWOw-YWeYdTBdjQqQ-8jJp26VG02aci323UySFlFr1H8zQheKi3s63GAtEPctaFNIUGHLEAvp8aGQMPxh30n-UyjqOkpcI5BDcr9yk3D5r9I_XNNFXyje4nt74D5LxObT2sd6r7V1Q1b-ua5Whutpan68cfeVd3YH1VNEjiiXnmMOKvh90HCdZV0qM3aW70snEwshJCD6wl79NWfgRM0_nN5Mu-08uMfJR0gRFE3kd25SqcTcHMyjqhDonK3v7fLu3kKQooQnA-UoehvgGByqRHFfNsNAFkypBhIbKl8EmXB1_tdK4wu4ys-CSQmZCw2kpZR2f0uFchYSXaxgE9sSR_vcVUUQAgyJ-vsiH1gVvbFJXwKtGCKTmY3iS-V52nKzD8tKtyZWf9VXgw1dcrkvyBo32i37_kDm1itdIofpjlc6xna6M2MP6wJpP2NY_EM3uuj4Oh3bD5mxIV0_5dwudiu3x73g-xkMGPZg7fqKpEqOJ2xsn1G5EeAReLjoV3EDqMJBcJrMW7LvkScKYhho9Mnb_2tolhu00ykTdLgd2DL7DbUWj_k0tMKlolvrARGxRrst-Kz_yb3oHsSvEVy99NqvOOMy8f0pNPu7vnWjCwsT2neHytoxDcW_8F_aBzFFrhuCakE51R42S9Xzsb_KdSuLT9eKEpYPGNe-lKGCbSHLwOA5lz5z1N0o2vaTPer8QlTxWfiWXnKkYu3XrLR4mKpyWOE7LD5D3QMV-RVsBtf5_gsJhEa5bu38u8dAjemrUsO_I78DHTTbmh3fmUTg5uKWe6T_Xt3vkD-hq76TKhe2xEFuE0uO4LTgupvjoTDekmr-2nfxlAK3zqNRdYS6B6i7O2Lf7Mlgri-PkHMK_hZR9FdZ5TR5L2UHQ1EJHn47mK7DNul0XskJsqFNjkkW93-ULSO4YYvpx-8BiydFaDDkMRfmB6AFK2rLPek5wJysLcYbAgT_Oqf7ntocSE_zeLtKIdxO9IQ3ULvM8ynsfm1Xi4yZYC2FgC3fpfNJ64kh_l9N9B2Uk3_AzZUhIu94RnrOnIXwc8rJnUzXwPoLX56JFzcVgMJGM7tbXyXN13W_E-1WI0wv-u8IzBqNDHKMhbXpe8muv9mSbTlD45llYENtkNxvBcOwGVTrLz1U3WhReck6Uc0RWaC7fqdEEcXEV4HcjWpH1XzTPjkJdfS-Mssf0dEglW5Px5Pjlxw3gaEfkDibDZ1zFjbjXDdlP0laMv5LhFjIUjo-R-h3wAT_Ll9qbRbaeLAC19EqSCymvwv_f4DUyIlscLTe1L8QlqP5DQ3xdPBQ8LPrtVYYqJUqAGVh_LrPWFx9zPnu1x8V7xEyl_NCCOZATmnp2EGYrl4SsaQ9WAcs5QskW7ZFzi9aS9zU0t--7J02N5D6AD6hTXjFJmtbinpt-WWwD-yHO_iE_cCnRqZmc_Nar87yPnj20CyGgPfssgRmgA1BL2kiZ24TzkJn30qe6OUdejy5EWOjCWwsBEMOXdmV-hhTy4k86LluU-MZxandzuwqZrxM8iS_7fzgnXlIQyoOcujM7lRTB3vI09xS__hDDpHVhYsfeTMpTp1cN_xItKhujdKtLoGgTEENf5sXK5hDeSgw1-f1z7oN8v7sp55ZGMQl0o2ZMtPVuvlKqoRA2930ow4QMp-91vQ4LwM_ykFkmHsvjjEysIkDycX02PEziZ1JMlQeFewaVbLHjLbhkgE2lP3GUx1e1S0Ig5zG5siMNTQoc4bRWh3tJx1zYo9ZyC9JQcFjOSsmiBGVhMH94RStLp28zovCCxyZ1xMORPRDWTSYDrXo_YiL_ADyWyD3Xr4alpdwWOf-dvGssO1UU3nujrJIZpo1OSPELAYvKJ8VaTHHtBNiWVfTlcRWBZ1B44PqPaaIIAUvf9oYaeY9k7HodNY8XYhdVNy6-MjOWjS0YZ0bNgEczCdqGgmu-WHcOKC9PNVK1uAqHgW-a72efCf_e6nf5OGmZoLRLo9UofdpV5Ds586v23UMI&cid=CAASEuRoE2xj5B7PXxs71n2lMmICDw&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240
Frame ID: 934EF78E1FA32FE59E8AB9C823731BC0
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIr22QEQ242E8gIY3oeyvAEwAQ&v=APEucNXmbcub_5mG8i0Q-keQfjaKRDxWJ9xtE5GsmuW8Y46hZ7rabAOsnXwPAOvVOs5-RJeaqj9z_F0UfeXJ1xpxCq-CmtFa048TCr-J1Yy_opDbn79LaAVySYEpmEXyr7Le5eaZA0WGoGhupeZxIIbSKbGviAS6XgVsO-3dfbIwb8zpsBfNFFM
Frame ID: 3CBFB8BF05432135FD2AFC9B4B8DCDCD
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C_g-F_s7nfhRbjUfcx7Gz00w20vUkdcSDGf89N-AqErESXca7zIXCWRwwm4bRnrrKKvfgHL0WawOSIGTSXbaYl1rfVD71RpdUebkmsi6MXK3jZGRMb2VCVmjakNm9oIhBOnOlGVcy4v9qNfOGssu5YnqqoGA&cry=1&dbm_d=AKAmf-AFsTiMiliqAvTwPEY7-glUCiyP3SbFBxm-AfG6CjU3D1h4oCmzfqxL9_L6UBgXeUT_PMUtDfpRgseSRuNZJfqkZfE74eA8QpQpmRqOssT7vawEYn9VpG_Rjh3uuj3-bIdB6bzUBCcB2I9imE4OHC5IGuy1S-KVqWChk5Tp0ejgFUK-PhpBxv3T4HvQm6Lr8S-fp5L5vQV0cFkWpgjh-xtzkItLAUhXBnRn3t_Hc1fVsu1-VP2Ni3qL8D575enteEexs3_zqboByCDgtB_DYSYDWj5LzLB-JKtbavxOwNRPGRJNup26m4cswWVfwtpHVfS-Wv7coUxoQeiqtTBOxBoZ8XxfhP-DZmHwOB5bPj2cbGd3OHUvZXTeW_fnQBlQkXZwFmLQ-XC6sve55JzY11gPw3PWG7ipuEH7zGrdnDXZz-VMCQMbN__oO-PhA3tzulOQdD1TGQ8A5YKk6oEczmAzyrclIDpFUoLwi4m07xoEpvlCMj78x4d-Ab5Uh7WFQAkEfItk2llzpZIt5JuR_KqYD39K98SUeWPpDxDaBe80ezGm63gdQjX8sa0EySZJ14vHQ5kUcRvBOaiq2Sxv1WTYkb606rAYyeqeM95fKMDHIOoMCRGCMGrleiX_oz4ZNqVrDfCEb0D_bySanu9PImQS8_MRg892QghwFwEdzo90IRgCKDIujygmBeB6AgCEUlLyLOe-E93BgMCJTPuBA1i4mRCMER0DX6cQADJp9hwRCq0_3XGpEWg-dwK0R3vcm56l7F4yuC93RtZYkMpHXzHqgrPnXREnZn020VQXaFPmbxDfrjS0bFVQTzrX_h6uN02hGSqzqkAML6CYqt6MMGuaKlHOYPvaCVkMDKvc5zYtTKPiX2LDoPAJqjiqLiTn_OvNVAjZagdd3Y9JAdRrXubHnbTMFKP_tBQxjl5BfsmCyYF08tyfl7q_J_yZozVOadvCAXfVZaT1YKReyWZF5MuddBhRVZ2jdP93z2th4fJJfcVgphJyddXMkBtDtK971lDTt9e5P16ruffixrzWW6WfRzonjIzMRBqYLk_kDaRFCBSdPHXtxjRgB_Sk7H12Eo7JrqkqYAEVg3kQrMqCBMOye6uyqyL9NK9YvJK11jk5XpQ3QgxG8SOP-iaFg4FzSzOOeetdgvUnr-syi9WPBd0A2haqvHpyz2m4v62goABm_ymOPUdDk4R-0I2rmzzBpn7kKTXd7Ta9KvhBl1JAMZCJbnYct96d6t4H3kIY784Wh7mDRJYDhz1jwAvuqsYkl7JP8yVsJsnCOfGZhHr9KEt9NYUet0v0010i5b4ujcj6_y2Xhq5di37QLtbtt-ttp1gAAYM4WlVaUyweKlJ9bm9kNZm1JpVKZ9ACvjpjWi0nD7_UpJxKicqV40_12wjVUVlVfwZqxiHjt5LGMCELHkKgeF3fZnjYg0PVrSEAlnm0K5F2AbSvpGks3Gnk4bc8K4LVXfBSiLiyC0QptsfxAfa0fRP3I2W1bPcZhHRkwJjIFKKxgicutKfXHNW2sAncAR45cOSUx6IlK7Y9Cnnw4xbqqvhO0ldZ5GeiTc8pjaGRxapuGb1LLeOPZwJVEVXHSdPi1wwgHWR6LtOMPfZqBYTBByFE9z4DE45wutGJAMubJ1SmBnVOZZ-5p-flmoNTqed9qTr0uBl9fgjvMTY1gu3HQcTatuwCZhyheyMPe73jjTckjZYVI8H8TRUKeqMINurqc_SIz_9MPqbsixIs8eUD1E6zylSFUjLHXm3NcWT-TjsxnUvfEhKL8wnJSqPfagnf67QrKtHP1AOB8M48L0__cfPZBTCxN-q5JmueHIAe4Ek-Fmh3LTqikw7b0U8RAYQFO4hTrCQzh_49vo_R5w8Nx9Ww6QhoFX7x4eMBt2jg1aYFwtk1ECnNFwkg6xvPqpzm2DPIyXQvRK5vU37mblGSBmqu0x8rGkUg7C9l7d7RwGIni447PzV3N4AV82WbR-bL7BI9aDvgMh0YSEZjT8F8Hpc7Ti8TJBUgULUEjzy3rbatHj9I_SmZrTAM1AGzYp0umcQWvBGA85146-RoDrd3_DdeCZthSg0YfKTyNUeGW2jdv6RQsrm8hxVbNM22ln7pyjmm-aAOtdQk7VmQHYUt7KRBPUlWFvys-8fZqngZe2VPTx5BLOUmh2b08HOGmD_pyRtlVyyIyO-CAIDyHNyk6hGBsqd9XSeE8SOr2yJQ9UOhl0g6AECs3B7ls40SWxc_1OTO64taB0iPDMKqNfsR_6jI2Ww_73f4w3ouabCcbD1_BGEuRJGOrrGGsyiogt_xsINh83craG7AlqwWxz6lzhy30KUPSDXCPv7P-Ngd5INvjnqOXbPahqf-x5uoaSmxTirWS1JzQTQBFSrlt8Rq69P65rv_UpSz2tA_5SA6sIRLC364L1GdAPiKO9PPK_AcuOmO7QXrZTv3ixDPgNlS8yA0RhSSYtlH5pSYtKyjgnw-_Q2p-zaGiKM2suIVssSHL0T7oRWRkzZF2TE3yZzpYX5WHRDwRDZuZbdtXWcorX0GogpqRLyJ6ovsXP1WM22AGl3BXF5RQth6ctIq3TbAc5_sr1VznOvq_RWpWNRavf5JZJf9-8CcqhJFpxFEVrPCeVb9e51l5VpzqMEe2F4x0I8juMhuah16oYS0Hsfu1__KiPxGUeoA9QXBbNVEanD9hr37nwR44ZIVn4slLGXyt7ryc85N55P_HfKdkdt2l3AKgP0lB492kMSpJcEQrZenB3uXix7IqV71js0RRnJv7STdt9LOwMCHZ0NaSCR17OAF9kMDkzYep9ltVxzMJ03QfT5yDFy9ot5CFj9wMeSdDK_Wa00NvDoHdAcM87dIvIFIT2nMUsloGQG4g6vZJxcptt2zKVjdbx9jXc5RFe6syn07DQ&cid=CAASBORoawE&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240
Frame ID: 98344EBF58405720E8D0ED5CBE0BE4D2
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNUsY93jA4TNZohSD4fg-2EEwgDs5ifuEqq9pLTmayq41GPnIUecm6HPSAJPsylJaAFIfK1QB3EE3Vv4lpI-2YMsDli0AwdaRjxntL91LGR5n6PT6mB_qTvQ1GSdOJ2oZOtW0x9t434SIqkyOKx4DqMxxrq90dNsgokpx7LSfJ5TiOHztDaFP9Art0RMSVFuQwAc-ZU8aH7mI8d2bOWBwuGb801t0evhWpFiPCmkOz7iN7MoSP668XCnyiBkPi6_xpxG8XzKsujTfaAVF3vH_8igGN0BCDA23nAt2j7vehPlyHVcCzBeKYWnZ4CqFxx7tDAJQt4dxokC0owaqJpTOHvjYXiUV9N8IARYA9z8BLyHAh3KrsFXNXiupM6BFnggVUrifRlCm74o3O82ki044xNS8pAYhT43gwFLUDcTl9c3BUkV2PUM6KR_XdCb3Hbq0T6ELXDtgivgJRADHgw2gBvjUI_kW7VLQq9xGLi75nLuoNyVw3abQStzUv7zpeRcGqSG0eZfE0o-iYwom4gPemN_UFiZYHv1ehI4MdBiK_EF7HFU4IEBTZ8nrqLYgGz0SKnc36EVYBp1ZRFDVTp0CCCYUrGf5jgwLBsEGaWA-MLWUOPNeqonYNufEsndSUUNibJQ2ODJ4SP0IvA2K6Ihcp0yaeC8SaqllsMoskgbLXAXNWPCn09G4R8pSoTyhyzg1MVx6tJrO61T8LV0ghE1o8ZJcRjnXSaDj66VzuifWtU-uv0Rgfqxmq8khGpJytP3Lz3j5Hwe9gfxnyQ18iDs12IhRm7Q675HbpaJxFQipj604sex5Fy54qfqWx637KYGOrUGyrsWrH9UtsOQEi58FHbZe0B8OJSp1lFW6Ytf4fcxv-WfgZldXktMj3i6nHRMOaPca5xIEpwHhMVJFY14Q4nPUzg_4sjGxC-L-QqcEdXbVeVlgbjyCSIRF2Sg5bAWwzvpD2kZ7Oh3RXMHGeS35DiMLbjaj3LC3PhOfmN06gzkhhVhM2zWND9RJRf-330lVfz3q_EeqnNY92M_ABSh4ZgLWCbC7g
Frame ID: 8A3F1B3187968341EF3AC386F9A22A33
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CVV1-ykf8YHa8DIU3aC_SmVFqVHf6Bdb3-T5oljVUmtSukWIFbFtsf_cKUUFuu9hQzQLeBJEM39ctAB-RGju6eVC6ENBAcgCDJhaXamwoQhkvHmZXMcHyDj9cnkaWTdrrC5If4c8HbNgwRxPJLai4ObcmR2g&dbm_d=AKAmf-DNjrktmY9aarNSvtZDoS4k99d08PSwOACTTd9FvIDLWlzbDrwmyJNvpZLgVq-tfIbSWtBqTw29BS4JvnacOgUnA4qUeEtbzQh4K8BsSpUM4xTpeZXhvZCiQQ98-AutesXgB4ArGXeSnOXeZl6X7jN6tMnmNZQfXbBMVIZEvdet80gmiKOHNCvN5ABw-H5or9ld9Yn6Eam1XUKxMjrIfWs928ZOakK_hPE_auj7MU7yn4Cu9IVluL-9w0ZYibp-bLaoJmnlEhj1mIr6HfoP-Ks5Uiao_zpSUlc8Y8dosWDtfwmpmsAUBy_7-YFNbjiXOvU01xn4NVWhsAo6xS0uGytmobrCvtAYm0Kc5ZGpuVkEz1K-mskJgxufTslbiwtqKurzdPEwttZTC--ZIIad60C4SEuyCF57gjhiwAv4VdPCdFfoZr4Jyb10ZcsMsKxkAcJRdTWreaE_e88U1uvbRqTLyj0_oOaqJo46b93o5gQuE-XwNebTI4UdVN3RjAU-5f08PjhN7ZIDUn8x34BuMG7-eV_6ac902A4xZKm135Wlpd4ZjDxaqIEMzJtydUWO7Bu5UqrOy7P1laQSVXGEXx0wIQRSXYZ4lOSaL8eYyFfdxdR6-Jkm8ktgFEzZoLLOUppWSS1Xzcwkw0Pl6rtFKJErYxp8OC8FfsJyJag-KFJLjMXpCExnVJzdcdIulCWgjaY9u7J5E5DVSDlNeJc98zsnw2wlUWwQuREkqc44JasqX8zZ2jDQCE0IEYVEUiySobOnMOQTpIsMU1zHpU_i8adL5RgT25HgZdcRqk3jPLJTvrjTWEbbOX96oTHe5eG_Xz0PwlZi6i8Tz4fz4NOtdbVTL-PcZTGklxQtrSSF-v57anY1930Z3W8OoQlFQv31j21r0VFePRKDivhlow40LtdTUpwljHnz36q4mG9bdKGtaQAzJglMAC-LVp3cfCmvvbEtEyOFkJQVrVFSJy7RW3GTmuV_VYE6XCgu5Uhl73zDzsclqoylCabgCwXCHAcUaXL2ZKyVwVim96kNEzG9szS-3xMs_tXmNcsDjzL2fizY2IYtGqmHRXx4pCEHECnvbS-K5WNmoSxZZjlNj3NE9u1yJCWs542npJ79iWIrhlSlVsrUQmm99vS2u59RalVd961GvOc7f5Zhg2EhbVnYi4MtAtPWfMdu2VsfquCEEI97IoexiKdChtLx44KIIL_KGh8Pt6fF3lHHeWT0qnl5T6j5rK55vUGNpPvkzIOA4owF86PyB4l9ewqIMwVj_25dgJaXnmvK4-Cl5YopcTrllC2DpyZXiNFTZ82Vj4mtLwkalzWlQdrzVJon7gcvxpi3NCSOV7Gx17nhzM9jqoxcaOX1ir_UmRn1ZhHfE61W6Y_XzJjQxdjmz4yKiJfwOxA2UpgVY1ywFHvXGlpVsQ0wgr6OOMqhoA_JuNL82GitJ99_v_HgDkYalp5NiuHivGzriiVl62SeXUDxLulJOVuT_L4FRqcLuFPhZrrYlCRFkepQPSSuBB_2KgMbJ3kj2sQylxhDk7J1B_jyEYG13vJ3e8iqItyIDfASg90h7ALFPOB1QpTh8pGQ7mOd6eFG4ceRHpkisoueVUgXvplJcbsGmA63DEb_bnwaVFReaBpMiklJ4w94t2UAIld3wFSFIymKJHxmVevDTRD5bn6cDREJqzTTInMHYB-OumkaAcnrjH0uAobsskR4DBcGElLTZWF9w-d0v35IxggpoYd-f752-GydwIEtkJt8WNRHYe-vFhZkEArHE7YbRpCeP9eCypzlI79QeRlT2v3O9FMcabrKTVC0tnLT2UOrUgxA8SodZvR8elevp-bvD6O0SQnsA4kxqAXOqpFKJrnTOLcxvj2Q4grHhZc2zRlTiHfpSZ66al4JIQL7ntaOykOqGwcVUvOwkgUnp30MQqerVRj3p73QdiTDxtTlz86cSYeOoKu2uKMmWmRn3fE84kskVVXN2IToZoBnNn04NSFZHQwcCwqQLnnrEmuPP8kYNfW-z-Me2-S87Y1raNk1Y9zZNXBvCFc8FOuE-aDkFIJNUpGP6nw-OFI4Z9_9B_vxl1vL3qBXoUk9A7wpk9kuJTqATgelPHIbbuP4mYtZoHiacm59IrDwjFVbEfhzJrMxJ10iVDAJfgiEUz-gxoVUenlPdFHpZbzndXkv3U5qf5m4EyHFFNGvAGaXhkDFGPl13esvH2i7Fb9XKcc2mbjUwooRWrsrpCzmZPgxPaOVY1JE4j6KptKdQnzlVFb7XWqgP2pc88XC8Jzc1cLm5dPzgYc0Fg4yHUfmXDC6uaP9hRDq4IUkkqpkvwKQRubNAlxmdYxgX84Htl_FxNJ9TboPJkpPaylilCY66QJqrrhs95rjNtNWN8dP6X__vmxeS7RmvJ0SHiYRM9zzaNZOQQd6CP9I-KZK13OpIaKOOelU5OxLPKaaTAd2KYf2WfqsA2P5CKFEbn5ZBG4BOy2mSa011VmgDWVV0kCOHoTujpjXKZBg1h3C4sQRbswf4gcpnq7ij2KdS92jMvfOTIZMuLq1ctSTUvV-YdCkm9z1NrV77ZaCxOnOQa669mIjVap70MxdRtUw4pNN4iQmUZNiTkvIapPbHHEI2Uqo2ahCWekcArGpOSd52vyFSnc2Fbix5wCzfFoZpCFlSvSHf-BziUPq5fsjoBFKVKJEVot7AyQZRO7FbKCgmO0MJBh7N_E0QqC5p2ozjDT2tylxYKbo7CGENHvsvYZl8Jsa0pr-LJjdBm6vjEXiaXx1iyhnIdAf09BsXFfBvBElptp8zTWWkjPBy7TRRT4a_C1fxvNaGJVPwXf2PaV1BmlKyE86HRzG6W6PNFs0CIUzNTXtxWCPd6Mw_Vu7Qs3121VcXl2jUTC39tMmI802EbWAtIdq_wMOE2fPR2YgIvLx5x8Q7LA2b4VT3EC7vEZiwKQ3LVcvU8xgi7zF40jiIMHGi6H0Fn73sURspsn_acI9r41kcB5o9WxxmDAPzov2r5enYLlLnJeFTEKCk-jeTo76CMi1q8O8-ot7fi-U5He5HfnarR0LsFpLY6PAs1wECOf4ZfsJBq7Q-Mpnj2knuXBeMsgBz1DaAuKPRCORtFAWWbwXjmT0GF46gJSyqSRiy3kak6Fqtrg5Uo7oAAlLJgo2XtyLx8zgJeQ6a7dOJpTjzvl2_u1Ak1Ab4bzlRcfY93LB2zANvNKuil_Swa0BPjVF8twLFNHpSfJ1HtxdDEC2Xxo7WbAVQcKHgger2dQqVAwT7yQW0dMBcHYmHuasOp77APOIdC0FYHTauEOlxfUg-liKueShswth9YjZ1Tv4F6P_GUS_lM1NHz1sRPG6np1UnQPBmF8R0Kqv_YSASpOo-p6-zTVy6yKyNkHi-W-vwAawARekKqn_xGzKG0ewd6S_tY152zFxtnFpCNgBA95UBdw1iF0z1uyuXlnkMS_H95g9jaPWzm-LO3KMj_z0LftaZc8fPpC1WJ2RM7wUK6hNpTKh2q-AD6ZD_j_O0Nrxj4vEC4KbxMUspH0b6raWnDkaBoHARCdSVjxxYDwoBYB2Rxi5SRFGfMM9wbKJBDesuCYmiL2SijXvEZO2Jce9odwVJz3-yJq0WPWiT8uaj8CfjvnuYow1otnioLzNbxudx5cHPmOGgDKuwTw4uKtSv2rnJKWvPTmJY694nKE1NpIR6n5OrVaA_nXed55KkSpgPLibKsxYowcBYqDBaoXfTLRjxYt-CyaYkRpWRgPzVwdvfInlifzfHJmMuMGUnEXtg0MjqESTpkL-tHqWdxMQJBYQxBnwtRWuHHVKTvLfrCrY1JHT8SyZMl9JplwjMlexEzHMdanEmBs_m2m2wo98qCsMRWRMUG5J7oMkVTJdClSglysCqaLaqR8lHwwsnus8DcphhKp3doDF2E2EntwNaja6vrYr51SfSQ&cid=CAASEuRoIeo23zK_beu3vFuhnBISjw&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240
Frame ID: F2ACE8FD413E6F154F9169F8205C7340
Requests: 13 HTTP requests in this frame

Frame: https://www.gstatic.com/mysidia/0a7038a78463924e38e856a41c4efd92.js?tag=client_fast_engine_2019
Frame ID: 48AC03234EDCF79CD1BB37C2B36DDAB0
Requests: 12 HTTP requests in this frame

Frame: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
Frame ID: 0A1BA18551D12E788B6C8145BC2C3062
Requests: 21 HTTP requests in this frame

Frame: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
Frame ID: DEFDC004359911431B6406E97466AF2B
Requests: 21 HTTP requests in this frame

Frame: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
Frame ID: 279EDCD73A297FABB9C1CBA00CB749F9
Requests: 21 HTTP requests in this frame

Frame: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
Frame ID: 87CD2FF02114FBB1173036AB4052D11F
Requests: 21 HTTP requests in this frame

Frame: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
Frame ID: 94C8E57907DEE5A2A28E177D195E14D3
Requests: 21 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 34D6CFB8869AFB0A6392946E03A439F0
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
Frame ID: 6FF3E95E91B68D327E35742C9ADE516A
Requests: 21 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: D840A1E5B0F4BBFEA6271CE3919C727E
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 8CFAB116DB3B108C072015A201E13ACE
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 35DB7FF6C830D783853980510EA77FCA
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: C8F493C5743416D9F73B5F55C7F32177
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: A8316E3356F5822D8AB7D1921741895A
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 3CF640B4BAE254A7E1F75EDF9C5E8E73
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: C0E87F2E5151C188725EF1C19FE7ACEE
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js
Frame ID: 53E722FAE1CDCF0931D6338A602D2C95
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 5D29F464C385CA04DEDF2630D8AC61FF
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 9E14106600EC844A6D2E71315E132099
Requests: 2 HTTP requests in this frame

Frame: https://cm.mgid.com/i-noref.js?cbuster=1642377633447885201070
Frame ID: 553235F192E8830606E5ED16E2B1B509
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=us-west
Frame ID: 80F3A04E4F8FE8F4121CA0C1BC811A1F
Requests: 4 HTTP requests in this frame

Frame: https://s.adtelligent.com/sync.html?aid=658327
Frame ID: E7FE5891F72B623E48242BADCABE019A
Requests: 2 HTTP requests in this frame

Frame: https://cdn.1vag.com/1x1.png
Frame ID: 4931F104E24EE47BD86D45E89E26F738
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

World museums and paintings by famous artistsFacebookTwitterPrintEmailAddThisFacebookTwitterPrintEmailAddThis

Page URL History Show full URLs

https://kartaplovdiv.com/sexdating.php Page URL
https://subterfugue.org/ Page URL

Detected technologies

GSAP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

TweenMax(?:\.min)?\.js

AddThis (Widgets) Expand

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Moat (Analytics) Expand

Overall confidence: 100%
Detected patterns

moatads\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

Zepto (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

zepto.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

473
Requests

93 %
HTTPS

36 %
IPv6

54
Domains

76
Subdomains

45
IPs

11
Countries

7653 kB
Transfer

14501 kB
Size

73
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://www.dynadot.com/domain/contact-request?domain=subterfugue.org&contact=2&contact_reason=2
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www.mgid.com/ghits/11740000/i/57443878/0/src/1980370284/pp/1/1?h=COH9ar6u46-UIN0Cy-ZhiM3DzJC_B3ILtZpf4WNkR_ygLeGY_7of51QhTJnqk7Jw&rid=7db324f1-7728-11ec-bb83-e43d1a2a96ea&ts=kartaplovdiv.com&tt=Referral&att=4&pubsrcid=subterfugue.org&afrd=8&iv=11&ct=1&gdpr=1&consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA

Search URL Search Domain Scan URL

URL: https://www.mgid.com/ghits/11739995/i/57443878/0/src/1980370284/pp/2/1?h=COH9ar6u46-UIN0Cy-ZhiClTxgV3aL1pnuVMfwa6K0BmPrfToax7vrwwhOtSbQFc&rid=7db324f1-7728-11ec-bb83-e43d1a2a96ea&ts=kartaplovdiv.com&tt=Referral&att=4&pubsrcid=subterfugue.org&afrd=8&iv=11&ct=1&gdpr=1&consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA

Search URL Search Domain Scan URL

URL: https://www.mgid.com/ghits/11740037/i/57443878/0/src/1980370284/pp/3/1?h=COH9ar6u46-UIN0Cy-ZhiB-9ZkcbQpJhf564R_qDea3SeXqSZXRh7QvORFcCS8tl&rid=7db324f1-7728-11ec-bb83-e43d1a2a96ea&ts=kartaplovdiv.com&tt=Referral&att=4&pubsrcid=subterfugue.org&afrd=8&iv=11&ct=1&gdpr=1&consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA

Search URL Search Domain Scan URL

URL: https://widgets.mgid.com/?utm_source=subterfugue.org&utm_medium=referral&utm_campaign=widgets&utm_content=1038348

Search URL Search Domain Scan URL

URL: https://www.mgid.com/services/privacy-policy

Search URL Search Domain Scan URL

URL: https://www.mgid.com/ghits/11740006/i/57372935/0/src/1980370284/pp/1/1?h=gzOfPe-SIhJ80aA7284QUxqPj7p99ahTHqrXdkDzj7ezQ5PbLRIMRzXSA6SQaTMO&rid=7db3c87b-7728-11ec-a016-e43d1a2a53a0&ts=kartaplovdiv.com&tt=Referral&att=4&pubsrcid=subterfugue.org&afrd=8&iv=11&ct=1&gdpr=1&consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&muid=m0gxR0SLV10g

Search URL Search Domain Scan URL

URL: https://www.mgid.com/ghits/11740009/i/57372935/0/src/1980370284/pp/2/1?h=gzOfPe-SIhJ80aA7284QU-49MJ-yjPmIROTQ7Y6JWWdp2Q_R3ef3Jx3P0A-b4ePL&rid=7db3c87b-7728-11ec-a016-e43d1a2a53a0&ts=kartaplovdiv.com&tt=Referral&att=4&pubsrcid=subterfugue.org&afrd=8&iv=11&ct=1&gdpr=1&consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&muid=m0gxR0SLV10g

Search URL Search Domain Scan URL

URL: https://www.mgid.com/ghits/11740004/i/57372935/0/src/1980370284/pp/3/1?h=gzOfPe-SIhJ80aA7284QU5S6p8sH4k0X0KkeiBZTdqewzrajRjcq5uQy5ha1bXBY&rid=7db3c87b-7728-11ec-a016-e43d1a2a53a0&ts=kartaplovdiv.com&tt=Referral&att=4&pubsrcid=subterfugue.org&afrd=8&iv=11&ct=1&gdpr=1&consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&muid=m0gxR0SLV10g

Search URL Search Domain Scan URL

URL: https://sd.subterfugue.org/
Title: World museums and paintings by famous artists.

Search URL Search Domain Scan URL

URL: https://cv.subterfugue.org/sitemap.xml
Title: .

Search URL Search Domain Scan URL

URL: https://www.addthis.com/website-tools/overview?utm_source=AddThis%20Tools&utm_medium=image
Title: AddThis

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://kartaplovdiv.com/sexdating.php Page URL
https://subterfugue.org/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 74

https://counter.yadro.ru/hit?rhttps%3A//kartaplovdiv.com/;s1600*1200*24;uhttps%3A//subterfugue.org/;0.8818364044481424 HTTP 302
https://counter.yadro.ru/hit?q;rhttps%3A//kartaplovdiv.com/;s1600*1200*24;uhttps%3A//subterfugue.org/;0.8818364044481424

Request Chain 94

https://mc.yandex.ru/watch/65397514?wmode=7&page-url=https%3A%2F%2Fsubterfugue.org%2F&page-ref=https%3A%2F%2Fkartaplovdiv.com%2F&charset=utf-8&site-info=%7B%22__ym%22%3A%7B%22isFromApi%22%3A%22yesIsFromApi%22%7D%7D&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A3u9fu6axod71lkz4p33%3Afp%3A953%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A730%3Acn%3A1%3Adp%3A0%3Als%3A680853229876%3Ahid%3A400475593%3Az%3A0%3Ai%3A20220117000030%3Aet%3A1642377630%3Ac%3A1%3Arn%3A1031824737%3Arqn%3A1%3Au%3A1642377630608242204%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1642377628177%3Anp%3ATGludXggeDg2XzY0%3Ads%3A95%2C44%2C155%2C11%2C0%2C0%2C%2C1009%2C44%2C%2C%2C%2C1316%3Awv%3A2%3Aco%3A0%3Arqnl%3A1%3Ast%3A1642377630%3At%3AWorld%20museums%20and%20paintings%20by%20famous%20artists&t=gdpr(14)aw(1)ti(2) HTTP 302
https://mc.yandex.ru/watch/65397514/1?wmode=7&page-url=https%3A%2F%2Fsubterfugue.org%2F&page-ref=https%3A%2F%2Fkartaplovdiv.com%2F&charset=utf-8&site-info=%7B%22__ym%22%3A%7B%22isFromApi%22%3A%22yesIsFromApi%22%7D%7D&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A3u9fu6axod71lkz4p33%3Afp%3A953%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A730%3Acn%3A1%3Adp%3A0%3Als%3A680853229876%3Ahid%3A400475593%3Az%3A0%3Ai%3A20220117000030%3Aet%3A1642377630%3Ac%3A1%3Arn%3A1031824737%3Arqn%3A1%3Au%3A1642377630608242204%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1642377628177%3Anp%3ATGludXggeDg2XzY0%3Ads%3A95%2C44%2C155%2C11%2C0%2C0%2C%2C1009%2C44%2C%2C%2C%2C1316%3Awv%3A2%3Aco%3A0%3Arqnl%3A1%3Ast%3A1642377630%3At%3AWorld%20museums%20and%20paintings%20by%20famous%20artists&t=gdpr%2814%29aw%281%29ti%282%29

Request Chain 123

https://impes.tradedoubler.com/imp?type(img)g(25128932)a(2865028)075512613 HTTP 302
https://vht.tradedoubler.com/file/324110/kit3/300X250.jpg

Request Chain 124

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFMW-4pyJAFIdeatPiVcEUM&google_cver=1

Request Chain 125

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YeSxnsgJnEB3749r8NiCxQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGRuKmIPm02e_9zH1M2HluI&google_cver=1

Request Chain 126

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEDACkytWOEE_nhoLiajfrFU&google_cver=1

Request Chain 127

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTE0MDg0MzM4OTgxNTcxNDk5Ng%3D%3D

Request Chain 128

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFMW-4pyJAFIdeatPiVcEUM&google_cver=1

Request Chain 129

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YeSxnsgJnEB3749r8NiCxQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGRuKmIPm02e_9zH1M2HluI&google_cver=1

Request Chain 130

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEDACkytWOEE_nhoLiajfrFU&google_cver=1

Request Chain 131

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjY4MzAwNDU3NjA2MDkwNDIxNg%3D%3D

Request Chain 197

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~440.839.66.1558.1364.1842.1878.2357.149.167.415.1889.1810.494.2299.817.2575.2985.1651.3154.1716.864.1033.1051.2072.2572.587.1097.1870.1230.2373.540.317.486.867.2316.1205.1712.338.1564.482.144.162.241.108.1201.259.1186.449.733.93.1449.2571.981.323.1301.1765.1276.1215.938.122.780.89.2628.1031.1092.1725.3052.1211.1290.2677.2526.2109.1577.1365.2253.495.326.574.272.311.1419.1570.1721.70.1127.2202.2177.491.1929.1591.1415.196 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGRuKmIPm02e_9zH1M2HluI&google_cver=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~440.839.66.1558.1364.1842.1878.2357.149.167.415.1889.1810.494.2299.817.2575.2985.1651.3154.1716.864.1033.1051.2072.2572.587.1097.1870.1230.2373.540.317.486.867.2316.1205.1712.338.1564.482.144.162.241.108.1201.259.1186.449.733.93.1449.2571.981.323.1301.1765.1276.1215.938.122.780.89.2628.1031.1092.1725.3052.1211.1290.2677.2526.2109.1577.1365.2253.495.326.574.272.311.1419.1570.1721.70.1127.2202.2177.491.1929.1591.1415.196

Request Chain 198

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~440.839.66.1558.1364.1842.1878.2357.149.167.415.1889.1810.494.2299.817.2575.2985.1651.3154.1716.864.1033.1051.2072.2572.587.1097.1870.1230.2373.540.317.486.867.2316.1205.1712.338.1564.482.144.162.241.108.1201.259.1186.449.733.93.1449.2571.981.323.1301.1765.1276.1215.938.122.780.89.2628.1031.1092.1725.3052.1211.1290.2677.2526.2109.1577.1365.2253.495.326.574.272.311.1419.1570.1721.70.1127.2202.2177.491.1929.1591.1415.196&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&google_nid=casale_media2_dsp_secure&google_cm&google_hm=YeSxnsgJnEB3749r8NiCxQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGRuKmIPm02e_9zH1M2HluI&google_cver=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA

Request Chain 200

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjY4MzAwNDU3NjA2MDkwNDIxNg%3D%3D

Request Chain 208

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~574.1365.272.817.1651.1721.2575.1716.864.1033.1051.2072.2985.587.3154.196.440.839.1364.1558.1842.1878.2572.1889.415.70.1810.494.2299.338.122.1564.482.2373.93.1449.1201.2571.1097.1230.1870.540.486.317.2316.1712.89.867.1205.1031.1092.1290.1211.1725.1186.449.259.241.162.144.108.323.733.780.981.1215.938.1276.1301.1765.311.2202.2628.2677.3052.1127.149.167.491.2177.1591.1415.1929.66.2357.2526.2109.1577.2253.1419.326.495.1570&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~574.1365.272.817.1651.1721.2575.1716.864.1033.1051.2072.2985.587.3154.196.440.839.1364.1558.1842.1878.2572.1889.415.70.1810.494.2299.338.122.1564.482.2373.93.1449.1201.2571.1097.1230.1870.540.486.317.2316.1712.89.867.1205.1031.1092.1290.1211.1725.1186.449.259.241.162.144.108.323.733.780.981.1215.938.1276.1301.1765.311.2202.2628.2677.3052.1127.149.167.491.2177.1591.1415.1929.66.2357.2526.2109.1577.2253.1419.326.495.1570&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ODZkOWIzNDQtNDU3NS0yYjY4LWM4MjktZGVmYTdjZjc2OGE0&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA

Request Chain 209

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~574.1365.272.817.1651.1721.2575.1716.864.1033.1051.2072.2985.587.3154.196.440.839.1364.1558.1842.1878.2572.1889.415.70.1810.494.2299.338.122.1564.482.2373.93.1449.1201.2571.1097.1230.1870.540.486.317.2316.1712.89.867.1205.1031.1092.1290.1211.1725.1186.449.259.241.162.144.108.323.733.780.981.1215.938.1276.1301.1765.311.2202.2628.2677.3052.1127.149.167.491.2177.1591.1415.1929.66.2357.2526.2109.1577.2253.1419.326.495.1570 HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEO_9kJLQVW_z2J9tzeJLDz0&google_cver=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~574.1365.272.817.1651.1721.2575.1716.864.1033.1051.2072.2985.587.3154.196.440.839.1364.1558.1842.1878.2572.1889.415.70.1810.494.2299.338.122.1564.482.2373.93.1449.1201.2571.1097.1230.1870.540.486.317.2316.1712.89.867.1205.1031.1092.1290.1211.1725.1186.449.259.241.162.144.108.323.733.780.981.1215.938.1276.1301.1765.311.2202.2628.2677.3052.1127.149.167.491.2177.1591.1415.1929.66.2357.2526.2109.1577.2253.1419.326.495.1570

Request Chain 210

https://sync.teads.tv/um?eid=3&uid=&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~574.1365.272.817.1651.1721.2575.1716.864.1033.1051.2072.2985.587.3154.196.440.839.1364.1558.1842.1878.2572.1889.415.70.1810.494.2299.338.122.1564.482.2373.93.1449.1201.2571.1097.1230.1870.540.486.317.2316.1712.89.867.1205.1031.1092.1290.1211.1725.1186.449.259.241.162.144.108.323.733.780.981.1215.938.1276.1301.1765.311.2202.2628.2677.3052.1127.149.167.491.2177.1591.1415.1929.66.2357.2526.2109.1577.2253.1419.326.495.1570&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZjkyM2RiZTktYjkxMy00M2JkLTg4ZGEtMTEwOWE3NGY5NDI4&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA

Request Chain 216

https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~1097.1230.2373.540.486.317.1564.1205.867.338.2316.1712.482.241.108.259.162.144.1201.440.1449.1364.839.66.1716.1870.2072.2571.2575.415.1651.2985.3154.494.149.167.817.1889.1810.864.1878.1051.1033.1558.1842.2299.587.2572.2677.1591.1929.2357.1419.272.495.2202.326.2526.1365.574.2177.2253.70.1127.311.1570.196.491.1415.1721.2109.1577.449.323.733.1186.1301.93.981.1725.780.1215.122.938.1276.1765.1031.89.1092.1290.2628.3052.1211&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~1097.1230.2373.540.486.317.1564.1205.867.338.2316.1712.482.241.108.259.162.144.1201.440.1449.1364.839.66.1716.1870.2072.2571.2575.415.1651.2985.3154.494.149.167.817.1889.1810.864.1878.1051.1033.1558.1842.2299.587.2572.2677.1591.1929.2357.1419.272.495.2202.326.2526.1365.574.2177.2253.70.1127.311.1570.196.491.1415.1721.2109.1577.449.323.733.1186.1301.93.981.1725.780.1215.122.938.1276.1765.1031.89.1092.1290.2628.3052.1211&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_id=7cac4064-7728-11ec-a33a-1be234f70106 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=N2NhYzQwMjktNzcyOC0xMWVjLWEzM2EtMWJlMjM0ZjcwMTA2

Request Chain 219

https://pixel.advertising.com/ups/55946/sync?_origin=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~1186.2373.482.1201.66.1449.167.149.1564.2316.486.540.867.1205.1712.1097.1230.2571.1870.1051.1033.864.1716.2985.587.3154.2072.817.1651.2575.317.415.1889.494.338.1810.2299.1364.241.108.259.440.839.144.162.1415.1558.1591.323.491.1842.1878.93.1929.2357.2202.2526.2572.2177.1127.122.495.2677.1419.2253.89.574.1365.1570.1721.2109.1577.1211.1290.1725.1031.272.1092.326.70.1215.1765.780.311.2628.3052.938.1276.1301.196.981.449.733&redir=true HTTP 302
https://pixel.advertising.com/ups/55946/sync?_origin=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~1186.2373.482.1201.66.1449.167.149.1564.2316.486.540.867.1205.1712.1097.1230.2571.1870.1051.1033.864.1716.2985.587.3154.2072.817.1651.2575.317.415.1889.494.338.1810.2299.1364.241.108.259.440.839.144.162.1415.1558.1591.323.491.1842.1878.93.1929.2357.2202.2526.2572.2177.1127.122.495.2677.1419.2253.89.574.1365.1570.1721.2109.1577.1211.1290.1725.1031.272.1092.326.70.1215.1765.780.311.2628.3052.938.1276.1301.196.981.449.733&redir=true&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/55946/sync?_origin=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~1186.2373.482.1201.66.1449.167.149.1564.2316.486.540.867.1205.1712.1097.1230.2571.1870.1051.1033.864.1716.2985.587.3154.2072.817.1651.2575.317.415.1889.494.338.1810.2299.1364.241.108.259.440.839.144.162.1415.1558.1591.323.491.1842.1878.93.1929.2357.2202.2526.2572.2177.1127.122.495.2677.1419.2253.89.574.1365.1570.1721.2109.1577.1211.1290.1725.1031.272.1092.326.70.1215.1765.780.311.2628.3052.938.1276.1301.196.981.449.733&redir=true&apid=UP7ca79f54-7728-11ec-97b8-061e8df12308 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_hm=VVA3Y2E3OWY1NC03NzI4LTExZWMtOTdiOC0wNjFlOGRmMTIzMDg%3D&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA

Request Chain 220

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~1186.2373.482.1201.66.1449.167.149.1564.2316.486.540.867.1205.1712.1097.1230.2571.1870.1051.1033.864.1716.2985.587.3154.2072.817.1651.2575.317.415.1889.494.338.1810.2299.1364.241.108.259.440.839.144.162.1415.1558.1591.323.491.1842.1878.93.1929.2357.2202.2526.2572.2177.1127.122.495.2677.1419.2253.89.574.1365.1570.1721.2109.1577.1211.1290.1725.1031.272.1092.326.70.1215.1765.780.311.2628.3052.938.1276.1301.196.981.449.733&redir=true HTTP 302
https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~1186.2373.482.1201.66.1449.167.149.1564.2316.486.540.867.1205.1712.1097.1230.2571.1870.1051.1033.864.1716.2985.587.3154.2072.817.1651.2575.317.415.1889.494.338.1810.2299.1364.241.108.259.440.839.144.162.1415.1558.1591.323.491.1842.1878.93.1929.2357.2202.2526.2572.2177.1127.122.495.2677.1419.2253.89.574.1365.1570.1721.2109.1577.1211.1290.1725.1031.272.1092.326.70.1215.1765.780.311.2628.3052.938.1276.1301.196.981.449.733&redir=true&verify=true HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS0wVTcxMjhwRTJ1R19NRzIzcWk5RFhoRkUwR09kb2xRbn5B&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA

Request Chain 224

https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_cm&google_dbm&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~440.839.66.1558.1364.1842.1878.2373.167.415.149.1889.1810.494.2299.817.1651.1716.864.1033.1051.2072.587.1097.2571.1870.1230.540.1205.2316.317.486.867.2575.1712.338.2985.3154.1564.482.144.162.241.259.108.1201.449.1449.733.93.2357.2526.1301.1186.323.981.2572.1276.1215.122.780.938.89.1765.1031.2677.1092.1725.1211.1290.2109.1577.1365.2253.495.326.574.272.1419.311.1570.1721.70.1127.2202.2177.2628.491.1929.1591.1415.3052.196 HTTP 302
https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEAaQpKeidAB0K9h5_d2olsg&google_cver=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~440.839.66.1558.1364.1842.1878.2373.167.415.149.1889.1810.494.2299.817.1651.1716.864.1033.1051.2072.587.1097.2571.1870.1230.540.1205.2316.317.486.867.2575.1712.338.2985.3154.1564.482.144.162.241.259.108.1201.449.1449.733.93.2357.2526.1301.1186.323.981.2572.1276.1215.122.780.938.89.1765.1031.2677.1092.1725.1211.1290.2109.1577.1365.2253.495.326.574.272.1419.311.1570.1721.70.1127.2202.2177.2628.491.1929.1591.1415.3052.196

Request Chain 225

https://ads.stickyadstv.com/user-matching?id=11 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=ZGM2NTkzYzk4ZmUxMWZiOGE4NDVlYTFhOWMxYzM1Yw==&gdpr=0&gdpr_consent=

Request Chain 226

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~440.839.66.1558.1364.1842.1878.2373.167.415.149.1889.1810.494.2299.817.1651.1716.864.1033.1051.2072.587.1097.2571.1870.1230.540.1205.2316.317.486.867.2575.1712.338.2985.3154.1564.482.144.162.241.259.108.1201.449.1449.733.93.2357.2526.1301.1186.323.981.2572.1276.1215.122.780.938.89.1765.1031.2677.1092.1725.1211.1290.2109.1577.1365.2253.495.326.574.272.1419.311.1570.1721.70.1127.2202.2177.2628.491.1929.1591.1415.3052.196 HTTP 302
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGG4SWtgRFYGpNxnBkYVsho&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~440.839.66.1558.1364.1842.1878.2373.167.415.149.1889.1810.494.2299.817.1651.1716.864.1033.1051.2072.587.1097.2571.1870.1230.540.1205.2316.317.486.867.2575.1712.338.2985.3154.1564.482.144.162.241.259.108.1201.449.1449.733.93.2357.2526.1301.1186.323.981.2572.1276.1215.122.780.938.89.1765.1031.2677.1092.1725.1211.1290.2109.1577.1365.2253.495.326.574.272.1419.311.1570.1721.70.1127.2202.2177.2628.491.1929.1591.1415.3052.196&google_cver=1

Request Chain 227

https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=GOOGLE_HOSTED_PI&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~440.839.66.1558.1364.1842.1878.2373.167.415.149.1889.1810.494.2299.817.1651.1716.864.1033.1051.2072.587.1097.2571.1870.1230.540.1205.2316.317.486.867.2575.1712.338.2985.3154.1564.482.144.162.241.259.108.1201.449.1449.733.93.2357.2526.1301.1186.323.981.2572.1276.1215.122.780.938.89.1765.1031.2677.1092.1725.1211.1290.2109.1577.1365.2253.495.326.574.272.1419.311.1570.1721.70.1127.2202.2177.2628.491.1929.1591.1415.3052.196&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_hm%3DSMART_USER_ID_B64 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_hm=Mjc2MTI0NzQ3MTQ0NDgxMTg1OQ==&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA HTTP 302
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGG4SWtgRFYGpNxnBkYVsho&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&google_cver=1

Request Chain 229

https://impes.tradedoubler.com/imp?type(img)g(25128934)a(2865028)912693930 HTTP 302
https://vht.tradedoubler.com/file/324110/kit3/728X90.jpg

Request Chain 405

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 459

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=mgid&endpoint=us-west HTTP 301
https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=us-west

Request Chain 461

https://x.bidswitch.net/sync?ssp=mgid HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=mgid HTTP 302
https://a.volvelle.tech/sync?ssp=bidswitch&bidswitch_ssp_id=mgid&bsw_uid=aed6b269-6563-498a-9e40-2c9b6d1c5ed9 HTTP 302
https://a.volvelle.tech/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=mgid&bsw_uid=aed6b269-6563-498a-9e40-2c9b6d1c5ed9 HTTP 302
https://x.bidswitch.net/sync?dsp_id=190&expires=14&user_group=1&user_id=d5f3cb78-cc93-4bec-b947-398c054f77b2&ssp=mgid HTTP 302
https://cm.mgid.com/m?cdsp=433145&c=aed6b269-6563-498a-9e40-2c9b6d1c5ed9&gdpr=&gdpr_consent=&us_privacy=

Request Chain 462

https://rtb-usw.mfadsrvr.com/sync?ssp=mgid HTTP 302
https://rtb-usw.mfadsrvr.com/ul_cb/sync?ssp=mgid HTTP 302
https://cm.mgid.com/m?cdsp=287839&c=af9ee8c1-6bcd-4a84-9731-21cf8717b181

Request Chain 463

https://ad.360yield.com/server_match?partner_id=1944&r=https%3A%2F%2Fcm.mgid.com%2Fm%3Fcdsp%3D665953%26c%3D%7BPUB_USER_ID%7D HTTP 302
https://ad.360yield.com/ul_cb/server_match?partner_id=1944&r=https%3A%2F%2Fcm.mgid.com%2Fm%3Fcdsp%3D665953%26c%3D%7BPUB_USER_ID%7D HTTP 302
https://cm.mgid.com/m?cdsp=665953&c=6d63c51f-f6cb-4c24-9ed2-0e73ac5bf0c6

Request Chain 464

https://match.adsrvr.org/track/cmf/generic?ttd_pid=omn67hl&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=omn67hl&ttd_tpi=1 HTTP 302
https://cm.mgid.com/m?cdsp=371158&c=539ec31f-aef6-4c67-b64a-cb8f0e96b7db&ttl=1644969633

Request Chain 465

https://x.bidswitch.net/sync?dsp_id=303&user_id=m0gxR0SLV10g HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=303&user_id=m0gxR0SLV10g HTTP 302
https://onetag-sys.com/match/?int_id=30&uid=aed6b269-6563-498a-9e40-2c9b6d1c5ed9&gdpr=&gdpr_consent=&us_privacy=

Request Chain 467

https://sync.e-volution.ai/34b9aae5baa016b251b9fc488f4a97cd.gif?puid=m0gxR0SLV10g HTTP 302
https://ssbsync.smartadserver.com/api/sync?callerId=24&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
https://sync.e-volution.ai/a02d62607dea0c97e41ff36ebd422945.gif?puid=2761247471444811859&gdpr=0&gdpr_consent= HTTP 302
https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-pashadv&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 468

https://cm.g.doubleclick.net/pixel?google_nid=marketgid&google_cm=&google_ula={guid}&google_hm=bTBneFIwU0xWMTBn&muidn=m0gxR0SLV10g HTTP 302
https://cm.mgid.com/google?muidn=m0gxR0SLV10g&google_ula={guid},5&google_gid=CAESEF5AB8bcU5b2UXvjJ3Hne-g&google_cver=1

Request Chain 469

https://creativecdn.com/cm-notify?pi=mgid HTTP 302
https://creativecdn.com/cm-notify?pi=mgid&tc=1 HTTP 302
https://cm.mgid.com/m?cdsp=501037&c=WumIru5KttjS00pFDF24&pi=mgid&tc=1

Request Chain 472

https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fcm.mgid.com%2Fm%3Fcdsp%3D617666%26c%3D%7Buid%7D HTTP 302
https://cm.mgid.com/m?cdsp=617666&c=bd5997dcc7895545

Request Chain 480

https://rtbbnr.com/get/?go=1&data=eyJpbXAiOlt7InNlY3VyZSI6MSwiZXh0Ijp7ImlkIjoxNjk1LCJzcGFjZWlkIjoxNjk1LCJpZHpvbmUiOm51bGwsImFkX3RhZ3MiOiIiLCJsYWJlbHMiOiI0LDUsNiw3LDgsOSwyNiw0Niw0Nyw1NCw1NSw2MSIsInRpdGxlIjoiIiwic3ViaWQiOiI5MTUxNjYxOTYiLCJ1dG0xIjoiIiwidXRtMiI6IiIsInV0bTQiOiIiLCJzcG90X2lkIjoxMDU5OX0sImJhbm5lciI6eyJ3IjoxLCJoIjoxfX1dLCJzaXRlIjp7ImlkIjoiMTA1OTkiLCJwYWdlIjoiaHR0cHM6Ly9zdWJ0ZXJmdWd1ZS5vcmcvIn0sImRldmljZSI6eyJ3IjoxNjAwLCJoIjoxMjAwfSwidXNlciI6eyJpZCI6Ijc1ZjY3ZDAyMGE2YzJjNDU2MWQxY2E0NjcwMzQ1YjBhIn0sImV4dCI6eyJkdCI6MTY0MjM3NzYzNTI0Nn19 HTTP 302
https://rtbbnr.com/banner/in/show/?mid=531202963&pid=0&site=10599&sc=FR&usage_type=DCH&subid=915166196&sid=0&cid=0&price=0&is_cpm=0&cpm=0&ecpm=0&crid=&crtid=&tcid=0&out_id=&ver=&ver_c=&refdom=subterfugue.org&hostname=auc-banner-hz-10&site_id=0&spot_id=10599&utm_source=&utm_medium=&utm_campaign=&utm_content=&expirationTimestamp=0&created_at=0000-00-00&is_native=0&auction_queue=0&burl=&pop_winurl=&ip=2001:41d0:8:d154::3&testab=&px_id=0&adblock=0&auction_host=&mm=&yc=&render_type=&campaign_type=&min_cpm=0&ttl=&space_id=1695&banner_width=1&banner_height=1&url=https%3A%2F%2Fbtds.zog.link%2Fin%2F912%2F%3Fsid%3D10599%26source%3D915166196%26idzone%3D0%26w%3D1%26h%3D1%26mo%3D%26ve%3D%26site_id%3D10599%26utm1%3D%26utm2%3D%26utm3%3D%26utm4%3D%26ad_tags%3D%26spot_id%3D10599%26p%3Dhttps%253A%252F%252Fsubterfugue.org%252F%26tds_labels%3D4%2C5%2C6%2C7%2C8%2C9%2C26%2C46%2C47%2C54%2C55%2C61 HTTP 302
https://btds.zog.link/in/912/?sid=10599&source=915166196&idzone=0&w=1&h=1&mo=&ve=&site_id=10599&utm1=&utm2=&utm3=&utm4=&ad_tags=&spot_id=10599&p=https%3A%2F%2Fsubterfugue.org%2F&tds_labels=4,5,6,7,8,9,26,46,47,54,55,61 HTTP 302
https://cdn.1vag.com/1x1.png

473 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 sexdating.php Show response
kartaplovdiv.com/ 1 KB
1 KB 937ms
882ms Document
text/html 2606:4700:3036::ac43:8f96
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kartaplovdiv.com/sexdating.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:8f96 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.5RC1
Resource Hash: 83b0697bfdd22e34bceaab565132404bdf52804164c4319c63d550696fccce20

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9

Response headers

date: Mon, 17 Jan 2022 00:00:28 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.4.5RC1
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RSdASuE6xRqYkDGyHSk%2BlCw2K8UDsmEa8MFaYHayqpEduF4x6PUPpmK1%2BHXdV%2Bghv5VgxJPcfoOyLXT%2Bjpm6oOWdaxG7nVQFGbyPgejFWdb99YcsPAMEggQKTKLnDvr9oxcIcsbAgL5ZpGCeQ8Uz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6ceb4daa8ca23ac8-CDG
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

POST
H2 200 Primary Request / Show response
subterfugue.org/ 108 KB
15 KB 295ms
156ms Document
text/html 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://subterfugue.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ba1d6d86d57086cd8f44e0fafc5e7b3aa5999ff09773e1c8e024267706f425a

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://kartaplovdiv.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://kartaplovdiv.com/

Response headers

date: Mon, 17 Jan 2022 00:00:28 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
access-control-allow-origin: *
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lUHqM4HB39zd4UsUpUCR9nmEz%2BPLLBv3fgoaL1CJ%2FEpUcgDJv%2BclX21ZmUS7R1fwvc2zFDCITUPGkwJSSqVDxx0IpaG81eMnkiPnwKHQ7dAwgjhABqDtekiswBQpmK2773iVpsXvlaHEtulNPbQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6ceb4db10968403d-CDG
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 core.css
subterfugue.org/template/11subterfugue15/css/ 2 KB
1003 B 423ms
421ms Stylesheet
text/css 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://subterfugue.org/template/11subterfugue15/css/core.css
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 605877ca3b26126b85ef03a88833e291b0ffcda21d0405bef47797585c561ad9

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:28 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Sun, 05 Jul 2020 17:25:09 GMT
server: cloudflare
etag: W/"89b-5a9b50a3f7969-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l2D9YBsPh1O%2BeoTetyzQ329w5snx9wPqzT2LITTbGo2VcIvPCZwn60yTPqRMjcnbEca%2F0W1OfKeKNeSHFU4b%2BIgjjeAYjdWOVIL8uTPZ%2Ba%2F5yK32E0P9CiD0I0jK61PYeYB%2FXFRfBrZntNHlaes%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6ceb4db22ae4403d-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 theme-external-style.css
subterfugue.org/template/11subterfugue15/css/ 78 KB
16 KB 552ms
550ms Stylesheet
text/css 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://subterfugue.org/template/11subterfugue15/css/theme-external-style.css
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1207631b5f539be3e5da265efeefd84366f57dfe8a49997ad0ea937fbce5bdb7

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Sun, 05 Jul 2020 17:25:11 GMT
server: cloudflare
etag: W/"138d6-5a9b50a618859-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UCK%2FHg0qOzfoFAJzhQohWqIHxjNlDaH2bcrHhCGBgYKhqxFj%2FI3%2B0GH90rZC3%2Bt%2B3KFVyKKdhkbcN9y5rvNTqAG%2FHYWIbNnaKhaZzmplBB1FP4fgXKTB5WiIFYQBPJP%2BiUDZvZVVRlmi2N%2BoUfQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6ceb4db22ae7403d-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 theme-style.css
subterfugue.org/template/11subterfugue15/css/ 141 KB
21 KB 549ms
548ms Stylesheet
text/css 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://subterfugue.org/template/11subterfugue15/css/theme-style.css
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 845c43373348d5a606b741dfaface41a9b16d2edfba7cc8523e23e6832a60f85

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Sun, 05 Jul 2020 17:25:16 GMT
server: cloudflare
etag: W/"23243-5a9b50aa61399-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4f1Zn3BKI%2BEkbOERUkWMuBOSu49qBK6T9abjlnYn7554o2nMcnsJ3EFF9c6Gm%2B3Eit04pPiN5KJ7yr55hRnKRH6LVCvL%2BUa8Ec4hjEydRBURMDfvJWg1ZlYulLOMxbodfuFICYdvXlGeHOS7fLU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6ceb4db22aeb403d-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 theme-responsive.css
subterfugue.org/template/11subterfugue15/css/ 17 KB
4 KB 59ms
58ms Stylesheet
text/css 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://subterfugue.org/template/11subterfugue15/css/theme-responsive.css
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 00ce4bc9ba9c11806156e7807aae588d2381653a2aedff75c6f731eddf222c57

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:28 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Sun, 05 Jul 2020 17:25:14 GMT
server: cloudflare
etag: W/"4558-5a9b50a8fcc5a-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RvAq1jfKehl0BEEsjmdFXL6jBFUM2mV8HOHGGVqszIh24As0QTYrVtcohwtxSniQXZTGDZQ%2Fu13auOgrkfQ5kbghWYWfTcEBEgtbj8knqiDSV6rvTJG6wu%2BQrBrdV%2BR%2BZ2xRCpp%2B8zALZ8Uicyg%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6ceb4db22aec403d-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 146 KB
51 KB 131ms
48ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: subterfugue.org
URL: https://subterfugue.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b9e47902eb881075fd12fb88ebdee21f2bc08bd20473c077962d8a5f7f06cd1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51976
x-xss-protection: 0
server: cafe
etag: 10257202394741136719
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 17 Jan 2022 00:00:29 GMT

GET
H2 200 jquery.js Show response
subterfugue.org/template/11subterfugue15/js/ 95 KB
34 KB 152ms
151ms Script
application/javascript 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://subterfugue.org/template/11subterfugue15/js/jquery.js
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:28 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Sun, 05 Jul 2020 17:25:32 GMT
server: cloudflare
etag: W/"17ba0-5a9b50b9d6575-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I4Ql1w65YuCZRRTb6WveNq3NQ8qILhVyUbhzuav0A4%2FdAOW374MbsdBnSlq6C2xTKx3cL99DlNVS3dLDF0bUYKMTu27ktbjWfy9S%2FydIQBC0TQAhYkYv0FwoDBJefhTZjOLnF4zPFHx9we3O85Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6ceb4db22aed403d-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 jquery-migrate.min.js Show response
subterfugue.org/template/11subterfugue15/js/ 10 KB
4 KB 344ms
343ms Script
application/javascript 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://subterfugue.org/template/11subterfugue15/js/jquery-migrate.min.js
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01ebeb3fcdc269ef402f29f9fba025d3266fcd5c54ae7bca44aaa7c2cf738d93

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:28 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Sun, 05 Jul 2020 17:25:32 GMT
server: cloudflare
etag: W/"26e7-5a9b50b94f929-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xiPXeuO0xgowUQJL3a98xK0Y0u0tiFU66xWtFBDH3uWgbS69qJYSdLoXpt3J6giZt9HkzNHIUs54VHhnXacqG38%2BTg0ij5zYE4SMCJ%2FHMH%2BCNpqiGePbRBUcoQ%2FZmCsQqBV8VmQEmW9ZyFpVfa8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6ceb4db22aee403d-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 353 KB
114 KB 140ms
28ms Script
application/javascript 104.75.88.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: subterfugue.org
URL: https://subterfugue.org/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-126.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: W/"5f971164-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
cache-control: public, max-age=600
date: Mon, 17 Jan 2022 00:00:28 GMT
x-host: s7.addthis.com
content-length: 116406

GET
H2 200 adManager.js Show response
js.wpadmngr.com/static/ 451 B
598 B 199ms
29ms Script
application/javascript 45.133.44.25
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js.wpadmngr.com/static/adManager.js
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.25 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 2f499c632d806f66b96dda6cbd4cac0363d331885476a8ac1d9e8ac60954d720

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: gzip
last-modified: Wed, 13 Oct 2021 09:03:43 GMT
server: nginx/1.18.0
etag: W/"6166a0ef-1c3"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Mon, 17 Jan 2022 01:00:29 GMT
cache-control: max-age=3600
x-proxy-cache: HIT

GET
H2 200 plugin.min.js Show response
get.optad360.io/sf/c5949347-9c95-4ee4-808c-0a7bb94aff6c/ 370 KB
88 KB 143ms
36ms Script
application/javascript 2600:9000:206f:8e00:11:a4de:2580:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://get.optad360.io/sf/c5949347-9c95-4ee4-808c-0a7bb94aff6c/plugin.min.js
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:8e00:11:a4de:2580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 10b362945d3b5db70b6bd7f958cc91b4f01eec543decb1b60a06a808fcf93057

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:37:08 GMT
content-encoding: gzip
last-modified: Mon, 03 Jan 2022 04:04:16 GMT
server: AmazonS3
age: 1402
etag: W/"e223387d1bf6cbd82efe5d2a5d25373b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 cf2939e85531f45f3306f792ea104eaa.cloudfront.net (CloudFront)
cache-control: public, max-age=3600
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: MDapDMCkyYcPwOQlWir2SCwKVM4XD81FS2WYXUriBfvL0OhjRwj3XQ==

GET
H2 200 / Show response
go9s.biz/ 14 KB
15 KB 103ms
40ms Script
application/javascript 188.166.135.13
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://go9s.biz/?te=mq4tgobumu5ha3ddf4zteobt

Requested by

Host: subterfugue.org
URL: https://subterfugue.org/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

188.166.135.13 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

bc17aea396be654f0f3aba069b42be33778af34f6f3ceb88b8de800b89dae15c

Security Headers

Name	Value
Content-Security-Policy	img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 17 Jan 2022 00:00:29 GMT
server: nginx
content-security-policy: img-src https: data:; upgrade-insecure-requests
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8

GET
H3 200 invisible.js Show response
subterfugue.org/cdn-cgi/challenge-platform/h/b/scripts/ 35 KB
13 KB 104ms
98ms Script
text/javascript 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://subterfugue.org/cdn-cgi/challenge-platform/h/b/scripts/invisible.js
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d715a30a66e548ffb68a8eddc5ca4c320d13effba6fc5500423275c11d72ce2e

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LZ1z2GDl3Gnf3m26Ld4qEafBNX1oxIjJC25uk5TLQDCKLdV2GZf7V36C1hbePicvHMd%2BCF24pr4%2FXoMGunnXR1ooQvsleUoD9uI53OoknR4U%2Bsk0D29lvDDbGZ6LGaP8HAm5gr6DVFuXbz%2FgNPQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=604800, public
x-control-type-options: nosniff
cf-ray: 6ceb4db60be7ee64-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 logo.png
subterfugue.org/template/11subterfugue15/img/ 6 KB
7 KB 232ms
225ms Image
image/png 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/template/11subterfugue15/img/logo.png
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2756cd8e40d9a4f9bfc7cc8cf917f4ae1edbc3612d5f88167587cf6e2332101b

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 6312
last-modified: Sun, 05 Jul 2020 21:14:49 GMT
server: cloudflare
etag: "18a8-5a9b83f937660"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UFzcUnHYg3U%2BmmRp%2BcOudScsJmaT8OSymhDmATZt2urJILHsAmCfmbbxmiTeM1JhQt3ahouVNZMYlPP4F6l8exWOnxnlHiqUMHXCASNcGMC2gawqi8G64BD8zTFsaATD4hqCbJ7wkxlZIxwY4G0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60be8ee64-CDG

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.9.0/ 91 KB
33 KB 99ms
26ms Script
text/javascript 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.9.0/jquery.min.js

Requested by

Host: subterfugue.org
URL: https://subterfugue.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7fa0d5c3f538c76f878e012ac390597faecaabfe6fb9d459b919258e76c5df8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 01:20:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 254396
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33140
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Jan 2023 01:20:33 GMT

GET
H2 200 leskanaris.com.1110058.js Show response
jsc.mgid.com/l/e/ 2 KB
1 KB 86ms
29ms Script
text/javascript 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jsc.mgid.com/l/e/leskanaris.com.1110058.js
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2a448d3034187b2f6296329966fb62876b351dc9859db127a8cc3968c9d81f3a

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: br
cf-cache-status: HIT
age: 5993
last-modified: Thu, 25 Nov 2021 11:34:13 GMT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: 2ZSH6T6E17WRZQ59
x-amz-id-2: l+HqYclHVrLfeU4AmHvSNfIJEj7XvDC9rkEJo+uLSIcOSqbvxhnAgXnbm2aQgcPWNSm7C6ARovM=
cf-bgj: minify
server: cloudflare
etag: W/"3c46e295df3eacd17a98840b04ef8bf5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=10800
cf-ray: 6ceb4db65ec2048b-CDG
expires: Mon, 17 Jan 2022 03:00:29 GMT

GET
H3 200 image_hhYhh2hk4Sl15tXyE0BtlSX.jpg
subterfugue.org/img/muze-2020/3474/ 51 KB
52 KB 43ms
36ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3474/image_hhYhh2hk4Sl15tXyE0BtlSX.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2474ee60c4d7f1184b36ba843b776d3093bb97f48c159ba4642e9d1815104d8

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6555
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 52577
last-modified: Thu, 05 Aug 2021 17:47:49 GMT
server: cloudflare
etag: "cd61-5c8d3847c6c9b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oeOObNI4%2BP659lIDBcK8x4BteqL0%2FNb8JWnLtQpcwXJN8neLD%2FwWyUQUlRaZ%2BDY0un%2BewU%2B32iIvQPYMc2S82Q7IdgKdrglmfYgk5WJqqioRnwoYw%2Brr7iNUUT%2BeyBSeR7SFLWSmGzgxaJ9%2FHNo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60beaee64-CDG

GET
H3 200 image_1dhNZzRRg9lQ8cKtonmH.jpg
subterfugue.org/img/muze-2020/3839/ 25 KB
26 KB 390ms
383ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3839/image_1dhNZzRRg9lQ8cKtonmH.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17d23f4a23d308c999d1f507b638383779066009cf052949690fe7a52a88bf7c

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 25663
last-modified: Thu, 05 Aug 2021 17:47:35 GMT
server: cloudflare
etag: "643f-5c8d3839f882f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WqXefHRgOXVDYUnL8sN6dJBRoLF7owuz5mrjjy0C0qTiqwm1HX8ZX8rkk2lnAbk5fMehry4H3ZFF5dPLWTvpu6gV6c3JChOWkCTD%2BbC6Ek2FnFWv%2FJzxd7EdBjabGDhf7eDQi1gIFif6sByw6Wc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60becee64-CDG

GET
H3 200 image_IqfUYvCosRUwbX45.jpg
subterfugue.org/img/muze-2020/2627/ 57 KB
58 KB 575ms
569ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/2627/image_IqfUYvCosRUwbX45.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ac690961a43f46b8d59277c1f6e182c8ca1e4dfe9c20122b3e4c11e4d9d64a9

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 58720
last-modified: Thu, 05 Aug 2021 17:47:37 GMT
server: cloudflare
etag: "e560-5c8d383bf4568"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UzhLLAZk7rxZPYAsF1oXy8wuz8WsE6fs%2BCj6dv2DLIo39clLTHQNkLLztW0fT1unSjIiKsqTmNjcP1htN9TsowX4boWPV6Ec91Xiss8GjnGZnAuWtFMT2qvbjSpUDn%2Ba1y39Fam6Bpkd01xHMKQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60bf2ee64-CDG

GET
H3 200 image_E21RrvgW22Fdlpkcd3lIK86o.jpg
subterfugue.org/img/muze-2020/3113/ 108 KB
109 KB 200ms
193ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3113/image_E21RrvgW22Fdlpkcd3lIK86o.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c47f2a8f938666ae3105c52ff904c711f261db3845d46f41bc0e6d6cfd388528

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 110639
last-modified: Thu, 05 Aug 2021 17:46:25 GMT
server: cloudflare
etag: "1b02f-5c8d37f77f719"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1c29V3glnExptcM%2BmFj%2BJ4eD9MkZgsTN2Gzscaty8E0DObI%2BUcVbuiVCgTdTBUtPgfq0O%2BdT9FbrUfpB57JitfwkEFfBweuZgl9XkHShgEMX3gw1mYMm4je8tMdS6Z9amOdpdqO%2BpzBbFIxHl9E%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60bf3ee64-CDG

GET
H3 200 image_X4irvmrrU32lZek2J0m.jpg
subterfugue.org/img/muze-2020/3551/ 19 KB
20 KB 355ms
349ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3551/image_X4irvmrrU32lZek2J0m.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a46ad61348a625a356a7a336415313b2887644f5ea3f5f0d41ea4fffd15cb86d

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 19562
last-modified: Thu, 05 Aug 2021 17:47:27 GMT
server: cloudflare
etag: "4c6a-5c8d3832a381c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xJjGCgTnxE11n2pJvyJRlPPO3hVK6P1TBl31XbkKIZYQfF38uK1yBIzK7YEoZthuo4RvKF6zK%2FI9RED4vbObD0tYGDSXIVtZh8%2FRFmHz%2FsswXTYGnKj%2FYusstEDD3%2FJafn4ai%2F3%2BUHXxavAK52Y%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60bf4ee64-CDG

GET
H3 200 image_kiat7eXH0vpnkk3V.jpg
subterfugue.org/img/muze-2020/3768/ 46 KB
46 KB 240ms
234ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3768/image_kiat7eXH0vpnkk3V.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b369487053a4e2536ca674aa24991d9a9cffeffbd4171a4d9f7d4bca8e01aa7

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 46918
last-modified: Thu, 05 Aug 2021 17:46:47 GMT
server: cloudflare
etag: "b746-5c8d380c76c73"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FrCCdkOGvDCHrL5cW10apxFJbEbb8e3xcvz47ZFNd2xhyCmiI4Ok5CFEL%2BOhWZ1P4V3IdrVcAGKWV661e%2BWatydaM8t9B%2BaVyuYsz6I4Mco%2FxVfQfXPIJYh9FyaKXrqw6TGuH08JU2hK2LWiCeU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60bf8ee64-CDG

GET
H3 200 image_9ckCQ1Kq161Z4anawuNE1uI.jpg
subterfugue.org/img/muze-2020/3183/ 88 KB
89 KB 527ms
521ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3183/image_9ckCQ1Kq161Z4anawuNE1uI.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e106b971637d55f5cc298e92213ccd6241bd273cb95626a7265e6396e487614e

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 90606
last-modified: Thu, 05 Aug 2021 17:47:02 GMT
server: cloudflare
etag: "161ee-5c8d381ac7eae"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zsXXcXIq9Exg8eC97v%2FeXo%2FXmqgdObSmvGQsE9cgjAgLFZU5wBHN1V0zDKCPzstPq52J9uDZWQ8P10TYSMUMBkycXbXZHWAyhXKP4Q%2BFbDqvmo7k4pxNfrzOswfZQKa7wWVm8QjwGb7Q81N2XL4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60bf9ee64-CDG

GET
H3 200 image_qH94YmZZq8fx4lxmpmduul.jpg
subterfugue.org/img/muze-2020/2840/ 32 KB
32 KB 380ms
374ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/2840/image_qH94YmZZq8fx4lxmpmduul.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 96b4e47816e94ae89a84538106ce3aada5858ba9660e3aa04384724f9f7624d4

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 32395
last-modified: Thu, 05 Aug 2021 17:46:32 GMT
server: cloudflare
etag: "7e8b-5c8d37fe19eb6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eSdeucZpifoW1IsA6xN8oUcKkBvJcnlrUCphiVHBX%2BiuIcWVqxb0kXuDScvmh4OWlsI1%2FCgyladcdw7k1lSuwBDMLgIDmvpovspfyTZlY8%2BDSm2UH8%2F4%2BeyGgDCCV1zJW%2B%2BZLRdDbUCf03U53j4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60bfaee64-CDG

GET
H3 200 image_ixuRcm0dE7SNDx0r4X9.jpg
subterfugue.org/img/muze-2020/2558/ 72 KB
72 KB 128ms
122ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/2558/image_ixuRcm0dE7SNDx0r4X9.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e608e935f2a110d32f390f88ffe17e2a40bb0dc6b8509b9a0bade5bb0117697c

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 73409
last-modified: Thu, 05 Aug 2021 17:46:30 GMT
server: cloudflare
etag: "11ec1-5c8d37fc4cf83"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5QqMqemor2j3OXci94I4ZCz43Jivh1AD8qBIWJZlejWWN3DYLFXSodK36%2FNyhSQqfpxU40vv%2Bulp5XBKi4MuGApinpY1LLaQmwBNj4bpYGa9jWaiDi1KjCsWMUKGCNHG6p7TZJ2rmhf4VjalnbU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60bfcee64-CDG

GET
H3 200 image_71ihzc4RLd77b3A.jpg
subterfugue.org/img/muze-2020/3395/ 16 KB
17 KB 167ms
161ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3395/image_71ihzc4RLd77b3A.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19314521548989105e51494ca91d24d19804a40695334246ad3b73f241abc965

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 16818
last-modified: Thu, 05 Aug 2021 17:47:54 GMT
server: cloudflare
etag: "41b2-5c8d384c2ebfa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2jPknvsNV%2BbvSFIGMUsN2wQ06HsiRVl%2BHbpeI1b4kEbJHfd9RN6PJGLZxZQSQUWyCBhcOS1EdCv3M3jGO7nmLIkHLqUxcBcig6FqefBQHyKa5%2BoFIIq9MTsWw9zzNayIhT77XnvbCZiWBlIV8N4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60bfdee64-CDG

GET
H3 200 image_bHBxb4sNmmyihulsla.jpg
subterfugue.org/img/muze-2020/3050/ 107 KB
107 KB 175ms
169ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3050/image_bHBxb4sNmmyihulsla.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f9353a29d11cd20f5209ac71733aea6bf320c2402975770ab6a2142460d7ff0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 109418
last-modified: Thu, 05 Aug 2021 17:46:42 GMT
server: cloudflare
etag: "1ab6a-5c8d380736fdc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VyX4nAUO%2BhYQtiUSxVRglmjhaofVHU76SLxWfP08niV77LEXv9v7OeDBik%2BRm%2FDMfW34Si8IFKWTcXA9DOK34z5b%2F%2BvRz2ILAgcM4kygfLDzKwyhv3vCCQ4rjp1In5z11jqR%2FGn82M61LCDzoVg%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60bfeee64-CDG

GET
H3 200 image_9ic0pdqnVrZtynj.jpg
subterfugue.org/img/muze-2020/3040/ 25 KB
26 KB 322ms
317ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3040/image_9ic0pdqnVrZtynj.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 169debe2e8bfd45adfcf9f86f40fde1f663151ecfb3ef642635514b9bc4ee339

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 26106
last-modified: Thu, 05 Aug 2021 17:46:40 GMT
server: cloudflare
etag: "65fa-5c8d3805fe7b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R9IzK9sgosFhGSarj1l3nT2MJlgPNSA58REHYJ09A8mzErfYvbFnlzKC0y5XSwJdsjxJv5kKM5UIBr9PuLRRjNqvQUluu6ukZQsvYPsE%2FAZc7s7QBPIzlVNDmJncILSzbKJ8xvpt0WtPNJxU5Kc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c01ee64-CDG

GET
H3 200 image_71NC1H7h1EzhZzz4i.jpg
subterfugue.org/img/muze-2020/2615/ 50 KB
50 KB 274ms
269ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/2615/image_71NC1H7h1EzhZzz4i.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c68b5d235bcb13e7170f861c133612c882e34d9e9d5255991cc6829a40a92c62

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 50966
last-modified: Thu, 05 Aug 2021 17:47:43 GMT
server: cloudflare
etag: "c716-5c8d3841fa5f5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZZuXWi440F%2BnBuIOdq0xLe28sAnL%2FgTwNhdJGu4O5FsDPrGy4yCbMG9P9sUqKbh4r2McUt8qcnucYvBkzzIBpfVVyTAd9WnLEA16wJUBCWFfQKHrIR4rGagqRjyVnHFSZNzmZHVO37QbkLmDc5g%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c02ee64-CDG

GET
H3 200 image_yjS0vX77Ao.jpg
subterfugue.org/img/muze-2020/2786/ 77 KB
77 KB 75ms
70ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/2786/image_yjS0vX77Ao.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 388b3987d0561195b56b5f7dad2a7e8c97e618e5d6a9aec4444dbd0c9edbb108

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 78670
last-modified: Thu, 05 Aug 2021 17:47:59 GMT
server: cloudflare
etag: "1334e-5c8d3850a367a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lGZuG9u%2BUbMdq1jclc86leDjZtiOdQ4QQOKvV1tS%2Bcm5B53MPqyqblFXI6KT%2F7P9RitnnRwMttwC1fupF6vib5kxjw81jDUUgmEp7UcTV1YrmP43fwbnviNX0%2BhEgWnmIypcLRieACk8p9Yt%2BFg%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c03ee64-CDG

GET
H3 200 image_etdi44MP9Yw99AqRozb.jpg
subterfugue.org/img/muze-2020/3217/ 81 KB
82 KB 306ms
301ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3217/image_etdi44MP9Yw99AqRozb.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ac5cf388ff063a63147988b5556cc65c0d76bd07b3d93ed887e80a859a12f98b

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 83210
last-modified: Thu, 05 Aug 2021 17:46:42 GMT
server: cloudflare
etag: "1450a-5c8d3807a74c9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JRLOGWoHZZwnb2i1f8%2F4S%2BBUYrGx54YpZC4suZxs101GGxj2SBAkB3QGszGfVNXxDMj%2B3GpNAdditmxPAxD8l50VYqcLpSywzbT0yoYxRnrovAL2hRQesMA7KZsTnfSAUqOymkNNktV3d2FhsQU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c05ee64-CDG

GET
H3 200 en-video-tour-of-the-uffizi-gallery.jpg
subterfugue.org/img/big/3267/ 18 KB
19 KB 346ms
341ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/big/3267/en-video-tour-of-the-uffizi-gallery.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d969417ae1567efbf2991eea9343d4f81b7eafa8e4e77cf1b1f32bee17f0fa10

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 18546
last-modified: Thu, 05 Aug 2021 17:46:17 GMT
server: cloudflare
etag: "4872-5c8d37ef4dbad"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ThCjjIrHc%2Ff1SZx1dUKcnorK0dJQvhEDNlSur5XtwmqvWxMTD9ov41HcuqDrZ%2Ba8OJN1MBZep3C6XqEMt%2BAy7m3rMhFvpPTlz9LsxUAVEdmIrdwoqYwAMLh95rQGNuBXJXNtv%2Bis%2F1sSNrmMIYs%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c07ee64-CDG

GET
H2 200 leskanaris.com.1038348.js Show response
jsc.mgid.com/l/e/ 2 KB
1 KB 82ms
28ms Script
text/javascript 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jsc.mgid.com/l/e/leskanaris.com.1038348.js
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 238cfc53a4a082194de298645f76342d3d7450a3675e8962aab983d6a1c1073c

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: br
cf-cache-status: HIT
age: 4431
last-modified: Tue, 30 Nov 2021 07:41:19 GMT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: 2ZSMWQ66BSDS17KZ
x-amz-id-2: WNl1tMeO9mo3BTkJm+/Wu3X6QLhOS8z+RjX7fA29TV88a69wGhpvE7Sc8vg67B3Zj/khgHY9utg=
cf-bgj: minify
server: cloudflare
etag: W/"1da58672064d809c636e300c02524163"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=10800
cf-ray: 6ceb4db65ec3048b-CDG
expires: Mon, 17 Jan 2022 03:00:29 GMT

GET
H3 200 image_UXnnJUa7sAXfzf75zxb0o.jpg
subterfugue.org/img/muze-2020/2954/ 95 KB
96 KB 366ms
362ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/2954/image_UXnnJUa7sAXfzf75zxb0o.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 053e6fc6fdaefafe22674e38fdfbab47c68816d36d22f108ebcf398d85f4b80f

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 97383
last-modified: Thu, 05 Aug 2021 17:46:45 GMT
server: cloudflare
etag: "17c67-5c8d3809fdf2c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PjNdsM5VZhC5boDtE3%2B2siSH%2FeuPKsZzSF57borPhn7xOurutTKlzJQWaDN0J2S3Of%2F0H6uw6F8ItZCrHx2b79lxlpma72I7XDXpfAR5ozsuVz46fD%2BgLGjcUUb8gOK%2FS12iPMabG0WR%2FLXazHI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c08ee64-CDG

GET
H3 200 image_glLs6Z1oKJ.jpg
subterfugue.org/img/muze-2020/3757/ 32 KB
33 KB 441ms
437ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3757/image_glLs6Z1oKJ.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e263183c6224121c90f2227f04d28e162c811aa9ddba70db42776c5d50244cad

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 33276
last-modified: Thu, 05 Aug 2021 17:47:27 GMT
server: cloudflare
etag: "81fc-5c8d3832296ee"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dq9nPpAQ84VuCskLuM0yNJLOXKq7sPhmHSGmeaW0LG%2FeO27xCzSXD0S0XXN4Cc7BwKgr6nw38TROvGk3d5%2FIllALU1WWBYL4RfkKQBybxqx2snFU855SzmyRkC7eEREEtYYZoBF6a6AKl7y7S1s%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c09ee64-CDG

GET
H3 200 image_0tw8WqDsBqLPhI7f0.jpg
subterfugue.org/img/muze-2020/3772/ 38 KB
39 KB 456ms
451ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3772/image_0tw8WqDsBqLPhI7f0.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 53b4896c94b0a893242ec78d96a48884e343e5a1feaf547af28c3691326bbe67

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 39106
last-modified: Thu, 05 Aug 2021 17:46:58 GMT
server: cloudflare
etag: "98c2-5c8d3816c873c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IjCyHaVxLfVC2paI9zymQ9j6FvxqcCrJHZt3gCmUZA23dJACpD2OIkvUSke0PisAOT%2BIP0471nh%2BLwSzXJV0EE0jzom9q2ij%2Fj89oL3j5JwGAJsRPSGDlgpngnt2va9o5UE%2Fa1AtfYHu34o4GnY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c0aee64-CDG

GET
H3 200 image_FxvwC2snmJn6s6NV1c07b.jpg
subterfugue.org/img/muze-2020/2498/ 53 KB
54 KB 470ms
465ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/2498/image_FxvwC2snmJn6s6NV1c07b.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6903f47ca7d4c007a6e3d63831958fd8eed2fd7104da065023a3949a0df31fd5

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 54449
last-modified: Thu, 05 Aug 2021 17:47:53 GMT
server: cloudflare
etag: "d4b1-5c8d384b65923"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xzCEfZa2eGhK9A2ngd9okXJIS4Yki7aBLRURSlFlDi9UY0mkByOpG8RvFp697XTRVI8hXARzjk0TqL61FGiphYEOW8Y4wGJql8EaxOFMmdJB8ANRgyIjftd24AG11MkvFDC3jP5DhdqDoHvaqUI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c0bee64-CDG

GET
H3 200 image_tHki3jGu2d.jpg
subterfugue.org/img/muze-2020/3117/ 96 KB
96 KB 584ms
580ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3117/image_tHki3jGu2d.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7769b5aa853474681fcbdae789a9f87890d2a7b890a607a04a52af3e2e1f8f90

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 97908
last-modified: Thu, 05 Aug 2021 17:46:52 GMT
server: cloudflare
etag: "17e74-5c8d381155e1f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XPaxXunqkZatOulg1L5gATKxCVGg25uCea0%2F5Y5LGBDCsw4Y9460bJ9e2Ncxhk8Vp7eEcwN25Wwklvrk1lxDKrkduLekC%2F8DtB8wcEtKF5ToFgDJi%2BBFXpx6JiM6e4bHZABBvKnKcacqo1PLGM0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c0cee64-CDG

GET
H3 200 image_0ga9ig5e3aDAv3DD.jpg
subterfugue.org/img/muze-2020/3993/ 75 KB
76 KB 504ms
500ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3993/image_0ga9ig5e3aDAv3DD.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 999b09170824782ecd49f750470e7966f9cf6c5802178f308bf5f73435b5f079

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 76744
last-modified: Thu, 05 Aug 2021 17:47:29 GMT
server: cloudflare
etag: "12bc8-5c8d3834a9196"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h13JZdzwGnzy712zSdUyxkAh0QMDHrxLPa2li3bQTJjTmHSr19CFDDkpR8%2BPEDXc6cLHrgOCdMJyiCrzUqZT3gk4avj4C49ByN0OvEfD5MdyHghkHkiEAeaWoqoW8%2BBgDPi1kVDSHL2zTbfxe4E%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c0dee64-CDG

GET
H3 200 image_cEXlqm7Uib20plr0l.jpg
subterfugue.org/img/muze-2020/3880/ 13 KB
13 KB 489ms
485ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3880/image_cEXlqm7Uib20plr0l.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59224296096d4e4ed92815a296ddbbacb1f48a709693c52aa7f10f6ccbc1a746

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 13029
last-modified: Thu, 05 Aug 2021 17:47:39 GMT
server: cloudflare
etag: "32e5-5c8d383de7600"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e52uCAS5d%2BGGgpTTbQWD4v8s6gP%2ByUUyp9RYH5yZkr3UCi8c%2Byp7vFZ50L8ZNiCMUc3dHk6WcAvijwjjna94f7Erv3GJ%2BcUBjPQADzjSxjovURt3MXY87GLSv899q%2B3BMz8l292BFDdi2PEqVt4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c0eee64-CDG

GET
H3 200 image_epX9yOmngr5Tltitu.jpg
subterfugue.org/img/muze-2020/2537/ 78 KB
78 KB 598ms
594ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/2537/image_epX9yOmngr5Tltitu.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 805b47504861e3c404cabf1cb8f084a497595842cf27262911d4be25777c5324

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 79496
last-modified: Thu, 05 Aug 2021 17:47:36 GMT
server: cloudflare
etag: "13688-5c8d383ad72c8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ybb%2FhXKwoCDSKqPLLVSgrtfV1f0glDDDkpaisZEukk1xbxx6XCHfbso2IbduD56fNMMUFYh%2FkWvnQFng70d0QJMWjfC%2FobgxhMijz6vgKVlOqM%2BE5tKiBzuYO8shUCQ0%2FD5fG4roGqdd5aok6SM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c10ee64-CDG

GET
H3 200 image_9tkkhpT2tiu0g6outvg88.jpg
subterfugue.org/img/muze-2020/3334/ 21 KB
22 KB 492ms
488ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3334/image_9tkkhpT2tiu0g6outvg88.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d320756a48563cd43fab9001351f72d3edd7241e9a61135acd6806eb24a63f3a

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 21619
last-modified: Thu, 05 Aug 2021 17:47:26 GMT
server: cloudflare
etag: "5473-5c8d38316ee79"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ezdCg2woE0RP7Q%2BPxAYU%2BmXYRz%2FHh79zr72Y7EWE%2FtnISKnb1LI8kHNHNFTqHKaAvWN8BHKhtS2vSG855MyHnmgb14edWU5f%2BxBTscuIfb674MXHwuR%2Fpe3S06vpoy5w3PZuA0Ex5XuSZU%2FxTSE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c11ee64-CDG

GET
H3 200 image_m7il6Ww5u9NUXTl20gmHfg.jpg
subterfugue.org/img/muze-2020/3552/ 27 KB
28 KB 494ms
491ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3552/image_m7il6Ww5u9NUXTl20gmHfg.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 677e4f1a1159d87ad5704ac1521a0500c32e5af3c5750a5e2f24a5a7ff584271

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 27839
last-modified: Thu, 05 Aug 2021 17:47:32 GMT
server: cloudflare
etag: "6cbf-5c8d3836b48d1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TL76%2BQIOOTlwVXv0QgKJ%2BlFWuH6H8YRM775%2Fv9Abi5hqNb6aja%2FsSXtYpZry898tmJEaWxeSlrxRd8SDt0NBapEsem2volSJcQRd%2B4vNnV1QpCQBBWjGA1bEzPF6C8MYHjGaC4Jj%2BcoCNf0are8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c12ee64-CDG

GET
H3 200 image_LububJepC12pBxVPy.jpg
subterfugue.org/img/muze-2020/3387/ 41 KB
42 KB 500ms
497ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3387/image_LububJepC12pBxVPy.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f813c405f7ba4f60e0af2d6265bcf5fcb6b3c29789d4673afe8ae1483e913272

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 41948
last-modified: Thu, 05 Aug 2021 17:47:23 GMT
server: cloudflare
etag: "a3dc-5c8d382ea8eca"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YmRMd4XosAslEvCvRepaoCt1SyJ3prKWm7knLgoS4YCnYM85SgZrnSSQTz8b2TGXFe3iFNW4Zk5XBeXYFDKnbjuN2Z7gz6TYH%2BM1uoctcNyI02174CLGdmkeBvtRbkrmRyK4ikk4lspzzc2BBcU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c13ee64-CDG

GET
H3 200 image_WT1fXh3c2V8LC.jpg
subterfugue.org/img/muze-2020/3938/ 30 KB
31 KB 563ms
560ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3938/image_WT1fXh3c2V8LC.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 26db92df9c260b7429e23c55870bfb165bb3c710587cfeb2e30c426d47c03e0e

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 30791
last-modified: Thu, 05 Aug 2021 17:46:39 GMT
server: cloudflare
etag: "7847-5c8d3804b6594"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hc4hhj7HB3pOXnoZbaMMzGSrHfQPRUNWZw8KfqxFPSDYBLGBT9NEbPFrfZdWbAWhH5qRJpW5Xj9Uzsk%2Fpo6BxJ8Wxlwz7e0mapyi24%2B6aPKT7RUx16Z5aTmb1iuEYQoxN1TOesuIkmpMkgFfa4g%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c14ee64-CDG

GET
H3 200 image_9hLzw772m32.jpg
subterfugue.org/img/muze-2020/3691/ 135 KB
136 KB 568ms
565ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3691/image_9hLzw772m32.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 365c29cf3c1d163c2ab9d7538cb20595022865e1fbcbbf483aec60100cd58f48

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 138182
last-modified: Thu, 05 Aug 2021 17:46:35 GMT
server: cloudflare
etag: "21bc6-5c8d38011696c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nZ%2FvyexjXJ7%2Bzw%2FzUrW03lnh3S08qpdnWbWjElTqXHQPfaIQ0sa1naUdpYmgcunyMv6hD9Q7Dh28w5vlw%2F8SltkcNQU8U6JbcGiTJpSGiEVdhEtlLW1qaTmkY5bVPyctrMx1FST4pvBuIJazh9Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c15ee64-CDG

GET
H3 200 image_9WMrzfr3gq0zVb07hGd.jpg
subterfugue.org/img/muze-2020/3659/ 34 KB
34 KB 643ms
640ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3659/image_9WMrzfr3gq0zVb07hGd.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25409163c38f98e2f0e6fb77d54ed55cf85d063a57adc62f69d84e1d60fab757

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 34649
last-modified: Thu, 05 Aug 2021 17:47:14 GMT
server: cloudflare
etag: "8759-5c8d38261f514"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DEFNUqDv8mBeCfXdSZtRl8ZcLJFtQMuYPGnXxS3dGKCpW%2BuqT8HEBTWOFaxMMq5vccZP7cYAwFBI0tcJ848WSoLB2zznBvteUadsrP%2BOA%2Bgfb1ANmBrMlbrx1t8GdmTQzI51HZ8RSEgfeK1UKws%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c18ee64-CDG

GET
H3 200 image_kIwD7Cqnu9Z5egH.jpg
subterfugue.org/img/muze-2020/2923/ 36 KB
36 KB 648ms
645ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/2923/image_kIwD7Cqnu9Z5egH.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bc3b8e3e076ed12d7d62e1b9e226d323ee196918f7051a89d80f81a3cf241498

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 36538
last-modified: Thu, 05 Aug 2021 17:47:07 GMT
server: cloudflare
etag: "8eba-5c8d381f6a794"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PC3tXVjMdyxfxFOFns2ulwgwkDlG50QKAWPpllDPBxLvczl%2Bq2wR9tev2DJ5gQ4KY3Zc2hf9XEiQfCxHW5ccdzI2HbhFIT5Z0ZrHr0485ebJRCSUGj2YuablA%2BgJE%2Ft4VLJlkJIX7jhlW5EuNAM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c1aee64-CDG

GET
H3 200 image_8I6DKJLrPobEfbwXw2sb.jpg
subterfugue.org/img/muze-2020/2522/ 67 KB
68 KB 658ms
654ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/2522/image_8I6DKJLrPobEfbwXw2sb.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04d5b64074508ee4686eb133c1383ddf34ad0e881ea724c752a1403bd94aa36b

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 68625
last-modified: Thu, 05 Aug 2021 17:47:56 GMT
server: cloudflare
etag: "10c11-5c8d384e21c92"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=99JDSGI66CP2jOxHRNjJA0%2BzFJLwtmm4jEvjqXhX9MX5FVAMH3K0wef3YiRLosVLQYr7749gswYRk%2FwgmX%2FDa5OQTODvDIhw6MdBnVh07oHWNrnH4JXMrRgHOaKEexn2ZdlNmTXwdmfYVyPW6HI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c1bee64-CDG

GET
H3 200 image_Na9ZkfLk8T15TNd9Y8yqgu.jpg
subterfugue.org/img/muze-2020/4049/ 8 KB
9 KB 672ms
669ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/4049/image_Na9ZkfLk8T15TNd9Y8yqgu.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c54ada4c1fe76299eab98a7317e0fce4db13eef0964e6df4b56c505c6b894e7

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 8203
last-modified: Thu, 05 Aug 2021 17:47:57 GMT
server: cloudflare
etag: "200b-5c8d384f0554b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ePcok%2F8FGrb4E9FaiQhICshPO6g%2BBBXwCGLc8vq4m%2BXxKi05mqfIcWokP2L%2F0yU1zol3zB%2FyBPAnjVdVCkpatnEQbGPQXNEkSrcjiEvERvKQmYYIAlex%2FKib9yET3xCE1pFuquBKthJjWILLnt0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db60c1cee64-CDG

GET
H3 200 theme-external-script.js Show response
subterfugue.org/template/11subterfugue15/js/ 251 KB
70 KB 345ms
345ms Script
application/javascript 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://subterfugue.org/template/11subterfugue15/js/theme-external-script.js
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b8a14b3c987a84d8a50e27a96a8d6df8d38280f156aef61b8c9c3dcdb08a1f59

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Sun, 05 Jul 2020 17:25:33 GMT
server: cloudflare
etag: W/"3ed9e-5a9b50ba75863-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HWCMdFcoGMggYEft8vMfttkKkBj6bcQhADEux7gO2Kut7KKk00WnhYYFAKtspxZJylxRTigdaxVr2fhnZGy%2F96tPtp8X%2FalZssSKXVDVNBuX40gl7V19wRGisJNjX8mfTKVIbcjxtil0R3Bu5Qw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6ceb4db5ab95ee64-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 ajax-script.js Show response
subterfugue.org/template/11subterfugue15/js/ 7 KB
2 KB 152ms
151ms Script
application/javascript 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://subterfugue.org/template/11subterfugue15/js/ajax-script.js
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab31dfc1634780370354066975de975ead374c78282d629cce708da49610348f

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Sun, 05 Jul 2020 17:25:31 GMT
server: cloudflare
etag: W/"1b50-5a9b50b8de49f-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eQAyvet2MAxdN7toqvifuWVHf3WMos9XOoXdWlEP51vm5vsbQaE4bmJWqiCKvZpGEHqUGATAXe%2B4Z6gGT8uwg%2BRTrIwpyPjUp%2BHUUlmIEOHsYWTOjchr9KnObvmEE8xrnKunmmTUfr1pza0yB18%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6ceb4db5fbe0ee64-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 theme-script.js Show response
subterfugue.org/template/11subterfugue15/js/ 21 KB
5 KB 321ms
319ms Script
application/javascript 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://subterfugue.org/template/11subterfugue15/js/theme-script.js
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3f24ccf2549c43ae12ff95013908bf58a923c5cb6d58bdd2c7535e108c638271

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Sun, 05 Jul 2020 17:25:33 GMT
server: cloudflare
etag: W/"5270-5a9b50baef98e-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FB%2Bkdcct%2FMODY2Te9hutrpIypYnaCvfOq5p%2BId27lZwntM%2FGuOQJi1FlQPFGMG%2Fe7APMwE31xOlLVKioVnz3YH8X2RRHwdwQ1IbRgtaxSujhxb6bJJB5%2BDG2PhuotxYjbVzEnUyKHQ3XLi1v2UQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6ceb4db60be1ee64-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 102ms
25ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: D5503D14AA2F06AA
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=32316
accept-ranges: bytes
content-length: 948
x-amz-id-2: JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=

GET
H2 200 cookies_gdpr.js Show response
cdn.zx-adnet.com/consent/ 34 KB
10 KB 276ms
228ms Script
text/javascript 151.101.1.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.zx-adnet.com/consent/cookies_gdpr.js?0.47093334923440966

Requested by

Host: subterfugue.org
URL: https://subterfugue.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

984fe06711f530b7c8834f049dabbcf659c8b1f224ec69ac8019a26b15abb941

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
last-modified: Sat, 15 Jan 2022 20:17:42 GMT
x-timer: S1642377629.172849,VS0,VE204
etag: "881d19a3b167f82bbebcc208aa537602c79abb9d915d00968187663b9ee6d96f-br"
x-served-by: cache-cdg20762-CDG
vary: accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: no-cache
date: Mon, 17 Jan 2022 00:00:29 GMT
accept-ranges: bytes
x-cache-hits: 0

GET
H3 200 Pe-icon-7-stroke.woff
subterfugue.org/template/11subterfugue15/css/fonts/ 57 KB
30 KB 673ms
670ms Font
application/font-woff 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://subterfugue.org/template/11subterfugue15/css/fonts/Pe-icon-7-stroke.woff
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/template/11subterfugue15/css/theme-external-style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6fb4217048f333e23e0fd0ba2ab05e05fd7500f86a5a80a7cf04a2f94b257bec

Request headers

Referer: https://subterfugue.org/template/11subterfugue15/css/theme-external-style.css
Origin: https://subterfugue.org
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Sun, 05 Jul 2020 17:25:26 GMT
server: cloudflare
etag: W/"e4bc-5a9b50b411bf3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6vxFCoC3jVEobjDMC5ytPudtei0bPVQJf4Xo8u4lFHnV4%2FHGyFHtLttBl%2BfBS2Lac3YqF51LmQTE9KvDRAZ7CvwuqP1ttRgciMydYyi%2BiVNwkWPDUxxoEn%2FVu5i7CubV2ODpwh9k2ePXRvs6vsw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 6ceb4db60c1dee64-CDG

GET
H3 200 ajax-loading.svg
subterfugue.org/template/11subterfugue15/img/ 50 KB
48 KB 596ms
596ms Image
image/svg+xml 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/template/11subterfugue15/img/ajax-loading.svg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/template/11subterfugue15/css/theme-style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/template/11subterfugue15/css/theme-style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6552
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Sun, 05 Jul 2020 17:25:28 GMT
server: cloudflare
etag: W/"c915-5a9b50b602d3f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UZFCMvHO53Xikq1hRpTZi5GOJ7BAD45EKnPa1tIvRckEoL9dfCWQFURaBl8Ye8VC1cyrLtBQDWZxOLA6jJWYMjNwZFuHxw6JSjm%2FIml40y6cT7%2FSzMR091N%2FQuwuGk%2F00vcPzGac7eyoYD9c9E4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 6ceb4db69ca6ee64-CDG

GET
H3 200 image_NN0zvjQ7yg6omclKZgsgAW0m.jpg
subterfugue.org/img/muze-2020/3718/ 57 KB
58 KB 598ms
598ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3718/image_NN0zvjQ7yg6omclKZgsgAW0m.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6182a51197155267dead5c37ebab5a7aaadc8e84fe09eda5e1f57318996683a6

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 58351
last-modified: Thu, 05 Aug 2021 17:47:34 GMT
server: cloudflare
etag: "e3ef-5c8d383897f67"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2qPYQdRvjDhPExqRw7Nj%2FIqkaANqVWfEB5hX%2BzsFvhLS3yFUFZIRiQbEpXAytS%2FcI85yJ2absST3MJjhH5c0SvDu%2BqMJmmLBLH%2BvVo0HUC4kcoiuRwBgHbN%2FWp6ithjkNhA6XkziBeWtt6qIqAM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db69ca8ee64-CDG

GET
H3 200 image_hoBhro7N6OlQPuDy2b2p.jpg
subterfugue.org/img/muze-2020/3131/ 42 KB
42 KB 610ms
610ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3131/image_hoBhro7N6OlQPuDy2b2p.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ae5ae7cbba65c7c58755e64da5be8dfa71bc322fa3fe465176d4dee33098ea6e

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 42640
last-modified: Thu, 05 Aug 2021 17:47:23 GMT
server: cloudflare
etag: "a690-5c8d382e8d947"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9F2jWF0b899DARMJOw7gUO4p92LvZQYtrGDOoNY0V2zXhxXjKnTu7KKBLvzlA0des5eFkmNUU4PTAZ8RJxpNS9pgdiKaHJd776HPROBSn9xfHt5dsVOcZlU7%2Bhps21DQRoFC0XXRY0w2ZiP%2F8sk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db69ca9ee64-CDG

GET
H3 200 image_7Wn0A2lcqonI75cPCm.jpg
subterfugue.org/img/muze-2020/3229/ 108 KB
109 KB 623ms
623ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3229/image_7Wn0A2lcqonI75cPCm.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d05430dc588e8e1d3ab13b49bf63f499498e971bcb1ca685733c2bf1f4d1f207

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 110802
last-modified: Thu, 05 Aug 2021 17:46:44 GMT
server: cloudflare
etag: "1b0d2-5c8d3809adde3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qQbz27odCu8NC%2BCEBb7tSRPrwE%2FdJYeAsBz20Dgs5YOUIaB5wuQm9Ocz6zg3TF7%2BwugUsOTu2tQ0JD45zowl%2BVdMFgzx7K2tfIqQJB%2FmQ6wMF0f2XiI6ay1DLaLG0M6NSuYtFB0n2u%2BQ1gd3WVs%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db69caaee64-CDG

GET
H3 200 image_bs6smSHQE07yxsMkwn1uMv.jpg
subterfugue.org/img/muze-2020/2913/ 19 KB
19 KB 641ms
641ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/2913/image_bs6smSHQE07yxsMkwn1uMv.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6560dc78e511a529a60724c2d2268db1e410e0d4d54d317dfacb3e1741f33f0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1087
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 19001
last-modified: Thu, 05 Aug 2021 17:46:56 GMT
server: cloudflare
etag: "4a39-5c8d3814e3165"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q0mFREAgLVDHiliFmk35VqtIxszYShhZsFcy3HyjHm5jGfbjO4IZXq1nCNlff8gVNykw8Ntp2tq4nKgK35WSYuMmSqX3DPxDNI3m%2BqNRaIz7kOdSlIvszJStHJmLI7sQiKDMgXMSRSHw1CaFyr8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db69cacee64-CDG

GET
H3 200 leskanaris.com.1038348.es6.js Show response
jsc.mgid.com/l/e/ 241 KB
71 KB 65ms
39ms Script
text/javascript 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jsc.mgid.com/l/e/leskanaris.com.1038348.es6.js
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/leskanaris.com.1038348.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8169972c106cb4795c727e8377df60f69b7aa056b4a5c0af24575cf4c67e279e

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: br
cf-cache-status: HIT
age: 3049
last-modified: Thu, 02 Dec 2021 15:00:48 GMT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: SDJQ1K746X5K284Y
x-amz-id-2: CHuVAkYeCquOfDa+kJPdXPjHZzdyDLKw+34UMueciV1EK+1U+HINkMu/1G0cABEoZMA6D3UPbpE=
cf-bgj: minify
server: cloudflare
etag: W/"3ad55049654a6070a7c2d77750a3e96a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=10800
cf-ray: 6ceb4db6fbc84001-CDG
expires: Mon, 17 Jan 2022 03:00:29 GMT

GET
H3 200 leskanaris.com.1110058.es6.js Show response
jsc.mgid.com/l/e/ 240 KB
71 KB 72ms
49ms Script
text/javascript 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jsc.mgid.com/l/e/leskanaris.com.1110058.es6.js
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/leskanaris.com.1110058.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 642fda7f69c324f7d196e62c474b7bcb45d9e6b3084f48cc829fe42f57568f38

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: br
cf-cache-status: HIT
age: 3166
last-modified: Thu, 02 Dec 2021 15:29:54 GMT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: 562TG77ESH5ZN9HX
x-amz-id-2: TGneDiL1hUOL3Q406X0sq4AtUhwuEWt8r4icmVnWulZAxuKHvVYDp7eMJi0fOkX795zx4EF1sS0=
cf-bgj: minify
server: cloudflare
etag: W/"b4f9f0f07204a11c35e22ae2d6df944a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=10800
cf-ray: 6ceb4db6fbc54001-CDG
expires: Mon, 17 Jan 2022 03:00:29 GMT

GET
H3 200 image_B9qaeRRvZ4ru5ntJ.jpg
subterfugue.org/img/muze-2020/2838/ 21 KB
21 KB 588ms
588ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/2838/image_B9qaeRRvZ4ru5ntJ.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 62e66035db438fc345c8512f2421d5a45f8e322f171e6d30be145f5d09ef057b

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 21223
last-modified: Thu, 05 Aug 2021 17:47:25 GMT
server: cloudflare
etag: "52e7-5c8d382ffbcd0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ss%2FVCCZhQFQwm%2FpN0zR8%2BWM0FLjojzlI03rzbVweUF%2Bh9sMBuRMJ31grHzrxTuh3R5rZ0w78IfTKrBwyeTFSF2iIIeOGKI5CThG1UDCXnSp1TqoDbJfUyqOuiNoPV0ol2WF1C6C2W7B0JiEa%2BpE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db6ece6ee64-CDG

GET
H3 200 image_A87Ly6xWzcdpDaY9.jpg
subterfugue.org/img/muze-2020/3006/ 26 KB
26 KB 593ms
592ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3006/image_A87Ly6xWzcdpDaY9.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd9eb6fbeabbacf9fd97ef8d5a670ecff3484a316f989ab8cabe226d39acb239

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 26345
last-modified: Thu, 05 Aug 2021 17:46:46 GMT
server: cloudflare
etag: "66e9-5c8d380b56af3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VWP0ct0Zu%2FwL68RvuAuGBGAB%2FSuLeU9zv2q5iLaecgnDzU%2FSazXuV2QLz3yR4LnY6ubii1lIrcHgOUJer163uR4a00OlJDwYJs%2B2eF42C1hQdJT1y%2BNUQSCxcYCQxTR2%2BTx4k2Oy7rqykrOm9%2F4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db6ece8ee64-CDG

GET
H3 200 image_23EmmY1956mypRwJKxrZe.jpg
subterfugue.org/img/muze-2020/3157/ 53 KB
53 KB 600ms
599ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3157/image_23EmmY1956mypRwJKxrZe.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e37d902789e65199ec0e64d8b1544052056c1f1d8a8f398778d010364febd4f0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 54077
last-modified: Thu, 05 Aug 2021 17:47:27 GMT
server: cloudflare
etag: "d33d-5c8d38329bb1b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ySr23zE%2BO98klzF0O%2BhSbqbStWFevxRg73yX%2FraJ1tHpG0PzBfBQd4EwbsGATq%2FapAFLUWtYpCb9neCh39klWZA9v3yP5vP0Od1QI%2BCJThtmylHi%2BOuJu8FIiOZ5sH9nIy1RKtzL98vBa%2B1uznk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db6ece9ee64-CDG

GET
H3 200 image_m0YrekuWX7nXR1h.jpg
subterfugue.org/img/muze-2020/3429/ 179 KB
179 KB 607ms
606ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3429/image_m0YrekuWX7nXR1h.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11e9c6e92ac0b2e97cd8c8e797104054a3a48cf6c2776d1940b0da4afb09893b

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 183115
last-modified: Thu, 05 Aug 2021 17:47:53 GMT
server: cloudflare
etag: "2cb4b-5c8d384ab9b10"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6DuUDeZ2nxJOIGPbjzKI53tYbsoBjKbjtudMfUrRJpGlp6QY0nIDeRGXTqhSC39obTEDYmWbQDo7Hr8bRAkyKSXx0rWiuoOeq41KVpzyvCeudUA2jCEyIMTA%2ForY82sUm%2BbuB7hZYi29gNd972o%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db6eceaee64-CDG

GET
H3 200 image_xiTtjSnZ2HYX8vT3QRMhi.jpg
subterfugue.org/img/muze-2020/3333/ 25 KB
26 KB 644ms
644ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3333/image_xiTtjSnZ2HYX8vT3QRMhi.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e784374584414fe75e14ef1f94eb3065994ed88e22ddcacf19ed375313f8a65

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 25801
last-modified: Thu, 05 Aug 2021 17:46:38 GMT
server: cloudflare
etag: "64c9-5c8d3803c909a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FBy3dV0f8eyFoKDs6uqd2gr%2Bzq4Ld3aTAC6BrYXRdfQJBtp4EqhGH4eHEyhm%2BVKaRlH4pQwm%2FphY3R%2F%2FOx1LeewoqJu75P%2Fk6Ibvir9Vlvwebc03py7%2BklhMCAQS8LSS17qy1K4kh%2FNv9nNBtYU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db6ecebee64-CDG

GET
H3 200 image_iGhR4uNVau4scey.jpg
subterfugue.org/img/muze-2020/3092/ 94 KB
94 KB 645ms
644ms Image
image/jpeg 2606:4700:3035::6815:25c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://subterfugue.org/img/muze-2020/3092/image_iGhR4uNVau4scey.jpg
Requested by: Host: subterfugue.org
URL: https://subterfugue.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:25c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab8e9a790b32ee1d121b22e664721eed938e586faf7c9b5bfd7d8a545b463318

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 95971
last-modified: Thu, 05 Aug 2021 17:47:37 GMT
server: cloudflare
etag: "176e3-5c8d383be1c86"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=igyholtLO3xy10ppAChUBraSPjRcyjiUKCaVIYfjplh%2B93BE95LMn4%2BHASZiKvP%2FCXrfmsSBiR35E47Xggc%2FPrNCjyo%2BsObqrQsNCkS1Zv86HVoGi%2B2PmA96KQLUu3bA9n0uofuEvzal6rV%2Bcf8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6ceb4db6ececee64-CDG

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201100101/ 279 KB
100 KB 89ms
54ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201100101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-7268067865878173&plah=subterfugue.org&bust=31064017

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4fe8af60f27d59c74d4f5455ea19ce2ae3beeae393256074a1243c5250c0ae00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 102650
x-xss-protection: 0
server: cafe
etag: 16854566369342803933
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 17 Jan 2022 00:00:29 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220112/r20190131/ Frame D6D3 11 KB
5 KB 35ms
34ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220112/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

425b48211e0ebe795b6ead9ec2f1bcd9e04e9930a7dd30e08cdb2fef0bcb834c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4885
x-xss-protection: 0
date: Sun, 16 Jan 2022 02:05:13 GMT
expires: Sun, 30 Jan 2022 02:05:13 GMT
cache-control: public, max-age=1209600
age: 78916
etag: 13671712056976469594
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 adManager.m.js Show response
js.wpadmngr.com/static/ 77 KB
29 KB 162ms
43ms Script
application/javascript 45.133.44.25
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js.wpadmngr.com/static/adManager.m.js
Requested by: Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.25 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 1615c2e3d17908a83ce2bb47f12ba97cb9d497a8cd444cd1ddd8c33f9dedb233

Request headers

Referer: https://subterfugue.org/
Origin: https://subterfugue.org
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: gzip
last-modified: Fri, 14 Jan 2022 07:31:36 GMT
server: nginx/1.18.0
etag: W/"61e126d8-13416"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Mon, 17 Jan 2022 01:00:29 GMT
cache-control: max-age=3600
x-proxy-cache: HIT

GET
H2 200 sdk.feda0fd8c5f2191f5c4b299585520859048f3705.js Show response
cdn.zx-adnet.com/consent/ 341 KB
66 KB 50ms
50ms Script
text/javascript 151.101.1.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.zx-adnet.com/consent/sdk.feda0fd8c5f2191f5c4b299585520859048f3705.js

Requested by

Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/consent/cookies_gdpr.js?0.47093334923440966

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

04149c43558d59b2f0f2cc3f679979b915401ca5c94e833479ca9ea754db0b89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
last-modified: Sat, 15 Jan 2022 20:17:42 GMT
x-timer: S1642377629.496616,VS0,VE0
etag: "903d4e9708a69e8cc899413e10c8bd8c12ff0e8553c05df46fc83d843518567b-br"
x-served-by: cache-cdg20762-CDG
vary: accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=315000
date: Mon, 17 Jan 2022 00:00:29 GMT
accept-ranges: bytes
content-length: 67057
x-cache-hits: 33

GET
H2 200 tag.js Show response
mc.yandex.ru/metrika/ 196 KB
67 KB 310ms
125ms Script
application/javascript 2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: subterfugue.org
URL: https://subterfugue.org/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

14f8ba90ae55f120df9ad242a6dcb942e7e10215cf98e146b14b749b0f397bb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: br
last-modified: Thu, 13 Jan 2022 15:44:49 GMT
etag: "61e01ec1-10a61"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
content-length: 68193
expires: Mon, 17 Jan 2022 01:00:29 GMT

GET
H/1.1

200
OK

hit
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit?rhttps%3A//kartaplovdiv.com/;s1600*1200*24;uhttps%3A//subterfugue.org/;0.8818364044481424
https://counter.yadro.ru/hit?q;rhttps%3A//kartaplovdiv.com/;s1600*1200*24;uhttps%3A//subterfugue.org/;0.8818364044481424

43 B
528 B

79ms
78ms

Image
image/gif

88.212.201.204
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit?q;rhttps%3A//kartaplovdiv.com/;s1600*1200*24;uhttps%3A//subterfugue.org/;0.8818364044481424

Requested by

Host: subterfugue.org
URL: https://subterfugue.org/

Protocol

HTTP/1.1

Server

88.212.201.204 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host204.rax.ru

Software

nginx/1.17.9 /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 00:00:46 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin: *
Cache-control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 16 Jan 2021 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 00:00:46 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Location: https://counter.yadro.ru/hit?q;rhttps%3A//kartaplovdiv.com/;s1600*1200*24;uhttps%3A//subterfugue.org/;0.8818364044481424
Cache-control: no-cache
Connection: keep-alive
Content-Type: text/html
Content-Length: 32
Expires: Sat, 16 Jan 2021 21:00:00 GMT

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-5ee2ba83c1c68ba2/ 2 KB
874 B 123ms
66ms Script
application/javascript 104.75.88.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-5ee2ba83c1c68ba2/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-126.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7a0ddf19daf579bd555f452419df573625463c5a1f974739cf226edcd1b8632c

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: gzip
etag: -722675849--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public, max-age=58, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 698

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 90 B
250 B 290ms
183ms Script
application/javascript 104.75.88.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=61e4b19d1cb0d360&bkl=0&bl=1&pdt=318&sid=61e4b19d1cb0d360&pub=ra-5ee2ba83c1c68ba2&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=subterfugue.org&dr=kartaplovdiv.com&fp=&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=4&gen=100&chr=UTF-8&mk=Home%2CWorld%20museums%20and%20paintings%20by%20famous%20artists&colc=1642377629503&jsl=1&uvs=61e4b19de8b280a8000&skipb=1&callback=addthis.cbs.jsonp__342492053378272270
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-126.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9fd5a5d610b53c738139de0f61895e4b12fdfa96ad752bac65d41aa3755e6d4c

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:29 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 90
content-type: application/javascript;charset=utf-8

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame E133 0
0

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html Show response
s7.addthis.com/static/ Frame 7537 71 KB
26 KB 71ms
71ms Document
text/html 104.75.88.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-126.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

server: nginx/1.15.8
content-type: text/html
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
etag: W/"5f971164-11adc"
timing-allow-origin: *
cache-control: public, max-age=86313600
p3p: CP="NON ADM OUR DEV IND COM STA"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 26421
date: Mon, 17 Jan 2022 00:00:29 GMT
vary: Accept-Encoding
x-host: s7.addthis.com

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 78 KB
27 KB 191ms
64ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/c5949347-9c95-4ee4-808c-0a7bb94aff6c/plugin.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

sffe /

Resource Hash

7cce378f390402bc0bbecf88ad6a38b490970f5167f1a5412a35447c5c7cdac3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26979
x-xss-protection: 0
server: sffe
etag: "1104 / 506 of 1000 / last-modified: 1642206167"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 17 Jan 2022 00:00:29 GMT

GET
H2 200 prebid5.14.0.js Show response
get.optad360.io/sf/ 460 KB
142 KB 41ms
41ms Script
application/javascript 2600:9000:206f:8e00:11:a4de:2580:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://get.optad360.io/sf/prebid5.14.0.js
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/c5949347-9c95-4ee4-808c-0a7bb94aff6c/plugin.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:8e00:11:a4de:2580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7109518959a6958168f639860050324f4f063fd1697f32677cf9d0180ab02453

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 15:15:22 GMT
content-encoding: gzip
last-modified: Thu, 23 Sep 2021 07:59:54 GMT
server: AmazonS3
age: 7116308
etag: W/"6dd0a13bde35d2daa452bba998871016"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 cf2939e85531f45f3306f792ea104eaa.cloudfront.net (CloudFront)
cache-control: public, max-age=360000000
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: MjApmm3WJK_Qifnxg7wI0SytOocndu9sGWT2IG4PVQe-GDGk2v5D6g==

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 219 B
647 B 172ms
56ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=subterfugue.org&callback=_gfp_s_&client=ca-pub-7268067865878173

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201100101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-7268067865878173&plah=subterfugue.org&bust=31064017

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

c5af0d98409f31b38267d810da56cff8835e0b6aa97e9c8e2bbf5449b6a5cc51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 203
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
792 B 171ms
54ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=subterfugue.org

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 143ms
53ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=subterfugue.org

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 00:00:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 59D7 188 KB
50 KB 546ms
546ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7268067865878173&output=html&adk=1812271804&adf=3025194257&lmt=1642377629&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fsubterfugue.org%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629308&bpp=3&bdt=834&idt=279&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5674816328801&frm=20&pv=2&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=309

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

27229fa6f0e812f79a505216bc3401de3c4f59f1053887814485109f9da52f85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 17 Jan 2022 00:00:30 GMT
server: cafe
content-length: 51079
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 00:00:30 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 854B 57 KB
27 KB 297ms
296ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4145494359&adf=4100368324&pi=t.ma~as.9187253983&w=336&lmt=1642377629&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629311&bpp=2&bdt=837&idt=379&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=460&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=80iXDl1sOT&p=https%3A//subterfugue.org&dtd=388

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cc099cfa43207002863e1913578a1a914ab94b469d5f52dfbfe9c48cdbe49a6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 17 Jan 2022 00:00:29 GMT
server: cafe
content-length: 27187
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 00:00:29 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F9DA 19 KB
8 KB 249ms
248ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4064271541&adf=2759310875&pi=t.ma~as.9187253983&w=336&lmt=1642377629&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629313&bpp=1&bdt=838&idt=398&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=9kSavseIl6&p=https%3A//subterfugue.org&dtd=406

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d597a9e8d2186ef677813921d7c5b4abe7b6f1d8a0ae3086200bddbc396370af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 17 Jan 2022 00:00:29 GMT
server: cafe
content-length: 8655
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 00:00:29 GMT
cache-control: private

GET
H2 200 ui-gdpr-en.feda0fd8c5f2191f5c4b299585520859048f3705.js Show response
cdn.zx-adnet.com/consent/ 230 KB
37 KB 36ms
36ms Script
text/javascript 151.101.1.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.zx-adnet.com/consent/ui-gdpr-en.feda0fd8c5f2191f5c4b299585520859048f3705.js

Requested by

Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/consent/sdk.feda0fd8c5f2191f5c4b299585520859048f3705.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ff4b703a37dc11dbca28199ebaa29bfd85fb3793138fdc9bb2b952954d098b68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
last-modified: Sat, 15 Jan 2022 20:17:42 GMT
x-timer: S1642377630.834085,VS0,VE2
etag: "dad5947af947c84745a29032a526f3e68afd9ce38af7f41ee281defb94b29c84-br"
x-served-by: cache-cdg20762-CDG
vary: accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=315000
date: Mon, 17 Jan 2022 00:00:29 GMT
accept-ranges: bytes
content-length: 37832
x-cache-hits: 1

GET
H2 200 layers.fa6cd1947ce26e890d3d.js Show response
s7.addthis.com/static/ 263 KB
76 KB 41ms
40ms Script
application/javascript 104.75.88.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-126.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: W/"5f971164-41cf5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86313600
date: Mon, 17 Jan 2022 00:00:29 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77617

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
1 KB 117ms
40ms XHR
application/json 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20220117

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid5.14.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

51702aa11105f27bc4d6cb3a70224cf3bdb28bed3f656de6e79f068fe9b1e2c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://subterfugue.org/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 17 Jan 2022 00:00:30 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 32373
x-jsd-version: 1.0.1223
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by: cache-fra19177-FRA, cache-cdg20746-CDG
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"69d-/vxiYPmwsK3QrI7x0q8OhwHAl20"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 6ceb4dbb7fb23ae9-CDG

GET
H2 200 1619 Show response
na.nawpush.com/tags/ 2 KB
882 B 112ms
30ms XHR
application/json 45.133.44.25
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://na.nawpush.com/tags/1619
Requested by: Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.25 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 77af123eccd522ffd300351bc7a536ab646bf129d4a7871268c2e5f99f4515b7

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 17 Jan 2022 00:00:30 GMT
cache-control: max-age=300, public
content-type: application/json
server: nginx/1.18.0
content-encoding: gzip
x-proxy-cache: HIT

GET
H2 200 wp-banners.js Show response
js.wpadmngr.com/npc/sdk/ 0
238 B 41ms
39ms Script
application/javascript 45.133.44.25
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js.wpadmngr.com/npc/sdk/wp-banners.js
Requested by: Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.25 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:29 GMT
last-modified: Fri, 20 Aug 2021 15:14:31 GMT
server: nginx/1.18.0
etag: "611fc6d7-0"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Mon, 17 Jan 2022 01:00:29 GMT
cache-control: max-age=3600
accept-ranges: bytes
content-length: 0
x-proxy-cache: HIT

GET
H3 200 pubads_impl_2022011002.js Show response
securepubads.g.doubleclick.net/gpt/ 352 KB
118 KB 62ms
26ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

sffe /

Resource Hash

e87e542e34fc3af7847f53ae5c258f82ff2d8739646ed8d249c9a54ede9f7128

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:33:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1638
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 121009
x-xss-protection: 0
last-modified: Mon, 10 Jan 2022 21:10:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 16 Jan 2023 23:33:12 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 97 B
111 B 76ms
35ms XHR
application/json 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=subterfugue.org

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

869485db860da1770cce5102fd5dccbd06b38045c8a39ec20fc9efb1e0aeb38d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 00:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 86
x-xss-protection: 0
expires: Mon, 17 Jan 2022 00:00:30 GMT

GET
H2

200

1 Show response
mc.yandex.ru/watch/65397514/
Redirect Chain

https://mc.yandex.ru/watch/65397514?wmode=7&page-url=https%3A%2F%2Fsubterfugue.org%2F&page-ref=https%3A%2F%2Fkartaplovdiv.com%2F&charset=utf-8&site-info=%7B%22__ym%22%3A%7B%22isFromApi%22%3A%22yesI...
https://mc.yandex.ru/watch/65397514/1?wmode=7&page-url=https%3A%2F%2Fsubterfugue.org%2F&page-ref=https%3A%2F%2Fkartaplovdiv.com%2F&charset=utf-8&site-info=%7B%22__ym%22%3A%7B%22isFromApi%22%3A%22ye...

331 B
413 B

52ms
52ms

XHR
application/json

2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/watch/65397514/1?wmode=7&page-url=https%3A%2F%2Fsubterfugue.org%2F&page-ref=https%3A%2F%2Fkartaplovdiv.com%2F&charset=utf-8&site-info=%7B%22__ym%22%3A%7B%22isFromApi%22%3A%22yesIsFromApi%22%7D%7D&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A3u9fu6axod71lkz4p33%3Afp%3A953%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A730%3Acn%3A1%3Adp%3A0%3Als%3A680853229876%3Ahid%3A400475593%3Az%3A0%3Ai%3A20220117000030%3Aet%3A1642377630%3Ac%3A1%3Arn%3A1031824737%3Arqn%3A1%3Au%3A1642377630608242204%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1642377628177%3Anp%3ATGludXggeDg2XzY0%3Ads%3A95%2C44%2C155%2C11%2C0%2C0%2C%2C1009%2C44%2C%2C%2C%2C1316%3Awv%3A2%3Aco%3A0%3Arqnl%3A1%3Ast%3A1642377630%3At%3AWorld%20museums%20and%20paintings%20by%20famous%20artists&t=gdpr%2814%29aw%281%29ti%282%29

Requested by

Host: subterfugue.org
URL: https://subterfugue.org/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

2e4dc0d5f0fdd5bf4ffd54f1db0bd1d49b0f1c8ba2db5c4570ffc148602ef577

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:30 GMT
x-content-type-options: nosniff
last-modified: Mon, 17-Jan-2022 00:00:30 GMT
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: https://subterfugue.org
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 331
x-xss-protection: 1; mode=block
expires: Mon, 17-Jan-2022 00:00:30 GMT

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:30 GMT
last-modified: Mon, 17-Jan-2022 00:00:30 GMT
location: /watch/65397514/1?wmode=7&page-url=https%3A%2F%2Fsubterfugue.org%2F&page-ref=https%3A%2F%2Fkartaplovdiv.com%2F&charset=utf-8&site-info=%7B%22__ym%22%3A%7B%22isFromApi%22%3A%22yesIsFromApi%22%7D%7D&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A3u9fu6axod71lkz4p33%3Afp%3A953%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A730%3Acn%3A1%3Adp%3A0%3Als%3A680853229876%3Ahid%3A400475593%3Az%3A0%3Ai%3A20220117000030%3Aet%3A1642377630%3Ac%3A1%3Arn%3A1031824737%3Arqn%3A1%3Au%3A1642377630608242204%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1642377628177%3Anp%3ATGludXggeDg2XzY0%3Ads%3A95%2C44%2C155%2C11%2C0%2C0%2C%2C1009%2C44%2C%2C%2C%2C1316%3Awv%3A2%3Aco%3A0%3Arqnl%3A1%3Ast%3A1642377630%3At%3AWorld%20museums%20and%20paintings%20by%20famous%20artists&t=gdpr%2814%29aw%281%29ti%282%29
strict-transport-security: max-age=31536000
access-control-allow-origin: https://subterfugue.org
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Mon, 17-Jan-2022 00:00:30 GMT

GET
H2 200 advert.gif
mc.yandex.ru/metrika/ 43 B
135 B 54ms
53ms Image
image/gif 2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.ru/metrika/advert.gif

Requested by

Host: subterfugue.org
URL: https://subterfugue.org/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:30 GMT
last-modified: Thu, 13 Jan 2022 15:44:49 GMT
etag: "61e01ec1-2b"
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Mon, 17 Jan 2022 01:00:30 GMT

GET
DATA 200
OK truncated
/ 443 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 854B 42 B
63 B 57ms
57ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CGxZWShkaxY20KJIurfLC9vyit5x1KQMTybXneu5jNTVICRkuNTmTavWhRpLTUDyik5dL8Wr7b4gQ0kQOUsEKhuAItHbHd-JcENPPgreRiw5YWORg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4145494359&adf=4100368324&pi=t.ma~as.9187253983&w=336&lmt=1642377629&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629311&bpp=2&bdt=837&idt=379&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=460&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=80iXDl1sOT&p=https%3A//subterfugue.org&dtd=388

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 854B 2 KB
2 KB 85ms
25ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:50:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 603
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:50:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 854B 121 KB
37 KB 166ms
91ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 17 Jan 2022 00:00:30 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 854B 15 KB
6 KB 77ms
33ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 299
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:55:31 GMT

GET
H3 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
122 B 82ms
41ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=subterfugue.org

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 00:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 82ms
41ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=subterfugue.org

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 00:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame ECF0 19 KB
9 KB 348ms
348ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4117114381&adf=3954608419&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=845&idt=526&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=267&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=ZV10ewvAkC&p=https%3A//subterfugue.org&dtd=1206

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

46a9e8e4ce1b82aba880255e13b95995b2f715c92660c4afddf51ec3f5216d5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 17 Jan 2022 00:00:30 GMT
server: cafe
content-length: 9612
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 00:00:30 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 60EE 19 KB
9 KB 321ms
321ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2495647230&adf=1404796083&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=609&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=607&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=75wf9xBgZQ&p=https%3A//subterfugue.org&dtd=1212

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a56996bb81bff7f9058ea049e00898181cc4a545b67cc3dcdf3778ecea325af1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 17 Jan 2022 00:00:30 GMT
server: cafe
content-length: 9496
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 00:00:30 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 98EE 19 KB
9 KB 315ms
315ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=462507153&adf=1780082840&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=685&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1027&ady=2049&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=9oRAN23ZSu&p=https%3A//subterfugue.org&dtd=1217

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eeef8426fc4212100085a35f3a90cea98bfd3064c77f2700354a0d8c058c1b41

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 17 Jan 2022 00:00:30 GMT
server: cafe
content-length: 9602
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 00:00:30 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame ED83 19 KB
9 KB 395ms
394ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2732065616&adf=629078454&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=2&bdt=844&idt=805&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=2936&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=hlAYMT9mzg&p=https%3A//subterfugue.org&dtd=1221

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7e06ab26d8a49c264af0a3561a8f3a8a851b14d71f32bafa2d50c97b15bea9fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 17 Jan 2022 00:00:30 GMT
server: cafe
content-length: 9603
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 00:00:30 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AD74 19 KB
9 KB 382ms
381ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=3107299941&adf=2927141728&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=976&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=3223&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=03TIDHTNwq&p=https%3A//subterfugue.org&dtd=1225

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

96abf03b0943cfabe3d8dbb501fe427cd759c4b4740416e1352a3b07136660a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 17 Jan 2022 00:00:30 GMT
server: cafe
content-length: 9642
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 00:00:30 GMT
cache-control: private

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame BCC9 624 B
300 B 47ms
47ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CIr22QEQ242E8gIYnvKyvAEwAQ&v=APEucNWcgm_92W_rv8rLerZ665SWtxKIt1gjs6syMzWmwjV6JZHDSwYlkqactoDjY-zfXBOgeUceGieFH3yPk6k9UtfoSgHJuWJeo2DJz_0ZTsqzdSmy-rfepclEJ60ukmCGaUy75sE41R23HZKv4hPxtyEoufig4m0qk1NvG-xcwpeQkPH02RI

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4064271541&adf=2759310875&pi=t.ma~as.9187253983&w=336&lmt=1642377629&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629313&bpp=1&bdt=838&idt=398&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=9kSavseIl6&p=https%3A//subterfugue.org&dtd=406

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4064271541&adf=2759310875&pi=t.ma~as.9187253983&w=336&lmt=1642377629&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629313&bpp=1&bdt=838&idt=398&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=9kSavseIl6&p=https%3A//subterfugue.org&dtd=406

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 17 Jan 2022 00:00:30 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 00:00:30 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7E4C 12 KB
9 KB 73ms
72ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B4frtsltdRnlAdnrky2swm4uHNuzrKCMGwgbYTECYycu-TCr4ipJC9l5pb5R28Dk-QD9xNaJtjpT-Xn-_fyVoc_gn4xQj9-yeUDMY-ohzlgdF6FUbA7dmjT-lIAL3pqOofGTn-qHMZ_DldhA0mO6CA9Cro3g&cry=1&dbm_d=AKAmf-BJ61SeLSoQX-BTjwPy7h7um7E5Ayh9_enea1dDm2NQlDWBCRB8iCUBfEea-tY_10AW9kSjkBIQwoJ2hSpDqAa3JmFfNbmSGjPYGMDguJK-1dhF7ByAgHunp8EftSooLWAsXV_K9Be1P6j3voWS9hg1qgczlchf_W9tIGNI2dslPu5UO8-vohfxUDTqiA7jOY4-w2k-ld0YcQ9IR_QgoqWbpFJZjA9ly3qbpq3jhgG9KleIaO1DWoGDF5lAmLs67PMpNHgkItfHB-XJ5TYvV3G2f2cbi5g1MFGeWGItSRbOLEttV-j53AojxYPKzn80G39gPbXghw1Qzx0XCL3Vs-eQQ2ZikRqC0pCaeTbO356LbSWj_Uh74xn3mZ-sOCk2L1uKigX4lnC5B_BGqXJleiiwYMdxlQ0JFKF8QB8Gw9nUbEhYmAHrcHWnwg7N1bSE1r5IhToS19N3eVhmp3w9qYjmDaAcoWwW63RSwfcOn1sDJv_ESsGgaae-Iqqhy0EeCRaRT9Zg_VTAmYNWYeKKFWKKwJ4Rpf7R5aQq3TZiv7P6RIb49xsE0_tv2NihTcxu9BRsak2djztEPQxWkRYadlgaaYEY6-N6vxRs6YnskqCa41SG3IcLZc7PBJTcxvU2v8Y-qdiPXQ2BP0pJ86C_FwCzHf3kgPu2jubJ1_qtfEoFFWbavoQJQl6C14izwXOMpHW3KJdoHABGSxeks1ulSwpBAC5i-InM6T7ETVTHgs9wJZPh8tqQtiEEspiiI8oJ87FUYk_C52k1CFRvtfJER6sD3iYsnaCaciI3AhXD9aljQfYA790VBdNEvkuzJ6MKdskvnF10A0w8lmVpAXJXdeZ7WCcIKZTapp1XZSK-jY83Y3NP1Abu79TukcLYhlC1xb-rrZ_R5LNAbhQUQXPO4425dBf-T3F9Wu4l2UjXeCJKSxpHvzqpbhltaT_KyvDbeNUl6oIm_49gcKdIL3cSOjIrA7h3tQsO6TvQu0SnW5_PYDaPxmAU88TeiH_tQKFaH4bpF_hq_0_p-f1JxxWNFHB3pjH2BP3IGJfcJ2Ck81BLUkj-4QM2yBY9CEwym2WWxwkGvBmgS0bp9_0vacJl9Z9CcvZ0DJSlBL9vn-IAvqW6wQSPsNRExnUW-lyWMUJZDtzIE6wNzXlvP4hnOrhiQHjkl8sVhJirdpmhHNLCcGXXHHeWbVEEiXTrMAarBetcEQbuu3lj4j8qUPXR3W3Sw0XUB32sz3xg77m6ZupFFkjrIwlEf0QGdGyBpL46626gk6iGB82fe5GmqiBTinqsRpbOkw2DrfgmySu12peHKVEcQ2AGR9afOVyLONGqQEAEKcpbJa-YXNXF4Qr--wqnTE1dwxOw0qwBsWSOURFPEHi2xDGLjs94CqTbMXrwLRaGkwd8a4aljr9WpTQHNgp1X_R-mXXQ37R2duuk2becuJax4XxJulizQEAj3RKZ8C7cUSp5IvHoa-zfkrEm4z1m3PWvmljWU07nV74E3JkPC0Lv7JlmpVf9Dh0g4Ww6S3QLDZ7X7LuLNtNFu4fsAfU5J2-odPxa_wfx4JTgHIDKTViaSHFk29FUuU64sNtwg1Y7BnYKYaOYlerjT5VGXDvxFUSjuzde1FnvI5e4P1Yz8VS_sO-68hMr4jOHvJ4QXl7GHqPJxNutZ3ghSTwd2PRSR9wsKIkPw-Xuh921eqJ7rIaJsAS7WEYXLd7wHJrEOLvPYK65ou5YkCAXdgzdIS4s2mtNepBBbbNGthesXr8UMkRoBdw-d25EvHjVAtcwHW_fdnvIL_sn7fc5mWP5MGN6i1Ux0mmTeHj62IWmcT_I5xKtmyemLSlsAZk4cDB3iFnVt3GgjA8PmVW5A4ZYiROf3oyYTNI-mvFfImpqUsy1vIXhLrqn2IHz5Ml53Dc6RAO64MFp6lXdCBcqriT0_XRHQDD68Uk1pOel4ndSg5gEsTmezgzwCiEBzubRjeDS8P7WrpOAj3rtHwGDsq5G89_CHTEpA60X2pB_C0WOBX5Qz4YgMMayniFBppWG4dJTGMHJJrZSlQZdNNVlKnoz2PiIgZK3Pn4ZLjrU23GnWoeHgoo2VSyqhIw4-sA6bOeoTFkCOShT-WXEPiTM1BViOTd6Mt40fffz9Op-S48Qae63Wjw1Aru7nRRqH4h2ESFZJdtvoBDHx19_nPjmKvFLP9CCkCO8lmdJN04gw0PWOWbjaT2bgn6_W_nXkyHHHUD1ga0WVHpX3nBvOnRXbF5qxh8dh-qrYb_Bd0dZapcUU93icBYynD2pQ4cM5sRBqXXGdGzjdU-oN1yeti_QJJePQWnuGSRSX0x9tpoksgVvQ1yeo_gMbLJoBYnM4WEVWN9P62igsAy1YeZYCFLM6s9xZYmzskdIur8sSlWsHQjFfMnNskiftPRN7c0P5ATCvCe6lFRaZxI0uE02Sj7rsN273xMh1YZ1NkNUDLh6oeIkik0iXNzDsNa296bcZ71kKKkj990ALpiFsQm32bThBWULUMRacVrwLj_F1wXtGcjnS4xj4QLeLFK3HRSwRcnhcglk-fj8D70002G58QtZKpchHU5fcQ6fJSpiUCEHWeKJEJWTmsRIrrI54ChqJCnCSN9k12oHdFhACkasvaGPrwvBJH19L0-uIru10jCvmNmVrWBIYsSNoJC5F66SzIfJ4akb4RoorgMeWXRBuCiAc2yrdFyHPANXqMNbZrrTv7qaO83S1i7OB-6D8mnnCxhwqkGb-I3P7sLe6XFGfMiZIcWs8UrlXzfrpc1Rjq6m8cxU6QwpuzaZOOjKec-hQ3UChUX5khSzSnBDDxRQg5cEgObbDuj15Evl_zDkxz75krKlZA4cSPd7dzi8BmIPfKlINRQBNQ4yySxaYUsi&cid=CAASBORoEaE&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

669ae9613c508815efd2d0133211d667b4d7dbc678062ce270065d1ef05c1734

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4064271541&adf=2759310875&pi=t.ma~as.9187253983&w=336&lmt=1642377629&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629313&bpp=1&bdt=838&idt=398&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=9kSavseIl6&p=https%3A//subterfugue.org&dtd=406
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:30 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8905
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 7E4C 2 KB
1 KB 92ms
46ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4064271541&adf=2759310875&pi=t.ma~as.9187253983&w=336&lmt=1642377629&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629313&bpp=1&bdt=838&idt=398&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=9kSavseIl6&p=https%3A//subterfugue.org&dtd=406

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:50:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 603
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:50:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7E4C 121 KB
38 KB 114ms
37ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4064271541&adf=2759310875&pi=t.ma~as.9187253983&w=336&lmt=1642377629&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629313&bpp=1&bdt=838&idt=398&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=9kSavseIl6&p=https%3A//subterfugue.org&dtd=406

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 17 Jan 2022 00:00:30 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 7E4C 15 KB
6 KB 76ms
31ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4064271541&adf=2759310875&pi=t.ma~as.9187253983&w=336&lmt=1642377629&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629313&bpp=1&bdt=838&idt=398&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=9kSavseIl6&p=https%3A//subterfugue.org&dtd=406

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 299
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:55:31 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7E4C 42 B
63 B 70ms
70ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-COPScmjRJr9F35TUDwQdHTtHY5Wt5o3OhvIt-qZdOlTDanTOGrn7C3b3JAcZJbjEZcl-sdJu7N5uQGr6R8bjzvR30r9cq4gUGthT96yq1IYpXSUfg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4064271541&adf=2759310875&pi=t.ma~as.9187253983&w=336&lmt=1642377629&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629313&bpp=1&bdt=838&idt=398&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=9kSavseIl6&p=https%3A//subterfugue.org&dtd=406

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 077D 624 B
300 B 47ms
47ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHR6uYCELDS8uoCGPTC770BMAE&v=APEucNXxdhFv1NjfEf-S-l3-myLnWK47JALLAv4xlyiZ_d0Hu7im6H93EjblFKUzBdB8phR1CtMbQkWOCxmpof1AL25huQJI7NUR6tk6MpNU8HzDT9gNaj6GaDEfu4Hx-gK_eE4Fr5XwaX40ej0zrirb9Ndg6sRonxKJRzOSG3KOmJKkBcBvLiE

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4145494359&adf=4100368324&pi=t.ma~as.9187253983&w=336&lmt=1642377629&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629311&bpp=2&bdt=837&idt=379&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=460&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=80iXDl1sOT&p=https%3A//subterfugue.org&dtd=388

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 17 Jan 2022 00:00:30 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 00:00:30 GMT

GET
H3 200 abg_lite_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/ Frame 854B 19 KB
8 KB 33ms
32ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2039446f8956518da2c2d70116d18c92fac3b04110942de074748aa4041067fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:44:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 936
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7881
x-xss-protection: 0
server: cafe
etag: 7605774008668088057
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:44:54 GMT

GET
H2 200 6783951571557292410
s0.2mdn.net/simgad/ Frame 854B 37 KB
38 KB 182ms
29ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/6783951571557292410

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d03f5a4be41744fc36104d13b1b443e7c4331365df7ac9a7b74eb632ce23256

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 15 Jan 2022 05:14:53 GMT
x-content-type-options: nosniff
age: 153937
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38259
x-xss-protection: 0
last-modified: Wed, 15 Dec 2021 18:14:54 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 15 Jan 2023 05:14:53 GMT

GET
H3 200 omrhp_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/ Frame 854B 6 KB
3 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/omrhp_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2d0744b54be7eab148245653f8fad2e4a0e8875b886bcacbb2c70741872eda55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 22:57:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3769
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2626
x-xss-protection: 0
server: cafe
etag: 8548655983161038638
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 22:57:41 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 854B 0
571 B 177ms
76ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuuZb2jDAVsc43AvKSA_6q0cn55IcKib4va5CMQVHL1r-RbiI7gbizXoOsj_51L-LitJSaBSK2F1oLweBbZ6aJnGVFsmZ2lsxcAm3Zv4_-L8kvRVgm1LfxJlS0jzU2hku4lbf0BQrm5qW0c2zjUWNiTKktENjVGKQFrsKHyLZwpq2t5TrqanW8p94g0B6dmXnK3WDhCGgxZcEmJvo_yG61E9JjDowyoVDi-u6zzYHPZWrbezkNFYW6gnjDbpeWzIOf1h4eU7cc2WYvsHMGtOGhTdHTsWZP1Po_WFQvuEueI9KVjMN3SGDR3NrcrX_-VNxrHAsey4wSc4iq-_4bkSUmJwT4v9WVJ4znGx_7ISW52HbVTovSH1R2hswpDD7e32w-gItapaamvpfUyym7T60MuhBEwwJ-4989DeJIo3govpUAJV2O5kgRkrSciu79VcDJNXKcTWgmfntzhn4b1RdNKr0Fua5eIFGdSr6Q9y70cBXtKD-BbkgK0G1jzu6FXZwORX06_OH5JuTH_5g6NaxUf66FGrb4k0ZWD4yQYh4wP0_TmR0FnjpLSj4FjDycmTL3VCzDvJ2AltwHvEwL_fqBPEzq7KRopkoioePPNulBVtLnFI_6w6IC96-90hrokC9WiJPmG9b5a7ZQjZ8iDccBEXF6nP9aCb2A7vb3fFGjVPs0mtWUSZlBIBXpHq2_6XSNpqnoROVp0gwRaUqoKwVREP1M9j3tcOWzlllhlti3a7TFJh3St2iEtLiKAMtV7kbwItPbIsJIzxSfPxSc7tQ5euKXrr3LS9Im1kQLb6OPhuZWErCKuvcVcXQ1ThnZMeROGwa4kgDXyEDRh5wsp5_EMRvMW5CKgQEjR-fOpxw7xMl0q4BMV_TOY1-7-n-vaorLkEG9n2uJo7jZ1QalDqP77qaeYNJ_x-vwp0DIa40xMXxN6PlXYQl9dvAlegl-K5CHGzoCWWgp_93HsDSkfZ9RHoL3ULE_F8BBqSpJGiHl7oeN2i0csn5hig7ZwWwhcjx-I9aabAmToUwlm-26yuLGsdp4GuWLzea1xR36WOpQ5hJoSInBeJJqP&sai=AMfl-YToVoZvz3Pu-7E40LqHMEyN3h46QMQucMfTKrOMCOsiwGUPTrKIkW3r7AFra1rIfsBE2XDrPpWcroACW6czfsYGM940rtA7D5VgUdHbzDqHPDDdWXk_5nbXC3W8zY_Z79MyXcCza0JtyLB5ZlFRnWlSaPaY3owMzUiOP3JAjAocvhcbZgy4C5Y&sig=Cg0ArKJSzLxsplal_77ZEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cstd=0&cisv=r20220112.81702&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 17 Jan 2022 00:00:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 854B 41 KB
15 KB 72ms
36ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:19:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 204077
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Jan 2023 15:19:13 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 19 KB
9 KB 346ms
346ms XHR
text/plain 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=227882031419255&correlator=424801369215355&output=ldjh&impl=fif&vrg=2022011002&ptt=17&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&gdpr=1&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&sc=1&sfv=1-0-38&ecs=20220117&iu_parts=121764058%3A22532057796%2Cleskanaris.com%2Cleskanaris.com_stat_336x280&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=336x280&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&bc=31&abxe=1&lmt=1642377630&dt=1642377630623&dlt=1642377628475&idt=2115&frm=20&biw=1600&bih=1200&oid=2&adxs=972&adys=197&adks=1743717478&ucis=1&ifi=16&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fsubterfugue.org%2F&ref=https%3A%2F%2Fkartaplovdiv.com%2F&vis=1&scr_x=0&scr_y=0&psz=0x0&msz=336x0&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=false&fws=132&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

a56587059a91f758aeedd61405ed8dc6b28a925aeedb000a802fc6e42d01d4af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:30 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9557
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://subterfugue.org
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 2604 6 KB
4 KB 132ms
33ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 17 Jan 2022 00:00:30 GMT
expires: Tue, 17 Jan 2023 00:00:30 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 7E4C 41 KB
15 KB 53ms
52ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B4frtsltdRnlAdnrky2swm4uHNuzrKCMGwgbYTECYycu-TCr4ipJC9l5pb5R28Dk-QD9xNaJtjpT-Xn-_fyVoc_gn4xQj9-yeUDMY-ohzlgdF6FUbA7dmjT-lIAL3pqOofGTn-qHMZ_DldhA0mO6CA9Cro3g&cry=1&dbm_d=AKAmf-BJ61SeLSoQX-BTjwPy7h7um7E5Ayh9_enea1dDm2NQlDWBCRB8iCUBfEea-tY_10AW9kSjkBIQwoJ2hSpDqAa3JmFfNbmSGjPYGMDguJK-1dhF7ByAgHunp8EftSooLWAsXV_K9Be1P6j3voWS9hg1qgczlchf_W9tIGNI2dslPu5UO8-vohfxUDTqiA7jOY4-w2k-ld0YcQ9IR_QgoqWbpFJZjA9ly3qbpq3jhgG9KleIaO1DWoGDF5lAmLs67PMpNHgkItfHB-XJ5TYvV3G2f2cbi5g1MFGeWGItSRbOLEttV-j53AojxYPKzn80G39gPbXghw1Qzx0XCL3Vs-eQQ2ZikRqC0pCaeTbO356LbSWj_Uh74xn3mZ-sOCk2L1uKigX4lnC5B_BGqXJleiiwYMdxlQ0JFKF8QB8Gw9nUbEhYmAHrcHWnwg7N1bSE1r5IhToS19N3eVhmp3w9qYjmDaAcoWwW63RSwfcOn1sDJv_ESsGgaae-Iqqhy0EeCRaRT9Zg_VTAmYNWYeKKFWKKwJ4Rpf7R5aQq3TZiv7P6RIb49xsE0_tv2NihTcxu9BRsak2djztEPQxWkRYadlgaaYEY6-N6vxRs6YnskqCa41SG3IcLZc7PBJTcxvU2v8Y-qdiPXQ2BP0pJ86C_FwCzHf3kgPu2jubJ1_qtfEoFFWbavoQJQl6C14izwXOMpHW3KJdoHABGSxeks1ulSwpBAC5i-InM6T7ETVTHgs9wJZPh8tqQtiEEspiiI8oJ87FUYk_C52k1CFRvtfJER6sD3iYsnaCaciI3AhXD9aljQfYA790VBdNEvkuzJ6MKdskvnF10A0w8lmVpAXJXdeZ7WCcIKZTapp1XZSK-jY83Y3NP1Abu79TukcLYhlC1xb-rrZ_R5LNAbhQUQXPO4425dBf-T3F9Wu4l2UjXeCJKSxpHvzqpbhltaT_KyvDbeNUl6oIm_49gcKdIL3cSOjIrA7h3tQsO6TvQu0SnW5_PYDaPxmAU88TeiH_tQKFaH4bpF_hq_0_p-f1JxxWNFHB3pjH2BP3IGJfcJ2Ck81BLUkj-4QM2yBY9CEwym2WWxwkGvBmgS0bp9_0vacJl9Z9CcvZ0DJSlBL9vn-IAvqW6wQSPsNRExnUW-lyWMUJZDtzIE6wNzXlvP4hnOrhiQHjkl8sVhJirdpmhHNLCcGXXHHeWbVEEiXTrMAarBetcEQbuu3lj4j8qUPXR3W3Sw0XUB32sz3xg77m6ZupFFkjrIwlEf0QGdGyBpL46626gk6iGB82fe5GmqiBTinqsRpbOkw2DrfgmySu12peHKVEcQ2AGR9afOVyLONGqQEAEKcpbJa-YXNXF4Qr--wqnTE1dwxOw0qwBsWSOURFPEHi2xDGLjs94CqTbMXrwLRaGkwd8a4aljr9WpTQHNgp1X_R-mXXQ37R2duuk2becuJax4XxJulizQEAj3RKZ8C7cUSp5IvHoa-zfkrEm4z1m3PWvmljWU07nV74E3JkPC0Lv7JlmpVf9Dh0g4Ww6S3QLDZ7X7LuLNtNFu4fsAfU5J2-odPxa_wfx4JTgHIDKTViaSHFk29FUuU64sNtwg1Y7BnYKYaOYlerjT5VGXDvxFUSjuzde1FnvI5e4P1Yz8VS_sO-68hMr4jOHvJ4QXl7GHqPJxNutZ3ghSTwd2PRSR9wsKIkPw-Xuh921eqJ7rIaJsAS7WEYXLd7wHJrEOLvPYK65ou5YkCAXdgzdIS4s2mtNepBBbbNGthesXr8UMkRoBdw-d25EvHjVAtcwHW_fdnvIL_sn7fc5mWP5MGN6i1Ux0mmTeHj62IWmcT_I5xKtmyemLSlsAZk4cDB3iFnVt3GgjA8PmVW5A4ZYiROf3oyYTNI-mvFfImpqUsy1vIXhLrqn2IHz5Ml53Dc6RAO64MFp6lXdCBcqriT0_XRHQDD68Uk1pOel4ndSg5gEsTmezgzwCiEBzubRjeDS8P7WrpOAj3rtHwGDsq5G89_CHTEpA60X2pB_C0WOBX5Qz4YgMMayniFBppWG4dJTGMHJJrZSlQZdNNVlKnoz2PiIgZK3Pn4ZLjrU23GnWoeHgoo2VSyqhIw4-sA6bOeoTFkCOShT-WXEPiTM1BViOTd6Mt40fffz9Op-S48Qae63Wjw1Aru7nRRqH4h2ESFZJdtvoBDHx19_nPjmKvFLP9CCkCO8lmdJN04gw0PWOWbjaT2bgn6_W_nXkyHHHUD1ga0WVHpX3nBvOnRXbF5qxh8dh-qrYb_Bd0dZapcUU93icBYynD2pQ4cM5sRBqXXGdGzjdU-oN1yeti_QJJePQWnuGSRSX0x9tpoksgVvQ1yeo_gMbLJoBYnM4WEVWN9P62igsAy1YeZYCFLM6s9xZYmzskdIur8sSlWsHQjFfMnNskiftPRN7c0P5ATCvCe6lFRaZxI0uE02Sj7rsN273xMh1YZ1NkNUDLh6oeIkik0iXNzDsNa296bcZ71kKKkj990ALpiFsQm32bThBWULUMRacVrwLj_F1wXtGcjnS4xj4QLeLFK3HRSwRcnhcglk-fj8D70002G58QtZKpchHU5fcQ6fJSpiUCEHWeKJEJWTmsRIrrI54ChqJCnCSN9k12oHdFhACkasvaGPrwvBJH19L0-uIru10jCvmNmVrWBIYsSNoJC5F66SzIfJ4akb4RoorgMeWXRBuCiAc2yrdFyHPANXqMNbZrrTv7qaO83S1i7OB-6D8mnnCxhwqkGb-I3P7sLe6XFGfMiZIcWs8UrlXzfrpc1Rjq6m8cxU6QwpuzaZOOjKec-hQ3UChUX5khSzSnBDDxRQg5cEgObbDuj15Evl_zDkxz75krKlZA4cSPd7dzi8BmIPfKlINRQBNQ4yySxaYUsi&cid=CAASBORoEaE&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:19:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 204077
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Jan 2023 15:19:13 GMT

GET
H/1.1

200
OK

300X250.jpg
vht.tradedoubler.com/file/324110/kit3/ Frame 7E4C
Redirect Chain

https://impes.tradedoubler.com/imp?type(img)g(25128932)a(2865028)075512613
https://vht.tradedoubler.com/file/324110/kit3/300X250.jpg

34 KB
35 KB

105ms
27ms

Image
image/jpeg

65.9.58.6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vht.tradedoubler.com/file/324110/kit3/300X250.jpg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4064271541&adf=2759310875&pi=t.ma~as.9187253983&w=336&lmt=1642377629&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629313&bpp=1&bdt=838&idt=398&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=9kSavseIl6&p=https%3A//subterfugue.org&dtd=406
Protocol: HTTP/1.1
Server: 65.9.58.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-6.fra56.r.cloudfront.net
Software: Apache /
Resource Hash: 40f94a2692115bd6079b150ab723a47eebea10c138fd329008b8c53cb9b8718d

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 14 Jan 2022 11:49:23 GMT
Via: 1.1 fdd677a35b242f0199586a71e2f6859e.cloudfront.net (CloudFront)
Last-Modified: Thu, 02 Dec 2021 12:58:00 GMT
Server: Apache
Age: 216667
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Content-Length: 35171
X-Amz-Cf-Id: 7GS2frQcN-N_9vWlIY2klDAM8NQ8aJbELXQ22XHgvTpwFYuW7B6rqQ==

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:30 GMT
via: 1.1 google
referrer-policy: origin
server: TXServerHttp
location: https://vht.tradedoubler.com/file/324110/kit3/300X250.jpg
p3p: policyref="http://tracker.tradedoubler.com/w3c/p3p.xml",CP="NOI DSP COR NID CUR OUR NOR"
access-control-allow-origin: *
cache-control: private, max-age=0
content-type: text/html; charset=ISO-8859-1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 262

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame BCC9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFMW-4pyJAFIdeatPiVcEUM&google_cver=1

43 B
1014 B

71ms
42ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFMW-4pyJAFIdeatPiVcEUM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIr22QEQ242E8gIYnvKyvAEwAQ&v=APEucNWcgm_92W_rv8rLerZ665SWtxKIt1gjs6syMzWmwjV6JZHDSwYlkqactoDjY-zfXBOgeUceGieFH3yPk6k9UtfoSgHJuWJeo2DJz_0ZTsqzdSmy-rfepclEJ60ukmCGaUy75sE41R23HZKv4hPxtyEoufig4m0qk1NvG-xcwpeQkPH02RI
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 00:00:30 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 17 Jan 2022 00:00:30 GMT

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:30 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFMW-4pyJAFIdeatPiVcEUM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame BCC9
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YeSxnsgJnEB3749r8NiCxQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGRuKmIPm02e_9zH1M2HluI&google_cver=1

43 B
1014 B

56ms
56ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGRuKmIPm02e_9zH1M2HluI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIr22QEQ242E8gIYnvKyvAEwAQ&v=APEucNWcgm_92W_rv8rLerZ665SWtxKIt1gjs6syMzWmwjV6JZHDSwYlkqactoDjY-zfXBOgeUceGieFH3yPk6k9UtfoSgHJuWJeo2DJz_0ZTsqzdSmy-rfepclEJ60ukmCGaUy75sE41R23HZKv4hPxtyEoufig4m0qk1NvG-xcwpeQkPH02RI
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 00:00:31 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 17 Jan 2022 00:00:31 GMT

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGRuKmIPm02e_9zH1M2HluI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame BCC9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEDACkytWOEE_nhoLiajfrFU&google_cver=1

43 B
1004 B

49ms
22ms

Image
image/gif

37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEDACkytWOEE_nhoLiajfrFU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIr22QEQ242E8gIYnvKyvAEwAQ&v=APEucNWcgm_92W_rv8rLerZ665SWtxKIt1gjs6syMzWmwjV6JZHDSwYlkqactoDjY-zfXBOgeUceGieFH3yPk6k9UtfoSgHJuWJeo2DJz_0ZTsqzdSmy-rfepclEJ60ukmCGaUy75sE41R23HZKv4hPxtyEoufig4m0qk1NvG-xcwpeQkPH02RI

Protocol

HTTP/1.1

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 00:00:30 GMT
X-Proxy-Origin: 37.59.164.101; 37.59.164.101; 693.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 958ac65b-2e50-4d6a-b06b-2ea11f1f3d68
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:30 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEDACkytWOEE_nhoLiajfrFU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BCC9
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTE0MDg0MzM4OTgxNTcxNDk5Ng%3D%3D

170 B
188 B

116ms
62ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTE0MDg0MzM4OTgxNTcxNDk5Ng%3D%3D

Requested by

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 00:00:30 GMT
X-Proxy-Origin: 37.59.164.101; 37.59.164.101; 693.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: e87906a5-52b9-4028-a4d3-3af090e4cefb
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTE0MDg0MzM4OTgxNTcxNDk5Ng%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 077D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFMW-4pyJAFIdeatPiVcEUM&google_cver=1

43 B
1014 B

70ms
41ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFMW-4pyJAFIdeatPiVcEUM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHR6uYCELDS8uoCGPTC770BMAE&v=APEucNXxdhFv1NjfEf-S-l3-myLnWK47JALLAv4xlyiZ_d0Hu7im6H93EjblFKUzBdB8phR1CtMbQkWOCxmpof1AL25huQJI7NUR6tk6MpNU8HzDT9gNaj6GaDEfu4Hx-gK_eE4Fr5XwaX40ej0zrirb9Ndg6sRonxKJRzOSG3KOmJKkBcBvLiE
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 00:00:30 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 17 Jan 2022 00:00:30 GMT

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:30 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFMW-4pyJAFIdeatPiVcEUM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 077D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YeSxnsgJnEB3749r8NiCxQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGRuKmIPm02e_9zH1M2HluI&google_cver=1

43 B
1014 B

56ms
55ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGRuKmIPm02e_9zH1M2HluI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHR6uYCELDS8uoCGPTC770BMAE&v=APEucNXxdhFv1NjfEf-S-l3-myLnWK47JALLAv4xlyiZ_d0Hu7im6H93EjblFKUzBdB8phR1CtMbQkWOCxmpof1AL25huQJI7NUR6tk6MpNU8HzDT9gNaj6GaDEfu4Hx-gK_eE4Fr5XwaX40ej0zrirb9Ndg6sRonxKJRzOSG3KOmJKkBcBvLiE
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 00:00:31 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 17 Jan 2022 00:00:31 GMT

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGRuKmIPm02e_9zH1M2HluI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 077D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEDACkytWOEE_nhoLiajfrFU&google_cver=1

43 B
1004 B

70ms
27ms

Image
image/gif

37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEDACkytWOEE_nhoLiajfrFU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHR6uYCELDS8uoCGPTC770BMAE&v=APEucNXxdhFv1NjfEf-S-l3-myLnWK47JALLAv4xlyiZ_d0Hu7im6H93EjblFKUzBdB8phR1CtMbQkWOCxmpof1AL25huQJI7NUR6tk6MpNU8HzDT9gNaj6GaDEfu4Hx-gK_eE4Fr5XwaX40ej0zrirb9Ndg6sRonxKJRzOSG3KOmJKkBcBvLiE

Protocol

HTTP/1.1

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 00:00:30 GMT
X-Proxy-Origin: 37.59.164.101; 37.59.164.101; 693.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: b084d6df-1ecb-485c-a7fb-14560a72d860
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:30 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEDACkytWOEE_nhoLiajfrFU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 077D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjY4MzAwNDU3NjA2MDkwNDIxNg%3D%3D

170 B
188 B

102ms
61ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjY4MzAwNDU3NjA2MDkwNDIxNg%3D%3D

Requested by

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 00:00:30 GMT
X-Proxy-Origin: 37.59.164.101; 37.59.164.101; 693.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: bf75d550-b937-4f50-a6d0-6443e59d895f
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjY4MzAwNDU3NjA2MDkwNDIxNg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame DE39 22 KB
8 KB 31ms
31ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 14 Jan 2022 15:19:21 GMT
expires: Sat, 14 Jan 2023 15:19:21 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 204069
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201100101/ 149 KB
53 KB 52ms
52ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201100101/reactive_library_fy2019.js?bust=31064017

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

73a6ba10b8b15eaf8d951731b6560ec798bbd8144f2434628f17924c14c79505

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54129
x-xss-protection: 0
server: cafe
etag: 5833308966351465010
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Jan 2022 00:00:30 GMT

GET
DATA 200
OK truncated
/ Frame 7E4C 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0c93d33a708948e8d7961af7b8577264f4516737ac56425ca4c6e222de60e269

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 854B 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b6e0d219c4feb530d46bdb0ddcfd48d64eae4d93af724f4dc7bb0bdc72e616b3

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 854B 0
23 B 97ms
64ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 00:00:30 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 41BC 22 KB
8 KB 26ms
25ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 14 Jan 2022 15:19:21 GMT
expires: Sat, 14 Jan 2023 15:19:21 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 204069
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
122 B 35ms
35ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=subterfugue.org

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 00:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 34ms
33ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=subterfugue.org

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 00:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/ Frame 5C77 11 KB
5 KB 26ms
26ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

425b48211e0ebe795b6ead9ec2f1bcd9e04e9930a7dd30e08cdb2fef0bcb834c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4885
x-xss-protection: 0
date: Sun, 16 Jan 2022 02:57:35 GMT
expires: Sun, 30 Jan 2022 02:57:35 GMT
cache-control: public, max-age=1209600
age: 75775
etag: 13671712056976469594
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/ Frame F746 11 KB
5 KB 27ms
27ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

425b48211e0ebe795b6ead9ec2f1bcd9e04e9930a7dd30e08cdb2fef0bcb834c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4885
x-xss-protection: 0
date: Sun, 16 Jan 2022 02:57:35 GMT
expires: Sun, 30 Jan 2022 02:57:35 GMT
cache-control: public, max-age=1209600
age: 75775
etag: 13671712056976469594
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9609 6 KB
3 KB 87ms
43ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 17 Jan 2022 00:00:30 GMT
expires: Tue, 17 Jan 2023 00:00:30 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 023E 3 KB
896 B 56ms
56ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNUbqMieeuxPDwG3V0VHdqHsLcOrnYgVCC-hhwvzQpqSRuDAdrTHJ-gAbmN3VU4oY1D9XuGM3sY9LgvvEI3A5qVGbByaoaE3xp6FjdMXNUXKqwRFxyR-35fTt2QzJoMG3yMHz5UQlplnCL90lL_OeeGwHjh2hmWX4l0MKa2qTxwclPB-KKWt0uo6wHEjjoyL27ZZhc8VfSBGphdJr_JpgcALGoNC_oQLfz4Pi-rJh4mUBSFqVmHgcw7ibtintAtogOYno1pakaxW9BAV57l8RwO1D0ExIlk7-J8D8In7xNxXB0GkLcBoScN63aP5Ut2klV-pGDTUR_QAwCUwyk_GjTbS9qLYDDBXHXhEXEyLrbSgeNPWlyMskBthnLv4wqosRFsLfPNxiOgqxcINn2K78Dm3rHDLShhOZ5NRQh5vw6uJaJFZ5Qv2vWB6EKVCXaWl8Xa6AltJF4GTcldX4mZ5CIeEnMahKNSyTFDtDKfGD1Nbw0FzGHHEbvzs7Eb5zBnG0jtvQa1eHUuEGQlXeCXcydjbB5bLXhRUlHXO885G0X-wmw9qN-Z7Uz9lq7vBouniiyL6mQhDzPQw-OuOs1-b4QwGJ4u4RA7I6Ev_n0RZVyvASagCB5bn-wgEFAuu0NGYIoQTEQUYEc9kGV7lyXj3a8UWDwGVOx6EB4K8nkOfvbTBAxy9wu0kw4OvAdM3GAk85-PgSBDIfetmsyxR30Kpsy6SZnlMdNqL9g49-MRYi04Au3viE-2ofYsAClt93zGeJrPGK5BZRICz2bDHoV1pl7nC8OLLBnmH_zeZzajnfzB1LRUBzij6CsgOT5PKChGONd3C4X9PaKPIcsNOG_GCa3_duTze5_J4FkzFfYw5G1z7MHxrPYlQ4CtlkCko9slCtx4jjMGbFD4vzFG9CGfEYcAVnMyEuzDDxiJr915OB4XQjWF7Wow_esyzTBV_piCl7AFmMbAi-1_f8Kl9lA6sm2SNJpWIVW1jPBXzxnzXS6EGdeTC2WAh-sZt8KP1oDnU8IlVHurt1zkrLYeAqfzmUQQdUYO5tw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=462507153&adf=1780082840&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=685&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1027&ady=2049&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=9oRAN23ZSu&p=https%3A//subterfugue.org&dtd=1217

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

acd6327ad08e4e3512a73e03cbf398d1367b04b4b6446454454a575a4920d5ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=462507153&adf=1780082840&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=685&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1027&ady=2049&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=9oRAN23ZSu&p=https%3A//subterfugue.org&dtd=1217

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 17 Jan 2022 00:00:31 GMT
server: cafe
cache-control: private
content-length: 874
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0E3E 71 KB
30 KB 82ms
82ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cg9_s87AEcBdprzDHJAVDQKAWAfjmGQc_x_-JRv5jCoh3DEODEtTCwHiqcwfVwnt1LfAtcxehMMlzCvc81s7ai8D-Cd4lTzG6VKUqV7S1FGPWNhHMY7UNhMcJGYVr9cz1iwHKYotA0ESHdWIyngPZw3y6ZkA&dbm_d=AKAmf-Bc9-aq65gk1Iyzk5iwOZ-fG_-Awt1LlfBweAXaHIPcdo0myOhy9SR3PCHJ-yT9WSpAIzYcBaoyuPwxpBnHl7Wkj08foF2S30pPjChMXtQCxYbSxbVEBJ_tPZL-KbmoaOff1o7aqQA4wSdxAEhqF2VsTIKWN8JUwr0ZldKwIHuForN2Vfl_v9p9pSsM348WmGpIEzf9eXQ0_KwQuswNgLwHtUjmb2-Sjs13K36j978DI0wpcxHMX8iDfMUTHdem0ehpCFVRwhtm5UmtHXScrsfmpxGz-qAdIOe0eHiA3VNjuTeRxyWpN17zYtWQn0deyuyI4Pk2mjyoXH5QtZ8sxtSseypQ08DN4Y4zmAySfuDXFRqINTG-g0Kxzq9M5cRfIsbt-Kg5w7qcOyCPsVIUXE4L2xy5dVjQ6cBIVoZkHWrX5tPqXuLd7w2IGX3lHI34yfFAc_Y5CiL75rpH_uC67CPj0qBdbU8Ej_vvU05Z3pUnCTXn4mUdX075IYWqAedod5CgNGOg8Sm1A_4Yu72xb-EIA6j5njOLua0P8v66XZr3z794SI5OMg3rQpZaIXuTNWMLeo9ztfXUIZ5pv_0RGNP5-ihFvIS-WS9pwXTeGJ1-Uzj-5VXuWnT1hqtozu1DoG1l-Q1Q7QeaZr8aamJAK-jFKxpQzmBNFrAEhD5k_BMRkKhE-mMQUf2Dw9MUiuSosb58qBxMk7OZFp4fhm-iVDgNX3wkX5d3OzDeVj5_WA3P7-rbqgODt3G9jM-BBQkW0vkWF8F64ZNr-bxNJoP1biLA8tYaDr3ABHdhEiJckUD_ybjNzkorCO01ABn6X-o4zWBXS97CLormo6DjFIktH0-Cs3-ScTv8s_F4zzs1qtHFFsHwQih8--J0gsVYf1BoPhLLFfEDIJz0CCAfhK5NOZ4zdmj5tuwwcKnboNSABlKn5mK6KWHZDThod834EH3gd_byKvOTNKJL9xQ3u8KA1u72Urv0smty8_hd2-6kg19pBYSWFWBgVnFvcbm73fGSdObDX09gdgsj_EgOitZ0_9K9GMaXiKJWx-S0ZG4MbFQ_mVCGkQzsE-4JNpwP45Kyoj8iIh8VWgAGUCx6yVilYG_uBRu8kvLfh_GNOb3AYjOccdUDLWvCAYknvzznxiQpQVRS-sD5w2xKFfOytplV95xis9fyR279G1Ctf6BHDFo_gMnGYUK74hZHegtjK5zHQiOnwstFHNB4L7LV8AiINZne8G1k-T-1co67CiLU_gyFOyjKm0VJrUT4dzjcNO4Gq7Jb0a2cWZJEZV1Ms984gSRDQF5pSXQqh5a4NqLbVc41ch5higi50zeg6rkk12xMLwcK1jIRSeRiULdDbvWo1uykSRiHD7H8DW4-SuIauwLDZUjUIOZ2r5Jkjxv8YnH_ZfmSvsEPtX3PzieruScIiVPPIkjuJROKpcfD3A6c-EK6ayvKiKSh_x0oHuyyIeEkC_x5FfoXtRFL_0P-6cTcvpFSkKh7SX-sm_pxQMzHZw-3_us4Fv247WwEo0RrVNaHfkGqccw0Ay-ou0cJTnadw8CiiWHQ89XiJmlaiZ97wQ8sLJ7h8p6Aup8y6FCn_1KMX-MBD6tB1cEtyo4KKldeJ2cx8l4FzCUi6NcGoR4vbnDKZRaBiCi_ijQU2yLf5fou_U2BI3jO4XH_rs5W_5G1s6vt8-r6SIR2F9J7tO4Hx3W4EBGgurDcmkhWLh1PsfEPe3x0dc0wdt_MzA_owOAsUlqyRkXsHd_KJqw6Y0Ujl2dyUhTe_dGgASpJVhBj3DIncW0OfV6z3YBaJE-edYAFYhrSLDv4HeM23SX5yl8ytMme2zkb14NDwzFjcO-7Vtlq_32fPxQcHclpQZu4buFpqtodk3fsuBYI99eHAHiKUa2aYOPq0nxlih5TOYu-ME_TdlrqAuLf0AYmhEfF0k01abNgbVpcBZmLu9OyGsZOetsyB-3cd3N8tj4xufS6nYWb4obkkdBiUsO3NhR5s0gCLjYIhaD7gfvLd5Z7ary4kT5ND7RNSIiA4EZ5sJaaDWqYXcQjIz9kUFIVNHKyIQkz_1do1AsBTYiEx80-KJ7R5UfQkzEWEMhQ-xczRpFrRi4XCq62rdC_nOZbWuc7Q_nzbf9sghpvwa97vgz5PKakVmaHq2yGUFa3utpxihWqWV-ia-tI7nKP27ALj3miKIjejUXpkL4E6Z9cZsnfMiPOKHmibtsGdUMXA6kJ9EhMUNK4QFKarG2R7QWCl9T88-cRLtVB-3CLu8TN6oFvHzDk_245qWu6MJ5AuyE_GDP2Edy6OwjI4EUA8cf06Q2QiXD-t-HaNamSB6CpzmZZD4lM11g2mOD6-aFJudEPyROCKLbAGAziKELnWG8Ptjvuz2htd_jXViWDxu0ONeePlgTm0oHDEkg0OROfACYlqYSa4yoDWU50LgY5j9tBdlwWLAYxE_YbE9eBBZorj95ZlUoWH536aLpA46OL2Rh3Xf6p9fTdZdfUUEHpDGTkAC5KJg_sDfwHPbkK3B8MN6YBQkt5HdTnjHAr5H7kVmjxPST6siirAzCExADR8t0qG1Hdm9qd5spiiCMr67K6-RJF8vVAAe2uXD-bqDFFIXfP50rOUtxMYAX4m0cyAVl3dwKWFtcyyqUGYNa8ybzzdMLIDVl_PGT5O1iX57zMfGviO866y2ZypoN5S7keVbVcS6hqVzpNfDgkQ3zXoT5xhz3KTfqRaGOKBXGNQrVdAs6jS0mJQayRIx14KUqP6WxnQQppzfbZzHgKfP6vAh2hitjpjg2eo9qtF_RJ2ko1faMbN5snTEPtWrMavm3Idvpojf5Pvh1lXZz9bRI8d-SnNhV5BbHr9NgBUzINbumFRPkG0BvKiHja-s0JtT077eVWfhHBsb9GCsv6VzoImo-vI-bBiDqjxjN8WKWtOVKkbelfk2qY5tNZImwwfuCt60rKtw8UFP1GVC1Y8eErXDjESdAU4FFQV9kjZ3bAUxD4v0MoiO4ZItSyEmoOp9k7hltdh8q1eC6p16_z2ZlFVAutJIVkUNwSfvBLaVjuOlPQgVAH0NGK3ajNmUgUwA0D0nCzBZYbtfKXQccSiZWxNBiSOZsLb3sMI2zZe14Q1U-WWO2umYu9WBmVy7edIWTucQlqY_0IOueetA8qN7Z78ZdZyfcd97-LscRs03G-j72mD5TIxEHWjJCRj0s5AGtrpmsRRFJCuq8eTj4fRyeu1fV_wjfpAJtlpQnNqOvkAJHRpN1zWEc8tTn6iZCdmkUOv7DNMu4Qjf1zh9GFmzJozFkVE601uTbISl5_K0oaKmDr7vgStbuiTcw5sVoM_Aes-H6Ib3awd8EC1wRDWNgx-P-9FiSbNUBo_c7t0cF1qXWCTHnaHXzdbyaQJDqrLL2i4iXXUJwRkILGj6s__lOETpiYRwIUy8ewMOdj96OxXuuO1LmX_1OTfSaOigFO9djxkyBN4is_n30GxlXzNsyqEeaMvp0TWfYwCPQwV_C4Nfnq0s_BGRYZ_wbIg3oc-jKNMQf8IeQfEwpZ821z-FPsL3gkWTILT_azgxmWUcAWe9Ks7fhT7vXJszlJpAcrRmuRnDnEIuFhW2_pt5eA0P4PTFZ9hkfZJAikItWvg92bSgQ_i0Mu8jLfQD568argcl3yx5YKHUwYswulQIW7Jn--TfAqoPAvEwndrOFzV5WNskdHSsKLYp3PB3xwNaQZ84byvSVHXW5r_AUDfc--2gCVwWYLhpmcSbyG6aEwMwUf3gZGg1hCgE_5lbbXX6ZqKEQr7dic5_at7ChaxnN3pfSkfstDQzj_TnrUh5UEWNa6MJ-dPhpIceEA0UdMQWN3bKcB&cid=CAASEuRob9PbO8Edfo32w0ppFeRn7w&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

faf91dcea1840cedca0a76b4471e70915f475e9f968d059ad29aa202ead75736

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=462507153&adf=1780082840&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=685&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1027&ady=2049&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=9oRAN23ZSu&p=https%3A//subterfugue.org&dtd=1217
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30181
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 0E3E 2 KB
1 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:50:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 604
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:50:27 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0E3E 121 KB
37 KB 101ms
49ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 17 Jan 2022 00:00:31 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 0E3E 15 KB
6 KB 43ms
43ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:55:31 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 0E3E 0
0 136ms
33ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT1dW8yx3mlJ_rGX6JD-YspP0n5namE-_UUatksTaoyc3Hc-IAGGOlbwb46DdMOqpZ08SiyxBHc3tNpir4F5whaU-6FgQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=462507153&adf=1780082840&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=685&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1027&ady=2049&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=9oRAN23ZSu&p=https%3A//subterfugue.org&dtd=1217
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0E3E 42 B
64 B 92ms
92ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BjGV3kVqIZebAVStzXVmYpu7RDv8duGcDcDuGHGfQ0s479hMG8-gL3qckwc7x-aHcJI3dDPyHFcc4jmj11jjsyofRjSrybWDgkxjAoSYQaYNvYftM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame DC61 4 KB
921 B 58ms
58ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNUFwg7otpgOWy5UrHLkVr1ZHOoiQU9ZW0krdPN7NX8x9lY3-yiHcqKoZac_PpAsphhmquG-wg2wtDtCO0O6hWs6qtM50091snPL813ne98hO64cRAbBGx8J6SHBd7i5tmLsLVHPzKK0MjGPnjxukxxM-OrEonODZndvX9zo1x1Knx43xftEOhJt-j6_OhSN4e-cRQnZGF8Ry-JimbUweEroJ13FThxr6XIpBkYmDUqeTgL5WgRh9J7mYlYZUt47Hw6AsGqH4GQmwFw12WQJRBwxXug3G26j7B5nTktzE198ZBtZrBbZktrWffyui3IWvUL1_vLsnWrHwqi41rNN6T1FZz32jdXmto7W79Qlziv5I70CfApBH49eFcx8QmhYMVgpeIkWXVCu2w9zi3YiqWB0oTiHqA6z2RiHIybPsSdiZBHgB87gOO6fkWKuN2ZN62b22t525C_QseMEfUwhJfsc0Mt_FyjlokuypX5xfojX4RDvY4Rvhwl_GW2Ki93MKJBu9NWidiWWq0PJPvWtNDPyDyu3h7tDyF8GxxNaNB3prCbBFc4tcheo24EQvUCYIuaUusnE3FpNxxDyBLoAbCk-tceFWQ8jW5ne8-VorXOP-OWMY1HUgQ9ReIkkuExmrMvyM7yL9X5QqdHs5fnwjE_HxXILCC5h12eu5_P1YBXUhR6_Js93aYU37uJbsOk2MhGXf_LLh-lny4G60p_WSrHGlJhHqwfnBGcV564HMLsmMQCtbvTis5br2vhq7SbRZ7mn2Pb0Gg-9pHXT_-s7GbWJNWyelkIXBRNiOEoZm9PuHkxLgORTLWjMx-MDfXjBWL7VFjptkQkkQkxMaT0neXFdGxR88GMhdRuGVzWQkPh-MRwKUBP-lh2cpRYGPgT__Xe-rAPwlBPm-FcDMKOOo-RcuBZa5NmXsLWmsnYw9sk0W_LW_3xH7Lpw9EnGK2gArPTWTy9LEVX6M-b2oPM0kLw2c8KtWSO9rFe-9cVSdcGQIRY6DI5luaWhjcY7P78TfVe1rkKPacQqjEe7gtWaSDpYRJm0Iw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2495647230&adf=1404796083&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=609&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=607&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=75wf9xBgZQ&p=https%3A//subterfugue.org&dtd=1212

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd72df046ba6a7f3d65b48d4d4b29000e1db17c84b1105cd8ab4c496686b99c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2495647230&adf=1404796083&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=609&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=607&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=75wf9xBgZQ&p=https%3A//subterfugue.org&dtd=1212

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 17 Jan 2022 00:00:31 GMT
server: cafe
cache-control: private
content-length: 899
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9076 71 KB
29 KB 76ms
76ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DsCEYdDGYw9z0uLhkoLY2oOj72NRxCOnAUBOFU3b-W_FpJrecVRxPP9Sp3hVueAIEcwIZQcz99QgP8GZJ3vTV-Uy7bzH-Vn5YzYEncWJS4zo9JeeoSULnctXzpSWXFwnOKdPWE2jaev2ZNm44_ppriVo0I0w&dbm_d=AKAmf-CmO53bZMnRA2Cf_h5yTDRe3ulaeFZDgFO2LNl0dQtNIJNYNtgAPQmgI2OYd94QCGb1oWo20Uuob04BSR9BmaA2TLE1M0rzuCTpJgMEo0bt-Y626Y4sKmK1w3duQTgd6d5Ab_n95Jr2LgQvGgZHUcnAQhYGX0ITGfTdvJaYtC6Ztm0dGmbZW-tLqMxCjkGOvDEd7TgFJhruzuLYfXHHcGoKS_va029RljVKg8-g3Q8LQBpUsmvHZd5FBxw9yUr_fqxpMnCgZ0Q-HF1H60mTqhctvQfNVwbfvzuL27SF9kAxGJjl0Cw_FZZ8zFvp7Ft8YOCBBp4GSiqKcN0BDkDiYf6NJlo2KJNUwuKA-bqPB9gmR0D1PXGMwsUZwaWZ4Ib1qreiOLyvanXPaiRJjPQfgONIwydfvOs4NY9Ux7H_MQ16BNA3zMsHJP6Yyk8Cp5JgnudBgxRWb4cjCcLXtmgPtMhtP35rMK1QbH6e-UFHA2iKGJSKetgnngh_oRzTqo9atudJYmvjRWfBJoce5WNlglyOdzhml99BSW3Cynmp-PthS0lxh4XvB9h261N-DCLT_aB2jJB3d__Mbwh3WlI4qBpPOQiRwwVsbpUwt0EM80qaWy8PEwXa1UQ7QFQqN8UBlUsZ2pX1LwiR0u2embPT4p9DYQ2elfNKXB44sl6jjBF2tDy0WdBS7KlGzvRUIfijBvlD947Fz44q_BHCUGubaPYqESq916sll2V13LmRrF8r6tTEhTTHa5d1NqxTszgPXNA6Fzo-HRnheO7TBMM3zIpdZRI2opBR7IgDrlLzxKGWyYzJjiYg58phebB2jJRPazWBVAl6YijiEefXBK39ekChBihU8kADjw3vzIipJvkXQX-CBHKFo6aF6FlIOY4BR7h8t_3pBYOgYw1i51QTI8YXf4Ur0mR03XVm-nRCPDaK8HJwTrcYTnTnLgdVlPXdzhe-0WyjD5quYozw5kAKg3nUzMM5R49eHria5RhaixG5jwQ3TM5Bf6dVioFfWHag4k_h8kgCCGlARd5D5Q_cZ6nORr4Gpn1SC_oRpHaqqwfc8QDlLsbHyCPpZTJKdkyENXbHJVlY4Eu11uPu35TtMHWVETccMRh4iWqwnje0USTZtuArGeRPfwvBfzLz09JmWPv27yq7oePKZpXmyjYh5PY908kmr_ndPmgaVuNerQ_pbieOygY2-MAchlvg8bunDcadqM3vzumCSs9U4p92n9MdUqgVTWqH8ymhRkvzLpqBwwMQ8rHqcJg2NllvJUx52isVabyelNq84fJ1su-4nOC9XDuBWiLbxNzjKP8DR_ZTO6vTEJRDpJk7yOAqG2qSgE1ukHNqpp90oeDmTIdWSei-CMW4dEUr7suUj_icqt77Y91a7E5SxzSGuxJIVp7XqsrgbOz9mrr3_b0k8bfRxppYT2XDJ07-fb6BvBhxXEuWrvqqvaH5jFa4d_qeAZ_zL1_WMNNtapKohPIt-iUDlkU2jL8qTtEpD79J_MrhwwMtavh5adk8n0epJyHBBK9QlCuC8vTrKBRmrcMNvzQCJ1mtqmnEfp0U9I7Ea1d0dGBYkgpBfKQxJhsWa2YnTTI3b8iJnidotJx4HgOubECuoHO4Xc_kTP-nLrOG1LanyV9LBVJTfkNiCpu7mDKXU_IMBWXdoqnLbNZ1ptxkADLS9mFvn-SuZh0pmlLvAqCqyi5l0bDVdV7BuhXaKNaAD2zSQWt6frQiKqWnrc1AirX_KioRV3rEot8CL-6iH2K3JOfp6BsXPX4qvxbOC1VHD5OnT1dc27Hi0E-CehlCb4uYi25GaxDeEPItvNRqjugtIa79rbtgW5Qjye4Fd1zND-YAXa0jokd6ztzWvrGllF6KAxO-vKc_MfBbS2qMaSAdy93HmIvuV8cI0xkOqGn5wz6esVzEGyfkv8VvI1DXAQCA9WvW450YdZMOTw8zNVnxCbGeRb0YKjaLtxkqlv_RKX38WPKq9MN3QNc06G_EL2MjhtTN5hYinF6NPnqZpiF_8cGSh6omijb6MY4rRwbka9uaIIjv9v14CguOfCkItPavL_CzCdwwNZe5Ho8x-AQwNwi8WIuuCvPqwFoEOX2gqro12sG2J4Anfi08xOzNVrHlfu9tabudkI6emRLLqvIIQqwBvo2r9T5qz3pAtbm6Eeb7WiRfdQnykxOVUQXjU2JwXWTLmmVOr9FtELakEcin33elADFqOj4lQIicUBvyoPMUj_UMxBw31j6OfZ24rxbTLgmLbSm98xYzX-VN57r0FxIMr780oM452BxCC19NukyfRabw0OHiGsUKV9Vd0TuQV4gVWWA4jSnKS-DLUwBX7DbVm7sFJ2QjD8u50DhM1L-5CBqwGt86OOnZz1EkHZbIEDQJIZRN8BwG9XYPvIIsr3DDxZJiFqxdnKXVxOKpEsWpxZAVGSmwCu_aMs9ZoDajGfxvShYOY8st_jCl4-z3nJCgGSwOruHG-7Ki9wYuQVdZB4ex6c4qrliUnH2w-LbMfYHM5KowoOEuoEmf9dU8whMAM0pD91C42PVSI7pxDyGJq-guPYnCysgbMEK9Qg796RNW7UDxvgqCYLbOcGvjAFprp4EMKii-hbs5UUmJ-LfDv4NMqmspHz3eDB7auUmU59yAsDWDORQBynD32u9uS2oHs6gVcVMwE7K6Bd964Nevjf3VD44EB377-_jKIPHLqFomtGtvY-1WSlrXUA7H8EdoFG1tw8_9XW2RV3xLH0cpzMwiKFeV8gBR7Zys2sdZpg2DHWJf9Oc6SRU_BqR98iseC9vLKI8c8gd8--ODw7CHC-BXVJfLg0ZxWjZZY6eiHji1dUq7fG5AsToAjlSda61tVOrP8rOk1OLvDFBf4T54Uqn_FZ99wC2p2bMJ_mc1ng_vIp5vGNwug176TmFHLzqBei3jkrxys4qNGVAGf2kfMddwA12jNhBXSE-te1cG4rS6AYB7LBpTIrBAnGEhuR1wpL8kk_hlkZYpIkYwwNVpDrC-EstLAdxZtNF8C2dPH7JYZ5-pj8YexIhVT-Bqh2mCrQmzjaw-dWNjOwGc1YPQZ5zU0wUAmIc8DfFI01NTewcsNGZRWpQp3F04cdbBAynd3F6z1sjoPS_QSdgad1T4qJ9Cd4j0oHimkM5JxU3EUrqfJ_2c9IrZA77qcNT3zFSHpaOzNxGeLFW0tELqhdsUNKAlOUk5y2miGGwVFg__gtDimj4W4CrtJX2MXsq0kw6fQqjjhS1gOgl78vZqrBgMglYoaE6ksfb8Da1HZFSW3996hEe7TVCc_LnrKOYp59Jab0VE1MCdZOXclIFEd7DJeqmBpMui4mBN6h0L5zWW_zq-uP4baQnSWdcmyzpV7d1ZL20diKmcoyXsICj298ICNKCoZMk06APlm26A_g_cCxTlOLzqxKh90cVEJn-d7d4uz_K3c9MQC_WGXtnheGiy7CslBUUBmGaz6xbe0A7I2uhQChciJVnHw9BE4tLOclS-63EziW6MglyPM5_-SqtiAPgsMAIydu6WaS6s6M_thkt8aB2EEDUYepouS433D3gKlKqpu0FgjdqQLAoH5EoP6uUwLXXpDSYcgTU5ugO2k7KZfWN5vruVybM1-ptWRDQy50wP7OkgqB3OYMqXar_ftWDQWZPS-lyCjZwlKuFTd3u7lZvzTlZL0j-2dHqE_QEai1rPXhw6YP0llcThn_vJdHxJPoa9v0zz314xstN34j9p224iubkOQrS5rdI4rCAD-z03C3XvH04-tGcSSgKcbSCJ8LLO4JUZ5kxYVIkJW2Ou-Fr1xQN8rsmoXoytDX46tnPDtJU&cid=CAASEuRo2LvuGs6gtlkyLrxL_zzWow&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b42bcfbcfc518df929d97de684b7875247a33a19c07f4173420016598f186700

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2495647230&adf=1404796083&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=609&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=607&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=75wf9xBgZQ&p=https%3A//subterfugue.org&dtd=1212
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30137
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 9076 2 KB
1 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2495647230&adf=1404796083&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=609&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=607&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=75wf9xBgZQ&p=https%3A//subterfugue.org&dtd=1212

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:50:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 604
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:50:27 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9076 121 KB
37 KB 95ms
62ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2495647230&adf=1404796083&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=609&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=607&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=75wf9xBgZQ&p=https%3A//subterfugue.org&dtd=1212

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 17 Jan 2022 00:00:31 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 9076 15 KB
6 KB 49ms
49ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2495647230&adf=1404796083&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=609&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=607&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=75wf9xBgZQ&p=https%3A//subterfugue.org&dtd=1212

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:55:31 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9076 42 B
64 B 78ms
78ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A80Omnv5F28HFzn7MpKCpz0G7HeTPSERtdgfAquCHdkecF24JHxUT7z7eTPZYF59HspXWx2kzd9YIbrnLtzGR5-ELD4qIpEaPo_YGe740xPTY5z8w

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2495647230&adf=1404796083&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=609&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=607&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=75wf9xBgZQ&p=https%3A//subterfugue.org&dtd=1212

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D0C9 3 KB
925 B 52ms
51ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNXAgitvkuGwkLqNOy_M7IVc6kfppdg_2VVm3ZSV44iOYTEQ9aCUpii8ebZ6LgLtgXJnYci9eMxQpoKiGuuyoEqjjNXzMjJMAZIbuBNf0xaIEZla92uvbzcqS050NPYhP3YxqPIcyn7kVV67zwPGiCsSd0YYOfib_kgJvnJAS5yzv8l2d3jRppW-EFzVDwinjdVdVaW8WnapjTPd0RYdwHa2ffpY-htqxvoYovwKkNcdYKV5bl9k3dyTiL_2kWk34AbljVIHBAsGk7VkLs46qHrITuyg1DBsjEzFUZOoKW9ilq2PQK2T_F4xI0sgkNtQaN0-H_bNBXj2N0Cmd2L6Ft-VOWFZwTQdYGQRzOcTLZRTCi2CQAM8QwTlSs6rJJt4qfg5IPTceOfZIG0vLX97or4pn7w3mgzcZFebbQ0CqfUkKKj99KeR46C9iBDSZnhxm_pftNgPxNOSyOwVeyaYfx48wKIdXbiBWcT6IdZL-2BO1yZ_AdYMh6wz0tNxwDcFh4b8zN33ioZ7iN2SSe9Z6PTeFgUfKZXV7BLKuJtVMb7zgbrvYusEPqnD0MiHs3WXCzv6noE0YWccAozP6V5ydehNSnwsba8a1XSUXSRL1eEAqXJJ3JajsWbq4_YSRoTLQdCHWpnR7sBemrB1xYt9YtqlxXScTDxcGA1FtIlKH76BqKjfytWAziePKWW8T6AworZOYBBaG3QO3j3j6Gl-ZuLs1zHcIF-KMdVG875xpZyfMamzwza1t2iqpCvk3a3xcSOqHis1wXibSPs1OCy3uSKeXmtzo2PZtTaDEwIQIJ3QAAlrDpAGoAMCIDvoM1JoUgeXQmqx6puk8qifL8bakjIjuDieQPTEC-omQ1RaAUbYLI23cRLXJ6XjYOiDt255xzlU0LmThTp3vz2GjHm-nrNCGnEU2vkRXT0xZBXkhdfFWavpZ5WUSEcZ930xJWIT96LO7jcyVIHV3SotZyfx4T9x2jjQrElKL4nAFTfdriGx73DUTRkrtfbjlSbdjwORY57W0yY-fP0N-EnzxMtv4XML1hqdjA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4117114381&adf=3954608419&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=845&idt=526&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=267&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=ZV10ewvAkC&p=https%3A//subterfugue.org&dtd=1206

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

426c774eb86397fe759d99340b242ea3974416632d24b66de3c74aeea458f50a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4117114381&adf=3954608419&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=845&idt=526&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=267&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=ZV10ewvAkC&p=https%3A//subterfugue.org&dtd=1206

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 17 Jan 2022 00:00:31 GMT
server: cafe
cache-control: private
content-length: 898
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 14A7 70 KB
29 KB 69ms
68ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CVLYWPPzrftYHFwOnnWJgQcrBLADYBGU00RL_27utjPSXlE4a7rhwISbKUHMlf1eJPX_T98k4QG_N6nUN8r3KefpKsefswsaataYETlQlW_XW92ucyiw453kcBJtGy6IFvwir5bV9knVs7MJj1po2fxgLUiQ&dbm_d=AKAmf-CHRsx3C5oWZT1vaNkmpEwl992jX7tQyseih75eFFeGgMgdLN-AKJTrmFxcFg7UmDlkYmSElFxy2riHDToZOsOhC_hYp68m16_xMxrFOcucYXR1Yx5ZTm9OcQ8a7cI4ByVhv-RfKRRVkargwVLe41TBKaZEbz7MfBVLwrKS_VKRpzjE5IS0iTB9XEvbSlTBBD19MtlDx7kiYJLM1dLXEVzcZM1mXCyaHiVGS_iCYingxvEOY6pGn3Sov4ff3FQtAJfyYPE9EXCzVc4wnE9ncbYPHZ4FLiWtw8kjeIPLgDr7hs2VoRacQO_-LNIdMAx1iz7RDTEytZdaQAm6ITJREcAm8XVa8ptOa8Onp1pd46FxnyXHm1RqOxA5QFNM1wZhw8czaMqHavLR_b9zE7YNZYvuRtmZpxdUoMDPR_EIvObWotPw7T9AgWpuQ8tCrjKIPoWQ89tiW7DtK5qdp4sT-o-yARcLz3yX_RJ-9R-5dsLebkL4AcF0ZqMBt2o7lq_4vre2cnhdpqDTvNnH0cnbXbAdb2e2oVA35HA06c4X609ti-OmsfDMcvWoLDz-9rdQVNz_WlK224QPBj8nl7kP_O03c10xCwvFmFJaBwUS_El5ABIg_20O6x0Xb2Cfbk_3V5Kw5BiUjBNFrlIzl53nn1jmx9JoolfeS5X8Z5Usn1x0shZCJQZSRyFYLBhkvnRCKv0PpwXZqzbUFdDCZcbj5beqtU_9AzmfgSbRL1AXMZuBzG1mXwuvN9LKJB--dLuUXcO9-BsQ4V-G4S0PwxY5tCYVyRPYnCq9A-wLhA2fi4EhPtbJHyKRe_8JEWfe1AC-ZzdOzdIZy0-eVw54xUWy7C03BB77CxxyNNa8jpOxvh4ynCEOj5JNY-T3dXi5OcliCb0B_O1coO1q32XWJlPM46sWgimtySp4zdpSV4JD2ifYSPw9A03BqkrqxlAONs5FggwCUoaH9zY9-fMdQTfIBqrpfaFWPtaLHQc_nndYFA-XSdOuraARtSIqnXavCa_KEmJ2CTd02CMOxWDOicBKI2SeEZlaBVdVLpZ7kx8uTV0LyxRZHaW3hmLBW-f71yl-Mv2zEwhlHAaYarhakCI7x40OwQU8WtDnZjUi8OzsAk1XzAurvcPyz4GYllxLXLfQv9zBli3eC-JBzuzI7-34zCrH87H46tsF6XdzyQqKvGdXqM5ONByyyzDJ3M2jsKFXlPlpSjOlB36UjCEASsQWPwKHxrrV0RQTQD499Rsy6fMLSaqeJg0_w4LzL0zQF8b-k6SslEqqReaAeyd6HHzMoELeOJEfRbFtc0KG8oDxwGRAVlvuEPEVnzDYXbmGyVTm8-GJ_sU2S-Rjqm3JPJgvYOs96ylbZVoI1t1NTSgpy9HRmcz8KX09CpAKnbUF663txd6yBY515lRFxl1Es1HB3wf91runOOxlacPjq9mp0BwbCH0buzhILc6nYmabu-PwpKRyyMG931d1YTUuQkJNODNQl9Rk_ikjoUrHnRrkQgWOHPbaNte0G_JFMsNWnqosGO36_zYKOhLC4J9WsHWEdolzDGQsVZRqbv5CDjxpc2C31E9CMibF4Rxz_CkzDYS7sDcFzkdR0ip73tAwMiY6RfShKwoyK-apuyGpDihlQKtkaATWLHszqN9aWHsIeJp67_Vhc1pNY3avb6rR3Rhqes2SMO4SxAfnJ_cngLEX9cO-Ve0TL0SEJ7rOykgRZDRG_s5nKnLleg5TJjIqWTpjspKRPlYjA7K66x2Ro14acWyNCqfnClHmjEK7g9Wi8J2arpb9kVTUf74Nir_cRDejokBmPQOkITy15uaIHM3MB1UcpVmuTdSkdcfBQzZIy0LyVZPONoLdGyrlaIL5Q9Q8fkqKod98uvJssXa0FlCxdL1K7TdOmijMsIWHBoQYFdhcaBSmiNDd9jqs-HBwodd5Zm9irkB4FtQOsJrdYqj6Ld-Dihv_Pk9DgE4Z45nbPh-aSh9OV7WCmHczN7OG-F6kizY-KpMvMB_ile5_rnEOIBAFoYBh3fti-TqFPWXMx5nX4aKjEWYA3Q-6CvdaLKm3LClfPDmy-qQ69mF-lO4N5YZ5NGu31OjvATGiOO4fgrkiK9SUBolGUUgEOSd9Qj1ZTSw7je5bvxcQ3rUUGwCX9605ekAieYE5KBTmmGDHErSlZuYCd1X5d04ea-yNgKc3s13X6Co1fCqKZ0B7zJe7Fjsohm3XY0Oipiv3xIATpoAPSh0Nt1XEkJy0WgCiqRd4-BDQhh150zVTTf5ZMZDBqu4xZpxTbfXbV6qwbLQpoB_aMcyjayn7naeA0UCA60RBvmxms-kXlefYjxd1yOpP43laqWeCxA-OxvPmi2OG3BoCFsDjQcArpr_aUwTX1r7mnALGRqopRYVrI5ShAWktMk3_aTouUZSQiTuii8KjCQ43YoBx-EOYsjv7rRPbVIl8-ArgehXGTfRIrE5REg8wRvSuGQwmvrSxDnCEoJohiVYCNHER4taP3B8yrFoHvzVz2r6G5jSnEBp5vYUwSivui3Kzz88dgge9Pfw_rXUTiKmNj3cAp1qeOkO7NRWMLUyao4BdmwtN7Cfm0XnILrvyLZCtULa_cG1xTWCyzcSSqt7V4oy7efOr_A0-1E-UUJrAc6q9AF64d-lJvqSfGYxyKd_Q0yYif7Oe_uzYD4NFv4cqey7pVOSlBvDIdApvx23NQ50kuONLjMf2fA6cZoHUFmZkYKjidT5-aNUtX50y59597fTu2aT7f69MacN4wl8wV2rab8xzEC8scDZKDoIAvc7lNEktwVGXZYPKDoffaWRS7C7MxPASVj3W20kdrXzWrnPozyw9R8sHdvGJr5oQZoOfSxcQlaDTq6tx3sZW34IhnN0a2tNN97Rk4RRN9ZoB4xT1qHKeWEKWxnZ5rq5adG4Owqv73LE4V60vXqc-rHBshmgNJyMgCLWVpCNkxzVm87UpEtg98okEoWdndW9ODr8juS2aSpubjT3EaNxUeiKTiGIo_MV8cFPOjU1buYi5GfO-di0WQUa4zSkgKPv6TeCdBGfQDoiENpbXXYPTjtDBZ7aNhnI6Wr430YbqGJIsrmzVK2h894VyxM5nPGIu1fYYTHxOpeoZffdXQ10rgF9q5ExV4JhM85HPvO9gkDYJHjdaTm5YaFnIcGO59S5Lm2-RcIVEprjR-raMzsDLV5pE3-b0GYCKNYVn7MOBA8mwNqXsJvq_wmLRAR_qrQeHLdVSl_W9vrCNTL-JRYRwsxhI_8tJUftDdyITSVedU431L_wLVn-JD0y9tcavuvrhh_xHfYczCgv6Qq3tQvp0dVVBZf5Af_SZ4Vj6CHPe8tLno1f6RHjaktcgCEVqq64Rzv9TSmRkt5uX3KoOUlUgvdGkpPw5ryEh21ykkcMOw9jiJxVuBIGUrCyRQKozmQJAwyucUob4iE9D9mS96SA8B7KCsEzCm5q_i9QkCUBSk26sRpoklbQ9YUZc4EUPlo7T9BdSP5TXGG4Es0EtfomP4n6TorkwLANnQAY_c6CSlNLW_1qH_NSRLEoHLX5FNsqH7S0FKFL6gvwsPqTLpRPlYGJhEKiFiQtTUl7qaFajn6e-tKZINxslBYx8tGvH2Iz_dJ1F7JceobXyEcXdWbfXZYopr0HUEBv8dsIIn8m9Ro7huII4jhtILqszqBOZ62aBlt_ALnzPIkxP5b8PvcUVmBah-Y2yyMdT7QXPCIHoZ-jg2ffeZ_05K_oLsExKxzhsU9NQCAeO9zid9bROL6L4wXExC2CuOXO7t-wEB1MOjQ1hZf9yQvG7GOGgpaxWqUq4WYc6Q8vuEEM&cid=CAASEuRoVLgiYEQ_h7xKrKG3BjkZrg&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b919007160bb7daeba86584f0657e7d6e97f6c41ae9700d275210e7679673a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4117114381&adf=3954608419&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=845&idt=526&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=267&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=ZV10ewvAkC&p=https%3A//subterfugue.org&dtd=1206
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30042
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 14A7 2 KB
1 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4117114381&adf=3954608419&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=845&idt=526&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=267&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=ZV10ewvAkC&p=https%3A//subterfugue.org&dtd=1206

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:50:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 604
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:50:27 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 14A7 121 KB
37 KB 102ms
100ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4117114381&adf=3954608419&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=845&idt=526&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=267&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=ZV10ewvAkC&p=https%3A//subterfugue.org&dtd=1206

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 17 Jan 2022 00:00:31 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 14A7 15 KB
6 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4117114381&adf=3954608419&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=845&idt=526&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=267&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=ZV10ewvAkC&p=https%3A//subterfugue.org&dtd=1206

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:55:31 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 14A7 0
0 86ms
33ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQGzI6TzPOKFhw-ZzadHW1TWU7QONVS5oo0pvUxJ979FNZvS0bkZRMrHAALDJWe0B6Ou1E8rt_qsl6tNYlseJ5XGRcQ3g
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4117114381&adf=3954608419&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=845&idt=526&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=267&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=ZV10ewvAkC&p=https%3A//subterfugue.org&dtd=1206
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 14A7 42 B
64 B 59ms
58ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AMj2bimdykhEWyadwNtnqBjEu_Em8mitfbn7U23ZIA7XUX4l3oV3bdOn5zU6xAxlPBBLHZtLCzApZlaWJjJ2h6dDqAclOoDJMusA-jhOCK3OXI_NM

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4117114381&adf=3954608419&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=845&idt=526&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=267&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=ZV10ewvAkC&p=https%3A//subterfugue.org&dtd=1206

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js Show response
pagead2.googlesyndication.com/bg/ Frame DE39 35 KB
13 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a02681ae1cc21a54f99afb9cf43cf89c42ab91bc9381aa64e96ffb4cf46e9f80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 21:00:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10792
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13579
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 16 Jan 2023 21:00:39 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8DCE 3 KB
828 B 41ms
39ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNUoR-8HAUsRWlg-UPtFlCR1w9IKDKd805HhGMqlGDkfL0pERZgZCRPLwE5AuZ_u9CQeaoD0ajNZEVvKLJaZQi94E-nJ_8tC573fI58uCTVUZ35H4RCAiNpFuIZ8OX4j34pUUut8KboBiK6VThvVzA61dFEVKmvmxzbaOtFur1IgfVKt1SCGv0GDrJM33ngHWUx3TRXzg8McanUeye5ZMcHLItcafSadsX19_WWNQUZ1_2gwyV6m6TUwf0ZsTo9_i7gAz7TnxkeK-a3Hao5uClAbPYcwknsJ_dNQ_z7nisnVYpyqRWFyV2K9rXoTipuT2g_hdUZTWzmypS9TxOjbLmlLHJu-SBy-9qVTpAzQLC_mNckOayjJeMWlkb2Oe1nNclvlDj4SPTYsFWVLoI_qajEIqBA4j6yh1hviO-5GuHnjxZkC84sbG_Ls7Cij83sqr3DohbY_aJTUWTPMNFFCqK7Ln8-pPKqfqmfpmzFPvteTI_W8QFxtJGfiy5ci9g50Ij3CjYWTPMNwRSrLbUk1q3HiqlpPH0bLxo_G__99dpqmYU9eGa9WGc-QSrVtjtAiKlSYmHicSmfOGimRMSyn4Hvq7kHuaok6_7isXm4ZNRYgfG7WVNV06F53wWbPSXGcgW2cdakGWP3qMRBzsulVgBMwNkmfDiBI8bl9VLLpZptczPxpUDPKUxL5QNUD9_2Y6pHGgbLuMlMZ3tlAHtEqKTcADK_YCyKqVATwZkIian4qsXfMf0U2xP66-KtBM8LPgf433OpA1VMIn0GiJ8CKpNAGZlm_yZP6gifId1WY2Z0q7hUwd8cg_KggNLK2n8TCzfNAqDR6_UVmhLG0sbDhgb0oF_AcY6Lr9PBzduTg3LZdTW0URQyxvoGc1fZmNTYcDXeB7eOugMDjG31Tuc5A482zPPLVkyAV-NdsCLw4x6I5J5GpN3Z4tCFWFKSunqyEiaJ18CP5xieLsiDuJB9MmvRXEBSebjARmq0w1irYqcpop9sjQ2PUZYQ07jRNzZnsARRPQMt8vBzSKyyC2WT-vRtZ5SxTAg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=3107299941&adf=2927141728&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=976&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=3223&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=03TIDHTNwq&p=https%3A//subterfugue.org&dtd=1225

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a9ba3383bb4ec1ee471bc2e81d22e428d54eb303fe13041d41e5265cddaa551c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=3107299941&adf=2927141728&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=976&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=3223&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=03TIDHTNwq&p=https%3A//subterfugue.org&dtd=1225

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 17 Jan 2022 00:00:31 GMT
server: cafe
cache-control: private
content-length: 800
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 3BE6 70 KB
29 KB 67ms
65ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BTOgsbrDFXqvZhSqP5EACYKUQsRQVMdn94Bo_Sd8wPzC8dGCdgIDWWxz5PRe_p0UQ7ZI9h0276pLWx0yjoqBVULdSjZlgEZJciAdvJhxkZmZ74TwRtLS4hVi23I82zBdubXr2tltk2Zks97gue324JfqNrpw&dbm_d=AKAmf-DLOBH0K1P-zX0FjVeBwvOfMMJUHSXtAW0G2VDo9yGL6vI_Qfxvy2AU5OCBN1p-yf9HCl3DRbtimPvqqptHfXnogqKPU82vchyiZ1Z1axMukFk9KVrMOV-_aqJMrUOwK7vgoLKSbXaQTTZ-_qsvvNDZJTUgwKow1b3htWR0mlThqXDXAbC6CHSv16Lck-PgOqytJVp5XtWmpew-X-Uk7BlzGaIEEqCCOV5gg8kLzcN8maCxC-_ag5lWVsXghtwUbhnS8DrZKd45Zik24DIyxuecU8klvNMAw3IqbAHmKGRU-kqYqZSt8d-Zmqq47mgyYUsNuDKePGUrhvzdgtCkrk_3sRzqc6pfIK96VeUuQ_JIKwbxx2wmZa3sFmqcClZrj9dHTpH_uQOU42NZuD6QTCuJURXio5rElZ8Fti5Gkj0yVIZayAzUGXPCzpPRQpEQ2DG3Bb8m76VpeyPp8fGvDz_qzj_ASowD0iiZwKfwBK7mFPcaAx3FHtR7dy_apEWVZYtBw3DEFZEX9A5v0CUvLcXhVpBehjLz3LNRoWYKEY3zD0HNu3_dmK6EpVRO2HsaRn6z35ikU5k9_DdpCydzZOXyhPzVu1eJ8InPLsSeP4BOH39hGjqKOVg2BmQS3cSdCCuMbSYreDUL2TMeWvy1dxRZm8l64Kcam7HQCAe8eDWzHyVw9MEoSOBkfj1W-dE4rcOgpY1M115mbtWkVhDRhKDC7MILsUHY2xNP6cN29xZfKQ763OjH0AQN2y6DFkeoxax4ta_WXRYGEWGLG9C-m9_UgP4BhFzed5nyOEgVWpr51P2dkFpTmYtbXc8mPz67lLyNmqaE5n21bcYN-Q6NKyX0bNY1ve98K84OKwHZriP79iE-Zh5lbpaatMwOqgT5PQIU4llZaflqXNS--TuanSC-bAWE3mbwyzvar8KgLA-oVD5u1eb6-KVWm2OeZQXL3XRFX4fjxFIVBXamZ0dtVZCVu-mHOuqDjoKHHmR4ntzecf1FW62Rb4OhqjuABfHTVzxw6iV_kWBjfEhNlC1glXSpiP56nm6vtcXQ31Kgbxa7sMy87B2qMCkRbW1JMscbpbXP9Iztc0AUJaVQLgzevmdSP__Zf7YE65TFIcabmMaO_B6VaNILOVzfxe_xIi2nLC-gb5XFA7jETfLpdl2MmmoLOPWEdoEpE_VQ7IvfHVZgtmfMqkLfE1ao2fis9ydUVKYy24qmXOYurdOSI2GKCWviFTxZVE0JWkcD-UMZjqv8_ARhiHQh3KXwykgBR0Skpo4X0QOrG29mQNxK1t1k_ZhsbrkYolhA8BeIfvDIpY1J_itcruwOp771DgLl8-2WBP2VofkLn4HLpuBKPXub-Xemf_Je2gljZo_S-GRLh2iQHuDo7JiHzCU-BJYyhHvEboyMR87b8mBYb5NeN8dGCU7P4I9nn_Ut98gNr5s0mNAq8Ug0arzx6Gfogt4_bzOzy6gRFTscGTpUAYen1QqbvGUyZy_2PF83p7rAIuy_bmgs1f4Yc_IikmFdf8XBP6z66lVFJ6Az267957sFYLYVtAJ02IGAcluDRqIpgsmUNexaTAXUDIsYCQK_h9G6MUoA_KZEn2eU74qY5AjiB_ghpWYqoqMlkTfjXNl-FhHrIvP-gsLhpu8mrA7Wp2L5C08TS9XCz8R7t1E6RKjxO0YBPtqjD3BA52ZG1epLqM4lMbIpMcMa81xQ6cLsp5DhdXkK3a-ZKWJVJlznzJ5-shYjWf5JEfFWlBkyhr0uc6SFj94GY-elwivulp5g5IulWh2WkIjuOPvA7lorhh4UO-s9zBQj_nRHygoz7zCQjI9Z-gOXqtdojjxJhNE9x4Dci4BWpD3UVKd1UKQy3ClAkxGIOVygM5mmHPFAnk6UbO42rroQGyY9FahYcME6ASB0fVWTu5kOUwT9r_k5L4WEmXJ6lNzOP3SsO7ifJ5VQxcezw66OiAyavVct5hG3qGmWk5xYa4ySea4SLrvcEuVw8zi9mqnwSCLbbN6IoJvT3DyYGa4Ap4qjrLtFxAG4N3dl6gIJUrVG2pJWs4TUX_o21rBdJXt58rjw9fZNyV4tD4N_IoO8XziWExQsz12dmyTQvoCj5EHzp9iN0uOp8nWmxZjnvw1Aiw4D8jcaltF9vVL4tupyG1-PuPx2_MDUsOSMJ78mFYHFpxKIz64P1nzQY912QwBkg92KEpvxfORpB3-TEg2hw8F1UyKhOj5_zWXjxRcoOrfEG-kMKtO1chXzGQMzMyun3IO8rnXhJ2kqPn1Uf1RHFPxWtK7WQmkT1wgW9cG3ZZRChjVi60F8rrSOG0-DPXyM9Fw9uBwZudl5Y4vFnhStI-TStWHL4dxAkWd8beIIkxfA82tXAzyOYktptzfyz4Sk7kMSz5zbsVb3wnfux0BojLgsqkNGBFOzKYVDVDKdNic8X8sfI0WJv142PPrIXq7ywuD9cerkJWgiztWfAnCCnXtaEzDVdW1E0_vNMpTHq1y0oepwD_HLo8yu_pn6oTlWge5VJn4pGCrW33uNq5OolzoBsOZVXOAfDekIAzL8vOIJoAxuY8635BLMf4bZVEIgPyvIW5S7KgMB2ribc0DWS4sJA5PvPH0dtlmINHJBYZSNEnM-Y9gQ3FpDK2E26OOStaSW2sVyg8vQd_zM95JkIcE1boISeqpPRW7T_nv8WplGOeW45qBWy1thiPFSdLSWJlAaw5uwNnesV4OwQxkNUjf_yIHsGUazUpzW5jjAx8Pwm_TO4cp_u00FK35inzqWraUNpz4kVGhYaWVu-mD7kEUB7e1rkhuXLwuGPJ3ILEK8i-tnRf_iPKkuhfuScytmXPfpHx06O__ZVfOTIHwmQyHQiP3pjtmXhF-qo9ATWVSuAKe107avl5qgUNfkBXbGGhqlM79WJ35kCbJIEEC2lD7BP4YnLbRhYHaz1U2ZBdqeNJQAq3IYj8NHt41TXiegGxiWW5wMsTnhWP8cAuU6pnFtXD7Bcyu0cs6QW0TVqSLl-pIoCl7PmIvoq0VtulIlHM-rE4BLLAVHuoAt7PLxkYRCb3a-YeYNp8Gv_5UT0JEpM3Le6sTlEX3VrT47PjGSSoyd1JhjUnnvJI_Xqv5aZ-wqINAX_x6RX-yYlVQXPiGUSLO_-P4tC8TQ_KkH6OmzgTExugOjnueqhPKay-eeSK8JQf6HIrV-jPwNLF81r7BcKguhgFno0cvmr0GbL_IPv5iHkMthdgbT9OUweKTOcqvgvBUtlzKT69Jc7IUVZi3Z--Z99Wzp7PWsQkqVeNoaqzEZb24VjhmpU926JMBchzeRtPJeO5Qy1nNY7DM81Lb10vpXAjtiACfBrwHFnyQPfNPjuVqrdXionSo94G7X4ZvM5D_CZvd5LSO2CDi53avNLasVKJRmIYp9FoR76Vmcy70SCAvQNX8jRdwzC4NWuk2m0pdbZaH_gW4Ftqqi4Op8dvFmVi4YxKDrEyXiuErxd99_dK5Qdp0cCUtVZNn11sLKYvf3voxiLou0nf3RKjOOCcy1dwcIdZV1SbMC5CjIjeOxcSrk8zAH682wCDm6SPxxzoJ9m1Cv2trVjVpzInHYJ6-C6AzDL4758j5f2x65FEm1pkJgHf4osxccCEHrjwi6Gb_Ya9Va1O3NzhAig_d8upxXjvhTuz6kbfqfzJutRPpY5EE0XNK66oNITfKg-lcbWI_l_4_mmeYZbnSHNtzTKjdwrxYqfvjj2Vzy3C9IaRRvPFTy8KBzR0tnWKgyU29YZQkyGXZY1i3DoT-s2oxqn0lWD1Ns9LijR7S9pxdwQQ06zTz13VENVS2_LtUffTBpf1g&cid=CAASEuRolEjkgglHm3ZSIZCmZSoV9Q&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4419664f9f206c7d60c4561e6639aea9c37af465a2d03186c9fd924a344180bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=3107299941&adf=2927141728&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=976&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=3223&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=03TIDHTNwq&p=https%3A//subterfugue.org&dtd=1225
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30109
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 3BE6 2 KB
1 KB 27ms
25ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=3107299941&adf=2927141728&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=976&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=3223&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=03TIDHTNwq&p=https%3A//subterfugue.org&dtd=1225

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:50:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 604
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:50:27 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3BE6 121 KB
37 KB 65ms
63ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=3107299941&adf=2927141728&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=976&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=3223&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=03TIDHTNwq&p=https%3A//subterfugue.org&dtd=1225

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 17 Jan 2022 00:00:31 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 3BE6 15 KB
6 KB 27ms
25ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=3107299941&adf=2927141728&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=976&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=3223&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=03TIDHTNwq&p=https%3A//subterfugue.org&dtd=1225

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:55:31 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 3BE6 0
0 36ms
32ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQONqq0QIiKIbAB7WZR1PzgckuHzLfVbfp06HmYaSM5zoGuvS7jzYhZFcxRc-ujoQUEz87fohZFueq8EwxAUCk463H2RQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=3107299941&adf=2927141728&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=976&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=3223&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=03TIDHTNwq&p=https%3A//subterfugue.org&dtd=1225
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3BE6 42 B
64 B 64ms
63ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C-tk2U4ZjBlmF7difh1lQgk4xGGvkbQ05Pbghz2fEBwO1dvd_CCf9YIRCH0ZiqFdDMzdERASA0VBlKM4RayMd-xVqCtvEit7NdAuSv5yAZW-eD2H8

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=3107299941&adf=2927141728&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=976&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=3223&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=03TIDHTNwq&p=https%3A//subterfugue.org&dtd=1225

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame EB9B 3 KB
917 B 43ms
41ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNXZ9omZAAfJv9VxJ6XZGIj9MiKVTABXumUhGZS2wmGJWhrxXJXbp71eur28tkKXYx9tcigz__TGoGTg4vgJFpx1X9aTn5m67COpjd_H2lTmSLgxO-DfrEscgr48wp4SPBdg3yNfXDKyTQ7IJn1LEsMPl4lg76pWEjfJvjfqHKa1RsesmJx8trIl68Z4QN304aXDLbYAI6AtO3g5PvxJamLnmzNCK8XiTIkMFXUHBtpzf7E-Dt3CjVQZh9kpS4aP0f8hDXjKg4OCD-qbHzMt6kfnLXRKsX7JjmS3OSQPpgTDSTVsckDwnHkEseL-lOXVvb3ZRwTigNGGp7raSpOZ2GvthERGyWaoV-BpLz4wsS3hCHJ5OD2ltqh43OoizbVeckuT7Pq6Cbc_QCRdoFmsBaYZY8ZQ7mv0Ci4wAazo8iFnPKxPiEdk-mvyXIFo7FxHx9yvWo8ia6zHuwrORpo3A8PPeXx8DHPjDb9JAMSG_xzj75RTk03oCsz5TPOl7Rtzyyu2_O69Xp7pnd2JNt437CQ25hpdTlS4bIlBuh6dEa8VUz1YY4iGuBmojvbgKyR-e0GBuYtvc1Dvky-26GJ89vRAi9lLOrf2oAw_lzSGgwm8NCznP3tg-gYzHP0ssgdChECbl8_89haFHwrbNxFLeK_GLSMb-yfE8v3NZOWRVxgSWMDQVRy6ka3dykLpJ92o8fmSlIyssuI5Qe8iuS1vpOezJq9HAX1VKmfbK4dIximg6p3Ocg_-eX3R_isXT7fybo96rMRniA9gqvh_EPjXEVCh9DQ01LCr2HytUS0idHO5K7TMm_-11JAVYRLby7EgPgxbV0VvhnVGFpgY3i4kZ_Uc0jvSSCowOWHt_lvRvD21MlsY5kEyqR7Z6PcqW-P8vA9ubSZHJX-MIJ5RPLGanmjIu_s2riJejTI7PWfqwz0Nxf_clMwR7r1pw8qtzO_l4f_6EldBwKY0CVRfGs8nzGY_-_xU1o9u_rPG3o5Htn9ao-6YVdKvMC7xnFF7a10hZ-pWsUzTUG2MwyDabmUupF3rGn9sKg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2732065616&adf=629078454&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=2&bdt=844&idt=805&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=2936&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=hlAYMT9mzg&p=https%3A//subterfugue.org&dtd=1221

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

13e7b076410ea419238acae6a0750405b8107b8625fe1ac1521c8293606d6ce9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2732065616&adf=629078454&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=2&bdt=844&idt=805&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=2936&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=hlAYMT9mzg&p=https%3A//subterfugue.org&dtd=1221

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 17 Jan 2022 00:00:31 GMT
server: cafe
cache-control: private
content-length: 889
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 934E 70 KB
29 KB 66ms
65ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D8Ml26DgrUy3IwUmk6SrTY2YR052r_bgbR649RybtEOdnBwQJaBnWcAS2QmXEbtggwvexxJN7EbIZejTRbTu49j97vv4OZellgbOqlyZcVqqX3_dTlV69UyZapXPa7u9xyqfWyvrQvt3pkm3p7JiyjDu6anQ&dbm_d=AKAmf-CSnV7Dbgyo7bq5Mup6fJ7vEobTlXrMrKnj45tplppyxZmmY9GRlWhG5NXxieZdPYnzj9rHLLbVNzdOLMqkwoeRD7CUP8YhxqebxxUvSj9Wnui3C1DbnFEXp1FCJc5D_yoB7KVBfwrHYor5nQYVVZvWj-hdXUTmmlrnxQ3ucHTry4hmJXB7ae4DGp9UWXapRLUvWwyN85uFp2wMhjtEzBo5YJ-IqlT9lKtdPyNG7jRYasEv3yXBv44y1eXuCauJ1Pze2G-0qhJSmj8BT36kO-QyyS5O1c0JnY4pecxr9RCFkC16lm2a0vIl87gaKrc2tRcWeZvB-FLvTw80xkpXzPCD8IoxprL1TKjKIOUUpLLOrl_E9tj7of7OucI7yuU909TMPHlNx8kthSEFHzS0OBYyrgBfDriAVwd6eEhYEyU3zpbViY4h02S_IfYX3jflFiUaQNEKb65is4UNhbtLWwidCIhgcnBInTcG7_aZBamWcKDF83SJ3xSYmivGv9-kR7WLUA4Jvm0FwZikMQ7SLSiNygsf9rwuhjnjXg7ydEr667A76lqJ2W6UuocLxoMrrqxMQzJOKoIpOo2y_WeiWHPmvHWZjDYiMDu2w-Dl8LIUoD_xBnEiznDpveAFtFZPK4oBlFcG9jpSdkKhEyLr2G9Ixo5CKSLIKPUVqzMWjoIKo6mJo4MsPehMVIf3oA9js09U7OaeSgqFhKRc83baqXHw9Ul26pfVkT_kFg248QvMxDki9tl0D-KgQh46_tn8HKa0hRDnnZKxzwuKwCXlDZELPxmig5gutsbRNUuaOjUo1GoiNgigibu88CgI1XE3uVsP53MzTvcR1wxZO4utR86YYWqzYvM4uvDJ2IuRD7C9M_gp0R_M3G6sp6gvxyTEoXVxPY8eItVo6vyQXF1bq7zNSscjSxMCHAWeIw6RzrTHWoDvup8JJ3bO5GT6SqT7Rj3vp0qnbD3ZGGnETi1ZJfHaEp_gEJIyvJ3n5gUJzOaBHzhvTQHopes0u0kFxZw27pfXKmAiKvSKZGLrMshytyEFrIX6VhvZv06RgyJXqnerE4b0qg3Pit-rwLJSx4it4qAjh79RHJy_SFAToYyu-kf7_tnG8xdqbMFQwB5MI-mLmNrFjFnkEA0ArACR5d-uIJ_VZeAhcRyIbhAlSgqGseq_q0biU9aL4XIIMFo0njx6LSE7btumZDqjYqh4HboNQTRThJLsDPY3PXW_UxCnzk2gZHB67LtRe6EUUxgmotd03i1AjWTSdDlOBQhWD95O35JC61WKOBJAlVb0epDkODAgycVbeOJxVXTbwp8WTJTIWI48L9Z9DlLn1Qm6gqTp8Y4C34LQU3lx4mpr0uQb4WP9EKhZrfJ1v3lVCr8mCiXp6vxJ6UuoHcJEUjkwzItayFbZIzRD27KgO9KsOSbSZ9CinyFpTMqdZ7jhrWtJijJDV2RY2HMsYceVUStiRFwDwucdv4KNuz0wZy-k78adSwRrwiIFR03hwo0ShT3juNStFySJH8tOTfUEB8EgNAlTUtl_Blw1BxgYbGZf7ySL8Wyi9QmVn2EofazYOy6JlYUNwS8W65Ig_yZS_H4yTQ20xAt74s6k2LQeKTVcBXoHj9_o5kiMK5i9LRt_M0RB5YFkgffxoTy-9xZTuhCaShEZsOgBMndDnCzl7IvscbSQfMhlcuMZrYnk9efg9EUx_ov4tsQ0klTEUeg23g90NkD-4zNDbFur-cR2k3lgAW1jAi7Or1nbIUwPSWZyqTFyP8vqtkCFijvsOXcrK2szUbOJdo2tWvbByhoH3VZPIvRTzZXExcWOw-YWeYdTBdjQqQ-8jJp26VG02aci323UySFlFr1H8zQheKi3s63GAtEPctaFNIUGHLEAvp8aGQMPxh30n-UyjqOkpcI5BDcr9yk3D5r9I_XNNFXyje4nt74D5LxObT2sd6r7V1Q1b-ua5Whutpan68cfeVd3YH1VNEjiiXnmMOKvh90HCdZV0qM3aW70snEwshJCD6wl79NWfgRM0_nN5Mu-08uMfJR0gRFE3kd25SqcTcHMyjqhDonK3v7fLu3kKQooQnA-UoehvgGByqRHFfNsNAFkypBhIbKl8EmXB1_tdK4wu4ys-CSQmZCw2kpZR2f0uFchYSXaxgE9sSR_vcVUUQAgyJ-vsiH1gVvbFJXwKtGCKTmY3iS-V52nKzD8tKtyZWf9VXgw1dcrkvyBo32i37_kDm1itdIofpjlc6xna6M2MP6wJpP2NY_EM3uuj4Oh3bD5mxIV0_5dwudiu3x73g-xkMGPZg7fqKpEqOJ2xsn1G5EeAReLjoV3EDqMJBcJrMW7LvkScKYhho9Mnb_2tolhu00ykTdLgd2DL7DbUWj_k0tMKlolvrARGxRrst-Kz_yb3oHsSvEVy99NqvOOMy8f0pNPu7vnWjCwsT2neHytoxDcW_8F_aBzFFrhuCakE51R42S9Xzsb_KdSuLT9eKEpYPGNe-lKGCbSHLwOA5lz5z1N0o2vaTPer8QlTxWfiWXnKkYu3XrLR4mKpyWOE7LD5D3QMV-RVsBtf5_gsJhEa5bu38u8dAjemrUsO_I78DHTTbmh3fmUTg5uKWe6T_Xt3vkD-hq76TKhe2xEFuE0uO4LTgupvjoTDekmr-2nfxlAK3zqNRdYS6B6i7O2Lf7Mlgri-PkHMK_hZR9FdZ5TR5L2UHQ1EJHn47mK7DNul0XskJsqFNjkkW93-ULSO4YYvpx-8BiydFaDDkMRfmB6AFK2rLPek5wJysLcYbAgT_Oqf7ntocSE_zeLtKIdxO9IQ3ULvM8ynsfm1Xi4yZYC2FgC3fpfNJ64kh_l9N9B2Uk3_AzZUhIu94RnrOnIXwc8rJnUzXwPoLX56JFzcVgMJGM7tbXyXN13W_E-1WI0wv-u8IzBqNDHKMhbXpe8muv9mSbTlD45llYENtkNxvBcOwGVTrLz1U3WhReck6Uc0RWaC7fqdEEcXEV4HcjWpH1XzTPjkJdfS-Mssf0dEglW5Px5Pjlxw3gaEfkDibDZ1zFjbjXDdlP0laMv5LhFjIUjo-R-h3wAT_Ll9qbRbaeLAC19EqSCymvwv_f4DUyIlscLTe1L8QlqP5DQ3xdPBQ8LPrtVYYqJUqAGVh_LrPWFx9zPnu1x8V7xEyl_NCCOZATmnp2EGYrl4SsaQ9WAcs5QskW7ZFzi9aS9zU0t--7J02N5D6AD6hTXjFJmtbinpt-WWwD-yHO_iE_cCnRqZmc_Nar87yPnj20CyGgPfssgRmgA1BL2kiZ24TzkJn30qe6OUdejy5EWOjCWwsBEMOXdmV-hhTy4k86LluU-MZxandzuwqZrxM8iS_7fzgnXlIQyoOcujM7lRTB3vI09xS__hDDpHVhYsfeTMpTp1cN_xItKhujdKtLoGgTEENf5sXK5hDeSgw1-f1z7oN8v7sp55ZGMQl0o2ZMtPVuvlKqoRA2930ow4QMp-91vQ4LwM_ykFkmHsvjjEysIkDycX02PEziZ1JMlQeFewaVbLHjLbhkgE2lP3GUx1e1S0Ig5zG5siMNTQoc4bRWh3tJx1zYo9ZyC9JQcFjOSsmiBGVhMH94RStLp28zovCCxyZ1xMORPRDWTSYDrXo_YiL_ADyWyD3Xr4alpdwWOf-dvGssO1UU3nujrJIZpo1OSPELAYvKJ8VaTHHtBNiWVfTlcRWBZ1B44PqPaaIIAUvf9oYaeY9k7HodNY8XYhdVNy6-MjOWjS0YZ0bNgEczCdqGgmu-WHcOKC9PNVK1uAqHgW-a72efCf_e6nf5OGmZoLRLo9UofdpV5Ds586v23UMI&cid=CAASEuRoE2xj5B7PXxs71n2lMmICDw&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

abee342fe45437a1537b3d4a0bc39f2621512948480e4b5289a235d464755051

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2732065616&adf=629078454&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=2&bdt=844&idt=805&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=2936&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=hlAYMT9mzg&p=https%3A//subterfugue.org&dtd=1221
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30101
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 934E 2 KB
1 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2732065616&adf=629078454&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=2&bdt=844&idt=805&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=2936&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=hlAYMT9mzg&p=https%3A//subterfugue.org&dtd=1221

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:50:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 604
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:50:27 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 934E 121 KB
37 KB 61ms
60ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2732065616&adf=629078454&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=2&bdt=844&idt=805&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=2936&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=hlAYMT9mzg&p=https%3A//subterfugue.org&dtd=1221

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 17 Jan 2022 00:00:31 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 934E 15 KB
6 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2732065616&adf=629078454&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=2&bdt=844&idt=805&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=2936&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=hlAYMT9mzg&p=https%3A//subterfugue.org&dtd=1221

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:55:31 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 934E 0
0 33ms
32ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQwhYHtVzROYKZ6Fegq_eVEgBMMMTEQlWxZ1ns_y5c2wKYFSZgKHtmV6N77bu6vyP5u99I0hNVxJ7TxI54ShVN1yIwu8w
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2732065616&adf=629078454&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=2&bdt=844&idt=805&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=2936&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=hlAYMT9mzg&p=https%3A//subterfugue.org&dtd=1221
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 934E 42 B
64 B 63ms
63ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C8Nu140fUxqQvgbdiXZieT-6V88OWj5L75RS55UL71DbC1fvN3uKqj-f_15Aq5vLItqVrOLSk0qMNFmQtqA-5-ABcGA077rq-D43JXx9JwHOEVU9Y

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2732065616&adf=629078454&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=2&bdt=844&idt=805&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=2936&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=hlAYMT9mzg&p=https%3A//subterfugue.org&dtd=1221

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame 5C77 4 KB
887 B 41ms
40ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 16 Jan 2022 22:42:47 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 17 Jan 2022 00:00:31 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 17 Jan 2022 00:00:31 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 5C77 205 B
744 B 90ms
25ms Image
image/png 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 08:21:04 GMT
x-content-type-options: nosniff
age: 229167
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 14 Jan 2023 08:21:04 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 5C77 604 B
695 B 90ms
25ms Image
image/png 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 20:22:02 GMT
x-content-type-options: nosniff
age: 13109
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 16 Jan 2023 20:22:02 GMT

GET
H3 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/ Frame 5C77 18 KB
8 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d49e447ea7189c83a39404fab2b4c9323ecf38b36c0b78996376f2c5d9125b0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 22:50:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4210
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8089
x-xss-protection: 0
server: cafe
etag: 17106604058346595485
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 22:50:21 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3CBF 0
16 B 39ms
36ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CIr22QEQ242E8gIY3oeyvAEwAQ&v=APEucNXmbcub_5mG8i0Q-keQfjaKRDxWJ9xtE5GsmuW8Y46hZ7rabAOsnXwPAOvVOs5-RJeaqj9z_F0UfeXJ1xpxCq-CmtFa048TCr-J1Yy_opDbn79LaAVySYEpmEXyr7Le5eaZA0WGoGhupeZxIIbSKbGviAS6XgVsO-3dfbIwb8zpsBfNFFM

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 17 Jan 2022 00:00:31 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9834 12 KB
9 KB 68ms
66ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C_g-F_s7nfhRbjUfcx7Gz00w20vUkdcSDGf89N-AqErESXca7zIXCWRwwm4bRnrrKKvfgHL0WawOSIGTSXbaYl1rfVD71RpdUebkmsi6MXK3jZGRMb2VCVmjakNm9oIhBOnOlGVcy4v9qNfOGssu5YnqqoGA&cry=1&dbm_d=AKAmf-AFsTiMiliqAvTwPEY7-glUCiyP3SbFBxm-AfG6CjU3D1h4oCmzfqxL9_L6UBgXeUT_PMUtDfpRgseSRuNZJfqkZfE74eA8QpQpmRqOssT7vawEYn9VpG_Rjh3uuj3-bIdB6bzUBCcB2I9imE4OHC5IGuy1S-KVqWChk5Tp0ejgFUK-PhpBxv3T4HvQm6Lr8S-fp5L5vQV0cFkWpgjh-xtzkItLAUhXBnRn3t_Hc1fVsu1-VP2Ni3qL8D575enteEexs3_zqboByCDgtB_DYSYDWj5LzLB-JKtbavxOwNRPGRJNup26m4cswWVfwtpHVfS-Wv7coUxoQeiqtTBOxBoZ8XxfhP-DZmHwOB5bPj2cbGd3OHUvZXTeW_fnQBlQkXZwFmLQ-XC6sve55JzY11gPw3PWG7ipuEH7zGrdnDXZz-VMCQMbN__oO-PhA3tzulOQdD1TGQ8A5YKk6oEczmAzyrclIDpFUoLwi4m07xoEpvlCMj78x4d-Ab5Uh7WFQAkEfItk2llzpZIt5JuR_KqYD39K98SUeWPpDxDaBe80ezGm63gdQjX8sa0EySZJ14vHQ5kUcRvBOaiq2Sxv1WTYkb606rAYyeqeM95fKMDHIOoMCRGCMGrleiX_oz4ZNqVrDfCEb0D_bySanu9PImQS8_MRg892QghwFwEdzo90IRgCKDIujygmBeB6AgCEUlLyLOe-E93BgMCJTPuBA1i4mRCMER0DX6cQADJp9hwRCq0_3XGpEWg-dwK0R3vcm56l7F4yuC93RtZYkMpHXzHqgrPnXREnZn020VQXaFPmbxDfrjS0bFVQTzrX_h6uN02hGSqzqkAML6CYqt6MMGuaKlHOYPvaCVkMDKvc5zYtTKPiX2LDoPAJqjiqLiTn_OvNVAjZagdd3Y9JAdRrXubHnbTMFKP_tBQxjl5BfsmCyYF08tyfl7q_J_yZozVOadvCAXfVZaT1YKReyWZF5MuddBhRVZ2jdP93z2th4fJJfcVgphJyddXMkBtDtK971lDTt9e5P16ruffixrzWW6WfRzonjIzMRBqYLk_kDaRFCBSdPHXtxjRgB_Sk7H12Eo7JrqkqYAEVg3kQrMqCBMOye6uyqyL9NK9YvJK11jk5XpQ3QgxG8SOP-iaFg4FzSzOOeetdgvUnr-syi9WPBd0A2haqvHpyz2m4v62goABm_ymOPUdDk4R-0I2rmzzBpn7kKTXd7Ta9KvhBl1JAMZCJbnYct96d6t4H3kIY784Wh7mDRJYDhz1jwAvuqsYkl7JP8yVsJsnCOfGZhHr9KEt9NYUet0v0010i5b4ujcj6_y2Xhq5di37QLtbtt-ttp1gAAYM4WlVaUyweKlJ9bm9kNZm1JpVKZ9ACvjpjWi0nD7_UpJxKicqV40_12wjVUVlVfwZqxiHjt5LGMCELHkKgeF3fZnjYg0PVrSEAlnm0K5F2AbSvpGks3Gnk4bc8K4LVXfBSiLiyC0QptsfxAfa0fRP3I2W1bPcZhHRkwJjIFKKxgicutKfXHNW2sAncAR45cOSUx6IlK7Y9Cnnw4xbqqvhO0ldZ5GeiTc8pjaGRxapuGb1LLeOPZwJVEVXHSdPi1wwgHWR6LtOMPfZqBYTBByFE9z4DE45wutGJAMubJ1SmBnVOZZ-5p-flmoNTqed9qTr0uBl9fgjvMTY1gu3HQcTatuwCZhyheyMPe73jjTckjZYVI8H8TRUKeqMINurqc_SIz_9MPqbsixIs8eUD1E6zylSFUjLHXm3NcWT-TjsxnUvfEhKL8wnJSqPfagnf67QrKtHP1AOB8M48L0__cfPZBTCxN-q5JmueHIAe4Ek-Fmh3LTqikw7b0U8RAYQFO4hTrCQzh_49vo_R5w8Nx9Ww6QhoFX7x4eMBt2jg1aYFwtk1ECnNFwkg6xvPqpzm2DPIyXQvRK5vU37mblGSBmqu0x8rGkUg7C9l7d7RwGIni447PzV3N4AV82WbR-bL7BI9aDvgMh0YSEZjT8F8Hpc7Ti8TJBUgULUEjzy3rbatHj9I_SmZrTAM1AGzYp0umcQWvBGA85146-RoDrd3_DdeCZthSg0YfKTyNUeGW2jdv6RQsrm8hxVbNM22ln7pyjmm-aAOtdQk7VmQHYUt7KRBPUlWFvys-8fZqngZe2VPTx5BLOUmh2b08HOGmD_pyRtlVyyIyO-CAIDyHNyk6hGBsqd9XSeE8SOr2yJQ9UOhl0g6AECs3B7ls40SWxc_1OTO64taB0iPDMKqNfsR_6jI2Ww_73f4w3ouabCcbD1_BGEuRJGOrrGGsyiogt_xsINh83craG7AlqwWxz6lzhy30KUPSDXCPv7P-Ngd5INvjnqOXbPahqf-x5uoaSmxTirWS1JzQTQBFSrlt8Rq69P65rv_UpSz2tA_5SA6sIRLC364L1GdAPiKO9PPK_AcuOmO7QXrZTv3ixDPgNlS8yA0RhSSYtlH5pSYtKyjgnw-_Q2p-zaGiKM2suIVssSHL0T7oRWRkzZF2TE3yZzpYX5WHRDwRDZuZbdtXWcorX0GogpqRLyJ6ovsXP1WM22AGl3BXF5RQth6ctIq3TbAc5_sr1VznOvq_RWpWNRavf5JZJf9-8CcqhJFpxFEVrPCeVb9e51l5VpzqMEe2F4x0I8juMhuah16oYS0Hsfu1__KiPxGUeoA9QXBbNVEanD9hr37nwR44ZIVn4slLGXyt7ryc85N55P_HfKdkdt2l3AKgP0lB492kMSpJcEQrZenB3uXix7IqV71js0RRnJv7STdt9LOwMCHZ0NaSCR17OAF9kMDkzYep9ltVxzMJ03QfT5yDFy9ot5CFj9wMeSdDK_Wa00NvDoHdAcM87dIvIFIT2nMUsloGQG4g6vZJxcptt2zKVjdbx9jXc5RFe6syn07DQ&cid=CAASBORoawE&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68c740e3aa224cedc70e150dd08ab731789bd29a7f0bdf595ed06da2056b74ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8826
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 9834 2 KB
1 KB 28ms
26ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/window_focus_fy2019.js

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:50:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 604
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:50:27 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9834 121 KB
37 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 17 Jan 2022 00:00:31 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 9834 15 KB
6 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:55:31 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9834 42 B
64 B 64ms
63ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AueGwY9i9CPVNM0XtGQzHxIFW9P_bgVd0OJSagWH6ooJeg_4n8PjJh9OJG6CRuyYvJ8_CmUiq2S7wDLSXBUxc7x8hPPvUI1268TUivZY1skcZE3qg

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 0E3E 106 KB
37 KB 65ms
30ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 20:53:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11241
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 20:53:10 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/ Frame 0E3E 8 KB
3 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cg9_s87AEcBdprzDHJAVDQKAWAfjmGQc_x_-JRv5jCoh3DEODEtTCwHiqcwfVwnt1LfAtcxehMMlzCvc81s7ai8D-Cd4lTzG6VKUqV7S1FGPWNhHMY7UNhMcJGYVr9cz1iwHKYotA0ESHdWIyngPZw3y6ZkA&dbm_d=AKAmf-Bc9-aq65gk1Iyzk5iwOZ-fG_-Awt1LlfBweAXaHIPcdo0myOhy9SR3PCHJ-yT9WSpAIzYcBaoyuPwxpBnHl7Wkj08foF2S30pPjChMXtQCxYbSxbVEBJ_tPZL-KbmoaOff1o7aqQA4wSdxAEhqF2VsTIKWN8JUwr0ZldKwIHuForN2Vfl_v9p9pSsM348WmGpIEzf9eXQ0_KwQuswNgLwHtUjmb2-Sjs13K36j978DI0wpcxHMX8iDfMUTHdem0ehpCFVRwhtm5UmtHXScrsfmpxGz-qAdIOe0eHiA3VNjuTeRxyWpN17zYtWQn0deyuyI4Pk2mjyoXH5QtZ8sxtSseypQ08DN4Y4zmAySfuDXFRqINTG-g0Kxzq9M5cRfIsbt-Kg5w7qcOyCPsVIUXE4L2xy5dVjQ6cBIVoZkHWrX5tPqXuLd7w2IGX3lHI34yfFAc_Y5CiL75rpH_uC67CPj0qBdbU8Ej_vvU05Z3pUnCTXn4mUdX075IYWqAedod5CgNGOg8Sm1A_4Yu72xb-EIA6j5njOLua0P8v66XZr3z794SI5OMg3rQpZaIXuTNWMLeo9ztfXUIZ5pv_0RGNP5-ihFvIS-WS9pwXTeGJ1-Uzj-5VXuWnT1hqtozu1DoG1l-Q1Q7QeaZr8aamJAK-jFKxpQzmBNFrAEhD5k_BMRkKhE-mMQUf2Dw9MUiuSosb58qBxMk7OZFp4fhm-iVDgNX3wkX5d3OzDeVj5_WA3P7-rbqgODt3G9jM-BBQkW0vkWF8F64ZNr-bxNJoP1biLA8tYaDr3ABHdhEiJckUD_ybjNzkorCO01ABn6X-o4zWBXS97CLormo6DjFIktH0-Cs3-ScTv8s_F4zzs1qtHFFsHwQih8--J0gsVYf1BoPhLLFfEDIJz0CCAfhK5NOZ4zdmj5tuwwcKnboNSABlKn5mK6KWHZDThod834EH3gd_byKvOTNKJL9xQ3u8KA1u72Urv0smty8_hd2-6kg19pBYSWFWBgVnFvcbm73fGSdObDX09gdgsj_EgOitZ0_9K9GMaXiKJWx-S0ZG4MbFQ_mVCGkQzsE-4JNpwP45Kyoj8iIh8VWgAGUCx6yVilYG_uBRu8kvLfh_GNOb3AYjOccdUDLWvCAYknvzznxiQpQVRS-sD5w2xKFfOytplV95xis9fyR279G1Ctf6BHDFo_gMnGYUK74hZHegtjK5zHQiOnwstFHNB4L7LV8AiINZne8G1k-T-1co67CiLU_gyFOyjKm0VJrUT4dzjcNO4Gq7Jb0a2cWZJEZV1Ms984gSRDQF5pSXQqh5a4NqLbVc41ch5higi50zeg6rkk12xMLwcK1jIRSeRiULdDbvWo1uykSRiHD7H8DW4-SuIauwLDZUjUIOZ2r5Jkjxv8YnH_ZfmSvsEPtX3PzieruScIiVPPIkjuJROKpcfD3A6c-EK6ayvKiKSh_x0oHuyyIeEkC_x5FfoXtRFL_0P-6cTcvpFSkKh7SX-sm_pxQMzHZw-3_us4Fv247WwEo0RrVNaHfkGqccw0Ay-ou0cJTnadw8CiiWHQ89XiJmlaiZ97wQ8sLJ7h8p6Aup8y6FCn_1KMX-MBD6tB1cEtyo4KKldeJ2cx8l4FzCUi6NcGoR4vbnDKZRaBiCi_ijQU2yLf5fou_U2BI3jO4XH_rs5W_5G1s6vt8-r6SIR2F9J7tO4Hx3W4EBGgurDcmkhWLh1PsfEPe3x0dc0wdt_MzA_owOAsUlqyRkXsHd_KJqw6Y0Ujl2dyUhTe_dGgASpJVhBj3DIncW0OfV6z3YBaJE-edYAFYhrSLDv4HeM23SX5yl8ytMme2zkb14NDwzFjcO-7Vtlq_32fPxQcHclpQZu4buFpqtodk3fsuBYI99eHAHiKUa2aYOPq0nxlih5TOYu-ME_TdlrqAuLf0AYmhEfF0k01abNgbVpcBZmLu9OyGsZOetsyB-3cd3N8tj4xufS6nYWb4obkkdBiUsO3NhR5s0gCLjYIhaD7gfvLd5Z7ary4kT5ND7RNSIiA4EZ5sJaaDWqYXcQjIz9kUFIVNHKyIQkz_1do1AsBTYiEx80-KJ7R5UfQkzEWEMhQ-xczRpFrRi4XCq62rdC_nOZbWuc7Q_nzbf9sghpvwa97vgz5PKakVmaHq2yGUFa3utpxihWqWV-ia-tI7nKP27ALj3miKIjejUXpkL4E6Z9cZsnfMiPOKHmibtsGdUMXA6kJ9EhMUNK4QFKarG2R7QWCl9T88-cRLtVB-3CLu8TN6oFvHzDk_245qWu6MJ5AuyE_GDP2Edy6OwjI4EUA8cf06Q2QiXD-t-HaNamSB6CpzmZZD4lM11g2mOD6-aFJudEPyROCKLbAGAziKELnWG8Ptjvuz2htd_jXViWDxu0ONeePlgTm0oHDEkg0OROfACYlqYSa4yoDWU50LgY5j9tBdlwWLAYxE_YbE9eBBZorj95ZlUoWH536aLpA46OL2Rh3Xf6p9fTdZdfUUEHpDGTkAC5KJg_sDfwHPbkK3B8MN6YBQkt5HdTnjHAr5H7kVmjxPST6siirAzCExADR8t0qG1Hdm9qd5spiiCMr67K6-RJF8vVAAe2uXD-bqDFFIXfP50rOUtxMYAX4m0cyAVl3dwKWFtcyyqUGYNa8ybzzdMLIDVl_PGT5O1iX57zMfGviO866y2ZypoN5S7keVbVcS6hqVzpNfDgkQ3zXoT5xhz3KTfqRaGOKBXGNQrVdAs6jS0mJQayRIx14KUqP6WxnQQppzfbZzHgKfP6vAh2hitjpjg2eo9qtF_RJ2ko1faMbN5snTEPtWrMavm3Idvpojf5Pvh1lXZz9bRI8d-SnNhV5BbHr9NgBUzINbumFRPkG0BvKiHja-s0JtT077eVWfhHBsb9GCsv6VzoImo-vI-bBiDqjxjN8WKWtOVKkbelfk2qY5tNZImwwfuCt60rKtw8UFP1GVC1Y8eErXDjESdAU4FFQV9kjZ3bAUxD4v0MoiO4ZItSyEmoOp9k7hltdh8q1eC6p16_z2ZlFVAutJIVkUNwSfvBLaVjuOlPQgVAH0NGK3ajNmUgUwA0D0nCzBZYbtfKXQccSiZWxNBiSOZsLb3sMI2zZe14Q1U-WWO2umYu9WBmVy7edIWTucQlqY_0IOueetA8qN7Z78ZdZyfcd97-LscRs03G-j72mD5TIxEHWjJCRj0s5AGtrpmsRRFJCuq8eTj4fRyeu1fV_wjfpAJtlpQnNqOvkAJHRpN1zWEc8tTn6iZCdmkUOv7DNMu4Qjf1zh9GFmzJozFkVE601uTbISl5_K0oaKmDr7vgStbuiTcw5sVoM_Aes-H6Ib3awd8EC1wRDWNgx-P-9FiSbNUBo_c7t0cF1qXWCTHnaHXzdbyaQJDqrLL2i4iXXUJwRkILGj6s__lOETpiYRwIUy8ewMOdj96OxXuuO1LmX_1OTfSaOigFO9djxkyBN4is_n30GxlXzNsyqEeaMvp0TWfYwCPQwV_C4Nfnq0s_BGRYZ_wbIg3oc-jKNMQf8IeQfEwpZ821z-FPsL3gkWTILT_azgxmWUcAWe9Ks7fhT7vXJszlJpAcrRmuRnDnEIuFhW2_pt5eA0P4PTFZ9hkfZJAikItWvg92bSgQ_i0Mu8jLfQD568argcl3yx5YKHUwYswulQIW7Jn--TfAqoPAvEwndrOFzV5WNskdHSsKLYp3PB3xwNaQZ84byvSVHXW5r_AUDfc--2gCVwWYLhpmcSbyG6aEwMwUf3gZGg1hCgE_5lbbXX6ZqKEQr7dic5_at7ChaxnN3pfSkfstDQzj_TnrUh5UEWNa6MJ-dPhpIceEA0UdMQWN3bKcB&cid=CAASEuRob9PbO8Edfo32w0ppFeRn7w&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:40:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1213
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:40:18 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/ Frame 0E3E 24 KB
9 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:41:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1152
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
server: cafe
etag: 6261108306223674270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:41:19 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 9076 106 KB
37 KB 64ms
41ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 20:53:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11241
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 20:53:10 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/ Frame 9076 8 KB
3 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DsCEYdDGYw9z0uLhkoLY2oOj72NRxCOnAUBOFU3b-W_FpJrecVRxPP9Sp3hVueAIEcwIZQcz99QgP8GZJ3vTV-Uy7bzH-Vn5YzYEncWJS4zo9JeeoSULnctXzpSWXFwnOKdPWE2jaev2ZNm44_ppriVo0I0w&dbm_d=AKAmf-CmO53bZMnRA2Cf_h5yTDRe3ulaeFZDgFO2LNl0dQtNIJNYNtgAPQmgI2OYd94QCGb1oWo20Uuob04BSR9BmaA2TLE1M0rzuCTpJgMEo0bt-Y626Y4sKmK1w3duQTgd6d5Ab_n95Jr2LgQvGgZHUcnAQhYGX0ITGfTdvJaYtC6Ztm0dGmbZW-tLqMxCjkGOvDEd7TgFJhruzuLYfXHHcGoKS_va029RljVKg8-g3Q8LQBpUsmvHZd5FBxw9yUr_fqxpMnCgZ0Q-HF1H60mTqhctvQfNVwbfvzuL27SF9kAxGJjl0Cw_FZZ8zFvp7Ft8YOCBBp4GSiqKcN0BDkDiYf6NJlo2KJNUwuKA-bqPB9gmR0D1PXGMwsUZwaWZ4Ib1qreiOLyvanXPaiRJjPQfgONIwydfvOs4NY9Ux7H_MQ16BNA3zMsHJP6Yyk8Cp5JgnudBgxRWb4cjCcLXtmgPtMhtP35rMK1QbH6e-UFHA2iKGJSKetgnngh_oRzTqo9atudJYmvjRWfBJoce5WNlglyOdzhml99BSW3Cynmp-PthS0lxh4XvB9h261N-DCLT_aB2jJB3d__Mbwh3WlI4qBpPOQiRwwVsbpUwt0EM80qaWy8PEwXa1UQ7QFQqN8UBlUsZ2pX1LwiR0u2embPT4p9DYQ2elfNKXB44sl6jjBF2tDy0WdBS7KlGzvRUIfijBvlD947Fz44q_BHCUGubaPYqESq916sll2V13LmRrF8r6tTEhTTHa5d1NqxTszgPXNA6Fzo-HRnheO7TBMM3zIpdZRI2opBR7IgDrlLzxKGWyYzJjiYg58phebB2jJRPazWBVAl6YijiEefXBK39ekChBihU8kADjw3vzIipJvkXQX-CBHKFo6aF6FlIOY4BR7h8t_3pBYOgYw1i51QTI8YXf4Ur0mR03XVm-nRCPDaK8HJwTrcYTnTnLgdVlPXdzhe-0WyjD5quYozw5kAKg3nUzMM5R49eHria5RhaixG5jwQ3TM5Bf6dVioFfWHag4k_h8kgCCGlARd5D5Q_cZ6nORr4Gpn1SC_oRpHaqqwfc8QDlLsbHyCPpZTJKdkyENXbHJVlY4Eu11uPu35TtMHWVETccMRh4iWqwnje0USTZtuArGeRPfwvBfzLz09JmWPv27yq7oePKZpXmyjYh5PY908kmr_ndPmgaVuNerQ_pbieOygY2-MAchlvg8bunDcadqM3vzumCSs9U4p92n9MdUqgVTWqH8ymhRkvzLpqBwwMQ8rHqcJg2NllvJUx52isVabyelNq84fJ1su-4nOC9XDuBWiLbxNzjKP8DR_ZTO6vTEJRDpJk7yOAqG2qSgE1ukHNqpp90oeDmTIdWSei-CMW4dEUr7suUj_icqt77Y91a7E5SxzSGuxJIVp7XqsrgbOz9mrr3_b0k8bfRxppYT2XDJ07-fb6BvBhxXEuWrvqqvaH5jFa4d_qeAZ_zL1_WMNNtapKohPIt-iUDlkU2jL8qTtEpD79J_MrhwwMtavh5adk8n0epJyHBBK9QlCuC8vTrKBRmrcMNvzQCJ1mtqmnEfp0U9I7Ea1d0dGBYkgpBfKQxJhsWa2YnTTI3b8iJnidotJx4HgOubECuoHO4Xc_kTP-nLrOG1LanyV9LBVJTfkNiCpu7mDKXU_IMBWXdoqnLbNZ1ptxkADLS9mFvn-SuZh0pmlLvAqCqyi5l0bDVdV7BuhXaKNaAD2zSQWt6frQiKqWnrc1AirX_KioRV3rEot8CL-6iH2K3JOfp6BsXPX4qvxbOC1VHD5OnT1dc27Hi0E-CehlCb4uYi25GaxDeEPItvNRqjugtIa79rbtgW5Qjye4Fd1zND-YAXa0jokd6ztzWvrGllF6KAxO-vKc_MfBbS2qMaSAdy93HmIvuV8cI0xkOqGn5wz6esVzEGyfkv8VvI1DXAQCA9WvW450YdZMOTw8zNVnxCbGeRb0YKjaLtxkqlv_RKX38WPKq9MN3QNc06G_EL2MjhtTN5hYinF6NPnqZpiF_8cGSh6omijb6MY4rRwbka9uaIIjv9v14CguOfCkItPavL_CzCdwwNZe5Ho8x-AQwNwi8WIuuCvPqwFoEOX2gqro12sG2J4Anfi08xOzNVrHlfu9tabudkI6emRLLqvIIQqwBvo2r9T5qz3pAtbm6Eeb7WiRfdQnykxOVUQXjU2JwXWTLmmVOr9FtELakEcin33elADFqOj4lQIicUBvyoPMUj_UMxBw31j6OfZ24rxbTLgmLbSm98xYzX-VN57r0FxIMr780oM452BxCC19NukyfRabw0OHiGsUKV9Vd0TuQV4gVWWA4jSnKS-DLUwBX7DbVm7sFJ2QjD8u50DhM1L-5CBqwGt86OOnZz1EkHZbIEDQJIZRN8BwG9XYPvIIsr3DDxZJiFqxdnKXVxOKpEsWpxZAVGSmwCu_aMs9ZoDajGfxvShYOY8st_jCl4-z3nJCgGSwOruHG-7Ki9wYuQVdZB4ex6c4qrliUnH2w-LbMfYHM5KowoOEuoEmf9dU8whMAM0pD91C42PVSI7pxDyGJq-guPYnCysgbMEK9Qg796RNW7UDxvgqCYLbOcGvjAFprp4EMKii-hbs5UUmJ-LfDv4NMqmspHz3eDB7auUmU59yAsDWDORQBynD32u9uS2oHs6gVcVMwE7K6Bd964Nevjf3VD44EB377-_jKIPHLqFomtGtvY-1WSlrXUA7H8EdoFG1tw8_9XW2RV3xLH0cpzMwiKFeV8gBR7Zys2sdZpg2DHWJf9Oc6SRU_BqR98iseC9vLKI8c8gd8--ODw7CHC-BXVJfLg0ZxWjZZY6eiHji1dUq7fG5AsToAjlSda61tVOrP8rOk1OLvDFBf4T54Uqn_FZ99wC2p2bMJ_mc1ng_vIp5vGNwug176TmFHLzqBei3jkrxys4qNGVAGf2kfMddwA12jNhBXSE-te1cG4rS6AYB7LBpTIrBAnGEhuR1wpL8kk_hlkZYpIkYwwNVpDrC-EstLAdxZtNF8C2dPH7JYZ5-pj8YexIhVT-Bqh2mCrQmzjaw-dWNjOwGc1YPQZ5zU0wUAmIc8DfFI01NTewcsNGZRWpQp3F04cdbBAynd3F6z1sjoPS_QSdgad1T4qJ9Cd4j0oHimkM5JxU3EUrqfJ_2c9IrZA77qcNT3zFSHpaOzNxGeLFW0tELqhdsUNKAlOUk5y2miGGwVFg__gtDimj4W4CrtJX2MXsq0kw6fQqjjhS1gOgl78vZqrBgMglYoaE6ksfb8Da1HZFSW3996hEe7TVCc_LnrKOYp59Jab0VE1MCdZOXclIFEd7DJeqmBpMui4mBN6h0L5zWW_zq-uP4baQnSWdcmyzpV7d1ZL20diKmcoyXsICj298ICNKCoZMk06APlm26A_g_cCxTlOLzqxKh90cVEJn-d7d4uz_K3c9MQC_WGXtnheGiy7CslBUUBmGaz6xbe0A7I2uhQChciJVnHw9BE4tLOclS-63EziW6MglyPM5_-SqtiAPgsMAIydu6WaS6s6M_thkt8aB2EEDUYepouS433D3gKlKqpu0FgjdqQLAoH5EoP6uUwLXXpDSYcgTU5ugO2k7KZfWN5vruVybM1-ptWRDQy50wP7OkgqB3OYMqXar_ftWDQWZPS-lyCjZwlKuFTd3u7lZvzTlZL0j-2dHqE_QEai1rPXhw6YP0llcThn_vJdHxJPoa9v0zz314xstN34j9p224iubkOQrS5rdI4rCAD-z03C3XvH04-tGcSSgKcbSCJ8LLO4JUZ5kxYVIkJW2Ou-Fr1xQN8rsmoXoytDX46tnPDtJU&cid=CAASEuRo2LvuGs6gtlkyLrxL_zzWow&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:40:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1213
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:40:18 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/ Frame 9076 24 KB
9 KB 38ms
27ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:41:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1152
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
server: cafe
etag: 6261108306223674270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:41:19 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 14A7 106 KB
37 KB 32ms
26ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 20:53:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11241
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 20:53:10 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/ Frame 14A7 8 KB
3 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CVLYWPPzrftYHFwOnnWJgQcrBLADYBGU00RL_27utjPSXlE4a7rhwISbKUHMlf1eJPX_T98k4QG_N6nUN8r3KefpKsefswsaataYETlQlW_XW92ucyiw453kcBJtGy6IFvwir5bV9knVs7MJj1po2fxgLUiQ&dbm_d=AKAmf-CHRsx3C5oWZT1vaNkmpEwl992jX7tQyseih75eFFeGgMgdLN-AKJTrmFxcFg7UmDlkYmSElFxy2riHDToZOsOhC_hYp68m16_xMxrFOcucYXR1Yx5ZTm9OcQ8a7cI4ByVhv-RfKRRVkargwVLe41TBKaZEbz7MfBVLwrKS_VKRpzjE5IS0iTB9XEvbSlTBBD19MtlDx7kiYJLM1dLXEVzcZM1mXCyaHiVGS_iCYingxvEOY6pGn3Sov4ff3FQtAJfyYPE9EXCzVc4wnE9ncbYPHZ4FLiWtw8kjeIPLgDr7hs2VoRacQO_-LNIdMAx1iz7RDTEytZdaQAm6ITJREcAm8XVa8ptOa8Onp1pd46FxnyXHm1RqOxA5QFNM1wZhw8czaMqHavLR_b9zE7YNZYvuRtmZpxdUoMDPR_EIvObWotPw7T9AgWpuQ8tCrjKIPoWQ89tiW7DtK5qdp4sT-o-yARcLz3yX_RJ-9R-5dsLebkL4AcF0ZqMBt2o7lq_4vre2cnhdpqDTvNnH0cnbXbAdb2e2oVA35HA06c4X609ti-OmsfDMcvWoLDz-9rdQVNz_WlK224QPBj8nl7kP_O03c10xCwvFmFJaBwUS_El5ABIg_20O6x0Xb2Cfbk_3V5Kw5BiUjBNFrlIzl53nn1jmx9JoolfeS5X8Z5Usn1x0shZCJQZSRyFYLBhkvnRCKv0PpwXZqzbUFdDCZcbj5beqtU_9AzmfgSbRL1AXMZuBzG1mXwuvN9LKJB--dLuUXcO9-BsQ4V-G4S0PwxY5tCYVyRPYnCq9A-wLhA2fi4EhPtbJHyKRe_8JEWfe1AC-ZzdOzdIZy0-eVw54xUWy7C03BB77CxxyNNa8jpOxvh4ynCEOj5JNY-T3dXi5OcliCb0B_O1coO1q32XWJlPM46sWgimtySp4zdpSV4JD2ifYSPw9A03BqkrqxlAONs5FggwCUoaH9zY9-fMdQTfIBqrpfaFWPtaLHQc_nndYFA-XSdOuraARtSIqnXavCa_KEmJ2CTd02CMOxWDOicBKI2SeEZlaBVdVLpZ7kx8uTV0LyxRZHaW3hmLBW-f71yl-Mv2zEwhlHAaYarhakCI7x40OwQU8WtDnZjUi8OzsAk1XzAurvcPyz4GYllxLXLfQv9zBli3eC-JBzuzI7-34zCrH87H46tsF6XdzyQqKvGdXqM5ONByyyzDJ3M2jsKFXlPlpSjOlB36UjCEASsQWPwKHxrrV0RQTQD499Rsy6fMLSaqeJg0_w4LzL0zQF8b-k6SslEqqReaAeyd6HHzMoELeOJEfRbFtc0KG8oDxwGRAVlvuEPEVnzDYXbmGyVTm8-GJ_sU2S-Rjqm3JPJgvYOs96ylbZVoI1t1NTSgpy9HRmcz8KX09CpAKnbUF663txd6yBY515lRFxl1Es1HB3wf91runOOxlacPjq9mp0BwbCH0buzhILc6nYmabu-PwpKRyyMG931d1YTUuQkJNODNQl9Rk_ikjoUrHnRrkQgWOHPbaNte0G_JFMsNWnqosGO36_zYKOhLC4J9WsHWEdolzDGQsVZRqbv5CDjxpc2C31E9CMibF4Rxz_CkzDYS7sDcFzkdR0ip73tAwMiY6RfShKwoyK-apuyGpDihlQKtkaATWLHszqN9aWHsIeJp67_Vhc1pNY3avb6rR3Rhqes2SMO4SxAfnJ_cngLEX9cO-Ve0TL0SEJ7rOykgRZDRG_s5nKnLleg5TJjIqWTpjspKRPlYjA7K66x2Ro14acWyNCqfnClHmjEK7g9Wi8J2arpb9kVTUf74Nir_cRDejokBmPQOkITy15uaIHM3MB1UcpVmuTdSkdcfBQzZIy0LyVZPONoLdGyrlaIL5Q9Q8fkqKod98uvJssXa0FlCxdL1K7TdOmijMsIWHBoQYFdhcaBSmiNDd9jqs-HBwodd5Zm9irkB4FtQOsJrdYqj6Ld-Dihv_Pk9DgE4Z45nbPh-aSh9OV7WCmHczN7OG-F6kizY-KpMvMB_ile5_rnEOIBAFoYBh3fti-TqFPWXMx5nX4aKjEWYA3Q-6CvdaLKm3LClfPDmy-qQ69mF-lO4N5YZ5NGu31OjvATGiOO4fgrkiK9SUBolGUUgEOSd9Qj1ZTSw7je5bvxcQ3rUUGwCX9605ekAieYE5KBTmmGDHErSlZuYCd1X5d04ea-yNgKc3s13X6Co1fCqKZ0B7zJe7Fjsohm3XY0Oipiv3xIATpoAPSh0Nt1XEkJy0WgCiqRd4-BDQhh150zVTTf5ZMZDBqu4xZpxTbfXbV6qwbLQpoB_aMcyjayn7naeA0UCA60RBvmxms-kXlefYjxd1yOpP43laqWeCxA-OxvPmi2OG3BoCFsDjQcArpr_aUwTX1r7mnALGRqopRYVrI5ShAWktMk3_aTouUZSQiTuii8KjCQ43YoBx-EOYsjv7rRPbVIl8-ArgehXGTfRIrE5REg8wRvSuGQwmvrSxDnCEoJohiVYCNHER4taP3B8yrFoHvzVz2r6G5jSnEBp5vYUwSivui3Kzz88dgge9Pfw_rXUTiKmNj3cAp1qeOkO7NRWMLUyao4BdmwtN7Cfm0XnILrvyLZCtULa_cG1xTWCyzcSSqt7V4oy7efOr_A0-1E-UUJrAc6q9AF64d-lJvqSfGYxyKd_Q0yYif7Oe_uzYD4NFv4cqey7pVOSlBvDIdApvx23NQ50kuONLjMf2fA6cZoHUFmZkYKjidT5-aNUtX50y59597fTu2aT7f69MacN4wl8wV2rab8xzEC8scDZKDoIAvc7lNEktwVGXZYPKDoffaWRS7C7MxPASVj3W20kdrXzWrnPozyw9R8sHdvGJr5oQZoOfSxcQlaDTq6tx3sZW34IhnN0a2tNN97Rk4RRN9ZoB4xT1qHKeWEKWxnZ5rq5adG4Owqv73LE4V60vXqc-rHBshmgNJyMgCLWVpCNkxzVm87UpEtg98okEoWdndW9ODr8juS2aSpubjT3EaNxUeiKTiGIo_MV8cFPOjU1buYi5GfO-di0WQUa4zSkgKPv6TeCdBGfQDoiENpbXXYPTjtDBZ7aNhnI6Wr430YbqGJIsrmzVK2h894VyxM5nPGIu1fYYTHxOpeoZffdXQ10rgF9q5ExV4JhM85HPvO9gkDYJHjdaTm5YaFnIcGO59S5Lm2-RcIVEprjR-raMzsDLV5pE3-b0GYCKNYVn7MOBA8mwNqXsJvq_wmLRAR_qrQeHLdVSl_W9vrCNTL-JRYRwsxhI_8tJUftDdyITSVedU431L_wLVn-JD0y9tcavuvrhh_xHfYczCgv6Qq3tQvp0dVVBZf5Af_SZ4Vj6CHPe8tLno1f6RHjaktcgCEVqq64Rzv9TSmRkt5uX3KoOUlUgvdGkpPw5ryEh21ykkcMOw9jiJxVuBIGUrCyRQKozmQJAwyucUob4iE9D9mS96SA8B7KCsEzCm5q_i9QkCUBSk26sRpoklbQ9YUZc4EUPlo7T9BdSP5TXGG4Es0EtfomP4n6TorkwLANnQAY_c6CSlNLW_1qH_NSRLEoHLX5FNsqH7S0FKFL6gvwsPqTLpRPlYGJhEKiFiQtTUl7qaFajn6e-tKZINxslBYx8tGvH2Iz_dJ1F7JceobXyEcXdWbfXZYopr0HUEBv8dsIIn8m9Ro7huII4jhtILqszqBOZ62aBlt_ALnzPIkxP5b8PvcUVmBah-Y2yyMdT7QXPCIHoZ-jg2ffeZ_05K_oLsExKxzhsU9NQCAeO9zid9bROL6L4wXExC2CuOXO7t-wEB1MOjQ1hZf9yQvG7GOGgpaxWqUq4WYc6Q8vuEEM&cid=CAASEuRoVLgiYEQ_h7xKrKG3BjkZrg&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:40:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1213
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:40:18 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/ Frame 14A7 24 KB
9 KB 27ms
25ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:41:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1152
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
server: cafe
etag: 6261108306223674270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:41:19 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 023E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4...
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGRuKmIPm02e_9zH1M2HluI&google_cver=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20z...

43 B
894 B

31ms
31ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGRuKmIPm02e_9zH1M2HluI&google_cver=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~440.839.66.1558.1364.1842.1878.2357.149.167.415.1889.1810.494.2299.817.2575.2985.1651.3154.1716.864.1033.1051.2072.2572.587.1097.1870.1230.2373.540.317.486.867.2316.1205.1712.338.1564.482.144.162.241.108.1201.259.1186.449.733.93.1449.2571.981.323.1301.1765.1276.1215.938.122.780.89.2628.1031.1092.1725.3052.1211.1290.2677.2526.2109.1577.1365.2253.495.326.574.272.311.1419.1570.1721.70.1127.2202.2177.491.1929.1591.1415.196
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNUbqMieeuxPDwG3V0VHdqHsLcOrnYgVCC-hhwvzQpqSRuDAdrTHJ-gAbmN3VU4oY1D9XuGM3sY9LgvvEI3A5qVGbByaoaE3xp6FjdMXNUXKqwRFxyR-35fTt2QzJoMG3yMHz5UQlplnCL90lL_OeeGwHjh2hmWX4l0MKa2qTxwclPB-KKWt0uo6wHEjjoyL27ZZhc8VfSBGphdJr_JpgcALGoNC_oQLfz4Pi-rJh4mUBSFqVmHgcw7ibtintAtogOYno1pakaxW9BAV57l8RwO1D0ExIlk7-J8D8In7xNxXB0GkLcBoScN63aP5Ut2klV-pGDTUR_QAwCUwyk_GjTbS9qLYDDBXHXhEXEyLrbSgeNPWlyMskBthnLv4wqosRFsLfPNxiOgqxcINn2K78Dm3rHDLShhOZ5NRQh5vw6uJaJFZ5Qv2vWB6EKVCXaWl8Xa6AltJF4GTcldX4mZ5CIeEnMahKNSyTFDtDKfGD1Nbw0FzGHHEbvzs7Eb5zBnG0jtvQa1eHUuEGQlXeCXcydjbB5bLXhRUlHXO885G0X-wmw9qN-Z7Uz9lq7vBouniiyL6mQhDzPQw-OuOs1-b4QwGJ4u4RA7I6Ev_n0RZVyvASagCB5bn-wgEFAuu0NGYIoQTEQUYEc9kGV7lyXj3a8UWDwGVOx6EB4K8nkOfvbTBAxy9wu0kw4OvAdM3GAk85-PgSBDIfetmsyxR30Kpsy6SZnlMdNqL9g49-MRYi04Au3viE-2ofYsAClt93zGeJrPGK5BZRICz2bDHoV1pl7nC8OLLBnmH_zeZzajnfzB1LRUBzij6CsgOT5PKChGONd3C4X9PaKPIcsNOG_GCa3_duTze5_J4FkzFfYw5G1z7MHxrPYlQ4CtlkCko9slCtx4jjMGbFD4vzFG9CGfEYcAVnMyEuzDDxiJr915OB4XQjWF7Wow_esyzTBV_piCl7AFmMbAi-1_f8Kl9lA6sm2SNJpWIVW1jPBXzxnzXS6EGdeTC2WAh-sZt8KP1oDnU8IlVHurt1zkrLYeAqfzmUQQdUYO5tw
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 00:00:31 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 17 Jan 2022 00:00:31 GMT

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGRuKmIPm02e_9zH1M2HluI&google_cver=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~440.839.66.1558.1364.1842.1878.2357.149.167.415.1889.1810.494.2299.817.2575.2985.1651.3154.1716.864.1033.1051.2072.2572.587.1097.1870.1230.2373.540.317.486.867.2316.1205.1712.338.1564.482.144.162.241.108.1201.259.1186.449.733.93.1449.2571.981.323.1301.1765.1276.1215.938.122.780.89.2628.1031.1092.1725.3052.1211.1290.2677.2526.2109.1577.1365.2253.495.326.574.272.311.1419.1570.1721.70.1127.2202.2177.491.1929.1591.1415.196
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1146
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 023E
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkV...
https://cm.g.doubleclick.net/pixel?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2...
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGRuKmIPm02e_9zH1M2HluI&google_cver=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20z...

43 B
894 B

36ms
35ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGRuKmIPm02e_9zH1M2HluI&google_cver=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNUbqMieeuxPDwG3V0VHdqHsLcOrnYgVCC-hhwvzQpqSRuDAdrTHJ-gAbmN3VU4oY1D9XuGM3sY9LgvvEI3A5qVGbByaoaE3xp6FjdMXNUXKqwRFxyR-35fTt2QzJoMG3yMHz5UQlplnCL90lL_OeeGwHjh2hmWX4l0MKa2qTxwclPB-KKWt0uo6wHEjjoyL27ZZhc8VfSBGphdJr_JpgcALGoNC_oQLfz4Pi-rJh4mUBSFqVmHgcw7ibtintAtogOYno1pakaxW9BAV57l8RwO1D0ExIlk7-J8D8In7xNxXB0GkLcBoScN63aP5Ut2klV-pGDTUR_QAwCUwyk_GjTbS9qLYDDBXHXhEXEyLrbSgeNPWlyMskBthnLv4wqosRFsLfPNxiOgqxcINn2K78Dm3rHDLShhOZ5NRQh5vw6uJaJFZ5Qv2vWB6EKVCXaWl8Xa6AltJF4GTcldX4mZ5CIeEnMahKNSyTFDtDKfGD1Nbw0FzGHHEbvzs7Eb5zBnG0jtvQa1eHUuEGQlXeCXcydjbB5bLXhRUlHXO885G0X-wmw9qN-Z7Uz9lq7vBouniiyL6mQhDzPQw-OuOs1-b4QwGJ4u4RA7I6Ev_n0RZVyvASagCB5bn-wgEFAuu0NGYIoQTEQUYEc9kGV7lyXj3a8UWDwGVOx6EB4K8nkOfvbTBAxy9wu0kw4OvAdM3GAk85-PgSBDIfetmsyxR30Kpsy6SZnlMdNqL9g49-MRYi04Au3viE-2ofYsAClt93zGeJrPGK5BZRICz2bDHoV1pl7nC8OLLBnmH_zeZzajnfzB1LRUBzij6CsgOT5PKChGONd3C4X9PaKPIcsNOG_GCa3_duTze5_J4FkzFfYw5G1z7MHxrPYlQ4CtlkCko9slCtx4jjMGbFD4vzFG9CGfEYcAVnMyEuzDDxiJr915OB4XQjWF7Wow_esyzTBV_piCl7AFmMbAi-1_f8Kl9lA6sm2SNJpWIVW1jPBXzxnzXS6EGdeTC2WAh-sZt8KP1oDnU8IlVHurt1zkrLYeAqfzmUQQdUYO5tw
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 00:00:31 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 17 Jan 2022 00:00:31 GMT

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGRuKmIPm02e_9zH1M2HluI&google_cver=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 703
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 023E 170 B
188 B 43ms
43ms Image
image/png 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~440.839.66.1558.1364.1842.1878.2357.149.167.415.1889.1810.494.2299.817.2575.2985.1651.3154.1716.864.1033.1051.2072.2572.587.1097.1870.1230.2373.540.317.486.867.2316.1205.1712.338.1564.482.144.162.241.108.1201.259.1186.449.733.93.1449.2571.981.323.1301.1765.1276.1215.938.122.780.89.2628.1031.1092.1725.3052.1211.1290.2677.2526.2109.1577.1365.2253.495.326.574.272.311.1419.1570.1721.70.1127.2202.2177.491.1929.1591.1415.196

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNUbqMieeuxPDwG3V0VHdqHsLcOrnYgVCC-hhwvzQpqSRuDAdrTHJ-gAbmN3VU4oY1D9XuGM3sY9LgvvEI3A5qVGbByaoaE3xp6FjdMXNUXKqwRFxyR-35fTt2QzJoMG3yMHz5UQlplnCL90lL_OeeGwHjh2hmWX4l0MKa2qTxwclPB-KKWt0uo6wHEjjoyL27ZZhc8VfSBGphdJr_JpgcALGoNC_oQLfz4Pi-rJh4mUBSFqVmHgcw7ibtintAtogOYno1pakaxW9BAV57l8RwO1D0ExIlk7-J8D8In7xNxXB0GkLcBoScN63aP5Ut2klV-pGDTUR_QAwCUwyk_GjTbS9qLYDDBXHXhEXEyLrbSgeNPWlyMskBthnLv4wqosRFsLfPNxiOgqxcINn2K78Dm3rHDLShhOZ5NRQh5vw6uJaJFZ5Qv2vWB6EKVCXaWl8Xa6AltJF4GTcldX4mZ5CIeEnMahKNSyTFDtDKfGD1Nbw0FzGHHEbvzs7Eb5zBnG0jtvQa1eHUuEGQlXeCXcydjbB5bLXhRUlHXO885G0X-wmw9qN-Z7Uz9lq7vBouniiyL6mQhDzPQw-OuOs1-b4QwGJ4u4RA7I6Ev_n0RZVyvASagCB5bn-wgEFAuu0NGYIoQTEQUYEc9kGV7lyXj3a8UWDwGVOx6EB4K8nkOfvbTBAxy9wu0kw4OvAdM3GAk85-PgSBDIfetmsyxR30Kpsy6SZnlMdNqL9g49-MRYi04Au3viE-2ofYsAClt93zGeJrPGK5BZRICz2bDHoV1pl7nC8OLLBnmH_zeZzajnfzB1LRUBzij6CsgOT5PKChGONd3C4X9PaKPIcsNOG_GCa3_duTze5_J4FkzFfYw5G1z7MHxrPYlQ4CtlkCko9slCtx4jjMGbFD4vzFG9CGfEYcAVnMyEuzDDxiJr915OB4XQjWF7Wow_esyzTBV_piCl7AFmMbAi-1_f8Kl9lA6sm2SNJpWIVW1jPBXzxnzXS6EGdeTC2WAh-sZt8KP1oDnU8IlVHurt1zkrLYeAqfzmUQQdUYO5tw

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 023E
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjY4MzAwNDU3NjA2MDkwNDIxNg%3D%3D

170 B
188 B

38ms
37ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjY4MzAwNDU3NjA2MDkwNDIxNg%3D%3D

Requested by

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 00:00:31 GMT
X-Proxy-Origin: 37.59.164.101; 37.59.164.101; 693.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: fecc00b7-2c70-4d3a-874a-7dc315890896
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjY4MzAwNDU3NjA2MDkwNDIxNg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8A3F 0
16 B 35ms
35ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNUsY93jA4TNZohSD4fg-2EEwgDs5ifuEqq9pLTmayq41GPnIUecm6HPSAJPsylJaAFIfK1QB3EE3Vv4lpI-2YMsDli0AwdaRjxntL91LGR5n6PT6mB_qTvQ1GSdOJ2oZOtW0x9t434SIqkyOKx4DqMxxrq90dNsgokpx7LSfJ5TiOHztDaFP9Art0RMSVFuQwAc-ZU8aH7mI8d2bOWBwuGb801t0evhWpFiPCmkOz7iN7MoSP668XCnyiBkPi6_xpxG8XzKsujTfaAVF3vH_8igGN0BCDA23nAt2j7vehPlyHVcCzBeKYWnZ4CqFxx7tDAJQt4dxokC0owaqJpTOHvjYXiUV9N8IARYA9z8BLyHAh3KrsFXNXiupM6BFnggVUrifRlCm74o3O82ki044xNS8pAYhT43gwFLUDcTl9c3BUkV2PUM6KR_XdCb3Hbq0T6ELXDtgivgJRADHgw2gBvjUI_kW7VLQq9xGLi75nLuoNyVw3abQStzUv7zpeRcGqSG0eZfE0o-iYwom4gPemN_UFiZYHv1ehI4MdBiK_EF7HFU4IEBTZ8nrqLYgGz0SKnc36EVYBp1ZRFDVTp0CCCYUrGf5jgwLBsEGaWA-MLWUOPNeqonYNufEsndSUUNibJQ2ODJ4SP0IvA2K6Ihcp0yaeC8SaqllsMoskgbLXAXNWPCn09G4R8pSoTyhyzg1MVx6tJrO61T8LV0ghE1o8ZJcRjnXSaDj66VzuifWtU-uv0Rgfqxmq8khGpJytP3Lz3j5Hwe9gfxnyQ18iDs12IhRm7Q675HbpaJxFQipj604sex5Fy54qfqWx637KYGOrUGyrsWrH9UtsOQEi58FHbZe0B8OJSp1lFW6Ytf4fcxv-WfgZldXktMj3i6nHRMOaPca5xIEpwHhMVJFY14Q4nPUzg_4sjGxC-L-QqcEdXbVeVlgbjyCSIRF2Sg5bAWwzvpD2kZ7Oh3RXMHGeS35DiMLbjaj3LC3PhOfmN06gzkhhVhM2zWND9RJRf-330lVfz3q_EeqnNY92M_ABSh4ZgLWCbC7g

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 17 Jan 2022 00:00:31 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F2AC 71 KB
30 KB 60ms
59ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CVV1-ykf8YHa8DIU3aC_SmVFqVHf6Bdb3-T5oljVUmtSukWIFbFtsf_cKUUFuu9hQzQLeBJEM39ctAB-RGju6eVC6ENBAcgCDJhaXamwoQhkvHmZXMcHyDj9cnkaWTdrrC5If4c8HbNgwRxPJLai4ObcmR2g&dbm_d=AKAmf-DNjrktmY9aarNSvtZDoS4k99d08PSwOACTTd9FvIDLWlzbDrwmyJNvpZLgVq-tfIbSWtBqTw29BS4JvnacOgUnA4qUeEtbzQh4K8BsSpUM4xTpeZXhvZCiQQ98-AutesXgB4ArGXeSnOXeZl6X7jN6tMnmNZQfXbBMVIZEvdet80gmiKOHNCvN5ABw-H5or9ld9Yn6Eam1XUKxMjrIfWs928ZOakK_hPE_auj7MU7yn4Cu9IVluL-9w0ZYibp-bLaoJmnlEhj1mIr6HfoP-Ks5Uiao_zpSUlc8Y8dosWDtfwmpmsAUBy_7-YFNbjiXOvU01xn4NVWhsAo6xS0uGytmobrCvtAYm0Kc5ZGpuVkEz1K-mskJgxufTslbiwtqKurzdPEwttZTC--ZIIad60C4SEuyCF57gjhiwAv4VdPCdFfoZr4Jyb10ZcsMsKxkAcJRdTWreaE_e88U1uvbRqTLyj0_oOaqJo46b93o5gQuE-XwNebTI4UdVN3RjAU-5f08PjhN7ZIDUn8x34BuMG7-eV_6ac902A4xZKm135Wlpd4ZjDxaqIEMzJtydUWO7Bu5UqrOy7P1laQSVXGEXx0wIQRSXYZ4lOSaL8eYyFfdxdR6-Jkm8ktgFEzZoLLOUppWSS1Xzcwkw0Pl6rtFKJErYxp8OC8FfsJyJag-KFJLjMXpCExnVJzdcdIulCWgjaY9u7J5E5DVSDlNeJc98zsnw2wlUWwQuREkqc44JasqX8zZ2jDQCE0IEYVEUiySobOnMOQTpIsMU1zHpU_i8adL5RgT25HgZdcRqk3jPLJTvrjTWEbbOX96oTHe5eG_Xz0PwlZi6i8Tz4fz4NOtdbVTL-PcZTGklxQtrSSF-v57anY1930Z3W8OoQlFQv31j21r0VFePRKDivhlow40LtdTUpwljHnz36q4mG9bdKGtaQAzJglMAC-LVp3cfCmvvbEtEyOFkJQVrVFSJy7RW3GTmuV_VYE6XCgu5Uhl73zDzsclqoylCabgCwXCHAcUaXL2ZKyVwVim96kNEzG9szS-3xMs_tXmNcsDjzL2fizY2IYtGqmHRXx4pCEHECnvbS-K5WNmoSxZZjlNj3NE9u1yJCWs542npJ79iWIrhlSlVsrUQmm99vS2u59RalVd961GvOc7f5Zhg2EhbVnYi4MtAtPWfMdu2VsfquCEEI97IoexiKdChtLx44KIIL_KGh8Pt6fF3lHHeWT0qnl5T6j5rK55vUGNpPvkzIOA4owF86PyB4l9ewqIMwVj_25dgJaXnmvK4-Cl5YopcTrllC2DpyZXiNFTZ82Vj4mtLwkalzWlQdrzVJon7gcvxpi3NCSOV7Gx17nhzM9jqoxcaOX1ir_UmRn1ZhHfE61W6Y_XzJjQxdjmz4yKiJfwOxA2UpgVY1ywFHvXGlpVsQ0wgr6OOMqhoA_JuNL82GitJ99_v_HgDkYalp5NiuHivGzriiVl62SeXUDxLulJOVuT_L4FRqcLuFPhZrrYlCRFkepQPSSuBB_2KgMbJ3kj2sQylxhDk7J1B_jyEYG13vJ3e8iqItyIDfASg90h7ALFPOB1QpTh8pGQ7mOd6eFG4ceRHpkisoueVUgXvplJcbsGmA63DEb_bnwaVFReaBpMiklJ4w94t2UAIld3wFSFIymKJHxmVevDTRD5bn6cDREJqzTTInMHYB-OumkaAcnrjH0uAobsskR4DBcGElLTZWF9w-d0v35IxggpoYd-f752-GydwIEtkJt8WNRHYe-vFhZkEArHE7YbRpCeP9eCypzlI79QeRlT2v3O9FMcabrKTVC0tnLT2UOrUgxA8SodZvR8elevp-bvD6O0SQnsA4kxqAXOqpFKJrnTOLcxvj2Q4grHhZc2zRlTiHfpSZ66al4JIQL7ntaOykOqGwcVUvOwkgUnp30MQqerVRj3p73QdiTDxtTlz86cSYeOoKu2uKMmWmRn3fE84kskVVXN2IToZoBnNn04NSFZHQwcCwqQLnnrEmuPP8kYNfW-z-Me2-S87Y1raNk1Y9zZNXBvCFc8FOuE-aDkFIJNUpGP6nw-OFI4Z9_9B_vxl1vL3qBXoUk9A7wpk9kuJTqATgelPHIbbuP4mYtZoHiacm59IrDwjFVbEfhzJrMxJ10iVDAJfgiEUz-gxoVUenlPdFHpZbzndXkv3U5qf5m4EyHFFNGvAGaXhkDFGPl13esvH2i7Fb9XKcc2mbjUwooRWrsrpCzmZPgxPaOVY1JE4j6KptKdQnzlVFb7XWqgP2pc88XC8Jzc1cLm5dPzgYc0Fg4yHUfmXDC6uaP9hRDq4IUkkqpkvwKQRubNAlxmdYxgX84Htl_FxNJ9TboPJkpPaylilCY66QJqrrhs95rjNtNWN8dP6X__vmxeS7RmvJ0SHiYRM9zzaNZOQQd6CP9I-KZK13OpIaKOOelU5OxLPKaaTAd2KYf2WfqsA2P5CKFEbn5ZBG4BOy2mSa011VmgDWVV0kCOHoTujpjXKZBg1h3C4sQRbswf4gcpnq7ij2KdS92jMvfOTIZMuLq1ctSTUvV-YdCkm9z1NrV77ZaCxOnOQa669mIjVap70MxdRtUw4pNN4iQmUZNiTkvIapPbHHEI2Uqo2ahCWekcArGpOSd52vyFSnc2Fbix5wCzfFoZpCFlSvSHf-BziUPq5fsjoBFKVKJEVot7AyQZRO7FbKCgmO0MJBh7N_E0QqC5p2ozjDT2tylxYKbo7CGENHvsvYZl8Jsa0pr-LJjdBm6vjEXiaXx1iyhnIdAf09BsXFfBvBElptp8zTWWkjPBy7TRRT4a_C1fxvNaGJVPwXf2PaV1BmlKyE86HRzG6W6PNFs0CIUzNTXtxWCPd6Mw_Vu7Qs3121VcXl2jUTC39tMmI802EbWAtIdq_wMOE2fPR2YgIvLx5x8Q7LA2b4VT3EC7vEZiwKQ3LVcvU8xgi7zF40jiIMHGi6H0Fn73sURspsn_acI9r41kcB5o9WxxmDAPzov2r5enYLlLnJeFTEKCk-jeTo76CMi1q8O8-ot7fi-U5He5HfnarR0LsFpLY6PAs1wECOf4ZfsJBq7Q-Mpnj2knuXBeMsgBz1DaAuKPRCORtFAWWbwXjmT0GF46gJSyqSRiy3kak6Fqtrg5Uo7oAAlLJgo2XtyLx8zgJeQ6a7dOJpTjzvl2_u1Ak1Ab4bzlRcfY93LB2zANvNKuil_Swa0BPjVF8twLFNHpSfJ1HtxdDEC2Xxo7WbAVQcKHgger2dQqVAwT7yQW0dMBcHYmHuasOp77APOIdC0FYHTauEOlxfUg-liKueShswth9YjZ1Tv4F6P_GUS_lM1NHz1sRPG6np1UnQPBmF8R0Kqv_YSASpOo-p6-zTVy6yKyNkHi-W-vwAawARekKqn_xGzKG0ewd6S_tY152zFxtnFpCNgBA95UBdw1iF0z1uyuXlnkMS_H95g9jaPWzm-LO3KMj_z0LftaZc8fPpC1WJ2RM7wUK6hNpTKh2q-AD6ZD_j_O0Nrxj4vEC4KbxMUspH0b6raWnDkaBoHARCdSVjxxYDwoBYB2Rxi5SRFGfMM9wbKJBDesuCYmiL2SijXvEZO2Jce9odwVJz3-yJq0WPWiT8uaj8CfjvnuYow1otnioLzNbxudx5cHPmOGgDKuwTw4uKtSv2rnJKWvPTmJY694nKE1NpIR6n5OrVaA_nXed55KkSpgPLibKsxYowcBYqDBaoXfTLRjxYt-CyaYkRpWRgPzVwdvfInlifzfHJmMuMGUnEXtg0MjqESTpkL-tHqWdxMQJBYQxBnwtRWuHHVKTvLfrCrY1JHT8SyZMl9JplwjMlexEzHMdanEmBs_m2m2wo98qCsMRWRMUG5J7oMkVTJdClSglysCqaLaqR8lHwwsnus8DcphhKp3doDF2E2EntwNaja6vrYr51SfSQ&cid=CAASEuRoIeo23zK_beu3vFuhnBISjw&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

af3f2fbeab751413a28b53708390fe82ef2785fdb9ac4e2b85fba21c388c505d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30231
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame F2AC 2 KB
1 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/window_focus_fy2019.js

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:50:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 604
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:50:27 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F2AC 121 KB
37 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 17 Jan 2022 00:00:31 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame F2AC 15 KB
6 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:55:31 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F2AC 42 B
64 B 64ms
63ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CPK8Mc9i9txKPdcMDWIAZ8TH9LpmXx4bKmngaJ3FyWbWKkC8aftvweu1cT-52SqUyRf_O-RGaKPxzymVrItsJNrJ9mi3ecUcduFnJAUJOXqtm9WHQ

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame DC61 170 B
188 B 40ms
40ms Image
image/png 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~574.1365.272.817.1651.1721.2575.1716.864.1033.1051.2072.2985.587.3154.196.440.839.1364.1558.1842.1878.2572.1889.415.70.1810.494.2299.338.122.1564.482.2373.93.1449.1201.2571.1097.1230.1870.540.486.317.2316.1712.89.867.1205.1031.1092.1290.1211.1725.1186.449.259.241.162.144.108.323.733.780.981.1215.938.1276.1301.1765.311.2202.2628.2677.3052.1127.149.167.491.2177.1591.1415.1929.66.2357.2526.2109.1577.2253.1419.326.495.1570

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNUFwg7otpgOWy5UrHLkVr1ZHOoiQU9ZW0krdPN7NX8x9lY3-yiHcqKoZac_PpAsphhmquG-wg2wtDtCO0O6hWs6qtM50091snPL813ne98hO64cRAbBGx8J6SHBd7i5tmLsLVHPzKK0MjGPnjxukxxM-OrEonODZndvX9zo1x1Knx43xftEOhJt-j6_OhSN4e-cRQnZGF8Ry-JimbUweEroJ13FThxr6XIpBkYmDUqeTgL5WgRh9J7mYlYZUt47Hw6AsGqH4GQmwFw12WQJRBwxXug3G26j7B5nTktzE198ZBtZrBbZktrWffyui3IWvUL1_vLsnWrHwqi41rNN6T1FZz32jdXmto7W79Qlziv5I70CfApBH49eFcx8QmhYMVgpeIkWXVCu2w9zi3YiqWB0oTiHqA6z2RiHIybPsSdiZBHgB87gOO6fkWKuN2ZN62b22t525C_QseMEfUwhJfsc0Mt_FyjlokuypX5xfojX4RDvY4Rvhwl_GW2Ki93MKJBu9NWidiWWq0PJPvWtNDPyDyu3h7tDyF8GxxNaNB3prCbBFc4tcheo24EQvUCYIuaUusnE3FpNxxDyBLoAbCk-tceFWQ8jW5ne8-VorXOP-OWMY1HUgQ9ReIkkuExmrMvyM7yL9X5QqdHs5fnwjE_HxXILCC5h12eu5_P1YBXUhR6_Js93aYU37uJbsOk2MhGXf_LLh-lny4G60p_WSrHGlJhHqwfnBGcV564HMLsmMQCtbvTis5br2vhq7SbRZ7mn2Pb0Gg-9pHXT_-s7GbWJNWyelkIXBRNiOEoZm9PuHkxLgORTLWjMx-MDfXjBWL7VFjptkQkkQkxMaT0neXFdGxR88GMhdRuGVzWQkPh-MRwKUBP-lh2cpRYGPgT__Xe-rAPwlBPm-FcDMKOOo-RcuBZa5NmXsLWmsnYw9sk0W_LW_3xH7Lpw9EnGK2gArPTWTy9LEVX6M-b2oPM0kLw2c8KtWSO9rFe-9cVSdcGQIRY6DI5luaWhjcY7P78TfVe1rkKPacQqjEe7gtWaSDpYRJm0Iw

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DC61
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBA...
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4E...
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ODZkOWIzNDQtNDU3NS0yYjY4LWM4MjktZGVmYTdjZjc2OGE0&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v2...

170 B
188 B

48ms
47ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ODZkOWIzNDQtNDU3NS0yYjY4LWM4MjktZGVmYTdjZjc2OGE0&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA

Requested by

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: gzip
server: OXGW/17.0.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ODZkOWIzNDQtNDU3NS0yYjY4LWM4MjktZGVmYTdjZjc2OGE0&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame DC61
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR...
https://sync.teads.tv/um?eid=3&uid=CAESEO_9kJLQVW_z2J9tzeJLDz0&google_cver=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4E...

23 B
287 B

65ms
52ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEO_9kJLQVW_z2J9tzeJLDz0&google_cver=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~574.1365.272.817.1651.1721.2575.1716.864.1033.1051.2072.2985.587.3154.196.440.839.1364.1558.1842.1878.2572.1889.415.70.1810.494.2299.338.122.1564.482.2373.93.1449.1201.2571.1097.1230.1870.540.486.317.2316.1712.89.867.1205.1031.1092.1290.1211.1725.1186.449.259.241.162.144.108.323.733.780.981.1215.938.1276.1301.1765.311.2202.2628.2677.3052.1127.149.167.491.2177.1591.1415.1929.66.2357.2526.2109.1577.2253.1419.326.495.1570
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNUFwg7otpgOWy5UrHLkVr1ZHOoiQU9ZW0krdPN7NX8x9lY3-yiHcqKoZac_PpAsphhmquG-wg2wtDtCO0O6hWs6qtM50091snPL813ne98hO64cRAbBGx8J6SHBd7i5tmLsLVHPzKK0MjGPnjxukxxM-OrEonODZndvX9zo1x1Knx43xftEOhJt-j6_OhSN4e-cRQnZGF8Ry-JimbUweEroJ13FThxr6XIpBkYmDUqeTgL5WgRh9J7mYlYZUt47Hw6AsGqH4GQmwFw12WQJRBwxXug3G26j7B5nTktzE198ZBtZrBbZktrWffyui3IWvUL1_vLsnWrHwqi41rNN6T1FZz32jdXmto7W79Qlziv5I70CfApBH49eFcx8QmhYMVgpeIkWXVCu2w9zi3YiqWB0oTiHqA6z2RiHIybPsSdiZBHgB87gOO6fkWKuN2ZN62b22t525C_QseMEfUwhJfsc0Mt_FyjlokuypX5xfojX4RDvY4Rvhwl_GW2Ki93MKJBu9NWidiWWq0PJPvWtNDPyDyu3h7tDyF8GxxNaNB3prCbBFc4tcheo24EQvUCYIuaUusnE3FpNxxDyBLoAbCk-tceFWQ8jW5ne8-VorXOP-OWMY1HUgQ9ReIkkuExmrMvyM7yL9X5QqdHs5fnwjE_HxXILCC5h12eu5_P1YBXUhR6_Js93aYU37uJbsOk2MhGXf_LLh-lny4G60p_WSrHGlJhHqwfnBGcV564HMLsmMQCtbvTis5br2vhq7SbRZ7mn2Pb0Gg-9pHXT_-s7GbWJNWyelkIXBRNiOEoZm9PuHkxLgORTLWjMx-MDfXjBWL7VFjptkQkkQkxMaT0neXFdGxR88GMhdRuGVzWQkPh-MRwKUBP-lh2cpRYGPgT__Xe-rAPwlBPm-FcDMKOOo-RcuBZa5NmXsLWmsnYw9sk0W_LW_3xH7Lpw9EnGK2gArPTWTy9LEVX6M-b2oPM0kLw2c8KtWSO9rFe-9cVSdcGQIRY6DI5luaWhjcY7P78TfVe1rkKPacQqjEe7gtWaSDpYRJm0Iw
Protocol: H2
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 17 Jan 2022 00:00:31 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEO_9kJLQVW_z2J9tzeJLDz0&google_cver=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~574.1365.272.817.1651.1721.2575.1716.864.1033.1051.2072.2985.587.3154.196.440.839.1364.1558.1842.1878.2572.1889.415.70.1810.494.2299.338.122.1564.482.2373.93.1449.1201.2571.1097.1230.1870.540.486.317.2316.1712.89.867.1205.1031.1092.1290.1211.1725.1186.449.259.241.162.144.108.323.733.780.981.1215.938.1276.1301.1765.311.2202.2628.2677.3052.1127.149.167.491.2177.1591.1415.1929.66.2357.2526.2109.1577.2253.1419.326.495.1570
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1114
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DC61
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZjkyM2RiZTktYjkxMy00M2JkLTg4ZGEtMTEwOWE3NGY5NDI4&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f...

170 B
188 B

37ms
37ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZjkyM2RiZTktYjkxMy00M2JkLTg4ZGEtMTEwOWE3NGY5NDI4&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA

Requested by

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: akka-http/10.2.7
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZjkyM2RiZTktYjkxMy00M2JkLTg4ZGEtMTEwOWE3NGY5NDI4&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA
cache-control: max-age=0, no-cache, no-store
content-length: 571
expires: Mon, 17 Jan 2022 00:00:31 GMT

GET
H3 200 oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js Show response
pagead2.googlesyndication.com/bg/ Frame 41BC 35 KB
13 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a02681ae1cc21a54f99afb9cf43cf89c42ab91bc9381aa64e96ffb4cf46e9f80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 21:00:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10792
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13579
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 16 Jan 2023 21:00:39 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 3BE6 106 KB
37 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 20:53:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11241
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 20:53:10 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/ Frame 3BE6 8 KB
3 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BTOgsbrDFXqvZhSqP5EACYKUQsRQVMdn94Bo_Sd8wPzC8dGCdgIDWWxz5PRe_p0UQ7ZI9h0276pLWx0yjoqBVULdSjZlgEZJciAdvJhxkZmZ74TwRtLS4hVi23I82zBdubXr2tltk2Zks97gue324JfqNrpw&dbm_d=AKAmf-DLOBH0K1P-zX0FjVeBwvOfMMJUHSXtAW0G2VDo9yGL6vI_Qfxvy2AU5OCBN1p-yf9HCl3DRbtimPvqqptHfXnogqKPU82vchyiZ1Z1axMukFk9KVrMOV-_aqJMrUOwK7vgoLKSbXaQTTZ-_qsvvNDZJTUgwKow1b3htWR0mlThqXDXAbC6CHSv16Lck-PgOqytJVp5XtWmpew-X-Uk7BlzGaIEEqCCOV5gg8kLzcN8maCxC-_ag5lWVsXghtwUbhnS8DrZKd45Zik24DIyxuecU8klvNMAw3IqbAHmKGRU-kqYqZSt8d-Zmqq47mgyYUsNuDKePGUrhvzdgtCkrk_3sRzqc6pfIK96VeUuQ_JIKwbxx2wmZa3sFmqcClZrj9dHTpH_uQOU42NZuD6QTCuJURXio5rElZ8Fti5Gkj0yVIZayAzUGXPCzpPRQpEQ2DG3Bb8m76VpeyPp8fGvDz_qzj_ASowD0iiZwKfwBK7mFPcaAx3FHtR7dy_apEWVZYtBw3DEFZEX9A5v0CUvLcXhVpBehjLz3LNRoWYKEY3zD0HNu3_dmK6EpVRO2HsaRn6z35ikU5k9_DdpCydzZOXyhPzVu1eJ8InPLsSeP4BOH39hGjqKOVg2BmQS3cSdCCuMbSYreDUL2TMeWvy1dxRZm8l64Kcam7HQCAe8eDWzHyVw9MEoSOBkfj1W-dE4rcOgpY1M115mbtWkVhDRhKDC7MILsUHY2xNP6cN29xZfKQ763OjH0AQN2y6DFkeoxax4ta_WXRYGEWGLG9C-m9_UgP4BhFzed5nyOEgVWpr51P2dkFpTmYtbXc8mPz67lLyNmqaE5n21bcYN-Q6NKyX0bNY1ve98K84OKwHZriP79iE-Zh5lbpaatMwOqgT5PQIU4llZaflqXNS--TuanSC-bAWE3mbwyzvar8KgLA-oVD5u1eb6-KVWm2OeZQXL3XRFX4fjxFIVBXamZ0dtVZCVu-mHOuqDjoKHHmR4ntzecf1FW62Rb4OhqjuABfHTVzxw6iV_kWBjfEhNlC1glXSpiP56nm6vtcXQ31Kgbxa7sMy87B2qMCkRbW1JMscbpbXP9Iztc0AUJaVQLgzevmdSP__Zf7YE65TFIcabmMaO_B6VaNILOVzfxe_xIi2nLC-gb5XFA7jETfLpdl2MmmoLOPWEdoEpE_VQ7IvfHVZgtmfMqkLfE1ao2fis9ydUVKYy24qmXOYurdOSI2GKCWviFTxZVE0JWkcD-UMZjqv8_ARhiHQh3KXwykgBR0Skpo4X0QOrG29mQNxK1t1k_ZhsbrkYolhA8BeIfvDIpY1J_itcruwOp771DgLl8-2WBP2VofkLn4HLpuBKPXub-Xemf_Je2gljZo_S-GRLh2iQHuDo7JiHzCU-BJYyhHvEboyMR87b8mBYb5NeN8dGCU7P4I9nn_Ut98gNr5s0mNAq8Ug0arzx6Gfogt4_bzOzy6gRFTscGTpUAYen1QqbvGUyZy_2PF83p7rAIuy_bmgs1f4Yc_IikmFdf8XBP6z66lVFJ6Az267957sFYLYVtAJ02IGAcluDRqIpgsmUNexaTAXUDIsYCQK_h9G6MUoA_KZEn2eU74qY5AjiB_ghpWYqoqMlkTfjXNl-FhHrIvP-gsLhpu8mrA7Wp2L5C08TS9XCz8R7t1E6RKjxO0YBPtqjD3BA52ZG1epLqM4lMbIpMcMa81xQ6cLsp5DhdXkK3a-ZKWJVJlznzJ5-shYjWf5JEfFWlBkyhr0uc6SFj94GY-elwivulp5g5IulWh2WkIjuOPvA7lorhh4UO-s9zBQj_nRHygoz7zCQjI9Z-gOXqtdojjxJhNE9x4Dci4BWpD3UVKd1UKQy3ClAkxGIOVygM5mmHPFAnk6UbO42rroQGyY9FahYcME6ASB0fVWTu5kOUwT9r_k5L4WEmXJ6lNzOP3SsO7ifJ5VQxcezw66OiAyavVct5hG3qGmWk5xYa4ySea4SLrvcEuVw8zi9mqnwSCLbbN6IoJvT3DyYGa4Ap4qjrLtFxAG4N3dl6gIJUrVG2pJWs4TUX_o21rBdJXt58rjw9fZNyV4tD4N_IoO8XziWExQsz12dmyTQvoCj5EHzp9iN0uOp8nWmxZjnvw1Aiw4D8jcaltF9vVL4tupyG1-PuPx2_MDUsOSMJ78mFYHFpxKIz64P1nzQY912QwBkg92KEpvxfORpB3-TEg2hw8F1UyKhOj5_zWXjxRcoOrfEG-kMKtO1chXzGQMzMyun3IO8rnXhJ2kqPn1Uf1RHFPxWtK7WQmkT1wgW9cG3ZZRChjVi60F8rrSOG0-DPXyM9Fw9uBwZudl5Y4vFnhStI-TStWHL4dxAkWd8beIIkxfA82tXAzyOYktptzfyz4Sk7kMSz5zbsVb3wnfux0BojLgsqkNGBFOzKYVDVDKdNic8X8sfI0WJv142PPrIXq7ywuD9cerkJWgiztWfAnCCnXtaEzDVdW1E0_vNMpTHq1y0oepwD_HLo8yu_pn6oTlWge5VJn4pGCrW33uNq5OolzoBsOZVXOAfDekIAzL8vOIJoAxuY8635BLMf4bZVEIgPyvIW5S7KgMB2ribc0DWS4sJA5PvPH0dtlmINHJBYZSNEnM-Y9gQ3FpDK2E26OOStaSW2sVyg8vQd_zM95JkIcE1boISeqpPRW7T_nv8WplGOeW45qBWy1thiPFSdLSWJlAaw5uwNnesV4OwQxkNUjf_yIHsGUazUpzW5jjAx8Pwm_TO4cp_u00FK35inzqWraUNpz4kVGhYaWVu-mD7kEUB7e1rkhuXLwuGPJ3ILEK8i-tnRf_iPKkuhfuScytmXPfpHx06O__ZVfOTIHwmQyHQiP3pjtmXhF-qo9ATWVSuAKe107avl5qgUNfkBXbGGhqlM79WJ35kCbJIEEC2lD7BP4YnLbRhYHaz1U2ZBdqeNJQAq3IYj8NHt41TXiegGxiWW5wMsTnhWP8cAuU6pnFtXD7Bcyu0cs6QW0TVqSLl-pIoCl7PmIvoq0VtulIlHM-rE4BLLAVHuoAt7PLxkYRCb3a-YeYNp8Gv_5UT0JEpM3Le6sTlEX3VrT47PjGSSoyd1JhjUnnvJI_Xqv5aZ-wqINAX_x6RX-yYlVQXPiGUSLO_-P4tC8TQ_KkH6OmzgTExugOjnueqhPKay-eeSK8JQf6HIrV-jPwNLF81r7BcKguhgFno0cvmr0GbL_IPv5iHkMthdgbT9OUweKTOcqvgvBUtlzKT69Jc7IUVZi3Z--Z99Wzp7PWsQkqVeNoaqzEZb24VjhmpU926JMBchzeRtPJeO5Qy1nNY7DM81Lb10vpXAjtiACfBrwHFnyQPfNPjuVqrdXionSo94G7X4ZvM5D_CZvd5LSO2CDi53avNLasVKJRmIYp9FoR76Vmcy70SCAvQNX8jRdwzC4NWuk2m0pdbZaH_gW4Ftqqi4Op8dvFmVi4YxKDrEyXiuErxd99_dK5Qdp0cCUtVZNn11sLKYvf3voxiLou0nf3RKjOOCcy1dwcIdZV1SbMC5CjIjeOxcSrk8zAH682wCDm6SPxxzoJ9m1Cv2trVjVpzInHYJ6-C6AzDL4758j5f2x65FEm1pkJgHf4osxccCEHrjwi6Gb_Ya9Va1O3NzhAig_d8upxXjvhTuz6kbfqfzJutRPpY5EE0XNK66oNITfKg-lcbWI_l_4_mmeYZbnSHNtzTKjdwrxYqfvjj2Vzy3C9IaRRvPFTy8KBzR0tnWKgyU29YZQkyGXZY1i3DoT-s2oxqn0lWD1Ns9LijR7S9pxdwQQ06zTz13VENVS2_LtUffTBpf1g&cid=CAASEuRolEjkgglHm3ZSIZCmZSoV9Q&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:40:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1213
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:40:18 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/ Frame 3BE6 24 KB
9 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:41:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1152
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
server: cafe
etag: 6261108306223674270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:41:19 GMT

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame D0C9 170 B
188 B 40ms
38ms Image
image/png 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~1097.1230.2373.540.486.317.1564.1205.867.338.2316.1712.482.241.108.259.162.144.1201.440.1449.1364.839.66.1716.1870.2072.2571.2575.415.1651.2985.3154.494.149.167.817.1889.1810.864.1878.1051.1033.1558.1842.2299.587.2572.2677.1591.1929.2357.1419.272.495.2202.326.2526.1365.574.2177.2253.70.1127.311.1570.196.491.1415.1721.2109.1577.449.323.733.1186.1301.93.981.1725.780.1215.122.938.1276.1765.1031.89.1092.1290.2628.3052.1211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNXAgitvkuGwkLqNOy_M7IVc6kfppdg_2VVm3ZSV44iOYTEQ9aCUpii8ebZ6LgLtgXJnYci9eMxQpoKiGuuyoEqjjNXzMjJMAZIbuBNf0xaIEZla92uvbzcqS050NPYhP3YxqPIcyn7kVV67zwPGiCsSd0YYOfib_kgJvnJAS5yzv8l2d3jRppW-EFzVDwinjdVdVaW8WnapjTPd0RYdwHa2ffpY-htqxvoYovwKkNcdYKV5bl9k3dyTiL_2kWk34AbljVIHBAsGk7VkLs46qHrITuyg1DBsjEzFUZOoKW9ilq2PQK2T_F4xI0sgkNtQaN0-H_bNBXj2N0Cmd2L6Ft-VOWFZwTQdYGQRzOcTLZRTCi2CQAM8QwTlSs6rJJt4qfg5IPTceOfZIG0vLX97or4pn7w3mgzcZFebbQ0CqfUkKKj99KeR46C9iBDSZnhxm_pftNgPxNOSyOwVeyaYfx48wKIdXbiBWcT6IdZL-2BO1yZ_AdYMh6wz0tNxwDcFh4b8zN33ioZ7iN2SSe9Z6PTeFgUfKZXV7BLKuJtVMb7zgbrvYusEPqnD0MiHs3WXCzv6noE0YWccAozP6V5ydehNSnwsba8a1XSUXSRL1eEAqXJJ3JajsWbq4_YSRoTLQdCHWpnR7sBemrB1xYt9YtqlxXScTDxcGA1FtIlKH76BqKjfytWAziePKWW8T6AworZOYBBaG3QO3j3j6Gl-ZuLs1zHcIF-KMdVG875xpZyfMamzwza1t2iqpCvk3a3xcSOqHis1wXibSPs1OCy3uSKeXmtzo2PZtTaDEwIQIJ3QAAlrDpAGoAMCIDvoM1JoUgeXQmqx6puk8qifL8bakjIjuDieQPTEC-omQ1RaAUbYLI23cRLXJ6XjYOiDt255xzlU0LmThTp3vz2GjHm-nrNCGnEU2vkRXT0xZBXkhdfFWavpZ5WUSEcZ930xJWIT96LO7jcyVIHV3SotZyfx4T9x2jjQrElKL4nAFTfdriGx73DUTRkrtfbjlSbdjwORY57W0yY-fP0N-EnzxMtv4XML1hqdjA

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D0C9
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVq...
https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVq...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=N2NhYzQwMjktNzcyOC0xMWVjLWEzM2EtMWJlMjM0ZjcwMTA2

170 B
188 B

35ms
34ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=N2NhYzQwMjktNzcyOC0xMWVjLWEzM2EtMWJlMjM0ZjcwMTA2

Requested by

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 17 Jan 2022 00:00:31 GMT
Server: nginx
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=N2NhYzQwMjktNzcyOC0xMWVjLWEzM2EtMWJlMjM0ZjcwMTA2
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 57
Connection: keep-alive
Content-Length: 0

GET
H2 204 v1
ads.yahoo.com/cms/ Frame D0C9 0
446 B 98ms
26ms Image
text/plain 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?esig=1~b04e41039133c73fafd60e0ed8cb49a70ecfb061&nwid=10000483131&sigv=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~1097.1230.2373.540.486.317.1564.1205.867.338.2316.1712.482.241.108.259.162.144.1201.440.1449.1364.839.66.1716.1870.2072.2571.2575.415.1651.2985.3154.494.149.167.817.1889.1810.864.1878.1051.1033.1558.1842.2299.587.2572.2677.1591.1929.2357.1419.272.495.2202.326.2526.1365.574.2177.2253.70.1127.311.1570.196.491.1415.1721.2109.1577.449.323.733.1186.1301.93.981.1725.780.1215.122.938.1276.1765.1031.89.1092.1290.2628.3052.1211

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 8DCE 170 B
188 B 42ms
41ms Image
image/png 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm&google_dbm&_origin=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~1186.2373.482.1201.66.1449.167.149.1564.2316.486.540.867.1205.1712.1097.1230.2571.1870.1051.1033.864.1716.2985.587.3154.2072.817.1651.2575.317.415.1889.494.338.1810.2299.1364.241.108.259.440.839.144.162.1415.1558.1591.323.491.1842.1878.93.1929.2357.2202.2526.2572.2177.1127.122.495.2677.1419.2253.89.574.1365.1570.1721.2109.1577.1211.1290.1725.1031.272.1092.326.70.1215.1765.780.311.2628.3052.938.1276.1301.196.981.449.733

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNUoR-8HAUsRWlg-UPtFlCR1w9IKDKd805HhGMqlGDkfL0pERZgZCRPLwE5AuZ_u9CQeaoD0ajNZEVvKLJaZQi94E-nJ_8tC573fI58uCTVUZ35H4RCAiNpFuIZ8OX4j34pUUut8KboBiK6VThvVzA61dFEVKmvmxzbaOtFur1IgfVKt1SCGv0GDrJM33ngHWUx3TRXzg8McanUeye5ZMcHLItcafSadsX19_WWNQUZ1_2gwyV6m6TUwf0ZsTo9_i7gAz7TnxkeK-a3Hao5uClAbPYcwknsJ_dNQ_z7nisnVYpyqRWFyV2K9rXoTipuT2g_hdUZTWzmypS9TxOjbLmlLHJu-SBy-9qVTpAzQLC_mNckOayjJeMWlkb2Oe1nNclvlDj4SPTYsFWVLoI_qajEIqBA4j6yh1hviO-5GuHnjxZkC84sbG_Ls7Cij83sqr3DohbY_aJTUWTPMNFFCqK7Ln8-pPKqfqmfpmzFPvteTI_W8QFxtJGfiy5ci9g50Ij3CjYWTPMNwRSrLbUk1q3HiqlpPH0bLxo_G__99dpqmYU9eGa9WGc-QSrVtjtAiKlSYmHicSmfOGimRMSyn4Hvq7kHuaok6_7isXm4ZNRYgfG7WVNV06F53wWbPSXGcgW2cdakGWP3qMRBzsulVgBMwNkmfDiBI8bl9VLLpZptczPxpUDPKUxL5QNUD9_2Y6pHGgbLuMlMZ3tlAHtEqKTcADK_YCyKqVATwZkIian4qsXfMf0U2xP66-KtBM8LPgf433OpA1VMIn0GiJ8CKpNAGZlm_yZP6gifId1WY2Z0q7hUwd8cg_KggNLK2n8TCzfNAqDR6_UVmhLG0sbDhgb0oF_AcY6Lr9PBzduTg3LZdTW0URQyxvoGc1fZmNTYcDXeB7eOugMDjG31Tuc5A482zPPLVkyAV-NdsCLw4x6I5J5GpN3Z4tCFWFKSunqyEiaJ18CP5xieLsiDuJB9MmvRXEBSebjARmq0w1irYqcpop9sjQ2PUZYQ07jRNzZnsARRPQMt8vBzSKyyC2WT-vRtZ5SxTAg

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8DCE
Redirect Chain

https://pixel.advertising.com/ups/55946/sync?_origin=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqT...
https://pixel.advertising.com/ups/55946/sync?_origin=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqT...
https://ups.analytics.yahoo.com/ups/55946/sync?_origin=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkV...
https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_hm=VVA3Y2E3OWY1NC03NzI4LTExZWMtOTdiOC0wNjFlOGRmMTIzMDg%3D&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t...

170 B
188 B

57ms
56ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_hm=VVA3Y2E3OWY1NC03NzI4LTExZWMtOTdiOC0wNjFlOGRmMTIzMDg%3D&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA

Requested by

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_hm=VVA3Y2E3OWY1NC03NzI4LTExZWMtOTdiOC0wNjFlOGRmMTIzMDg%3D&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA
date: Mon, 17 Jan 2022 00:00:31 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8DCE
Redirect Chain

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkV...
https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkV...
https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS0wVTcxMjhwRTJ1R19NRzIzcWk5RFhoRkUwR09kb2xRbn5B&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7...

170 B
188 B

43ms
43ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS0wVTcxMjhwRTJ1R19NRzIzcWk5RFhoRkUwR09kb2xRbn5B&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA

Requested by

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS0wVTcxMjhwRTJ1R19NRzIzcWk5RFhoRkUwR09kb2xRbn5B&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA
date: Mon, 17 Jan 2022 00:00:31 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 934E 106 KB
37 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 20:53:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11241
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 20:53:10 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/ Frame 934E 8 KB
3 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D8Ml26DgrUy3IwUmk6SrTY2YR052r_bgbR649RybtEOdnBwQJaBnWcAS2QmXEbtggwvexxJN7EbIZejTRbTu49j97vv4OZellgbOqlyZcVqqX3_dTlV69UyZapXPa7u9xyqfWyvrQvt3pkm3p7JiyjDu6anQ&dbm_d=AKAmf-CSnV7Dbgyo7bq5Mup6fJ7vEobTlXrMrKnj45tplppyxZmmY9GRlWhG5NXxieZdPYnzj9rHLLbVNzdOLMqkwoeRD7CUP8YhxqebxxUvSj9Wnui3C1DbnFEXp1FCJc5D_yoB7KVBfwrHYor5nQYVVZvWj-hdXUTmmlrnxQ3ucHTry4hmJXB7ae4DGp9UWXapRLUvWwyN85uFp2wMhjtEzBo5YJ-IqlT9lKtdPyNG7jRYasEv3yXBv44y1eXuCauJ1Pze2G-0qhJSmj8BT36kO-QyyS5O1c0JnY4pecxr9RCFkC16lm2a0vIl87gaKrc2tRcWeZvB-FLvTw80xkpXzPCD8IoxprL1TKjKIOUUpLLOrl_E9tj7of7OucI7yuU909TMPHlNx8kthSEFHzS0OBYyrgBfDriAVwd6eEhYEyU3zpbViY4h02S_IfYX3jflFiUaQNEKb65is4UNhbtLWwidCIhgcnBInTcG7_aZBamWcKDF83SJ3xSYmivGv9-kR7WLUA4Jvm0FwZikMQ7SLSiNygsf9rwuhjnjXg7ydEr667A76lqJ2W6UuocLxoMrrqxMQzJOKoIpOo2y_WeiWHPmvHWZjDYiMDu2w-Dl8LIUoD_xBnEiznDpveAFtFZPK4oBlFcG9jpSdkKhEyLr2G9Ixo5CKSLIKPUVqzMWjoIKo6mJo4MsPehMVIf3oA9js09U7OaeSgqFhKRc83baqXHw9Ul26pfVkT_kFg248QvMxDki9tl0D-KgQh46_tn8HKa0hRDnnZKxzwuKwCXlDZELPxmig5gutsbRNUuaOjUo1GoiNgigibu88CgI1XE3uVsP53MzTvcR1wxZO4utR86YYWqzYvM4uvDJ2IuRD7C9M_gp0R_M3G6sp6gvxyTEoXVxPY8eItVo6vyQXF1bq7zNSscjSxMCHAWeIw6RzrTHWoDvup8JJ3bO5GT6SqT7Rj3vp0qnbD3ZGGnETi1ZJfHaEp_gEJIyvJ3n5gUJzOaBHzhvTQHopes0u0kFxZw27pfXKmAiKvSKZGLrMshytyEFrIX6VhvZv06RgyJXqnerE4b0qg3Pit-rwLJSx4it4qAjh79RHJy_SFAToYyu-kf7_tnG8xdqbMFQwB5MI-mLmNrFjFnkEA0ArACR5d-uIJ_VZeAhcRyIbhAlSgqGseq_q0biU9aL4XIIMFo0njx6LSE7btumZDqjYqh4HboNQTRThJLsDPY3PXW_UxCnzk2gZHB67LtRe6EUUxgmotd03i1AjWTSdDlOBQhWD95O35JC61WKOBJAlVb0epDkODAgycVbeOJxVXTbwp8WTJTIWI48L9Z9DlLn1Qm6gqTp8Y4C34LQU3lx4mpr0uQb4WP9EKhZrfJ1v3lVCr8mCiXp6vxJ6UuoHcJEUjkwzItayFbZIzRD27KgO9KsOSbSZ9CinyFpTMqdZ7jhrWtJijJDV2RY2HMsYceVUStiRFwDwucdv4KNuz0wZy-k78adSwRrwiIFR03hwo0ShT3juNStFySJH8tOTfUEB8EgNAlTUtl_Blw1BxgYbGZf7ySL8Wyi9QmVn2EofazYOy6JlYUNwS8W65Ig_yZS_H4yTQ20xAt74s6k2LQeKTVcBXoHj9_o5kiMK5i9LRt_M0RB5YFkgffxoTy-9xZTuhCaShEZsOgBMndDnCzl7IvscbSQfMhlcuMZrYnk9efg9EUx_ov4tsQ0klTEUeg23g90NkD-4zNDbFur-cR2k3lgAW1jAi7Or1nbIUwPSWZyqTFyP8vqtkCFijvsOXcrK2szUbOJdo2tWvbByhoH3VZPIvRTzZXExcWOw-YWeYdTBdjQqQ-8jJp26VG02aci323UySFlFr1H8zQheKi3s63GAtEPctaFNIUGHLEAvp8aGQMPxh30n-UyjqOkpcI5BDcr9yk3D5r9I_XNNFXyje4nt74D5LxObT2sd6r7V1Q1b-ua5Whutpan68cfeVd3YH1VNEjiiXnmMOKvh90HCdZV0qM3aW70snEwshJCD6wl79NWfgRM0_nN5Mu-08uMfJR0gRFE3kd25SqcTcHMyjqhDonK3v7fLu3kKQooQnA-UoehvgGByqRHFfNsNAFkypBhIbKl8EmXB1_tdK4wu4ys-CSQmZCw2kpZR2f0uFchYSXaxgE9sSR_vcVUUQAgyJ-vsiH1gVvbFJXwKtGCKTmY3iS-V52nKzD8tKtyZWf9VXgw1dcrkvyBo32i37_kDm1itdIofpjlc6xna6M2MP6wJpP2NY_EM3uuj4Oh3bD5mxIV0_5dwudiu3x73g-xkMGPZg7fqKpEqOJ2xsn1G5EeAReLjoV3EDqMJBcJrMW7LvkScKYhho9Mnb_2tolhu00ykTdLgd2DL7DbUWj_k0tMKlolvrARGxRrst-Kz_yb3oHsSvEVy99NqvOOMy8f0pNPu7vnWjCwsT2neHytoxDcW_8F_aBzFFrhuCakE51R42S9Xzsb_KdSuLT9eKEpYPGNe-lKGCbSHLwOA5lz5z1N0o2vaTPer8QlTxWfiWXnKkYu3XrLR4mKpyWOE7LD5D3QMV-RVsBtf5_gsJhEa5bu38u8dAjemrUsO_I78DHTTbmh3fmUTg5uKWe6T_Xt3vkD-hq76TKhe2xEFuE0uO4LTgupvjoTDekmr-2nfxlAK3zqNRdYS6B6i7O2Lf7Mlgri-PkHMK_hZR9FdZ5TR5L2UHQ1EJHn47mK7DNul0XskJsqFNjkkW93-ULSO4YYvpx-8BiydFaDDkMRfmB6AFK2rLPek5wJysLcYbAgT_Oqf7ntocSE_zeLtKIdxO9IQ3ULvM8ynsfm1Xi4yZYC2FgC3fpfNJ64kh_l9N9B2Uk3_AzZUhIu94RnrOnIXwc8rJnUzXwPoLX56JFzcVgMJGM7tbXyXN13W_E-1WI0wv-u8IzBqNDHKMhbXpe8muv9mSbTlD45llYENtkNxvBcOwGVTrLz1U3WhReck6Uc0RWaC7fqdEEcXEV4HcjWpH1XzTPjkJdfS-Mssf0dEglW5Px5Pjlxw3gaEfkDibDZ1zFjbjXDdlP0laMv5LhFjIUjo-R-h3wAT_Ll9qbRbaeLAC19EqSCymvwv_f4DUyIlscLTe1L8QlqP5DQ3xdPBQ8LPrtVYYqJUqAGVh_LrPWFx9zPnu1x8V7xEyl_NCCOZATmnp2EGYrl4SsaQ9WAcs5QskW7ZFzi9aS9zU0t--7J02N5D6AD6hTXjFJmtbinpt-WWwD-yHO_iE_cCnRqZmc_Nar87yPnj20CyGgPfssgRmgA1BL2kiZ24TzkJn30qe6OUdejy5EWOjCWwsBEMOXdmV-hhTy4k86LluU-MZxandzuwqZrxM8iS_7fzgnXlIQyoOcujM7lRTB3vI09xS__hDDpHVhYsfeTMpTp1cN_xItKhujdKtLoGgTEENf5sXK5hDeSgw1-f1z7oN8v7sp55ZGMQl0o2ZMtPVuvlKqoRA2930ow4QMp-91vQ4LwM_ykFkmHsvjjEysIkDycX02PEziZ1JMlQeFewaVbLHjLbhkgE2lP3GUx1e1S0Ig5zG5siMNTQoc4bRWh3tJx1zYo9ZyC9JQcFjOSsmiBGVhMH94RStLp28zovCCxyZ1xMORPRDWTSYDrXo_YiL_ADyWyD3Xr4alpdwWOf-dvGssO1UU3nujrJIZpo1OSPELAYvKJ8VaTHHtBNiWVfTlcRWBZ1B44PqPaaIIAUvf9oYaeY9k7HodNY8XYhdVNy6-MjOWjS0YZ0bNgEczCdqGgmu-WHcOKC9PNVK1uAqHgW-a72efCf_e6nf5OGmZoLRLo9UofdpV5Ds586v23UMI&cid=CAASEuRoE2xj5B7PXxs71n2lMmICDw&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:40:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1213
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:40:18 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/ Frame 934E 24 KB
9 KB 28ms
25ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:41:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1152
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
server: cafe
etag: 6261108306223674270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:41:19 GMT

GET
H/1.1

200
OK

user-registering
ads.stickyadstv.com/ Frame EB9B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_cm&google_dbm&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36...
https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEAaQpKeidAB0K9h5_d2olsg&google_cver=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_...

43 B
720 B

89ms
33ms

Image
image/gif

2.18.234.233
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEAaQpKeidAB0K9h5_d2olsg&google_cver=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~440.839.66.1558.1364.1842.1878.2373.167.415.149.1889.1810.494.2299.817.1651.1716.864.1033.1051.2072.587.1097.2571.1870.1230.540.1205.2316.317.486.867.2575.1712.338.2985.3154.1564.482.144.162.241.259.108.1201.449.1449.733.93.2357.2526.1301.1186.323.981.2572.1276.1215.122.780.938.89.1765.1031.2677.1092.1725.1211.1290.2109.1577.1365.2253.495.326.574.272.1419.311.1570.1721.70.1127.2202.2177.2628.491.1929.1591.1415.3052.196
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNXZ9omZAAfJv9VxJ6XZGIj9MiKVTABXumUhGZS2wmGJWhrxXJXbp71eur28tkKXYx9tcigz__TGoGTg4vgJFpx1X9aTn5m67COpjd_H2lTmSLgxO-DfrEscgr48wp4SPBdg3yNfXDKyTQ7IJn1LEsMPl4lg76pWEjfJvjfqHKa1RsesmJx8trIl68Z4QN304aXDLbYAI6AtO3g5PvxJamLnmzNCK8XiTIkMFXUHBtpzf7E-Dt3CjVQZh9kpS4aP0f8hDXjKg4OCD-qbHzMt6kfnLXRKsX7JjmS3OSQPpgTDSTVsckDwnHkEseL-lOXVvb3ZRwTigNGGp7raSpOZ2GvthERGyWaoV-BpLz4wsS3hCHJ5OD2ltqh43OoizbVeckuT7Pq6Cbc_QCRdoFmsBaYZY8ZQ7mv0Ci4wAazo8iFnPKxPiEdk-mvyXIFo7FxHx9yvWo8ia6zHuwrORpo3A8PPeXx8DHPjDb9JAMSG_xzj75RTk03oCsz5TPOl7Rtzyyu2_O69Xp7pnd2JNt437CQ25hpdTlS4bIlBuh6dEa8VUz1YY4iGuBmojvbgKyR-e0GBuYtvc1Dvky-26GJ89vRAi9lLOrf2oAw_lzSGgwm8NCznP3tg-gYzHP0ssgdChECbl8_89haFHwrbNxFLeK_GLSMb-yfE8v3NZOWRVxgSWMDQVRy6ka3dykLpJ92o8fmSlIyssuI5Qe8iuS1vpOezJq9HAX1VKmfbK4dIximg6p3Ocg_-eX3R_isXT7fybo96rMRniA9gqvh_EPjXEVCh9DQ01LCr2HytUS0idHO5K7TMm_-11JAVYRLby7EgPgxbV0VvhnVGFpgY3i4kZ_Uc0jvSSCowOWHt_lvRvD21MlsY5kEyqR7Z6PcqW-P8vA9ubSZHJX-MIJ5RPLGanmjIu_s2riJejTI7PWfqwz0Nxf_clMwR7r1pw8qtzO_l4f_6EldBwKY0CVRfGs8nzGY_-_xU1o9u_rPG3o5Htn9ao-6YVdKvMC7xnFF7a10hZ-pWsUzTUG2MwyDabmUupF3rGn9sKg
Protocol: HTTP/1.1
Server: 2.18.234.233 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-233.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 00:00:31 GMT
Server: nginx
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 43
x-sticky-vk: 1642377631296056-574
Expires: Mon, 17 Jan 2022 00:00:31 GMT

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEAaQpKeidAB0K9h5_d2olsg&google_cver=1&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~440.839.66.1558.1364.1842.1878.2373.167.415.149.1889.1810.494.2299.817.1651.1716.864.1033.1051.2072.587.1097.2571.1870.1230.540.1205.2316.317.486.867.2575.1712.338.2985.3154.1564.482.144.162.241.259.108.1201.449.1449.733.93.2357.2526.1301.1186.323.981.2572.1276.1215.122.780.938.89.1765.1031.2677.1092.1725.1211.1290.2109.1577.1365.2253.495.326.574.272.1419.311.1570.1721.70.1127.2202.2177.2628.491.1929.1591.1415.3052.196
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1150
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EB9B
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=11
https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=ZGM2NTkzYzk4ZmUxMWZiOGE4NDVlYTFhOWMxYzM1Yw==&gdpr=0&gdpr_consent=

170 B
188 B

35ms
34ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=ZGM2NTkzYzk4ZmUxMWZiOGE4NDVlYTFhOWMxYzM1Yw==&gdpr=0&gdpr_consent=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNXZ9omZAAfJv9VxJ6XZGIj9MiKVTABXumUhGZS2wmGJWhrxXJXbp71eur28tkKXYx9tcigz__TGoGTg4vgJFpx1X9aTn5m67COpjd_H2lTmSLgxO-DfrEscgr48wp4SPBdg3yNfXDKyTQ7IJn1LEsMPl4lg76pWEjfJvjfqHKa1RsesmJx8trIl68Z4QN304aXDLbYAI6AtO3g5PvxJamLnmzNCK8XiTIkMFXUHBtpzf7E-Dt3CjVQZh9kpS4aP0f8hDXjKg4OCD-qbHzMt6kfnLXRKsX7JjmS3OSQPpgTDSTVsckDwnHkEseL-lOXVvb3ZRwTigNGGp7raSpOZ2GvthERGyWaoV-BpLz4wsS3hCHJ5OD2ltqh43OoizbVeckuT7Pq6Cbc_QCRdoFmsBaYZY8ZQ7mv0Ci4wAazo8iFnPKxPiEdk-mvyXIFo7FxHx9yvWo8ia6zHuwrORpo3A8PPeXx8DHPjDb9JAMSG_xzj75RTk03oCsz5TPOl7Rtzyyu2_O69Xp7pnd2JNt437CQ25hpdTlS4bIlBuh6dEa8VUz1YY4iGuBmojvbgKyR-e0GBuYtvc1Dvky-26GJ89vRAi9lLOrf2oAw_lzSGgwm8NCznP3tg-gYzHP0ssgdChECbl8_89haFHwrbNxFLeK_GLSMb-yfE8v3NZOWRVxgSWMDQVRy6ka3dykLpJ92o8fmSlIyssuI5Qe8iuS1vpOezJq9HAX1VKmfbK4dIximg6p3Ocg_-eX3R_isXT7fybo96rMRniA9gqvh_EPjXEVCh9DQ01LCr2HytUS0idHO5K7TMm_-11JAVYRLby7EgPgxbV0VvhnVGFpgY3i4kZ_Uc0jvSSCowOWHt_lvRvD21MlsY5kEyqR7Z6PcqW-P8vA9ubSZHJX-MIJ5RPLGanmjIu_s2riJejTI7PWfqwz0Nxf_clMwR7r1pw8qtzO_l4f_6EldBwKY0CVRfGs8nzGY_-_xU1o9u_rPG3o5Htn9ao-6YVdKvMC7xnFF7a10hZ-pWsUzTUG2MwyDabmUupF3rGn9sKg

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 00:00:31 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=ZGM2NTkzYzk4ZmUxMWZiOGE4NDVlYTFhOWMxYzM1Yw==&gdpr=0&gdpr_consent=
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1642377631123081-569
Expires: Mon, 17 Jan 2022 00:00:31 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame EB9B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4Ku...
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGG4SWtgRFYGpNxnBkYVsho&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_...

43 B
416 B

56ms
20ms

Image
image/gif

185.86.139.89
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGG4SWtgRFYGpNxnBkYVsho&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~440.839.66.1558.1364.1842.1878.2373.167.415.149.1889.1810.494.2299.817.1651.1716.864.1033.1051.2072.587.1097.2571.1870.1230.540.1205.2316.317.486.867.2575.1712.338.2985.3154.1564.482.144.162.241.259.108.1201.449.1449.733.93.2357.2526.1301.1186.323.981.2572.1276.1215.122.780.938.89.1765.1031.2677.1092.1725.1211.1290.2109.1577.1365.2253.495.326.574.272.1419.311.1570.1721.70.1127.2202.2177.2628.491.1929.1591.1415.3052.196&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNXZ9omZAAfJv9VxJ6XZGIj9MiKVTABXumUhGZS2wmGJWhrxXJXbp71eur28tkKXYx9tcigz__TGoGTg4vgJFpx1X9aTn5m67COpjd_H2lTmSLgxO-DfrEscgr48wp4SPBdg3yNfXDKyTQ7IJn1LEsMPl4lg76pWEjfJvjfqHKa1RsesmJx8trIl68Z4QN304aXDLbYAI6AtO3g5PvxJamLnmzNCK8XiTIkMFXUHBtpzf7E-Dt3CjVQZh9kpS4aP0f8hDXjKg4OCD-qbHzMt6kfnLXRKsX7JjmS3OSQPpgTDSTVsckDwnHkEseL-lOXVvb3ZRwTigNGGp7raSpOZ2GvthERGyWaoV-BpLz4wsS3hCHJ5OD2ltqh43OoizbVeckuT7Pq6Cbc_QCRdoFmsBaYZY8ZQ7mv0Ci4wAazo8iFnPKxPiEdk-mvyXIFo7FxHx9yvWo8ia6zHuwrORpo3A8PPeXx8DHPjDb9JAMSG_xzj75RTk03oCsz5TPOl7Rtzyyu2_O69Xp7pnd2JNt437CQ25hpdTlS4bIlBuh6dEa8VUz1YY4iGuBmojvbgKyR-e0GBuYtvc1Dvky-26GJ89vRAi9lLOrf2oAw_lzSGgwm8NCznP3tg-gYzHP0ssgdChECbl8_89haFHwrbNxFLeK_GLSMb-yfE8v3NZOWRVxgSWMDQVRy6ka3dykLpJ92o8fmSlIyssuI5Qe8iuS1vpOezJq9HAX1VKmfbK4dIximg6p3Ocg_-eX3R_isXT7fybo96rMRniA9gqvh_EPjXEVCh9DQ01LCr2HytUS0idHO5K7TMm_-11JAVYRLby7EgPgxbV0VvhnVGFpgY3i4kZ_Uc0jvSSCowOWHt_lvRvD21MlsY5kEyqR7Z6PcqW-P8vA9ubSZHJX-MIJ5RPLGanmjIu_s2riJejTI7PWfqwz0Nxf_clMwR7r1pw8qtzO_l4f_6EldBwKY0CVRfGs8nzGY_-_xU1o9u_rPG3o5Htn9ao-6YVdKvMC7xnFF7a10hZ-pWsUzTUG2MwyDabmUupF3rGn9sKg
Protocol: HTTP/1.1
Server: 185.86.139.89 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:30 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGG4SWtgRFYGpNxnBkYVsho&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~440.839.66.1558.1364.1842.1878.2373.167.415.149.1889.1810.494.2299.817.1651.1716.864.1033.1051.2072.587.1097.2571.1870.1230.540.1205.2316.317.486.867.2575.1712.338.2985.3154.1564.482.144.162.241.259.108.1201.449.1449.733.93.2357.2526.1301.1186.323.981.2572.1276.1215.122.780.938.89.1765.1031.2677.1092.1725.1211.1290.2109.1577.1365.2253.495.326.574.272.1419.311.1570.1721.70.1127.2202.2177.2628.491.1929.1591.1415.3052.196&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1149
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame EB9B
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=GOOGLE_HOSTED_PI&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB...
https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_hm=Mjc2MTI0NzQ3MTQ0NDgxMTg1OQ==&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zj...
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGG4SWtgRFYGpNxnBkYVsho&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_...

43 B
416 B

23ms
23ms

Image
image/gif

185.86.139.89
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGG4SWtgRFYGpNxnBkYVsho&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ5ZbmARiC_IS-ATAB&v=APEucNXZ9omZAAfJv9VxJ6XZGIj9MiKVTABXumUhGZS2wmGJWhrxXJXbp71eur28tkKXYx9tcigz__TGoGTg4vgJFpx1X9aTn5m67COpjd_H2lTmSLgxO-DfrEscgr48wp4SPBdg3yNfXDKyTQ7IJn1LEsMPl4lg76pWEjfJvjfqHKa1RsesmJx8trIl68Z4QN304aXDLbYAI6AtO3g5PvxJamLnmzNCK8XiTIkMFXUHBtpzf7E-Dt3CjVQZh9kpS4aP0f8hDXjKg4OCD-qbHzMt6kfnLXRKsX7JjmS3OSQPpgTDSTVsckDwnHkEseL-lOXVvb3ZRwTigNGGp7raSpOZ2GvthERGyWaoV-BpLz4wsS3hCHJ5OD2ltqh43OoizbVeckuT7Pq6Cbc_QCRdoFmsBaYZY8ZQ7mv0Ci4wAazo8iFnPKxPiEdk-mvyXIFo7FxHx9yvWo8ia6zHuwrORpo3A8PPeXx8DHPjDb9JAMSG_xzj75RTk03oCsz5TPOl7Rtzyyu2_O69Xp7pnd2JNt437CQ25hpdTlS4bIlBuh6dEa8VUz1YY4iGuBmojvbgKyR-e0GBuYtvc1Dvky-26GJ89vRAi9lLOrf2oAw_lzSGgwm8NCznP3tg-gYzHP0ssgdChECbl8_89haFHwrbNxFLeK_GLSMb-yfE8v3NZOWRVxgSWMDQVRy6ka3dykLpJ92o8fmSlIyssuI5Qe8iuS1vpOezJq9HAX1VKmfbK4dIximg6p3Ocg_-eX3R_isXT7fybo96rMRniA9gqvh_EPjXEVCh9DQ01LCr2HytUS0idHO5K7TMm_-11JAVYRLby7EgPgxbV0VvhnVGFpgY3i4kZ_Uc0jvSSCowOWHt_lvRvD21MlsY5kEyqR7Z6PcqW-P8vA9ubSZHJX-MIJ5RPLGanmjIu_s2riJejTI7PWfqwz0Nxf_clMwR7r1pw8qtzO_l4f_6EldBwKY0CVRfGs8nzGY_-_xU1o9u_rPG3o5Htn9ao-6YVdKvMC7xnFF7a10hZ-pWsUzTUG2MwyDabmUupF3rGn9sKg
Protocol: HTTP/1.1
Server: 185.86.139.89 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGG4SWtgRFYGpNxnBkYVsho&gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 706
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 9834 41 KB
15 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C_g-F_s7nfhRbjUfcx7Gz00w20vUkdcSDGf89N-AqErESXca7zIXCWRwwm4bRnrrKKvfgHL0WawOSIGTSXbaYl1rfVD71RpdUebkmsi6MXK3jZGRMb2VCVmjakNm9oIhBOnOlGVcy4v9qNfOGssu5YnqqoGA&cry=1&dbm_d=AKAmf-AFsTiMiliqAvTwPEY7-glUCiyP3SbFBxm-AfG6CjU3D1h4oCmzfqxL9_L6UBgXeUT_PMUtDfpRgseSRuNZJfqkZfE74eA8QpQpmRqOssT7vawEYn9VpG_Rjh3uuj3-bIdB6bzUBCcB2I9imE4OHC5IGuy1S-KVqWChk5Tp0ejgFUK-PhpBxv3T4HvQm6Lr8S-fp5L5vQV0cFkWpgjh-xtzkItLAUhXBnRn3t_Hc1fVsu1-VP2Ni3qL8D575enteEexs3_zqboByCDgtB_DYSYDWj5LzLB-JKtbavxOwNRPGRJNup26m4cswWVfwtpHVfS-Wv7coUxoQeiqtTBOxBoZ8XxfhP-DZmHwOB5bPj2cbGd3OHUvZXTeW_fnQBlQkXZwFmLQ-XC6sve55JzY11gPw3PWG7ipuEH7zGrdnDXZz-VMCQMbN__oO-PhA3tzulOQdD1TGQ8A5YKk6oEczmAzyrclIDpFUoLwi4m07xoEpvlCMj78x4d-Ab5Uh7WFQAkEfItk2llzpZIt5JuR_KqYD39K98SUeWPpDxDaBe80ezGm63gdQjX8sa0EySZJ14vHQ5kUcRvBOaiq2Sxv1WTYkb606rAYyeqeM95fKMDHIOoMCRGCMGrleiX_oz4ZNqVrDfCEb0D_bySanu9PImQS8_MRg892QghwFwEdzo90IRgCKDIujygmBeB6AgCEUlLyLOe-E93BgMCJTPuBA1i4mRCMER0DX6cQADJp9hwRCq0_3XGpEWg-dwK0R3vcm56l7F4yuC93RtZYkMpHXzHqgrPnXREnZn020VQXaFPmbxDfrjS0bFVQTzrX_h6uN02hGSqzqkAML6CYqt6MMGuaKlHOYPvaCVkMDKvc5zYtTKPiX2LDoPAJqjiqLiTn_OvNVAjZagdd3Y9JAdRrXubHnbTMFKP_tBQxjl5BfsmCyYF08tyfl7q_J_yZozVOadvCAXfVZaT1YKReyWZF5MuddBhRVZ2jdP93z2th4fJJfcVgphJyddXMkBtDtK971lDTt9e5P16ruffixrzWW6WfRzonjIzMRBqYLk_kDaRFCBSdPHXtxjRgB_Sk7H12Eo7JrqkqYAEVg3kQrMqCBMOye6uyqyL9NK9YvJK11jk5XpQ3QgxG8SOP-iaFg4FzSzOOeetdgvUnr-syi9WPBd0A2haqvHpyz2m4v62goABm_ymOPUdDk4R-0I2rmzzBpn7kKTXd7Ta9KvhBl1JAMZCJbnYct96d6t4H3kIY784Wh7mDRJYDhz1jwAvuqsYkl7JP8yVsJsnCOfGZhHr9KEt9NYUet0v0010i5b4ujcj6_y2Xhq5di37QLtbtt-ttp1gAAYM4WlVaUyweKlJ9bm9kNZm1JpVKZ9ACvjpjWi0nD7_UpJxKicqV40_12wjVUVlVfwZqxiHjt5LGMCELHkKgeF3fZnjYg0PVrSEAlnm0K5F2AbSvpGks3Gnk4bc8K4LVXfBSiLiyC0QptsfxAfa0fRP3I2W1bPcZhHRkwJjIFKKxgicutKfXHNW2sAncAR45cOSUx6IlK7Y9Cnnw4xbqqvhO0ldZ5GeiTc8pjaGRxapuGb1LLeOPZwJVEVXHSdPi1wwgHWR6LtOMPfZqBYTBByFE9z4DE45wutGJAMubJ1SmBnVOZZ-5p-flmoNTqed9qTr0uBl9fgjvMTY1gu3HQcTatuwCZhyheyMPe73jjTckjZYVI8H8TRUKeqMINurqc_SIz_9MPqbsixIs8eUD1E6zylSFUjLHXm3NcWT-TjsxnUvfEhKL8wnJSqPfagnf67QrKtHP1AOB8M48L0__cfPZBTCxN-q5JmueHIAe4Ek-Fmh3LTqikw7b0U8RAYQFO4hTrCQzh_49vo_R5w8Nx9Ww6QhoFX7x4eMBt2jg1aYFwtk1ECnNFwkg6xvPqpzm2DPIyXQvRK5vU37mblGSBmqu0x8rGkUg7C9l7d7RwGIni447PzV3N4AV82WbR-bL7BI9aDvgMh0YSEZjT8F8Hpc7Ti8TJBUgULUEjzy3rbatHj9I_SmZrTAM1AGzYp0umcQWvBGA85146-RoDrd3_DdeCZthSg0YfKTyNUeGW2jdv6RQsrm8hxVbNM22ln7pyjmm-aAOtdQk7VmQHYUt7KRBPUlWFvys-8fZqngZe2VPTx5BLOUmh2b08HOGmD_pyRtlVyyIyO-CAIDyHNyk6hGBsqd9XSeE8SOr2yJQ9UOhl0g6AECs3B7ls40SWxc_1OTO64taB0iPDMKqNfsR_6jI2Ww_73f4w3ouabCcbD1_BGEuRJGOrrGGsyiogt_xsINh83craG7AlqwWxz6lzhy30KUPSDXCPv7P-Ngd5INvjnqOXbPahqf-x5uoaSmxTirWS1JzQTQBFSrlt8Rq69P65rv_UpSz2tA_5SA6sIRLC364L1GdAPiKO9PPK_AcuOmO7QXrZTv3ixDPgNlS8yA0RhSSYtlH5pSYtKyjgnw-_Q2p-zaGiKM2suIVssSHL0T7oRWRkzZF2TE3yZzpYX5WHRDwRDZuZbdtXWcorX0GogpqRLyJ6ovsXP1WM22AGl3BXF5RQth6ctIq3TbAc5_sr1VznOvq_RWpWNRavf5JZJf9-8CcqhJFpxFEVrPCeVb9e51l5VpzqMEe2F4x0I8juMhuah16oYS0Hsfu1__KiPxGUeoA9QXBbNVEanD9hr37nwR44ZIVn4slLGXyt7ryc85N55P_HfKdkdt2l3AKgP0lB492kMSpJcEQrZenB3uXix7IqV71js0RRnJv7STdt9LOwMCHZ0NaSCR17OAF9kMDkzYep9ltVxzMJ03QfT5yDFy9ot5CFj9wMeSdDK_Wa00NvDoHdAcM87dIvIFIT2nMUsloGQG4g6vZJxcptt2zKVjdbx9jXc5RFe6syn07DQ&cid=CAASBORoawE&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:19:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 204078
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Jan 2023 15:19:13 GMT

GET
H/1.1

200
OK

728X90.jpg
vht.tradedoubler.com/file/324110/kit3/ Frame 9834
Redirect Chain

https://impes.tradedoubler.com/imp?type(img)g(25128934)a(2865028)912693930
https://vht.tradedoubler.com/file/324110/kit3/728X90.jpg

28 KB
28 KB

27ms
27ms

Image
image/jpeg

65.9.58.6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vht.tradedoubler.com/file/324110/kit3/728X90.jpg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1
Protocol: HTTP/1.1
Server: 65.9.58.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-6.fra56.r.cloudfront.net
Software: Apache /
Resource Hash: a087741d89c871c74a686dba096a819e5f4335e8012b906d438c3342654e3c02

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 14 Jan 2022 11:49:33 GMT
Via: 1.1 fdd677a35b242f0199586a71e2f6859e.cloudfront.net (CloudFront)
Last-Modified: Thu, 02 Dec 2021 12:58:01 GMT
Server: Apache
Age: 216658
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Content-Length: 28577
X-Amz-Cf-Id: YVOpYG77zr51avPvJYyoD1y7_Y6WpEuDKJb7tRzm7vIvTDpOiH3vfQ==

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:31 GMT
via: 1.1 google
referrer-policy: origin
server: TXServerHttp
location: https://vht.tradedoubler.com/file/324110/kit3/728X90.jpg
p3p: policyref="http://tracker.tradedoubler.com/w3c/p3p.xml",CP="NOI DSP COR NID CUR OUR NOR"
access-control-allow-origin: *
cache-control: private, max-age=0
content-type: text/html; charset=ISO-8859-1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 261

GET
DATA 200
OK truncated
/ Frame 9834 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2ebcbb2299bdcd27f16421a0ee7c77f7692265e8dbf6d9f02662b051beed25c6

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 0a7038a78463924e38e856a41c4efd92.js Show response
www.gstatic.com/mysidia/ Frame 48AC 8 KB
3 KB 64ms
30ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/0a7038a78463924e38e856a41c4efd92.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b07b4e0d02a41172ffb5b11e33f997583021a5fe04d18ffb2c5262ad4555dd74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 16:24:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 200156
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3339
x-xss-protection: 0
last-modified: Tue, 11 Jan 2022 08:34:10 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 14 Apr 2022 16:24:35 GMT

GET
H3 200 d21411ece572ce2870b8d279b6163686.js Show response
www.gstatic.com/mysidia/ Frame 48AC 11 KB
5 KB 63ms
29ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/d21411ece572ce2870b8d279b6163686.js?tag=pingback

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3954905eae16fa888a3e7e785d0cb8a0d0171bfbea2221157e5425596538fed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 10:28:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 221497
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4725
x-xss-protection: 0
last-modified: Tue, 11 Jan 2022 08:34:10 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 14 Apr 2022 10:28:54 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 48AC 3 KB
579 B 75ms
35ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 16 Jan 2022 22:44:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 17 Jan 2022 00:00:31 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 17 Jan 2022 00:00:31 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 48AC 1 KB
875 B 26ms
25ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd11fa353cc6a8560f4c35e67c6fb8a3a4061ed3de4309cdf83fca65f8319bb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:58:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 151
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 848
x-xss-protection: 0
server: cafe
etag: 2277666839114365613
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:58:00 GMT

GET
H3 200 e485ffd488b44fd3558b39d314f67b09.js Show response
www.gstatic.com/mysidia/ Frame 48AC 6 KB
2 KB 63ms
30ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/e485ffd488b44fd3558b39d314f67b09.js?tag=analytics_pingback_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd2002cdf21b9a1c068b3b6f24ece6d21d00ecdf3b14de9b37372425e8045e90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 15:16:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31470
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2354
x-xss-protection: 0
last-modified: Thu, 13 Jan 2022 18:31:08 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 16 Apr 2022 15:16:01 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/ Frame 48AC 19 KB
8 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2039446f8956518da2c2d70116d18c92fac3b04110942de074748aa4041067fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 883
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7881
x-xss-protection: 0
server: cafe
etag: 7605774008668088057
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:45:48 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 48AC 2 KB
1 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:50:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 604
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:50:27 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 48AC 121 KB
37 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 17 Jan 2022 00:00:31 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 48AC 15 KB
6 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:55:31 GMT

GET
H3 200 b08052bb948632636d2eb594b39baf17.js Show response
www.gstatic.com/mysidia/ Frame 48AC 27 KB
11 KB 57ms
25ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/b08052bb948632636d2eb594b39baf17.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7cb23a8c81d8e04f278b4ebbcc8c169c2f602398e4fb0f336dbf71e4752470c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 16:24:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 200156
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11476
x-xss-protection: 0
last-modified: Tue, 11 Jan 2022 08:34:10 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 14 Apr 2022 16:24:35 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame F2AC 106 KB
37 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/
Origin: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 20:53:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11241
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 20:53:10 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/ Frame F2AC 8 KB
3 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CVV1-ykf8YHa8DIU3aC_SmVFqVHf6Bdb3-T5oljVUmtSukWIFbFtsf_cKUUFuu9hQzQLeBJEM39ctAB-RGju6eVC6ENBAcgCDJhaXamwoQhkvHmZXMcHyDj9cnkaWTdrrC5If4c8HbNgwRxPJLai4ObcmR2g&dbm_d=AKAmf-DNjrktmY9aarNSvtZDoS4k99d08PSwOACTTd9FvIDLWlzbDrwmyJNvpZLgVq-tfIbSWtBqTw29BS4JvnacOgUnA4qUeEtbzQh4K8BsSpUM4xTpeZXhvZCiQQ98-AutesXgB4ArGXeSnOXeZl6X7jN6tMnmNZQfXbBMVIZEvdet80gmiKOHNCvN5ABw-H5or9ld9Yn6Eam1XUKxMjrIfWs928ZOakK_hPE_auj7MU7yn4Cu9IVluL-9w0ZYibp-bLaoJmnlEhj1mIr6HfoP-Ks5Uiao_zpSUlc8Y8dosWDtfwmpmsAUBy_7-YFNbjiXOvU01xn4NVWhsAo6xS0uGytmobrCvtAYm0Kc5ZGpuVkEz1K-mskJgxufTslbiwtqKurzdPEwttZTC--ZIIad60C4SEuyCF57gjhiwAv4VdPCdFfoZr4Jyb10ZcsMsKxkAcJRdTWreaE_e88U1uvbRqTLyj0_oOaqJo46b93o5gQuE-XwNebTI4UdVN3RjAU-5f08PjhN7ZIDUn8x34BuMG7-eV_6ac902A4xZKm135Wlpd4ZjDxaqIEMzJtydUWO7Bu5UqrOy7P1laQSVXGEXx0wIQRSXYZ4lOSaL8eYyFfdxdR6-Jkm8ktgFEzZoLLOUppWSS1Xzcwkw0Pl6rtFKJErYxp8OC8FfsJyJag-KFJLjMXpCExnVJzdcdIulCWgjaY9u7J5E5DVSDlNeJc98zsnw2wlUWwQuREkqc44JasqX8zZ2jDQCE0IEYVEUiySobOnMOQTpIsMU1zHpU_i8adL5RgT25HgZdcRqk3jPLJTvrjTWEbbOX96oTHe5eG_Xz0PwlZi6i8Tz4fz4NOtdbVTL-PcZTGklxQtrSSF-v57anY1930Z3W8OoQlFQv31j21r0VFePRKDivhlow40LtdTUpwljHnz36q4mG9bdKGtaQAzJglMAC-LVp3cfCmvvbEtEyOFkJQVrVFSJy7RW3GTmuV_VYE6XCgu5Uhl73zDzsclqoylCabgCwXCHAcUaXL2ZKyVwVim96kNEzG9szS-3xMs_tXmNcsDjzL2fizY2IYtGqmHRXx4pCEHECnvbS-K5WNmoSxZZjlNj3NE9u1yJCWs542npJ79iWIrhlSlVsrUQmm99vS2u59RalVd961GvOc7f5Zhg2EhbVnYi4MtAtPWfMdu2VsfquCEEI97IoexiKdChtLx44KIIL_KGh8Pt6fF3lHHeWT0qnl5T6j5rK55vUGNpPvkzIOA4owF86PyB4l9ewqIMwVj_25dgJaXnmvK4-Cl5YopcTrllC2DpyZXiNFTZ82Vj4mtLwkalzWlQdrzVJon7gcvxpi3NCSOV7Gx17nhzM9jqoxcaOX1ir_UmRn1ZhHfE61W6Y_XzJjQxdjmz4yKiJfwOxA2UpgVY1ywFHvXGlpVsQ0wgr6OOMqhoA_JuNL82GitJ99_v_HgDkYalp5NiuHivGzriiVl62SeXUDxLulJOVuT_L4FRqcLuFPhZrrYlCRFkepQPSSuBB_2KgMbJ3kj2sQylxhDk7J1B_jyEYG13vJ3e8iqItyIDfASg90h7ALFPOB1QpTh8pGQ7mOd6eFG4ceRHpkisoueVUgXvplJcbsGmA63DEb_bnwaVFReaBpMiklJ4w94t2UAIld3wFSFIymKJHxmVevDTRD5bn6cDREJqzTTInMHYB-OumkaAcnrjH0uAobsskR4DBcGElLTZWF9w-d0v35IxggpoYd-f752-GydwIEtkJt8WNRHYe-vFhZkEArHE7YbRpCeP9eCypzlI79QeRlT2v3O9FMcabrKTVC0tnLT2UOrUgxA8SodZvR8elevp-bvD6O0SQnsA4kxqAXOqpFKJrnTOLcxvj2Q4grHhZc2zRlTiHfpSZ66al4JIQL7ntaOykOqGwcVUvOwkgUnp30MQqerVRj3p73QdiTDxtTlz86cSYeOoKu2uKMmWmRn3fE84kskVVXN2IToZoBnNn04NSFZHQwcCwqQLnnrEmuPP8kYNfW-z-Me2-S87Y1raNk1Y9zZNXBvCFc8FOuE-aDkFIJNUpGP6nw-OFI4Z9_9B_vxl1vL3qBXoUk9A7wpk9kuJTqATgelPHIbbuP4mYtZoHiacm59IrDwjFVbEfhzJrMxJ10iVDAJfgiEUz-gxoVUenlPdFHpZbzndXkv3U5qf5m4EyHFFNGvAGaXhkDFGPl13esvH2i7Fb9XKcc2mbjUwooRWrsrpCzmZPgxPaOVY1JE4j6KptKdQnzlVFb7XWqgP2pc88XC8Jzc1cLm5dPzgYc0Fg4yHUfmXDC6uaP9hRDq4IUkkqpkvwKQRubNAlxmdYxgX84Htl_FxNJ9TboPJkpPaylilCY66QJqrrhs95rjNtNWN8dP6X__vmxeS7RmvJ0SHiYRM9zzaNZOQQd6CP9I-KZK13OpIaKOOelU5OxLPKaaTAd2KYf2WfqsA2P5CKFEbn5ZBG4BOy2mSa011VmgDWVV0kCOHoTujpjXKZBg1h3C4sQRbswf4gcpnq7ij2KdS92jMvfOTIZMuLq1ctSTUvV-YdCkm9z1NrV77ZaCxOnOQa669mIjVap70MxdRtUw4pNN4iQmUZNiTkvIapPbHHEI2Uqo2ahCWekcArGpOSd52vyFSnc2Fbix5wCzfFoZpCFlSvSHf-BziUPq5fsjoBFKVKJEVot7AyQZRO7FbKCgmO0MJBh7N_E0QqC5p2ozjDT2tylxYKbo7CGENHvsvYZl8Jsa0pr-LJjdBm6vjEXiaXx1iyhnIdAf09BsXFfBvBElptp8zTWWkjPBy7TRRT4a_C1fxvNaGJVPwXf2PaV1BmlKyE86HRzG6W6PNFs0CIUzNTXtxWCPd6Mw_Vu7Qs3121VcXl2jUTC39tMmI802EbWAtIdq_wMOE2fPR2YgIvLx5x8Q7LA2b4VT3EC7vEZiwKQ3LVcvU8xgi7zF40jiIMHGi6H0Fn73sURspsn_acI9r41kcB5o9WxxmDAPzov2r5enYLlLnJeFTEKCk-jeTo76CMi1q8O8-ot7fi-U5He5HfnarR0LsFpLY6PAs1wECOf4ZfsJBq7Q-Mpnj2knuXBeMsgBz1DaAuKPRCORtFAWWbwXjmT0GF46gJSyqSRiy3kak6Fqtrg5Uo7oAAlLJgo2XtyLx8zgJeQ6a7dOJpTjzvl2_u1Ak1Ab4bzlRcfY93LB2zANvNKuil_Swa0BPjVF8twLFNHpSfJ1HtxdDEC2Xxo7WbAVQcKHgger2dQqVAwT7yQW0dMBcHYmHuasOp77APOIdC0FYHTauEOlxfUg-liKueShswth9YjZ1Tv4F6P_GUS_lM1NHz1sRPG6np1UnQPBmF8R0Kqv_YSASpOo-p6-zTVy6yKyNkHi-W-vwAawARekKqn_xGzKG0ewd6S_tY152zFxtnFpCNgBA95UBdw1iF0z1uyuXlnkMS_H95g9jaPWzm-LO3KMj_z0LftaZc8fPpC1WJ2RM7wUK6hNpTKh2q-AD6ZD_j_O0Nrxj4vEC4KbxMUspH0b6raWnDkaBoHARCdSVjxxYDwoBYB2Rxi5SRFGfMM9wbKJBDesuCYmiL2SijXvEZO2Jce9odwVJz3-yJq0WPWiT8uaj8CfjvnuYow1otnioLzNbxudx5cHPmOGgDKuwTw4uKtSv2rnJKWvPTmJY694nKE1NpIR6n5OrVaA_nXed55KkSpgPLibKsxYowcBYqDBaoXfTLRjxYt-CyaYkRpWRgPzVwdvfInlifzfHJmMuMGUnEXtg0MjqESTpkL-tHqWdxMQJBYQxBnwtRWuHHVKTvLfrCrY1JHT8SyZMl9JplwjMlexEzHMdanEmBs_m2m2wo98qCsMRWRMUG5J7oMkVTJdClSglysCqaLaqR8lHwwsnus8DcphhKp3doDF2E2EntwNaja6vrYr51SfSQ&cid=CAASEuRoIeo23zK_beu3vFuhnBISjw&rfl=2%2Chttps%253A%252F%252Fsubterfugue.org%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:40:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1213
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:40:18 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/ Frame F2AC 24 KB
9 KB 31ms
31ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:41:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1152
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
server: cafe
etag: 6261108306223674270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 30 Jan 2022 23:41:19 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 0E3E 41 KB
15 KB 28ms
25ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:19:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 204078
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Jan 2023 15:19:13 GMT

GET
DATA 200
OK truncated
/ Frame 0E3E 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dbf2f498cf22f59ce80e398562af1e02080fa09d5b28d33be583da4ee3c32f42

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/4249241/1641553762375/300x250/ Frame 0A1B 4 KB
1 KB 60ms
27ms Document
text/html 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fee21c28692a8e704d88300e60bb27015e87859f69de8d215248ee6a0c60116b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 1481
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 16 Jan 2022 01:05:15 GMT
expires: Mon, 17 Jan 2022 01:05:15 GMT
cache-control: public, max-age=86400
age: 82516
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0E3E 0
24 B 68ms
67ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsskh1K2xCLGxAItcVe0QtXxuxb3RVFtbN2osH8FIF-Dcs2n8SgI1cL9GOmCWcxVVWLlnIyWjv8-KCe7HQD_PU0J7T02JNVDemaaPjIdA0aiA9n6o0pPweebKOOrSPmw6kq91VkjzAP2QDeKn44wiQgr45E4kKRAky4400tJ7v26XFyWdzj3eYp7J-Hg9h0Tc_kTG0g9UIlWuJyq4mS2jWqeVko0U-DLCU8oNpjURNJGNUjc7bQqPOex1qqknJOFkfna6bpl3IxXersYUMIK2NjYWO47TbipEWfsQg2TYBM3zSvsTiauMOppJiCHN05_C4OWZfFmEGAAghc2MQSIllTwLz65oBK9-aEgrKUUw-jKE8KX1GjH50Wwwrbu9ivDTiBqCcENR8dZIfUHx01tZStfbIqAVznRSbSn2t45Mc63EWCoUxPKUS4GOHWS0bRNfvA26ooK3eP06VS6-9fgkcSwCKiB_YMeqx8fMRd0nUYHN78RJevZ76s8_WmfJSAqFRrbvXpbQhXjIGYo-n_Bh_koNehKKPxG6UoNkdzx4I_J2S7oH0Fzussqw_0qFb83ACCaj_FfeTevBSn_bBTEBTgG62HMq0vc_KGHs8PMhfK6Sy8_7V4Uca7svnHR1OT4Au4Two9xAnEJXamYg08E0mKPZ-5Hbc6cHYEFFZlSVTrnVxuNtfhbCiSgR2y2yPt6Yzxgfov3xSIM7rUyuVopQcewHVrPCYDydirEWdcWYqlyhBl4KJ9KJYU20fW9pvN_kHRKHt2M7oSDpKBgAb6jts6bJ84lPYi8PhTpjvAHk1YuLuqkQrKMSFBBPgcvENPBJGAwtQ9nXY_qGz5wHaF5Yk5GmBJNXpL0jJmxB17ZZn8AtiSchMCj3d2UikX2YO2lxQDbqk7uwEjRa8eCXphv42JImi2goWHfPhbHsx7_0oIxOnqI8LCgVnrHsnr4VjIUDlXkO4H9qPGG5iK7TT-n-jg2I8TL_dOOFg2h8idXh15ZSZH89ElHRsauE65sxWQVH17YYg8InkQcgv55fBz7JpuozYqUHDCbOOHxw4D3qvaRxuGD_y7nmyRuKt9WSqTrjgwDET6gVweYNur_j_VEHiVl2vHVjo2mleBCp24sezpt-1Rky1_nx3V9DIGLhhpNdXUn_lGyF75o_VEmgrdDQ1qztQ&sai=AMfl-YQBQTaQy5XSk0BTzQVODWzAv0_XGp4lY_OD3gr9EEaugMIlw0PvpUfvv4ytLW_5fVXPHwEwu41BaR8AGnpnT_qaqcaoKBU5HsNrP5fJ9TVJDpNYT5K_qALcNzAuyW6z-_8o4hHwgqJcOXdKwUiuA5p5W3CDKA&sig=Cg0ArKJSzEX0uovGwWrqEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=270&cbvp=1&cstd=267&cisv=r20220112.88615&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 17 Jan 2022 00:00:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 index.html Show response
s0.2mdn.net/4249241/1641553762375/300x250/ Frame DEFD 4 KB
1 KB 50ms
27ms Document
text/html 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fee21c28692a8e704d88300e60bb27015e87859f69de8d215248ee6a0c60116b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 1481
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 16 Jan 2022 01:05:15 GMT
expires: Mon, 17 Jan 2022 01:05:15 GMT
cache-control: public, max-age=86400
age: 82516
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 14A7 0
24 B 91ms
90ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuerKpvcW44TxARDYZ6kVVn45tWwROZIlO4nqRwE8ySMEfrVrnIkevPJQUr2jwgB2wsw7F7uQ_xV0C6HjxgDQvbgkOTvvvHJq1Q3Tt8-f9PNhMTmfL-XvDAZLghnt9uTP5PgRUTT4dOMkGp-AEZ-uItOfh-GjDKKNx-OgDfeQFWBNGmWr9IFAyooJfzkcjbn7F8Zu20-A1JLG9SnY5g_JLQfV4Fjpakc-vhfdwa-pytRQ8sPwFvOEV3mSk75is036XpKvcEsPDPQGNYFe8lWt9wYOEof1R6oJ2Uw_bh3PpuJ3MgKVk78FGEFiuZzMnS6SRAeQvCGt6Osxre4ISxL40NhkSYZ5AnTiL1MV-NiTzj3Z9CPwMtZo929fT0nLGuhH60V1oENm6C05_UpdqCw3NWeSHBs6tN8kFegi4meLSUP8sDHUMWcPN1GkF7lWYE7f2xxANkl3odfe1_jXp1Cpf_K1X0AWOPJar6Z8N_49QIecnuitXEXbEkRGpoiAIOtoqEHC0O93HFLo4KTtp8oBXTAhChMutj8mlbvTjwuFKv9UdHGvJosXcIV85kU3hAsM39M73gHHksctYPDiul4mTGOk8TEmJ_yj1vmvJHiGMonKK5XpXx1FVm93fF52tti8UxEq5WAt6-hMRmLZoErlTaWAiPo_5VYAljCunxE7PbWRzoOgkMjCiXqgFOjn_Bx1V68LY6XEymBu9MVd-VRKaqSHzJty2wrt_7PCdSusnaLoe7y5BPrNbCYNl3fgS0jLV_Kee2oO8wWp8QTJLx72znXa-JJWvcJRa7Q93m_YUct1UXqCGDiZZMRPi69wQfYJxToYB_KPTdac8bbXLO4CKHMB9egfEFMDkCpf_Yat6--1q14xGnoaNUQOsRovBXWWREDwam756ahC74xfCyKDSZDrcZRcNcSeYy7uDcwFjc1KOAVjKrQzl0-Vuo3ilAZiG8HCWSL6Ae6MvH2azM8qMiqEJjbaJfN2chvBTrv3YvFKd4OzHtYNDywNRhuqNCZvi7ZR3U70PhEyDbKmios3_xBJhnk_ykDkvdjztbKw4fsgXcUet5VFex0GFJS7grcwJAaTKWk1Ul77A4OTlMyo-OYD0SRS6fNg4gh1P12cvg1-Ho7iZtaxx3iJCKUqsELfRDIYLV1KrvBSc&sai=AMfl-YS3RItUnY0K32xz_aWixj3RZDwxZ2qsPGmaEEgSD--wdgkeChacgQY8Ald_z08y_bHoRfqgKfYhUuxPzBv76K77IY5_l1U98SYTiADvtREZikq0ZWiNdeUeMPH-6lUgcuGkYYpkb8wtMcZhJwBss6aCK7ZMRA&sig=Cg0ArKJSzEMIYbinfGolEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=258&cbvp=1&cstd=256&cisv=r20220112.63454&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 17 Jan 2022 00:00:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 index.html Show response
s0.2mdn.net/4249241/1641553762375/300x250/ Frame 279E 4 KB
1 KB 45ms
26ms Document
text/html 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fee21c28692a8e704d88300e60bb27015e87859f69de8d215248ee6a0c60116b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 1481
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 16 Jan 2022 01:05:15 GMT
expires: Mon, 17 Jan 2022 01:05:15 GMT
cache-control: public, max-age=86400
age: 82516
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9076 0
24 B 99ms
99ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst14t2km_ue014reCajhzkUE63RTzW3uhtygTR3CYVSQglg5qmJROzbIy0XWWsKyaNFHDoIfCaatzA0aZju-fhc4-VazBW82Vus5o1nOJp6elBDtRn9vtbaLEDON_puDlXj7oxwb0gw-T69htDZRgVJ-MNcOhQ_LuiX3F_AhPascXLSFDij2408yCD7feuHXNEUco7Z8HAw0TkW0T6UjOuhd3kSsHSNdzFg1L4kCyi9SMmWh6fxVGA28I01GifFjcPUPytmfHAsv9a1EFnoxhGRbN54uboZWoqCzLYwEseu7KlC0BLdHSXgy2LQ4EsL8TEGHD4mTESx-bgiLsuoudYukLhP_y-AJO_65ZUDf35i2NqEG1ph1lvy2dUZHo1_uUuw4aCrLPib30wtO6pOnAvNY8rJ2dWYgu6q1he3mKZyT0a80MjUD3UUM5T98-fhHBY-kQ5LP2EHaVyKXOtbvyfk8M7M8yCGhKBH3C5ukaeOawHR4mOp5myPTwrUY3KQaMu3nJZdvT3usGzroGkkDzWIXTE6vFXMHhUKalrW3XTiMdzJIZIWyY915b65eZ0ma7nM9r7BazOXUF_nkAlcAN4ZRq3rL1LPRLCew2bntIVIFMBlPfst1smnv0Jsg0bTnY-sZEAyfc33NhGkBBbhpCI44EScQ58va6W-lpRlqqn9uAv8qvZhCBJg_cd6Hq48o13P6B4rjsITjsf7e5dcNB0yXNiY1Iy8QUfwYBq5GJqS96IPwLNYlosQC1eIToHPeuGl6Zp6JcF02HKK1sxBaZ3Aa_YcjhG6fXrFVFUEmr8cf_0B3VLW9Zf99DFDRemxZKWAkCobI2WKHAltIlXwb-Vi_ICvxUa1Uem66qRDz8hg1bpgF-TwfeUgIGKGYoqtslnudeqR9ZMXrR8kp1LkhMHHycutZQCtgWnGlKjhwtEKOwQeGvf2-D3e0u6UCRABKlQO_Q2As2dIrHYSCbGXjf9LeMD0c_mjanlEI2oLofTqPFbF-FWxKvovFsAcjl5ERQansL4gfIcHDiZbknQo6CNCIN-vOS-f8y-58hjfczdLwabNfCNSMniIKM-s5SmNPwOCROPxRCH_zTux7BXKu-iy4y1ffaUxtBgR5XCrWmwTjYq0UWwr3f1G5wfi0lTpFu0JGJHbebipdks&sai=AMfl-YSCQQUQt2mif-K4lsEzj7ZjGsorh161c0JudJZojiVcuLLcQvnkTyunxl2AGcxV52gcWdfaOr6_LWsy4KxK9nuTbf8TV8mOQ-0n3V4VpVfMjdtZuRdatGKw2lbxkADvhoWo8M8pB0vBFFGDp1YFjVzDau-Ayg&sig=Cg0ArKJSzI5W-fuCjd7gEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=273&cbvp=1&cstd=271&cisv=r20220112.05786&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 17 Jan 2022 00:00:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 9076 41 KB
15 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2495647230&adf=1404796083&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=609&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=607&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=75wf9xBgZQ&p=https%3A//subterfugue.org&dtd=1212

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:19:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 204078
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Jan 2023 15:19:13 GMT

GET
DATA 200
OK truncated
/ Frame 9076 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 06497b51a0447daa94b5232d51e7d52989bc3c15baaab474373b7908d3b587cb

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 14A7 41 KB
15 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=4117114381&adf=3954608419&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=845&idt=526&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=267&ady=3007&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=ZV10ewvAkC&p=https%3A//subterfugue.org&dtd=1206

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:19:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 204078
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Jan 2023 15:19:13 GMT

GET
DATA 200
OK truncated
/ Frame 14A7 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 68731aa017ecb42e44c079c3e31b03813bbaf7e9630c1f2a5c01e8e6f07bfa20

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/4249241/1641553762375/300x250/ Frame 87CD 4 KB
1 KB 25ms
25ms Document
text/html 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fee21c28692a8e704d88300e60bb27015e87859f69de8d215248ee6a0c60116b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 1481
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 16 Jan 2022 01:05:15 GMT
expires: Mon, 17 Jan 2022 01:05:15 GMT
cache-control: public, max-age=86400
age: 82516
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3BE6 0
24 B 68ms
68ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvCjcUJX3uOISQj8VFhSFHbcVU9DkKl8jSc4WHYAAB31WiaU2ppH-MKK4bsZIV2QGSDb3-07Wf-n0P-5BLnV7BH1G-YbAX5oXftBiWk0tYy4EnC-gEWCFjvxgpRE3sbruQoGINxzMG3PQwFPAsRGzuOstkEgLPUIVmLcF9JfGOq7UUEkHdXFkBn5CsaPdft4xXMbaiF0G2C2oXUIzEwnXLfmIYLvXXmtqKcgIaVoH6e4YoGnFi8WUHFOlcuZG5bM21ZqM-oTmuByIuUIbEb0YNthYXQqFM8OIxR6bRi7Xm4tbcnljHVLuw2Ro079fimYpqdlxn99GGHkXjRT4B78Q3_-pTgv1ZqFJ7tm0-PyIWZoGmCneX2Fyvl_QQ0dx7xTQwpBstt1S1asXGQk8Qf8NBZuBBtjLrr4EXRk6OcVKwkOY6KBHHEMajuueZWB-De0aXUhghX99Y-0XuhhdPC0nDu1v7JziwdcoIr6xuBcifrYiMO_dPoI21Xn5IgczRdiY0oCdzpWDIz9Ug9M6ws8CFjmUBUzIYCB42YLNLsGMrlfYkQMd_sZRZC-vjRcOyuaZDPpALe5sO8zY5m0W6FRC3nv3qC946u31UG57PX6bngEwiWNggBkxIS4zZyLuDNvG2rUae7Rbb3jt-JUQ9yfOPTwqbyQCzHQix2_qJCTQ0-1RpPHpRHH0kYwOq6KyOt-6uJwsco6AHl4i7YI59uDPEQYL8Z5znbXmEylUvoEyhMj1p4zA3mu0kaaYZMOwESV2K-GGgghCWSMl_lbt26l38Wf-f5a8Kpar7kGcZjF3UJoqZ2n5FpC7gRnB4029K_7tiPueM7JqSilZvHVg7dzfLiICp2Tx8TQymsgaRFJqTU-TYa1vd6tVY1JAgRGPBZE37Yn8hXv5F_hJAnYsULUnfryUTQ1HjxY7xY9ZdYK8usptVc_mZJFK_8JYuoSCCMNABFCsn9_z1HmRrB0MnNGnGR5hRiJ7n4dyGEdrsmEp8bA7ks4HEcMQuH6MVM7__-9FT0c7rEtIx3bnSK1EWVwATLwQELaO-jOEppyniCWYOej5g5oQsUvQi24w4Wh3z0EpnD8u87aI99y4qMajl0YG6kmWOC_O3srpVdwHx7eNKrJWmEwbBdMOm8K9glQwSVsAMEReKrDDTc888&sai=AMfl-YSBkueG3JOmQNUPaVXnKO2Iiptse7njSGAJ5Hc59lazpDLo6H6UB1W_04Lq0BSBg3a2fuFlr3z8sJZA6UxgUy3Thmw-RbZkqr-jzvfqwfaLe_FtgAHV_XaryNOSHvkQbxsmuMYAqgx6hAc7HJbIkMbCFLuPVQ&sig=Cg0ArKJSzHnqC-tjpT_REAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=281&cbvp=1&cstd=279&cisv=r20220112.77411&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 17 Jan 2022 00:00:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 3BE6 41 KB
15 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=3107299941&adf=2927141728&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=1&bdt=844&idt=976&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=3223&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=03TIDHTNwq&p=https%3A//subterfugue.org&dtd=1225

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:19:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 204078
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Jan 2023 15:19:13 GMT

GET
DATA 200
OK truncated
/ Frame 3BE6 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c66f9bb4cea975c97e5f75d3a277dd0809f6a1a96fccfd43dceb24db645a9ee8

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/4249241/1641553762375/300x250/ Frame 94C8 4 KB
1 KB 25ms
24ms Document
text/html 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fee21c28692a8e704d88300e60bb27015e87859f69de8d215248ee6a0c60116b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 1481
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 16 Jan 2022 01:05:15 GMT
expires: Mon, 17 Jan 2022 01:05:15 GMT
cache-control: public, max-age=86400
age: 82516
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 934E 0
24 B 76ms
75ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssCZW0ZUBTS3_-UKZ3uV_H5QL_ocQBrUscwVSU2pq7dXCC-kNgUIAXRGUe5zwkwzVvYiZ0ccDbTZdAA_q6T5fi6LOSwjDMkp-3aLGwhX9u8lQqM-gufg5AwZX2C2QgKbouNtbU4QxcfOJZcLZm6jyAamIuWDcY4FVb7zcZVTPPyofuClvwKAsKFoW9NVj4X5VSoBqMX-tyyl_3DEuPmdIkggabXM0pKk2Ywq_Z2wgXwfMO_ZdHSNREYifvJgBKzP8M2ZAPGQjzLoRcral6HGmxReAJTst83OihoXSRcRfvo5eIw89cfmR3mPekdkftv3eK4iMJ-K2Wu73EYCurmT_6GgbfQV0RqAModNDnXW82dfwK0MxriRvXBLd_sHa_rQLwSYMK73b1NdfbkxlHp6upoEnvxNg5QB-a5G2j6gifvbmCN79skKmUdbbILCxOCvkGm7TGAYb5DbJ7I5_MXylilIrcYCC7Bn8ds3ySDyigbJ1yoXSIoJbPPXU2IuH-GNNTIGDLeuOIfHD6pZKHjDgqGj5ZlJi4_0slCk805Id-BqPUsy0mJ6wsCfGtyerlp0IzRHMunMAAm_odSqiRPH4yeyWmEg0X36A6g-lQLw_rRTMTu01TZRMxMfMPO3a1xVMElV_-7d0FpXZ3YUOmwEX1_MojeU5V-8mctgDmjkwnLKVY6kP6tc-L3pJNqh7ZjgbEK0Z1YFhG3yRsf65Tpi4hZFlI8On1lDWlteloqGNf8sn1o5DVAY42vpPcKu8xCb5t6D-ufCjuaWcdONHG5jWLVTokkyKQuZmFf7kW80M3sJOExw78pRQoLyYBfO88bf7teyPljjeVITYfgT43CD0_ScWoTQmUq1HLRC61m-0AAPDEP8VHKesXSrlu3zlzIro90D1zXWg18K451nBRP52wiFU4ot-6BYmwgnI0ijuhiVEadxOzdEregbIZNL9P95aNOSzp4ydhpfW_pN40vwO24LrBZlZnjxaCwxAl7aeESJBL6TT-MvemMPmBM4qvR59g9vytPC6E-0Ud9Vqhsdxzu78ugr5fsBG4GDEAO1AfQauUCwZUf_zcEbbviILN6bR_13OxClgJ1opuqOVo4DM6Mz6ARURxnjTa6BZMHpNMHUZj-EiemDcKALzpgtm9pnILZoFwDyPG4dE6aSSMf9dQ&sai=AMfl-YT00nPiXxuVdC5O49gq8FSqy2mSWkBOLaTmg6Kxr57HcDH8jNyDWIzlRG1qbpDzO9BEt-UcYdJp44XyAXjwr0X7ajknX5S7JIRJX5ye9rhh5Hr_FGTqUjYvsp3bsOYzEqSy139_FuC5WM07KH-Q0zAodLwZTw&sig=Cg0ArKJSzLeAfAFYrd8WEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=294&cbvp=1&cstd=292&cisv=r20220112.72745&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 17 Jan 2022 00:00:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 934E 41 KB
15 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=1&gdpr_consent=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&client=ca-pub-7268067865878173&output=html&h=280&slotname=9187253983&adk=2732065616&adf=629078454&pi=t.ma~as.9187253983&w=336&lmt=1642377630&psa=0&format=336x280&url=https%3A%2F%2Fsubterfugue.org%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642377629319&bpp=2&bdt=844&idt=805&shv=r20220112&mjsv=m202201100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Daaa912183f31b3bd-220d48ba21cd0035%3AT%3D1642377629%3ART%3D1642377629%3AS%3DALNI_MYhX-dkqkPceP0KqH_czoZ8Kkjs1Q&prev_fmts=0x0%2C336x280%2C336x280%2C336x280%2C336x280%2C336x280&nras=1&correlator=5674816328801&frm=20&pv=1&ga_vid=1755634244.1642377630&ga_sid=1642377630&ga_hid=1217981941&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=2936&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C31064017&oid=2&pvsid=227882031419255&pem=956&tmod=988&ref=https%3A%2F%2Fkartaplovdiv.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=hlAYMT9mzg&p=https%3A//subterfugue.org&dtd=1221

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:19:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 204078
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Jan 2023 15:19:13 GMT

GET
DATA 200
OK truncated
/ Frame 934E 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b3ac4d3608ec040d97d6d6eb8e865ef8f85c4c2f7aa4237340b617dbac6fb427

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 34D6 22 KB
8 KB 33ms
32ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 14 Jan 2022 15:19:21 GMT
expires: Sat, 14 Jan 2023 15:19:21 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 204070
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 index.html Show response
s0.2mdn.net/4249241/1641553762375/300x250/ Frame 6FF3 4 KB
1 KB 25ms
24ms Document
text/html 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fee21c28692a8e704d88300e60bb27015e87859f69de8d215248ee6a0c60116b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 1481
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 16 Jan 2022 01:05:15 GMT
expires: Mon, 17 Jan 2022 01:05:15 GMT
cache-control: public, max-age=86400
age: 82516
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame F2AC 0
24 B 70ms
69ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuqC6WsHQxILZR7hYi-zues-TQg6tOnDoeraDMTeztp4G987587ihlHk4Ddg8bGLR0rZAFZ_E8v78YIVSMPXRZ6AUgLe1hQsA7X71k4XUhQg1GVK_uHlJ0l2JVDFIysIKoJki1oP6ekrxb3EhMRJw3wneULvhecFe0JYIdz4sngtWBgHavwFh0YiALe18kGyUq7aOdHJr95czUhZkrAgLS1-ufI8WEbVOM1hEiacDPqBEywocjB8hwlHG7yE2DgTu0CqFmB41oCwtJo27lL_58UVuZDJCJvRP7QEGRRMNeLmsM2ccA3uoAUbj3ClBj1JC-fuh4NvlDCf_IC9WJWini5Wb079VLvLF0qY2h7vqM4sFF7WdmFCyir6ZK-QXsxUAKF9kwanzmHgK7ATyMUIp3J2RAbP3WdLFBVsMGzG39I68sEJ8QpfJ6WmcGp_6vLGmN92VPO4kfMq9yXEqPDNP5XhjXv9kal21LfHrI2uJi_bzelQPdWFD7zCrC5RcCUknsXn0l4q-G8jv5-vvduc11hJO5WReDWSUgvs69L-kwXvHjfQLqB00z23kDEZnXzInInPQVqF1c5Yd-IsQEebn0LNprHBTJCwGPySt9_KDDrF3NPiJF-EFCdnb9cYE4QLplf10qUz6IhTk6QNZ5LVF0qXev6OWirt70yOgWlN0lgETN2vBAmO7jfI2qZo3E5sdnBOwMvGkEg9E7j9LOGy7aLfe6xnUmdCSZNZgHoR9FQUPkY3l6nzM0bi3tLRYBpFhTz3KOcBthZ_IbLT1dhNW7e5zoFXL3k1LAC-aThxd1NaqAej5frSB2tRfxE-Y8a_W-aNJDbZADJT8SxIu0nAQvU0Lu2RlYM4bILr7EvG2sOV9JOdiTpIowOXH0MKIZpXK0x0RovJfL7qf7MQUKzoy26vJSLmOYYm2RhcGewi9vIrPBzQyDQoyZmrUk5H-64Daul6VxZmS-I9v5yaUMH0Edj2PPHnMkU_TPoDu5I8ZvFirLEsVruaRymTGesylI7C_yLSN5jVuyl6r9A9g28raZCMTF1Os8QSsA9rQHy3buXSd9qm1wIeMOq23m_FkcRUwCfNCTHYHUsOojZd0NyfTALGy9AVHmg8fe3FwYRjeASXRJ3V1_W9WDb3__0SJuoPy-0AWCO_qsC8kyw02WJgjd5fz2hcBKiHML1rKql2ND-s13cGZTcXLvMa1ZJHTxQ1mDHzcakP66CKOCr1zPMEg&sai=AMfl-YQutRPPe_yPz7us_O6vVDkqcgtETj4b0idHnS8tZKZ1VLl08kIy8ve8P6rJTUfI9RefiXAhXbWB3aJZda9D7jETWcTdpQoUBvTxaleqnppbjXibCzhJMsBY5QFdxspFxcVVPSKdLLoAYs5iJ4Y7xFRu84uGMg&sig=Cg0ArKJSzLdHRWGhDJBkEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=280&cbvp=1&cstd=278&cisv=r20220112.97754&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 17 Jan 2022 00:00:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 track Show response
17052e5944.1691ba9d92.com/in/ 0
199 B 131ms
69ms XHR
text/plain 45.133.44.25
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://17052e5944.1691ba9d92.com/in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiIxNzcyNDExNzQ3ODEzNzIwOTAwMCIsInRpbWV6b25lIjowLCJ2ZXIiOiIyLjE0LjAiLCJ0YWdfaWQiOjE2MTksInNjcmVlbl9yZXNvbHV0aW9uIjoiMTYwMHgxMjAwIiwiYWRibG9jayI6MCwidGltZXpvbmVfb2xzb24iOiJFdGMvVW5rbm93biIsInV0bV9zb3VyY2UiOiIiLCJ1dG1fbWVkaXVtIjoiIiwidXRtX2NhbXBhaWduIjoiIiwidXRtX2NvbnRlbnQiOiIiLCJtbSI6MH0=
Requested by: Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.25 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:32 GMT
server: nginx/1.18.0
vary: Origin
access-control-allow-methods: *
access-control-allow-origin: *
cache-control: no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers: *
content-length: 0

GET
H2 200 build.m.js Show response
js.cabnnr.com/banner-admanager/ 25 KB
10 KB 95ms
39ms Script
application/javascript 45.133.44.25
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js.cabnnr.com/banner-admanager/build.m.js
Requested by: Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.25 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: e0b5a4c5a222720eb46c0effe46b2ed52f24f427d99227445011150b4b4b70db

Request headers

Referer: https://subterfugue.org/
Origin: https://subterfugue.org
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: gzip
last-modified: Tue, 28 Dec 2021 13:38:49 GMT
server: nginx/1.18.0
etag: W/"61cb1369-648a"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Mon, 17 Jan 2022 01:00:31 GMT
cache-control: max-age=3600
x-proxy-cache: HIT

GET
H2 200 native.m.js Show response
js.natsdk.com/npc/sdk/ 40 KB
14 KB 106ms
47ms Script
application/javascript 45.133.44.25
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js.natsdk.com/npc/sdk/native.m.js
Requested by: Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.25 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: c883dec0dc4b34cb4c0d23fb1e1496a1dcf3c46ca1d55a6ccc3f67b3a5d7b41b

Request headers

Referer: https://subterfugue.org/
Origin: https://subterfugue.org
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: gzip
last-modified: Tue, 11 Jan 2022 12:10:50 GMT
server: nginx/1.18.0
etag: W/"61dd73ca-9fbe"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Mon, 17 Jan 2022 01:00:31 GMT
cache-control: max-age=3600
x-proxy-cache: HIT

GET
H2 200 csub.js Show response
js.wpushsdk.com/npc/sdk/wpu/ 13 KB
5 KB 101ms
44ms Script
application/javascript 45.133.44.25
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js.wpushsdk.com/npc/sdk/wpu/csub.js
Requested by: Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.25 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 4ecde2d2133c88aed7c545af11fc8fb7e8196c95a855dc8078fdb9a73864e1ec

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: gzip
last-modified: Fri, 14 Jan 2022 13:43:34 GMT
server: nginx/1.18.0
etag: W/"61e17e06-32f8"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Mon, 17 Jan 2022 01:00:31 GMT
cache-control: max-age=3600
x-proxy-cache: HIT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame D840 22 KB
8 KB 25ms
24ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 14 Jan 2022 15:19:21 GMT
expires: Sat, 14 Jan 2023 15:19:21 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 204070
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8CFA 22 KB
8 KB 25ms
24ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 14 Jan 2022 15:19:21 GMT
expires: Sat, 14 Jan 2023 15:19:21 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 204070
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 TweenMax.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/latest/ Frame 279E 105 KB
31 KB 84ms
42ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/latest/TweenMax.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

001acbb15d9c69510c0817e6dde361bff098406fad182ab3c367f86ff3da8343

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5274190
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 31378
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e71-1a5b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZZrwtxckj4cDMGZ8EtjaqdyHVy2SrHsUNNp3nDcDnVvO9HksxJS50HjVTHwEM%2FFZhIEvUKsR3qFosQ%2Fh9v4YjHcteorYtrbwAxVoPVFe%2Fu6hfB%2FHpTfDOBvb98OTnOswh4cx%2F7y1lA%2FexDR856FgosZM"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6ceb4dc7ae603a63-CDG
expires: Sat, 07 Jan 2023 00:00:31 GMT

GET
H2 200 zepto.js Show response
cdnjs.cloudflare.com/ajax/libs/zepto/1.1.6/ Frame 279E 55 KB
13 KB 109ms
68ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/zepto/1.1.6/zepto.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ab854cc22d028b4cdbe236179c0b0908b7722063c816444a3837ba7a1b8af8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5347388
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 13499
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:18:11 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04043-da98"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8ywDT4SkOgro1hW2LtMoO8pK%2FvKxvQRdccWfeSCoGoDacHRqtON9oLS%2BeArhjqoEqBxd0RXo1SdTcVqzaCQmdc5HGeBtm4ki4L81mRzfOfKl3xSnZWCUjoloY0T%2B0W9Uay2phUEpb98UuzzCqPftacig"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6ceb4dc7ae613a63-CDG
expires: Sat, 07 Jan 2023 00:00:31 GMT

GET
H3 200 styles.css
s0.2mdn.net/4249241/1641553762375/300x250/ Frame 279E 2 KB
631 B 25ms
25ms Stylesheet
text/css 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca66ce214f061f6bef74fe6efa1ece7f0a35eedae738ebbc3fd1b4dbffad00be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 605
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:17 GMT

GET
H3 200 bg1.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 279E 65 KB
65 KB 63ms
63ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a00d4579f77231643a0621c0b078d0b3191508ebd318e9e89d13f8aecbd3e9b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 66553
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg2.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 279E 79 KB
79 KB 79ms
78ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a969a673c13d6979bd4e322e4aaa227216cef9fae37ffc31b7721cc94e2a0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 80438
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg3.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 279E 42 KB
42 KB 79ms
78ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6997dd75309ff66fe274e6e7af455dd7e1d6088f040118023a0b17b54fb2013

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42563
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg5.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 279E 61 KB
61 KB 88ms
79ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg5.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e6e3228dc18ebca7170c145cde9ef9c030a59d3f69a93fa3be896e37b5fb1c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62736
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg_slider.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 279E 3 KB
3 KB 95ms
86ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg_slider.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77119836d65555901ae15fd4b0ba7fcfa661a02fbcbe7112614538d4ab9b056f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3011
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 logo_small.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 279E 3 KB
3 KB 96ms
87ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/logo_small.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b46b0112a83a3a5f24762558e66428a0f3b4394c5eb609137ec197c7e131945e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3023
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt1.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 279E 3 KB
3 KB 105ms
96ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7cee78edf15d9bc8a2de584de60623e3ba6972abd5751b6ba1ed2274085790af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3336
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 txt2.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 279E 3 KB
3 KB 106ms
97ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c1927405979dc7fdd8b64e3cd57c476bad4d032bfe38d31c6053e3a1afde031

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3263
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt3.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 279E 3 KB
3 KB 107ms
98ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a3c4c7a374f4306d2bae677e251655803f5583deddb90dfc0daaa009c9b5263

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3310
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt5.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 279E 2 KB
2 KB 107ms
98ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

730d1a9f03f2d5088ddc8b00bf3da8fc2bf3112b229a227b5eaa6d9b3410d6c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2397
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt5_1.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 279E 3 KB
3 KB 107ms
98ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt5_1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

199797e420dd8f79de2ef71e8cb58b69763c33119777e8bf93f5c7cae5a96965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2828
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 offer.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 279E 3 KB
3 KB 107ms
98ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/offer.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3fab1a185dee2b44c2308af821ff07b21d83f300afa2266b85d915707776a4b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3422
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 cta.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 279E 3 KB
3 KB 100ms
96ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

06c7eb7d2b0fa0dd095a4f24246053d5585bca68a30dfd720f0d400b4d7f76f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3054
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 arrow.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 279E 242 B
266 B 100ms
96ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/arrow.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0678ce624028582f1afe0bd9f4b10b5711a70a1c9a0b5892e6adf805d035ae39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 242
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 legal5.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 279E 2 KB
2 KB 100ms
97ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/legal5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bec4ade172f991fd6a0d3c2004729964a6015e2aea0ce28de642008bb3d3daa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1947
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/4249241/1641553762375/300x250/ Frame 279E 5 KB
826 B 27ms
27ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6bd3a2d62fb9cfba2ae6a21baaec2882fb4a0821f14297318171151d8e72818

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 800
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H2 200 TweenMax.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/latest/ Frame DEFD 105 KB
31 KB 87ms
47ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/latest/TweenMax.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

001acbb15d9c69510c0817e6dde361bff098406fad182ab3c367f86ff3da8343

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5274190
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 31378
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e71-1a5b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TFdPFP%2FkOj%2FK%2FcLvUwVDs71GdtMPSATqen0j46j0byqkOxuu9tKOlkQH8BA%2FWNjwAQHJeI5qgFMhaW7H0qDfURohPi77ZD1Pu%2Bm7TT9J2Q%2BqprKjqmGXQDN9K4VUHl3EQkt%2FfTGKfIcA37HLMqsXK98d"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6ceb4dc7be633a63-CDG
expires: Sat, 07 Jan 2023 00:00:31 GMT

GET
H2 200 zepto.js Show response
cdnjs.cloudflare.com/ajax/libs/zepto/1.1.6/ Frame DEFD 55 KB
13 KB 106ms
67ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/zepto/1.1.6/zepto.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ab854cc22d028b4cdbe236179c0b0908b7722063c816444a3837ba7a1b8af8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5347388
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 13499
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:18:11 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04043-da98"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rgQOPeFiCGPfbzqajIGVyoCr0RxZPvbGtze%2Fg45oCIU%2BdqgHqRVM78jyq3e9sq1q5I6qBODQgKYmZIgTWKd5jlCtYaSLDrUk6ylac0sOYCbAPhzr%2FctNIinmEphQAPY593Lit%2Fb6nkKZZSNzpxFkICXy"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6ceb4dc7be653a63-CDG
expires: Sat, 07 Jan 2023 00:00:31 GMT

GET
H3 200 styles.css
s0.2mdn.net/4249241/1641553762375/300x250/ Frame DEFD 2 KB
631 B 24ms
24ms Stylesheet
text/css 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca66ce214f061f6bef74fe6efa1ece7f0a35eedae738ebbc3fd1b4dbffad00be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 605
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:17 GMT

GET
H3 200 bg1.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame DEFD 65 KB
65 KB 100ms
97ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a00d4579f77231643a0621c0b078d0b3191508ebd318e9e89d13f8aecbd3e9b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 66553
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg2.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame DEFD 79 KB
79 KB 101ms
98ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a969a673c13d6979bd4e322e4aaa227216cef9fae37ffc31b7721cc94e2a0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 80438
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg3.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame DEFD 42 KB
42 KB 103ms
100ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6997dd75309ff66fe274e6e7af455dd7e1d6088f040118023a0b17b54fb2013

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42563
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg5.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame DEFD 61 KB
61 KB 104ms
101ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg5.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e6e3228dc18ebca7170c145cde9ef9c030a59d3f69a93fa3be896e37b5fb1c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62736
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg_slider.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame DEFD 3 KB
3 KB 106ms
104ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg_slider.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77119836d65555901ae15fd4b0ba7fcfa661a02fbcbe7112614538d4ab9b056f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3011
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 logo_small.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame DEFD 3 KB
3 KB 107ms
104ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/logo_small.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b46b0112a83a3a5f24762558e66428a0f3b4394c5eb609137ec197c7e131945e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3023
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt1.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame DEFD 3 KB
3 KB 107ms
105ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7cee78edf15d9bc8a2de584de60623e3ba6972abd5751b6ba1ed2274085790af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3336
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 txt2.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame DEFD 3 KB
3 KB 109ms
107ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c1927405979dc7fdd8b64e3cd57c476bad4d032bfe38d31c6053e3a1afde031

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3263
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt3.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame DEFD 3 KB
3 KB 109ms
107ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a3c4c7a374f4306d2bae677e251655803f5583deddb90dfc0daaa009c9b5263

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3310
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt5.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame DEFD 2 KB
2 KB 110ms
108ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

730d1a9f03f2d5088ddc8b00bf3da8fc2bf3112b229a227b5eaa6d9b3410d6c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2397
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt5_1.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame DEFD 3 KB
3 KB 110ms
108ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt5_1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

199797e420dd8f79de2ef71e8cb58b69763c33119777e8bf93f5c7cae5a96965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2828
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 offer.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame DEFD 3 KB
3 KB 110ms
109ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/offer.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3fab1a185dee2b44c2308af821ff07b21d83f300afa2266b85d915707776a4b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3422
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 cta.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame DEFD 3 KB
3 KB 111ms
109ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

06c7eb7d2b0fa0dd095a4f24246053d5585bca68a30dfd720f0d400b4d7f76f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3054
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 arrow.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame DEFD 242 B
266 B 111ms
109ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/arrow.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0678ce624028582f1afe0bd9f4b10b5711a70a1c9a0b5892e6adf805d035ae39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 242
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 legal5.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame DEFD 2 KB
2 KB 111ms
109ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/legal5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bec4ade172f991fd6a0d3c2004729964a6015e2aea0ce28de642008bb3d3daa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1947
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/4249241/1641553762375/300x250/ Frame DEFD 5 KB
826 B 26ms
25ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6bd3a2d62fb9cfba2ae6a21baaec2882fb4a0821f14297318171151d8e72818

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 800
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H2 200 TweenMax.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/latest/ Frame 0A1B 105 KB
31 KB 97ms
63ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/latest/TweenMax.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

001acbb15d9c69510c0817e6dde361bff098406fad182ab3c367f86ff3da8343

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5274190
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 31378
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e71-1a5b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=45dRFXvIlruKxxX0Hhyy0ZTcBoSGkyi5vFNS4XuoJIy3%2BxkYLBb6FNvoly1MIhYjY7M586dAffI7DyeWrpKNy3ecLx5CzD4sPeV8HL3UGXLLuRwFZVUEsR1Is%2Bqj8TUmNP%2BTNTDp8SI%2BLlnEjnYorI1g"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6ceb4dc7be663a63-CDG
expires: Sat, 07 Jan 2023 00:00:31 GMT

GET
H2 200 zepto.js Show response
cdnjs.cloudflare.com/ajax/libs/zepto/1.1.6/ Frame 0A1B 55 KB
14 KB 95ms
62ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/zepto/1.1.6/zepto.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ab854cc22d028b4cdbe236179c0b0908b7722063c816444a3837ba7a1b8af8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5347388
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 13499
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:18:11 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04043-da98"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M2xbAG9xiJReoyxvDH2JivTncEedBneCTuCDCtfCP6YxB1M%2FT386ydY%2BINNOxsxaNxNV1cTxXr1357gL6H2t0TuVUYNsMSKl4Kji3CTndntMW0pmQsIWTDZDMEfUsUCStl3zne%2Fz8VVr%2BQFa8DzxKZb3"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6ceb4dc7be683a63-CDG
expires: Sat, 07 Jan 2023 00:00:31 GMT

GET
H3 200 styles.css
s0.2mdn.net/4249241/1641553762375/300x250/ Frame 0A1B 2 KB
631 B 25ms
24ms Stylesheet
text/css 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca66ce214f061f6bef74fe6efa1ece7f0a35eedae738ebbc3fd1b4dbffad00be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 605
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:17 GMT

GET
H3 200 bg1.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 0A1B 65 KB
65 KB 27ms
26ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a00d4579f77231643a0621c0b078d0b3191508ebd318e9e89d13f8aecbd3e9b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 66553
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg2.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 0A1B 79 KB
79 KB 42ms
41ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a969a673c13d6979bd4e322e4aaa227216cef9fae37ffc31b7721cc94e2a0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 80438
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg3.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 0A1B 42 KB
42 KB 33ms
32ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6997dd75309ff66fe274e6e7af455dd7e1d6088f040118023a0b17b54fb2013

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42563
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg5.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 0A1B 61 KB
61 KB 58ms
57ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg5.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e6e3228dc18ebca7170c145cde9ef9c030a59d3f69a93fa3be896e37b5fb1c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62736
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg_slider.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 0A1B 3 KB
3 KB 63ms
62ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg_slider.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77119836d65555901ae15fd4b0ba7fcfa661a02fbcbe7112614538d4ab9b056f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3011
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 logo_small.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 0A1B 3 KB
3 KB 64ms
63ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/logo_small.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b46b0112a83a3a5f24762558e66428a0f3b4394c5eb609137ec197c7e131945e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3023
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt1.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 0A1B 3 KB
3 KB 90ms
88ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7cee78edf15d9bc8a2de584de60623e3ba6972abd5751b6ba1ed2274085790af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3336
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 txt2.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 0A1B 3 KB
3 KB 85ms
84ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c1927405979dc7fdd8b64e3cd57c476bad4d032bfe38d31c6053e3a1afde031

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3263
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt3.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 0A1B 3 KB
3 KB 90ms
89ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a3c4c7a374f4306d2bae677e251655803f5583deddb90dfc0daaa009c9b5263

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3310
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt5.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 0A1B 2 KB
2 KB 86ms
85ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

730d1a9f03f2d5088ddc8b00bf3da8fc2bf3112b229a227b5eaa6d9b3410d6c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2397
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt5_1.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 0A1B 3 KB
3 KB 86ms
85ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt5_1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

199797e420dd8f79de2ef71e8cb58b69763c33119777e8bf93f5c7cae5a96965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2828
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 offer.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 0A1B 3 KB
3 KB 85ms
84ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/offer.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3fab1a185dee2b44c2308af821ff07b21d83f300afa2266b85d915707776a4b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3422
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 cta.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 0A1B 3 KB
3 KB 90ms
89ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

06c7eb7d2b0fa0dd095a4f24246053d5585bca68a30dfd720f0d400b4d7f76f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3054
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 arrow.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 0A1B 242 B
266 B 91ms
90ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/arrow.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0678ce624028582f1afe0bd9f4b10b5711a70a1c9a0b5892e6adf805d035ae39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 242
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 legal5.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 0A1B 2 KB
2 KB 90ms
88ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/legal5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bec4ade172f991fd6a0d3c2004729964a6015e2aea0ce28de642008bb3d3daa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1947
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/4249241/1641553762375/300x250/ Frame 0A1B 5 KB
826 B 29ms
28ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6bd3a2d62fb9cfba2ae6a21baaec2882fb4a0821f14297318171151d8e72818

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 800
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 35DB 143 B
167 B 25ms
24ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Response headers

x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 145
x-xss-protection: 0
date: Sun, 16 Jan 2022 23:02:43 GMT
cache-control: public, max-age=3600
content-type: text/html; charset=UTF-8
age: 3468
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame F2AC 41 KB
15 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com
URL: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 15:19:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 204078
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Jan 2023 15:19:13 GMT

GET
DATA 200
OK truncated
/ Frame F2AC 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f0b09631fbb338d03727ac8d7bf6b141702c2dfc5179c3acf78fcf27bc4ab31e

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C8F4 22 KB
8 KB 32ms
32ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 14 Jan 2022 15:19:21 GMT
expires: Sat, 14 Jan 2023 15:19:21 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 204070
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 TweenMax.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/latest/ Frame 87CD 105 KB
31 KB 71ms
47ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/latest/TweenMax.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

001acbb15d9c69510c0817e6dde361bff098406fad182ab3c367f86ff3da8343

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5274191
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 31378
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e71-1a5b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BinxZ0U%2BX7P9%2FoWDLmun7PQMxvkwBquz9PgNzHBNkyMpQF30BpdOvylkpt9M7JI3KlSGgZk9jXDmZsnj5%2BroOWOMu2%2B2WmLIgZltW8cINYnWM5Wdc9uDbuIRpXmj2wk5%2BqeyR6IJaNGntZ739NtwM2xh"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6ceb4dc82a123a41-CDG
expires: Sat, 07 Jan 2023 00:00:32 GMT

GET
H3 200 zepto.js Show response
cdnjs.cloudflare.com/ajax/libs/zepto/1.1.6/ Frame 87CD 55 KB
14 KB 50ms
28ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/zepto/1.1.6/zepto.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ab854cc22d028b4cdbe236179c0b0908b7722063c816444a3837ba7a1b8af8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5347389
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 13499
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:18:11 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04043-da98"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SPUnheakHAvpgl1D8gmOQ%2FINaMZuYm183UOyWojOExuR1j7tGxMNRHsaDCO%2FonSmE8iJBeST3OoGURHqjDYYkV9q%2BIZXq8IJwOZhtXUDhTOssUpGbd1IWDZ4H9txzywgUSoemhZ6cdQWY1OlUIrnd67b"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6ceb4dc82a103a41-CDG
expires: Sat, 07 Jan 2023 00:00:32 GMT

GET
H3 200 styles.css
s0.2mdn.net/4249241/1641553762375/300x250/ Frame 87CD 2 KB
631 B 25ms
24ms Stylesheet
text/css 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca66ce214f061f6bef74fe6efa1ece7f0a35eedae738ebbc3fd1b4dbffad00be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82515
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 605
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:17 GMT

GET
H3 200 bg1.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 87CD 65 KB
65 KB 110ms
110ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a00d4579f77231643a0621c0b078d0b3191508ebd318e9e89d13f8aecbd3e9b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 66553
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg2.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 87CD 79 KB
79 KB 110ms
110ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a969a673c13d6979bd4e322e4aaa227216cef9fae37ffc31b7721cc94e2a0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 80438
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg3.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 87CD 42 KB
42 KB 114ms
113ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6997dd75309ff66fe274e6e7af455dd7e1d6088f040118023a0b17b54fb2013

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42563
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg5.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 87CD 61 KB
61 KB 115ms
114ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg5.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e6e3228dc18ebca7170c145cde9ef9c030a59d3f69a93fa3be896e37b5fb1c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62736
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg_slider.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 87CD 3 KB
3 KB 117ms
116ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg_slider.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77119836d65555901ae15fd4b0ba7fcfa661a02fbcbe7112614538d4ab9b056f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3011
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 logo_small.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 87CD 3 KB
3 KB 120ms
119ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/logo_small.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b46b0112a83a3a5f24762558e66428a0f3b4394c5eb609137ec197c7e131945e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3023
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt1.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 87CD 3 KB
3 KB 122ms
121ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7cee78edf15d9bc8a2de584de60623e3ba6972abd5751b6ba1ed2274085790af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3336
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 txt2.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 87CD 3 KB
3 KB 122ms
121ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c1927405979dc7fdd8b64e3cd57c476bad4d032bfe38d31c6053e3a1afde031

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3263
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt3.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 87CD 3 KB
3 KB 122ms
121ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a3c4c7a374f4306d2bae677e251655803f5583deddb90dfc0daaa009c9b5263

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3310
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt5.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 87CD 2 KB
2 KB 122ms
121ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

730d1a9f03f2d5088ddc8b00bf3da8fc2bf3112b229a227b5eaa6d9b3410d6c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2397
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt5_1.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 87CD 3 KB
3 KB 123ms
122ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt5_1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

199797e420dd8f79de2ef71e8cb58b69763c33119777e8bf93f5c7cae5a96965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2828
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 offer.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 87CD 3 KB
3 KB 123ms
122ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/offer.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3fab1a185dee2b44c2308af821ff07b21d83f300afa2266b85d915707776a4b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3422
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 cta.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 87CD 3 KB
3 KB 123ms
122ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

06c7eb7d2b0fa0dd095a4f24246053d5585bca68a30dfd720f0d400b4d7f76f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3054
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 arrow.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 87CD 242 B
266 B 123ms
123ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/arrow.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0678ce624028582f1afe0bd9f4b10b5711a70a1c9a0b5892e6adf805d035ae39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 242
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 legal5.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 87CD 2 KB
2 KB 124ms
123ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/legal5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bec4ade172f991fd6a0d3c2004729964a6015e2aea0ce28de642008bb3d3daa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1947
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/4249241/1641553762375/300x250/ Frame 87CD 5 KB
826 B 25ms
25ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6bd3a2d62fb9cfba2ae6a21baaec2882fb4a0821f14297318171151d8e72818

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 800
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame A831 22 KB
8 KB 27ms
27ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 14 Jan 2022 15:19:21 GMT
expires: Sat, 14 Jan 2023 15:19:21 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 204071
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 TweenMax.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/latest/ Frame 94C8 105 KB
31 KB 27ms
26ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/latest/TweenMax.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

001acbb15d9c69510c0817e6dde361bff098406fad182ab3c367f86ff3da8343

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5274191
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 31378
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e71-1a5b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gVkByhxYWsRfFwuQGaRkJtDQ2mZlTGTJQrW2TJlkiTjDmkoGsbk6r5RY7TJSXIRS1CYZOoCoPtapXGOa2mZF1eBnwsLuZRQh7qfr%2B5d1Lqjf4AVKKytAAR2%2FRs6Cfi3WwqVgZNmvLydqPnAw4uniJIzi"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6ceb4dc88a7b3a41-CDG
expires: Sat, 07 Jan 2023 00:00:32 GMT

GET
H3 200 zepto.js Show response
cdnjs.cloudflare.com/ajax/libs/zepto/1.1.6/ Frame 94C8 55 KB
14 KB 25ms
25ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/zepto/1.1.6/zepto.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ab854cc22d028b4cdbe236179c0b0908b7722063c816444a3837ba7a1b8af8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5347389
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 13499
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:18:11 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04043-da98"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eyOVppkJWK%2F%2FtcckIRsSNwFYaakZKzt%2F9lMnSK%2BXrup2ljTlZ769f9jh1nNri14fObdwuI5VRObg6bpBtE2GpoKs5z6I95ikkvJgB9nv%2FfA4ujqwm2KdMeEKj0roSjJDNYm53aIBk1v5hleQG2idbryg"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6ceb4dc88a7f3a41-CDG
expires: Sat, 07 Jan 2023 00:00:32 GMT

GET
H3 200 styles.css
s0.2mdn.net/4249241/1641553762375/300x250/ Frame 94C8 2 KB
631 B 28ms
27ms Stylesheet
text/css 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca66ce214f061f6bef74fe6efa1ece7f0a35eedae738ebbc3fd1b4dbffad00be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82515
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 605
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:17 GMT

GET
H3 200 bg1.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 94C8 65 KB
65 KB 108ms
108ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a00d4579f77231643a0621c0b078d0b3191508ebd318e9e89d13f8aecbd3e9b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 66553
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg2.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 94C8 79 KB
79 KB 109ms
108ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a969a673c13d6979bd4e322e4aaa227216cef9fae37ffc31b7721cc94e2a0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 80438
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg3.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 94C8 42 KB
42 KB 116ms
114ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6997dd75309ff66fe274e6e7af455dd7e1d6088f040118023a0b17b54fb2013

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42563
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg5.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 94C8 61 KB
61 KB 117ms
116ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg5.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e6e3228dc18ebca7170c145cde9ef9c030a59d3f69a93fa3be896e37b5fb1c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62736
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg_slider.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 94C8 3 KB
3 KB 121ms
119ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg_slider.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77119836d65555901ae15fd4b0ba7fcfa661a02fbcbe7112614538d4ab9b056f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3011
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 logo_small.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 94C8 3 KB
3 KB 121ms
120ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/logo_small.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b46b0112a83a3a5f24762558e66428a0f3b4394c5eb609137ec197c7e131945e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3023
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt1.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 94C8 3 KB
3 KB 122ms
120ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7cee78edf15d9bc8a2de584de60623e3ba6972abd5751b6ba1ed2274085790af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3336
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 txt2.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 94C8 3 KB
3 KB 122ms
121ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c1927405979dc7fdd8b64e3cd57c476bad4d032bfe38d31c6053e3a1afde031

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3263
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt3.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 94C8 3 KB
3 KB 122ms
121ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a3c4c7a374f4306d2bae677e251655803f5583deddb90dfc0daaa009c9b5263

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3310
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt5.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 94C8 2 KB
2 KB 124ms
123ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

730d1a9f03f2d5088ddc8b00bf3da8fc2bf3112b229a227b5eaa6d9b3410d6c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2397
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt5_1.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 94C8 3 KB
3 KB 125ms
123ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt5_1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

199797e420dd8f79de2ef71e8cb58b69763c33119777e8bf93f5c7cae5a96965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2828
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 offer.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 94C8 3 KB
3 KB 125ms
124ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/offer.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3fab1a185dee2b44c2308af821ff07b21d83f300afa2266b85d915707776a4b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3422
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 cta.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 94C8 3 KB
3 KB 126ms
124ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

06c7eb7d2b0fa0dd095a4f24246053d5585bca68a30dfd720f0d400b4d7f76f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3054
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 arrow.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 94C8 242 B
266 B 126ms
125ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/arrow.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0678ce624028582f1afe0bd9f4b10b5711a70a1c9a0b5892e6adf805d035ae39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 242
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 legal5.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 94C8 2 KB
2 KB 126ms
125ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/legal5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bec4ade172f991fd6a0d3c2004729964a6015e2aea0ce28de642008bb3d3daa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1947
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/4249241/1641553762375/300x250/ Frame 94C8 5 KB
826 B 29ms
28ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6bd3a2d62fb9cfba2ae6a21baaec2882fb4a0821f14297318171151d8e72818

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 800
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3CF6 22 KB
8 KB 25ms
24ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 14 Jan 2022 15:19:21 GMT
expires: Sat, 14 Jan 2023 15:19:21 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 204071
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 48AC 0
28 B 57ms
56ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=CgcIByoDd2ViCgcICCoDbHRyChwIASoYbGFyZ2UtYmFubmVyLXJkYS12YW5pbGxhCgoIAioGc2VydmVyCi8IBCorbXlzaWRpYV9hbmFseXRpY3MscGVyZl92aWRlb19nY2FjaGVfZGlzYWJsZQoNECshAAAAAAAAFEAwBAoNEAMhAAAAAADwdkAwBAoNEA0hAAAAAAAAAAAwBAoJEB4qAzB4MDAECgkQGSoDMHgwMAQKDRArIQAAAAAAABxAMAQKDRAQIQAAAAAAAAAAMAQKDRARIQAAAADAMdFAMAQKDRASIQAAAAAAACBAMAQKDRATIQAAAAAAABBAMAQKDRAXIQAAAGZmxnlAMAQSGkNQV1owYm05dF9VQ0ZWWHNFUWdkWTJjTjJ3Ihp0ZXh0L3ZhbmlsbGFfdGV4dF9jbG9zZV92MigD

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/d21411ece572ce2870b8d279b6163686.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 TweenMax.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/latest/ Frame 6FF3 105 KB
31 KB 31ms
30ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/latest/TweenMax.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

001acbb15d9c69510c0817e6dde361bff098406fad182ab3c367f86ff3da8343

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5274191
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 31378
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e71-1a5b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4%2Fezd0IL3CSoi%2B7%2Bws%2FqEzd70rDtzCyjs%2B49EEUmvycBqCaetOUO9eRoxX7zttRByBvA6NTM3XJ2%2BTB3r8Lg2q3TwnAZi3APt8ZuRu7tkUUQUteGWtDdbldyDICe2hzzW1wGNkq7nyT0sbtL1HGtjuSO"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6ceb4dc8dacc3a41-CDG
expires: Sat, 07 Jan 2023 00:00:32 GMT

GET
H3 200 zepto.js Show response
cdnjs.cloudflare.com/ajax/libs/zepto/1.1.6/ Frame 6FF3 55 KB
14 KB 30ms
28ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/zepto/1.1.6/zepto.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ab854cc22d028b4cdbe236179c0b0908b7722063c816444a3837ba7a1b8af8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5347389
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 13499
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:18:11 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04043-da98"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oGBjxUbp6eFUNJR9yHstN3PGbb9N9vk2BrGjn4ZcxBuGUGs%2B0EfMoDw5COv%2BARGvN1%2F20raixGNtGbH265OOfL9xAqb8xS6GAk%2BLUYvQWYVkE5eQUm2EAmT8IlF9ExkCjDpYQby9pONySsuEBBWk%2B83N"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6ceb4dc8dad03a41-CDG
expires: Sat, 07 Jan 2023 00:00:32 GMT

GET
H3 200 styles.css
s0.2mdn.net/4249241/1641553762375/300x250/ Frame 6FF3 2 KB
631 B 26ms
25ms Stylesheet
text/css 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca66ce214f061f6bef74fe6efa1ece7f0a35eedae738ebbc3fd1b4dbffad00be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82515
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 605
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:17 GMT

GET
H3 200 bg1.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 6FF3 65 KB
65 KB 97ms
96ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a00d4579f77231643a0621c0b078d0b3191508ebd318e9e89d13f8aecbd3e9b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 66553
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg2.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 6FF3 79 KB
79 KB 103ms
98ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a969a673c13d6979bd4e322e4aaa227216cef9fae37ffc31b7721cc94e2a0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 80438
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg3.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 6FF3 42 KB
42 KB 106ms
100ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6997dd75309ff66fe274e6e7af455dd7e1d6088f040118023a0b17b54fb2013

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42563
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg5.jpg
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 6FF3 61 KB
61 KB 111ms
104ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg5.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e6e3228dc18ebca7170c145cde9ef9c030a59d3f69a93fa3be896e37b5fb1c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62736
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg_slider.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 6FF3 3 KB
3 KB 113ms
106ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg_slider.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77119836d65555901ae15fd4b0ba7fcfa661a02fbcbe7112614538d4ab9b056f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3011
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 logo_small.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 6FF3 3 KB
3 KB 113ms
107ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/logo_small.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b46b0112a83a3a5f24762558e66428a0f3b4394c5eb609137ec197c7e131945e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3023
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt1.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 6FF3 3 KB
3 KB 113ms
107ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7cee78edf15d9bc8a2de584de60623e3ba6972abd5751b6ba1ed2274085790af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3336
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 txt2.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 6FF3 3 KB
3 KB 113ms
107ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c1927405979dc7fdd8b64e3cd57c476bad4d032bfe38d31c6053e3a1afde031

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3263
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt3.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 6FF3 3 KB
3 KB 113ms
107ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a3c4c7a374f4306d2bae677e251655803f5583deddb90dfc0daaa009c9b5263

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3310
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt5.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 6FF3 2 KB
2 KB 115ms
109ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

730d1a9f03f2d5088ddc8b00bf3da8fc2bf3112b229a227b5eaa6d9b3410d6c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2397
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 txt5_1.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 6FF3 3 KB
3 KB 113ms
109ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/txt5_1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

199797e420dd8f79de2ef71e8cb58b69763c33119777e8bf93f5c7cae5a96965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2828
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 offer.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 6FF3 3 KB
3 KB 113ms
109ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/offer.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3fab1a185dee2b44c2308af821ff07b21d83f300afa2266b85d915707776a4b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:19 GMT
x-content-type-options: nosniff
age: 82513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3422
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:19 GMT

GET
H3 200 cta.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 6FF3 3 KB
3 KB 114ms
109ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

06c7eb7d2b0fa0dd095a4f24246053d5585bca68a30dfd720f0d400b4d7f76f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3054
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 arrow.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 6FF3 242 B
266 B 114ms
109ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/arrow.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0678ce624028582f1afe0bd9f4b10b5711a70a1c9a0b5892e6adf805d035ae39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 242
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 legal5.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 6FF3 2 KB
2 KB 114ms
110ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/legal5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bec4ade172f991fd6a0d3c2004729964a6015e2aea0ce28de642008bb3d3daa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1947
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/4249241/1641553762375/300x250/ Frame 6FF3 5 KB
826 B 28ms
28ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6bd3a2d62fb9cfba2ae6a21baaec2882fb4a0821f14297318171151d8e72818

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 800
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C0E8 22 KB
8 KB 25ms
25ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 14 Jan 2022 15:19:21 GMT
expires: Sat, 14 Jan 2023 15:19:21 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 204071
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 bg_slider.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 0A1B 3 KB
3 KB 64ms
62ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg_slider.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77119836d65555901ae15fd4b0ba7fcfa661a02fbcbe7112614538d4ab9b056f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3011
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg_slider.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 279E 3 KB
3 KB 100ms
97ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg_slider.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77119836d65555901ae15fd4b0ba7fcfa661a02fbcbe7112614538d4ab9b056f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3011
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg_slider.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame DEFD 3 KB
3 KB 113ms
111ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg_slider.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77119836d65555901ae15fd4b0ba7fcfa661a02fbcbe7112614538d4ab9b056f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3011
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg_slider.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 87CD 3 KB
3 KB 124ms
123ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg_slider.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77119836d65555901ae15fd4b0ba7fcfa661a02fbcbe7112614538d4ab9b056f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3011
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 bg_slider.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 94C8 3 KB
3 KB 126ms
125ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg_slider.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77119836d65555901ae15fd4b0ba7fcfa661a02fbcbe7112614538d4ab9b056f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3011
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DE39 0
28 B 61ms
60ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bc6FynbHkYdW0LNXmgQfT25jAAgAAAAA4AeAEAg&bg=!b2ylbCjNAAaocxMpqHM7ACkAdvg8WrnAZHRM8ZZ0A9gXVGdU3bb7d9kfd8OhOaMsUCXT3MGZgJ18zwIAAAL_UgAAAAFoAQcKACDaaw5KjnkGsGoCnQ_x8_nNwnvNowPNGS7NiO9JKbkWdJkC0neWQ2VrNg7BGS1vfAOvP9cU58vEo3SIYCYEiJ6KSEdBR1pbG-5EA1UoPYzI2QzytZoCsULZaIuq4g4oQ2sWJtC6Qhp6rc1cdAdvBm2Ep7uVf8xBeP0d7K66nohMilW8m2xa19J6Wg_VUw42_WAb0SGf5KdtJYv8SEpEw6I3937MDh_zNSmyTY29-ZgpwO7TexdsCOBMQwp2lZGDxhecwhFwPz-RghWZziqmIZxXdbKEvlhWeC_4cjBBjq4LuhnLhd97jSylcIndUzcb17RcFu-iMYTl3Oerp_gGV_8Ijn_b_XejCsAlv6h3VyVe6Lb4qCnvfD1IKoNAyWB98u31Wpkr99y5BPlIej62-Itn-5tvThN8EAnm_JEU8aiou_v5pRuYvNtR647KDHaFcmxt7GevVs2USvXRoiAYD4Bd2Qb1Qk7v08_YJr3KKgkwSY4VKv50dFIb3A8Vo8D4auhpRAr9hdEF1dMPhg-TwwT8EpzlxEX6NrjwS7WjtdNMu4ByU7e5Mbrr6Rk5JOvnVU3mnEGSR6IpkqNHR8b3CpRCT0FKnX3BUzRN-3p0_BiZDw0W9D6R7nuyc_GRctESDjI0f0c-jYkBkKTtrdN2a7hHa5HnWsXmYNfWwULFeEsEENrD_tI0aXxhQDWTwdGoocsrvlmwxMlwvKydOxXlA-XPuekxSn974Sbn3M5MFSAh2ek_wE_3GwAiadlHr16V3JvuAj0tIizOPz6BUdAeWxiTxMgvXbMUDCx5SJzsuQq36mn5mIjJjhKlEj9lbKXpNmm5862vlpFVoLdw33RLSFIF7CU3PyYpt54xOWZzkebnn5NqUBWJly3jQG17bqZxfJypzjyGMHY0AdPj6jdycTfdeYeskqE0F4fmI14ueWMZykuhqj5mGQSZI9YRwTJvcbHlE7tRsIrPpK45JB-VBn-e6NRAW-1pNHeQPgRusKGdq3rHXz3P

Requested by

Host: subterfugue.org
URL: https://subterfugue.org/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js Show response
pagead2.googlesyndication.com/bg/ Frame 34D6 35 KB
13 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a02681ae1cc21a54f99afb9cf43cf89c42ab91bc9381aa64e96ffb4cf46e9f80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 21:00:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10793
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13579
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 16 Jan 2023 21:00:39 GMT

GET
H3 200 bg_slider.png
s0.2mdn.net/4249241/1641553762375/300x250/images/ Frame 6FF3 3 KB
3 KB 114ms
110ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4249241/1641553762375/300x250/images/bg_slider.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77119836d65555901ae15fd4b0ba7fcfa661a02fbcbe7112614538d4ab9b056f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s0.2mdn.net/4249241/1641553762375/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 01:05:18 GMT
x-content-type-options: nosniff
age: 82514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3011
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 11:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 01:05:18 GMT

GET
H3 200 oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js Show response
pagead2.googlesyndication.com/bg/ Frame D840 35 KB
13 KB 30ms
29ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a02681ae1cc21a54f99afb9cf43cf89c42ab91bc9381aa64e96ffb4cf46e9f80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 21:00:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10793
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13579
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 16 Jan 2023 21:00:39 GMT

GET
H3 200 oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js Show response
pagead2.googlesyndication.com/bg/ Frame 8CFA 35 KB
13 KB 36ms
30ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a02681ae1cc21a54f99afb9cf43cf89c42ab91bc9381aa64e96ffb4cf46e9f80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 21:00:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10793
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13579
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 16 Jan 2023 21:00:39 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 35DB
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
22 B

52ms
52ms

Document
text/html

2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 17 Jan 2022 00:00:32 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 00:00:32 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 17 Jan 2022 00:00:32 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js Show response
pagead2.googlesyndication.com/bg/ Frame 53E7 35 KB
13 KB 39ms
34ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a02681ae1cc21a54f99afb9cf43cf89c42ab91bc9381aa64e96ffb4cf46e9f80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 21:00:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10793
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13579
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 16 Jan 2023 21:00:39 GMT

GET
H3 200 oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js Show response
pagead2.googlesyndication.com/bg/ Frame C8F4 35 KB
13 KB 34ms
32ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a02681ae1cc21a54f99afb9cf43cf89c42ab91bc9381aa64e96ffb4cf46e9f80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 21:00:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10793
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13579
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 16 Jan 2023 21:00:39 GMT

GET
H3 200 oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js Show response
pagead2.googlesyndication.com/bg/ Frame A831 35 KB
13 KB 46ms
41ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a02681ae1cc21a54f99afb9cf43cf89c42ab91bc9381aa64e96ffb4cf46e9f80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 21:00:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10793
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13579
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 16 Jan 2023 21:00:39 GMT

GET
H3 200 oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js Show response
pagead2.googlesyndication.com/bg/ Frame 3CF6 35 KB
13 KB 46ms
40ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a02681ae1cc21a54f99afb9cf43cf89c42ab91bc9381aa64e96ffb4cf46e9f80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 21:00:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10793
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13579
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 16 Jan 2023 21:00:39 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 41BC 0
28 B 88ms
84ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bw2BvnrHkYcq9JIThgAf04YT4AwAAAAA4AeAEAg&bg=!d3SldDDNAAaocxMpqHM7ACkAdvg8WnBa657dd74NJC-ERn7bMfsHGtiA_jVQZq2zjFwe3iwcIou7SAIAAAKZUgAAAANoAQeZAwUoWi0sa0IScDq9t24Qdz1BWWjf7M5L1BAdbkbktZr9NpJwEwKhY4aTEwkJEhs6SiLTtFXVRgzAUyjg_MRkxsw9zlkOhBbrk86CRsw02x73I7TF9PfFhQAWLgIHTwepTQAqlFMr1OWV5h0f4Zfzt3KVBQKe0RdqQ9h3TY5flSOsD_hwqEk9ZI9JL-b1pqeBpkoq7zMJh-C43vUoOS3g6_3MoSimcXW8QXK-KzxGxF07fdFFINp6odKl5NgNgSHQbMhNv-4jmV04WhP4vpEGBWrEcdAMIMdRWSBMo5feCf9zdH6R8bLN2_dnWqLh4GAy9cEByCMQXltdY0NWQIW0Nn2Z2TTHDAfY1YeQsrYYlMezseEifBfDvhWScEglT1LVfHpSjRmegHW3Yl8Zd_LC7in-U0vRrE7510amLqjKKFs1D40nuCtV9oHKjwHFZcSjiHUtBAMnANf8s6kXa5f9hZshhb0WHfZuFf0hDF18SztrhqRhpg1HBVePbk0N7DCA7n1_RlOMP3LaWlOEC67tk3sKw0Ml4iA0Ypp8mXkj3E-qQKOcFjP6kPL4G4ZbDtPMwxfPG7OHFIhnolYRfm7pjAcB0DxjfD9l2v40l1xamiaeDn5xM0weYTl1zeUBKTq3OS9piFwys7QUXzdU_bGzwdZ0-BrJPBPo5JQ1wCgCBTJ71SMy5_g2ydVDD0ztfYLtOsi0SlQMVMQ0ISCORnSFSCmtAxKXKSnbJJvAGeLh_KI4Q7rvEwLSHZypThC3g3gZU0_ue5fOqB2tsT1Jo60jKk5SHy2f437748U7BA4Ho1pbr27UohWHCysiMpUNCbX1Nyd6h66xlk0Pyt2f7GUyk5q_pS_ITFo-R28o6Gx0mkrJQUQi5a_M5KgBkxZMpDscQ8PCLMdWN40vbdRFgRymxORabCSVw7zGEjCyYfBzW69dBylcLfTd7OtPIWN56am6XLXQZ0wRB52s77PUHNVLoZAxciWmLHCsUWK43jUvyPsw5n7d6mbXkVgY06JJ_8cVH1h9NU8jGQ

Requested by

Host: subterfugue.org
URL: https://subterfugue.org/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js Show response
pagead2.googlesyndication.com/bg/ Frame C0E8 35 KB
13 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a02681ae1cc21a54f99afb9cf43cf89c42ab91bc9381aa64e96ffb4cf46e9f80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 21:00:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10793
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13579
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 16 Jan 2023 21:00:39 GMT

GET
H2 200 cJZKeOuBrn4kERxqtaUH3VtXRa8TVwTICgirnJhmVJw.woff2
fonts.gstatic.com/s/opensans/v10/ 15 KB
15 KB 123ms
39ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v10/cJZKeOuBrn4kERxqtaUH3VtXRa8TVwTICgirnJhmVJw.woff2

Requested by

Host: subterfugue.org
URL: https://subterfugue.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3135160ee3b34e2d1e58bf80944a1ed2cef3f073528ea98f11916a397b4c6ac9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://subterfugue.org/
Origin: https://subterfugue.org
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 14:19:41 GMT
x-content-type-options: nosniff
age: 466851
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15556
x-xss-protection: 0
last-modified: Thu, 21 Aug 2014 18:06:58 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 11 Jan 2023 14:19:41 GMT

GET
H2 200 k3k702ZOKiLJc3WVjuplzOgdm0LZdjqr5-oayXSOefg.woff2
fonts.gstatic.com/s/opensans/v10/ 16 KB
16 KB 109ms
27ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v10/k3k702ZOKiLJc3WVjuplzOgdm0LZdjqr5-oayXSOefg.woff2

Requested by

Host: subterfugue.org
URL: https://subterfugue.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

abcbe0423061bbf5caca8b070eb57c5ea831fde8cca4af206f8b48938142b4e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://subterfugue.org/
Origin: https://subterfugue.org
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 17:23:16 GMT
x-content-type-options: nosniff
age: 455836
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16224
x-xss-protection: 0
last-modified: Thu, 21 Aug 2014 18:08:16 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 11 Jan 2023 17:23:16 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 48AC 0
28 B 58ms
57ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=CgcIByoDd2ViCgcICCoDbHRyChwIASoYbGFyZ2UtYmFubmVyLXJkYS12YW5pbGxhCgoIAioGc2VydmVyCi8IBCorbXlzaWRpYV9hbmFseXRpY3MscGVyZl92aWRlb19nY2FjaGVfZGlzYWJsZQoNEBQhAAAAAMB10kAwBAoNEBUhAAAAAAAAJkAwBAoNEBYhAAAAAAAAFEAwBAoNEBghAAAAmZnFhkAwBBIaQ1BXWjBibTl0X1VDRlZYc0VRZ2RZMmNOMnciGnRleHQvdmFuaWxsYV90ZXh0X2Nsb3NlX3YyKAM=

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/d21411ece572ce2870b8d279b6163686.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 854B 42 B
64 B 94ms
60ms Fetch
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssP62colHRMy2zJj3BIv3_8aMwD5Tc9O-RUQLKuqS1EmoqX__6B9PT50lQyOLcRYVLeKlplyxo_VNm0Cm_Vx1qdUOpBwsLMiGum0d7s&sai=AMfl-YRc4XQ72imE38lJKR1s794-ypZsVMwlC-cl6CuS3_bCM5eLI9jecolMqD2o_n4-eW046a7kxcLDvxE8&sig=Cg0ArKJSzA4kee7zuFgNEAE&cid=CAASBORoKSY&id=lidar2&mcvt=1059&p=0,0,284,336&mtos=0,1059,1059,1059,1059&tos=0,1059,0,0,0&v=20220112&bin=7&avms=nio&bs=0,0&mc=0.99&if=1&app=0&itpl=20&adk=4145494359&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1642377629700&rpt=1627&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7E4C 42 B
64 B 92ms
59ms Fetch
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstcmExyvs2auVU8APzFrMqJ43uSYGgi3FG3DnLlKswPwwf_3tGD0-wxtgvprbBiJstmX_SJaJzKvBawbB3ds_zMSPjIGw92-4Zsi3EhilR8yJ0FHsppfQ&sai=AMfl-YTDnc-tm94Cw-8ecneLZQYGq86wQzqB2810s4gyGxZae9DT4a4CZCsgWNKbI0EfGCnqcfAZrmyB7fbx&sig=Cg0ArKJSzMuvYGl8B4B4EAE&cid=CAASBORoEaE&id=lidar2&mcvt=1060&p=0,0,254,300&mtos=0,1060,1060,1060,1060&tos=0,1060,0,0,0&v=20220112&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=4064271541&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1642377630556&rpt=776&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0E3E 0
23 B 63ms
62ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsskh1K2xCLGxAItcVe0QtXxuxb3RVFtbN2osH8FIF-Dcs2n8SgI1cL9GOmCWcxVVWLlnIyWjv8-KCe7HQD_PU0J7T02JNVDemaaPjIdA0aiA9n6o0pPweebKOOrSPmw6kq91VkjzAP2QDeKn44wiQgr45E4kKRAky4400tJ7v26XFyWdzj3eYp7J-Hg9h0Tc_kTG0g9UIlWuJyq4mS2jWqeVko0U-DLCU8oNpjURNJGNUjc7bQqPOex1qqknJOFkfna6bpl3IxXersYUMIK2NjYWO47TbipEWfsQg2TYBM3zSvsTiauMOppJiCHN05_C4OWZfFmEGAAghc2MQSIllTwLz65oBK9-aEgrKUUw-jKE8KX1GjH50Wwwrbu9ivDTiBqCcENR8dZIfUHx01tZStfbIqAVznRSbSn2t45Mc63EWCoUxPKUS4GOHWS0bRNfvA26ooK3eP06VS6-9fgkcSwCKiB_YMeqx8fMRd0nUYHN78RJevZ76s8_WmfJSAqFRrbvXpbQhXjIGYo-n_Bh_koNehKKPxG6UoNkdzx4I_J2S7oH0Fzussqw_0qFb83ACCaj_FfeTevBSn_bBTEBTgG62HMq0vc_KGHs8PMhfK6Sy8_7V4Uca7svnHR1OT4Au4Two9xAnEJXamYg08E0mKPZ-5Hbc6cHYEFFZlSVTrnVxuNtfhbCiSgR2y2yPt6Yzxgfov3xSIM7rUyuVopQcewHVrPCYDydirEWdcWYqlyhBl4KJ9KJYU20fW9pvN_kHRKHt2M7oSDpKBgAb6jts6bJ84lPYi8PhTpjvAHk1YuLuqkQrKMSFBBPgcvENPBJGAwtQ9nXY_qGz5wHaF5Yk5GmBJNXpL0jJmxB17ZZn8AtiSchMCj3d2UikX2YO2lxQDbqk7uwEjRa8eCXphv42JImi2goWHfPhbHsx7_0oIxOnqI8LCgVnrHsnr4VjIUDlXkO4H9qPGG5iK7TT-n-jg2I8TL_dOOFg2h8idXh15ZSZH89ElHRsauE65sxWQVH17YYg8InkQcgv55fBz7JpuozYqUHDCbOOHxw4D3qvaRxuGD_y7nmyRuKt9WSqTrjgwDET6gVweYNur_j_VEHiVl2vHVjo2mleBCp24sezpt-1Rky1_nx3V9DIGLhhpNdXUn_lGyF75o_VEmgrdDQ1qztQ&sai=AMfl-YQBQTaQy5XSk0BTzQVODWzAv0_XGp4lY_OD3gr9EEaugMIlw0PvpUfvv4ytLW_5fVXPHwEwu41BaR8AGnpnT_qaqcaoKBU5HsNrP5fJ9TVJDpNYT5K_qALcNzAuyW6z-_8o4hHwgqJcOXdKwUiuA5p5W3CDKA&sig=Cg0ArKJSzEX0uovGwWrqEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1235&vt=11&dtpt=965&dett=3&cstd=267&cisv=r20220112.88615&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 00:00:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9076 0
23 B 62ms
61ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst14t2km_ue014reCajhzkUE63RTzW3uhtygTR3CYVSQglg5qmJROzbIy0XWWsKyaNFHDoIfCaatzA0aZju-fhc4-VazBW82Vus5o1nOJp6elBDtRn9vtbaLEDON_puDlXj7oxwb0gw-T69htDZRgVJ-MNcOhQ_LuiX3F_AhPascXLSFDij2408yCD7feuHXNEUco7Z8HAw0TkW0T6UjOuhd3kSsHSNdzFg1L4kCyi9SMmWh6fxVGA28I01GifFjcPUPytmfHAsv9a1EFnoxhGRbN54uboZWoqCzLYwEseu7KlC0BLdHSXgy2LQ4EsL8TEGHD4mTESx-bgiLsuoudYukLhP_y-AJO_65ZUDf35i2NqEG1ph1lvy2dUZHo1_uUuw4aCrLPib30wtO6pOnAvNY8rJ2dWYgu6q1he3mKZyT0a80MjUD3UUM5T98-fhHBY-kQ5LP2EHaVyKXOtbvyfk8M7M8yCGhKBH3C5ukaeOawHR4mOp5myPTwrUY3KQaMu3nJZdvT3usGzroGkkDzWIXTE6vFXMHhUKalrW3XTiMdzJIZIWyY915b65eZ0ma7nM9r7BazOXUF_nkAlcAN4ZRq3rL1LPRLCew2bntIVIFMBlPfst1smnv0Jsg0bTnY-sZEAyfc33NhGkBBbhpCI44EScQ58va6W-lpRlqqn9uAv8qvZhCBJg_cd6Hq48o13P6B4rjsITjsf7e5dcNB0yXNiY1Iy8QUfwYBq5GJqS96IPwLNYlosQC1eIToHPeuGl6Zp6JcF02HKK1sxBaZ3Aa_YcjhG6fXrFVFUEmr8cf_0B3VLW9Zf99DFDRemxZKWAkCobI2WKHAltIlXwb-Vi_ICvxUa1Uem66qRDz8hg1bpgF-TwfeUgIGKGYoqtslnudeqR9ZMXrR8kp1LkhMHHycutZQCtgWnGlKjhwtEKOwQeGvf2-D3e0u6UCRABKlQO_Q2As2dIrHYSCbGXjf9LeMD0c_mjanlEI2oLofTqPFbF-FWxKvovFsAcjl5ERQansL4gfIcHDiZbknQo6CNCIN-vOS-f8y-58hjfczdLwabNfCNSMniIKM-s5SmNPwOCROPxRCH_zTux7BXKu-iy4y1ffaUxtBgR5XCrWmwTjYq0UWwr3f1G5wfi0lTpFu0JGJHbebipdks&sai=AMfl-YSCQQUQt2mif-K4lsEzj7ZjGsorh161c0JudJZojiVcuLLcQvnkTyunxl2AGcxV52gcWdfaOr6_LWsy4KxK9nuTbf8TV8mOQ-0n3V4VpVfMjdtZuRdatGKw2lbxkADvhoWo8M8pB0vBFFGDp1YFjVzDau-Ayg&sig=Cg0ArKJSzI5W-fuCjd7gEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1331&vt=11&dtpt=1058&dett=3&cstd=271&cisv=r20220112.05786&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 00:00:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 14A7 0
23 B 93ms
93ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuerKpvcW44TxARDYZ6kVVn45tWwROZIlO4nqRwE8ySMEfrVrnIkevPJQUr2jwgB2wsw7F7uQ_xV0C6HjxgDQvbgkOTvvvHJq1Q3Tt8-f9PNhMTmfL-XvDAZLghnt9uTP5PgRUTT4dOMkGp-AEZ-uItOfh-GjDKKNx-OgDfeQFWBNGmWr9IFAyooJfzkcjbn7F8Zu20-A1JLG9SnY5g_JLQfV4Fjpakc-vhfdwa-pytRQ8sPwFvOEV3mSk75is036XpKvcEsPDPQGNYFe8lWt9wYOEof1R6oJ2Uw_bh3PpuJ3MgKVk78FGEFiuZzMnS6SRAeQvCGt6Osxre4ISxL40NhkSYZ5AnTiL1MV-NiTzj3Z9CPwMtZo929fT0nLGuhH60V1oENm6C05_UpdqCw3NWeSHBs6tN8kFegi4meLSUP8sDHUMWcPN1GkF7lWYE7f2xxANkl3odfe1_jXp1Cpf_K1X0AWOPJar6Z8N_49QIecnuitXEXbEkRGpoiAIOtoqEHC0O93HFLo4KTtp8oBXTAhChMutj8mlbvTjwuFKv9UdHGvJosXcIV85kU3hAsM39M73gHHksctYPDiul4mTGOk8TEmJ_yj1vmvJHiGMonKK5XpXx1FVm93fF52tti8UxEq5WAt6-hMRmLZoErlTaWAiPo_5VYAljCunxE7PbWRzoOgkMjCiXqgFOjn_Bx1V68LY6XEymBu9MVd-VRKaqSHzJty2wrt_7PCdSusnaLoe7y5BPrNbCYNl3fgS0jLV_Kee2oO8wWp8QTJLx72znXa-JJWvcJRa7Q93m_YUct1UXqCGDiZZMRPi69wQfYJxToYB_KPTdac8bbXLO4CKHMB9egfEFMDkCpf_Yat6--1q14xGnoaNUQOsRovBXWWREDwam756ahC74xfCyKDSZDrcZRcNcSeYy7uDcwFjc1KOAVjKrQzl0-Vuo3ilAZiG8HCWSL6Ae6MvH2azM8qMiqEJjbaJfN2chvBTrv3YvFKd4OzHtYNDywNRhuqNCZvi7ZR3U70PhEyDbKmios3_xBJhnk_ykDkvdjztbKw4fsgXcUet5VFex0GFJS7grcwJAaTKWk1Ul77A4OTlMyo-OYD0SRS6fNg4gh1P12cvg1-Ho7iZtaxx3iJCKUqsELfRDIYLV1KrvBSc&sai=AMfl-YS3RItUnY0K32xz_aWixj3RZDwxZ2qsPGmaEEgSD--wdgkeChacgQY8Ald_z08y_bHoRfqgKfYhUuxPzBv76K77IY5_l1U98SYTiADvtREZikq0ZWiNdeUeMPH-6lUgcuGkYYpkb8wtMcZhJwBss6aCK7ZMRA&sig=Cg0ArKJSzEMIYbinfGolEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1324&vt=11&dtpt=1066&dett=3&cstd=256&cisv=r20220112.63454&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 00:00:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame F2AC 0
23 B 94ms
94ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuqC6WsHQxILZR7hYi-zues-TQg6tOnDoeraDMTeztp4G987587ihlHk4Ddg8bGLR0rZAFZ_E8v78YIVSMPXRZ6AUgLe1hQsA7X71k4XUhQg1GVK_uHlJ0l2JVDFIysIKoJki1oP6ekrxb3EhMRJw3wneULvhecFe0JYIdz4sngtWBgHavwFh0YiALe18kGyUq7aOdHJr95czUhZkrAgLS1-ufI8WEbVOM1hEiacDPqBEywocjB8hwlHG7yE2DgTu0CqFmB41oCwtJo27lL_58UVuZDJCJvRP7QEGRRMNeLmsM2ccA3uoAUbj3ClBj1JC-fuh4NvlDCf_IC9WJWini5Wb079VLvLF0qY2h7vqM4sFF7WdmFCyir6ZK-QXsxUAKF9kwanzmHgK7ATyMUIp3J2RAbP3WdLFBVsMGzG39I68sEJ8QpfJ6WmcGp_6vLGmN92VPO4kfMq9yXEqPDNP5XhjXv9kal21LfHrI2uJi_bzelQPdWFD7zCrC5RcCUknsXn0l4q-G8jv5-vvduc11hJO5WReDWSUgvs69L-kwXvHjfQLqB00z23kDEZnXzInInPQVqF1c5Yd-IsQEebn0LNprHBTJCwGPySt9_KDDrF3NPiJF-EFCdnb9cYE4QLplf10qUz6IhTk6QNZ5LVF0qXev6OWirt70yOgWlN0lgETN2vBAmO7jfI2qZo3E5sdnBOwMvGkEg9E7j9LOGy7aLfe6xnUmdCSZNZgHoR9FQUPkY3l6nzM0bi3tLRYBpFhTz3KOcBthZ_IbLT1dhNW7e5zoFXL3k1LAC-aThxd1NaqAej5frSB2tRfxE-Y8a_W-aNJDbZADJT8SxIu0nAQvU0Lu2RlYM4bILr7EvG2sOV9JOdiTpIowOXH0MKIZpXK0x0RovJfL7qf7MQUKzoy26vJSLmOYYm2RhcGewi9vIrPBzQyDQoyZmrUk5H-64Daul6VxZmS-I9v5yaUMH0Edj2PPHnMkU_TPoDu5I8ZvFirLEsVruaRymTGesylI7C_yLSN5jVuyl6r9A9g28raZCMTF1Os8QSsA9rQHy3buXSd9qm1wIeMOq23m_FkcRUwCfNCTHYHUsOojZd0NyfTALGy9AVHmg8fe3FwYRjeASXRJ3V1_W9WDb3__0SJuoPy-0AWCO_qsC8kyw02WJgjd5fz2hcBKiHML1rKql2ND-s13cGZTcXLvMa1ZJHTxQ1mDHzcakP66CKOCr1zPMEg&sai=AMfl-YQutRPPe_yPz7us_O6vVDkqcgtETj4b0idHnS8tZKZ1VLl08kIy8ve8P6rJTUfI9RefiXAhXbWB3aJZda9D7jETWcTdpQoUBvTxaleqnppbjXibCzhJMsBY5QFdxspFxcVVPSKdLLoAYs5iJ4Y7xFRu84uGMg&sig=Cg0ArKJSzLdHRWGhDJBkEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1119&vt=11&dtpt=839&dett=3&cstd=278&cisv=r20220112.97754&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 00:00:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3BE6 0
23 B 66ms
66ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvCjcUJX3uOISQj8VFhSFHbcVU9DkKl8jSc4WHYAAB31WiaU2ppH-MKK4bsZIV2QGSDb3-07Wf-n0P-5BLnV7BH1G-YbAX5oXftBiWk0tYy4EnC-gEWCFjvxgpRE3sbruQoGINxzMG3PQwFPAsRGzuOstkEgLPUIVmLcF9JfGOq7UUEkHdXFkBn5CsaPdft4xXMbaiF0G2C2oXUIzEwnXLfmIYLvXXmtqKcgIaVoH6e4YoGnFi8WUHFOlcuZG5bM21ZqM-oTmuByIuUIbEb0YNthYXQqFM8OIxR6bRi7Xm4tbcnljHVLuw2Ro079fimYpqdlxn99GGHkXjRT4B78Q3_-pTgv1ZqFJ7tm0-PyIWZoGmCneX2Fyvl_QQ0dx7xTQwpBstt1S1asXGQk8Qf8NBZuBBtjLrr4EXRk6OcVKwkOY6KBHHEMajuueZWB-De0aXUhghX99Y-0XuhhdPC0nDu1v7JziwdcoIr6xuBcifrYiMO_dPoI21Xn5IgczRdiY0oCdzpWDIz9Ug9M6ws8CFjmUBUzIYCB42YLNLsGMrlfYkQMd_sZRZC-vjRcOyuaZDPpALe5sO8zY5m0W6FRC3nv3qC946u31UG57PX6bngEwiWNggBkxIS4zZyLuDNvG2rUae7Rbb3jt-JUQ9yfOPTwqbyQCzHQix2_qJCTQ0-1RpPHpRHH0kYwOq6KyOt-6uJwsco6AHl4i7YI59uDPEQYL8Z5znbXmEylUvoEyhMj1p4zA3mu0kaaYZMOwESV2K-GGgghCWSMl_lbt26l38Wf-f5a8Kpar7kGcZjF3UJoqZ2n5FpC7gRnB4029K_7tiPueM7JqSilZvHVg7dzfLiICp2Tx8TQymsgaRFJqTU-TYa1vd6tVY1JAgRGPBZE37Yn8hXv5F_hJAnYsULUnfryUTQ1HjxY7xY9ZdYK8usptVc_mZJFK_8JYuoSCCMNABFCsn9_z1HmRrB0MnNGnGR5hRiJ7n4dyGEdrsmEp8bA7ks4HEcMQuH6MVM7__-9FT0c7rEtIx3bnSK1EWVwATLwQELaO-jOEppyniCWYOej5g5oQsUvQi24w4Wh3z0EpnD8u87aI99y4qMajl0YG6kmWOC_O3srpVdwHx7eNKrJWmEwbBdMOm8K9glQwSVsAMEReKrDDTc888&sai=AMfl-YSBkueG3JOmQNUPaVXnKO2Iiptse7njSGAJ5Hc59lazpDLo6H6UB1W_04Lq0BSBg3a2fuFlr3z8sJZA6UxgUy3Thmw-RbZkqr-jzvfqwfaLe_FtgAHV_XaryNOSHvkQbxsmuMYAqgx6hAc7HJbIkMbCFLuPVQ&sig=Cg0ArKJSzHnqC-tjpT_REAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1302&vt=11&dtpt=1021&dett=3&cstd=279&cisv=r20220112.77411&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 00:00:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 934E 0
23 B 92ms
92ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssCZW0ZUBTS3_-UKZ3uV_H5QL_ocQBrUscwVSU2pq7dXCC-kNgUIAXRGUe5zwkwzVvYiZ0ccDbTZdAA_q6T5fi6LOSwjDMkp-3aLGwhX9u8lQqM-gufg5AwZX2C2QgKbouNtbU4QxcfOJZcLZm6jyAamIuWDcY4FVb7zcZVTPPyofuClvwKAsKFoW9NVj4X5VSoBqMX-tyyl_3DEuPmdIkggabXM0pKk2Ywq_Z2wgXwfMO_ZdHSNREYifvJgBKzP8M2ZAPGQjzLoRcral6HGmxReAJTst83OihoXSRcRfvo5eIw89cfmR3mPekdkftv3eK4iMJ-K2Wu73EYCurmT_6GgbfQV0RqAModNDnXW82dfwK0MxriRvXBLd_sHa_rQLwSYMK73b1NdfbkxlHp6upoEnvxNg5QB-a5G2j6gifvbmCN79skKmUdbbILCxOCvkGm7TGAYb5DbJ7I5_MXylilIrcYCC7Bn8ds3ySDyigbJ1yoXSIoJbPPXU2IuH-GNNTIGDLeuOIfHD6pZKHjDgqGj5ZlJi4_0slCk805Id-BqPUsy0mJ6wsCfGtyerlp0IzRHMunMAAm_odSqiRPH4yeyWmEg0X36A6g-lQLw_rRTMTu01TZRMxMfMPO3a1xVMElV_-7d0FpXZ3YUOmwEX1_MojeU5V-8mctgDmjkwnLKVY6kP6tc-L3pJNqh7ZjgbEK0Z1YFhG3yRsf65Tpi4hZFlI8On1lDWlteloqGNf8sn1o5DVAY42vpPcKu8xCb5t6D-ufCjuaWcdONHG5jWLVTokkyKQuZmFf7kW80M3sJOExw78pRQoLyYBfO88bf7teyPljjeVITYfgT43CD0_ScWoTQmUq1HLRC61m-0AAPDEP8VHKesXSrlu3zlzIro90D1zXWg18K451nBRP52wiFU4ot-6BYmwgnI0ijuhiVEadxOzdEregbIZNL9P95aNOSzp4ydhpfW_pN40vwO24LrBZlZnjxaCwxAl7aeESJBL6TT-MvemMPmBM4qvR59g9vytPC6E-0Ud9Vqhsdxzu78ugr5fsBG4GDEAO1AfQauUCwZUf_zcEbbviILN6bR_13OxClgJ1opuqOVo4DM6Mz6ARURxnjTa6BZMHpNMHUZj-EiemDcKALzpgtm9pnILZoFwDyPG4dE6aSSMf9dQ&sai=AMfl-YT00nPiXxuVdC5O49gq8FSqy2mSWkBOLaTmg6Kxr57HcDH8jNyDWIzlRG1qbpDzO9BEt-UcYdJp44XyAXjwr0X7ajknX5S7JIRJX5ye9rhh5Hr_FGTqUjYvsp3bsOYzEqSy139_FuC5WM07KH-Q0zAodLwZTw&sig=Cg0ArKJSzLeAfAFYrd8WEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1262&vt=11&dtpt=968&dett=3&cstd=292&cisv=r20220112.72745&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: kartaplovdiv.com
URL: https://kartaplovdiv.com/sexdating.php

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 00:00:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 45ms
45ms XHR
application/json 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220112&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4055b6e9d938e55d9677ed223d8431e1170f8e2f54c94041d31cb176b4f555d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 00:00:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8846
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 17 Jan 2022 00:00:32 GMT

GET
H2 200 / Show response
c.mgid.com/pv/ 0
303 B 148ms
134ms Script
text/plain 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.mgid.com/pv/?tcfV2=1&pv=5&src_id=subterfugue.org&cbuster=1642377632921361888146&childs=1110070&consentData=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&gdprApplies=true&niet=4g&nisd=false&jsv=es6&ref=https%3A%2F%2Fkartaplovdiv.com%2F&cxurl=https%3A%2F%2Fsubterfugue.org%2F&pr=kartaplovdiv.com&lu=https%3A%2F%2Fsubterfugue.org%2F&sessionId=61e4b1a1-055db&pageView=1&pvid=17e6555dc9982286d88&site=657953&implVersion=11&dpr=1
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/leskanaris.com.1110058.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 6ceb4dcde8b1048b-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9834 42 B
64 B 61ms
60ms Fetch
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstVmYKwiNrcXnHMevAYZzAlmn2oVGrUsuILTiWqTyshk8IudyWqD_hU5Ivlt2zsO49ig4TOXDI0wLNljY5NojwxMahfO7fV4PuwZTLbYOhQFoqNVQXkAw&sai=AMfl-YTQ7mCnVMlW17ZZWOE11wSiHhZtUbHZT3-DIUdk9M7lkJt-Fj1DdXhMTLt--jex1Q_7hJr2Fo24HDTr&sig=Cg0ArKJSzGncZXJ0i-mfEAE&cid=CAASBORoawE&id=lidar2&mcvt=1046&p=0,0,94,728&mtos=0,1046,1046,1046,1046&tos=0,1046,0,0,0&v=20220112&bin=7&avms=nio&bs=0,0&mc=0.94&if=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1642377631292&rpt=561&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F2AC 42 B
64 B 72ms
72ms Fetch
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstXJ_6GakZAFBj2AOnXBZrts7hE4Vd4eIsZ_KvojxNJVrjdRaA9XeA3dzoruNJZ7sXGTPtEMkrtNitx2EOZN2ibFF6fxT-VPKczclV07uOt1muP6vxXwQ&sai=AMfl-YS9oMKlnaF_AafhOeNIHBAogrLcVqPQ3-hrvV7PfqhyeqKJdhKwbaHJWheLigRDZs99m3ZNS4-BLJusRu7M_M9DnoFoLA3VOXb-70s28U1sHn43uPvz_It7VkrN&sig=Cg0ArKJSzLJgBIGJrFgsEAE&cid=CAASEuRoIeo23zK_beu3vFuhnBISjw&id=lidar2&mcvt=1056&p=180,972,430,1272&mtos=1056,1056,1056,1056,1056&tos=1056,0,0,0,0&v=20220112&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1743717478&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1642377631384&rpt=554&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 5D29 13 KB
5 KB 25ms
25ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 16 Jan 2022 23:15:31 GMT
expires: Mon, 16 Jan 2023 23:15:31 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 2702
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 9E14 783 B
535 B 36ms
35ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

5387523cc6450cf70641cf6713be4823a61337a123e9419ec40370c575dfc97e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ZTaJGyqpeBukYOor5co1FQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Mon, 17 Jan 2022 00:00:33 GMT
date: Mon, 17 Jan 2022 00:00:33 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-ZTaJGyqpeBukYOor5co1FQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 MGID_plus.svg
cdn.mgid.com/images/logos/ 2 KB
1 KB 40ms
31ms Image
image/svg+xml 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/logos/MGID_plus.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 741932350156677164b36a1506347cfd558bc502310bd1d50e246d454c4c1131

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:33 GMT
content-encoding: br
cf-cache-status: HIT
age: 3920
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: B9201827F81D32DC
x-amz-id-2: oKgOzNf5arXSuLpawmQDb8wF7AHHBYdedIxY85YAn8qIfNXdz81xtOQ1yH8O6og8UfPiWO7QqMs=
last-modified: Tue, 23 Feb 2021 16:22:15 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1614097325/ctime:1614097325/gid:0/gname:root/md5:f7525f3a5f32c6f4a8e9867e9f57ab45/mode:33206/mtime:1614097325/uid:0/uname:root
etag: W/"f7525f3a5f32c6f4a8e9867e9f57ab45"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 6ceb4dcee97a048b-CDG
expires: Tue, 18 Jan 2022 00:00:33 GMT

GET
H2 200 Adchoices.svg
cdn.mgid.com/images/logos/ 836 B
841 B 36ms
27ms Image
image/svg+xml 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/logos/Adchoices.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7992a4430843ef8b4bbae534358be3193aa1ae9c78f273e8e8a70b6af1244ac5

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:33 GMT
content-encoding: br
cf-cache-status: HIT
age: 3921
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: 50VWJQBT5W4QYKJG
x-amz-id-2: xhXkWrQ90G/ebA55GK4VP5V6mncDrGDeipe5cahYa8kJ+JMUWbxTCzXMUo5ci9AAJm/Ct0tTCXE=
last-modified: Wed, 17 Feb 2021 18:15:53 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1613585745/ctime:1613585745/gid:0/gname:root/md5:7d59364b7ed2df3f02507c9f92560df9/mode:33206/mtime:1613585745/uid:0/uname:root
etag: W/"7d59364b7ed2df3f02507c9f92560df9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 6ceb4dcee97c048b-CDG
expires: Tue, 18 Jan 2022 00:00:33 GMT

GET
H2 200 close.png
cdn.mgid.com/images/ 358 B
685 B 35ms
26ms Image
image/webp 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/close.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e4723bb2b6aeaef0c3ae37ff9aff3e908fc8e91fa8a84166eb1590d478b6936

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:33 GMT
cf-cache-status: HIT
age: 6391
cf-polished: origFmt=png, origSize=908
cf-ray: 6ceb4dcee97b048b-CDG
last-modified: Mon, 04 May 2020 12:16:43 GMT
content-disposition: inline; filename="close.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 358
x-amz-id-2: IGJnCeJUa4P09JMpG2v5zTp0LD6jqmxOE9B/UaxjqqgGbwMU48DY6uZrqQkqcG0dXEf8Q+Ex8Sw=
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "95d9d9aed5585c7eb53e5d487ee4dfb8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-amz-request-id: D8VQDWYC99SMXQ3D
cache-control: public, max-age=86400
accept-ranges: bytes
content-type: image/webp
expires: Tue, 18 Jan 2022 00:00:33 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 34D6 0
28 B 61ms
61ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BMzW3n7HkYaSVFNHax_APp66YqAIAAAAAOAHgBAI&bg=!JCelJ2PNAAaocxMpqHM7ACkAdvg8WmqDG_-UXUGrgvuViaTo7KI5NYPDGDPUiVZ2WAyRWkPnuteH5QIAAAJlUgAAAAJoAQcKAIN4Hg2CXbQB5KLPmqWBtp2dKlXsGcZrWGai8KWzq0kycb3faaUeNhG4XV_DYTx_Vu6mzH7b-Wfw4aM7rk8Rdr-rO3M6FuXxO7d0jGj2vYlIgbfQpDmKjjWmmgtar2iBOQ-E1p5hRUSQl1YwaIhqVu3jBmyaqspRL7t262FTehlM5OYEUJkDBBglFsmhqBFSiVyVKW00BbXsQjzeByrFUyznKh8dgUTB6yh6TwknvLW6-ecfnKzrZJ_PUpWbaXsvhl0Y3CkNGdTyyFlt_Cf66BUClGWRzWIubi9neGma1_5QcuaJBCaLHOY1D21Azjyjpm5b-boPrN2W1uBa7UZGCiKLTue8SqeNR1F9zkozvT-dBA8kEwD0ZHdJWFFgtJUaEKtZcE3VVzFV3GYp_2KhanqjtbSfphbtMVgJVlgIS0oeUurz23y7FX1uZGcLFXSxAXDYd6nCIrxAedn-rfq3b3Y96c9b5KyuXDqcyPuyVWIcufvoWiKpYKjB8_-0DGxKimURFPCvOL7wY7VtiL5OrJL0Hidz1PaRCZKFd6LSECfKOrfITG6-vktXKJTM6s_jEj1MykBPRBJpzd0z2ZZR1hlMlS30x2tXvZzLEOSsElhOdu1rTt9pJCyRe3tG_tIeRfSIqfb09-8hsVKuFjqAnf8jWImUudmXsA6QBW9uf_ijhdge7sjCbcHn-o3fdMNB8CU8wMZEiEj9Usvhug4InIzXJR3q8Ua7JI8wuXqpZmz_FOJ0eWZPWVDEFASn0UAKA6CULs55YspHCjMpDix5urFwjFFkdzPh84diGEN8QtMKElRIXMj_LoMaAeLmKx207bTUQwkHEJS6gfm-OGkuhjHXSPZUKgOwj4wXVV53j40a4FjkqICG-lkr_Nhxg9EnCcqEOwvE1aRbX4Yp-ATZO-rwaekuQVkmVu0ChRaLQCcfHxbxKdqdfubpzD0C2duzsm3MLkK_8qeciW7yev0E5udNo49TOg3hjMnfdaePMwAseoq2KySAlrj56310q_YWD1dTN65wj0fZjrxx7-1wTJQaNPPpZQHGornFnCGGtE1MpODjwRjFtQRzADygoQdyGlWsmv8XnDi5CMcvu6ahYzL-GAIrhWsjuXC_NdhXulC2bBeIkP3s8sDzFFAQKkTduTa_FMpBdXxdtpdJ5BYWLDCrt33mCQihP3P_rzt2VFFTAHvKZnePsKLqLj0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D840 0
28 B 61ms
61ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BSlS9n7HkYYymCuSH7_UP4OWSyAcAAAAAOAHgBAI&bg=!EBOlE1fNAAaocxMpqHM7ACkAdvg8WlmCBfXRQRcJf16gyQGlsYoi3hjR5ydgdned5HMsY62K18_jUgIAAAJ8UgAAAAJoAQeZAwNQqKwVgpd0vvrAo6WoWZEjcZzmGfbFtR5TZtiIS23AGamWta_DW2BabA5_zTVhOJUrxDhcb5Zq41H6vGGyATNM3VhwoqOVUyaaKueDXMf4dTLWUPRZwpBGUsJSKWKYtstaeUR9HKKxV7hZyXZNGBCrDccxP3G5AMBKzwlr9fTee0jhHo6Ub9RY56hiaM_sHxy1oDpY7U1E1_rhZXuiveB3TV0hUgOJQyuDNxcZo5zZ2-0RTAnmMjM17cFgTNphvybFW5baIF-1wPVrbUXhzBJ-FDsB-CDnk80THssgjgSBBcjLSc5hP87qt9wyEWBMIHsAZye8AEhBv273UnH-LlZmIa_nVkfOO-VxgkXx7b909X9HJufV9QHU-bLjPL1LiNnUwvhJsdiQz7bxOX-I_vU5oC7UE7GwbI4c-Xj9oaxzeM9xU1X8HOhAs8jn3dI0zrBR1PEqcPYyvFppIwc53CmlcWjEv_ejf0fEsRXCT8tvEVwXVWo07XzvdLDtw1MpDlplMx2nsxpDhEnKEsJI_sJALa44cG-ZIdllf5zXfye8-F8p7ze1XYxiy-MNRmoM62jV5VB1X2AynmintPwDxlKGPw8cPuts6ci1juLAta35XUy4WEbEhgZWs2SP5ZjTxQoZAbZB2syS6-J6MQ4BQkTvhHkO279S6oDzKvbJdOtlKTwdocR8G-bsmY-odpy7OBMyb8-OCCFJPYkr3YMRqr2LoSTuUPLxn8dIdMgV0-h8rUjvRFBFxeBwqoDbP7JyI9I7z9_cXPJJJi-aTK3wp03qkvVIl_QP-mMez4vhbbJ_uhafGmtqjUl_ezUo7Wm3ZPJ8in3Xp8AGA3RSEabyvaxu3k2OID3irkgUotkflM5Plg-jnytUbXZX2JGYPnp0XHnatJv-WzvdhgqgwRNRVA5_JB6zu4L-QPd64xeRQYv8vmqVap2w8z4wUIZ4OTsnyMDji6712nDwfottFTqapF4-D1TAMHpHJvJW_iE7vaVvqaydhd6mI3jNad6NsFPuNNBnFpo

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8CFA 0
28 B 60ms
60ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BjcSVn7HkYY26C4CV9u8PwNeQ2AgAAAAAOAHgBAI&bg=!j4yljMjNAAaocxMpqHM7ACkAdvg8Wl_l9v_AO3edzDAio4Q_0IbJFVSXLrwHoL_zeUN1Bkt_57w8tAIAAAJaUgAAAAZoAQcKAC366YFoTc4qbdqOmmIAt94zPt-bYT7zLVsmlQkkIKk_5_ZhctGj8okaMiDdKXWZAwC-F2HUYkYucDSABTpmSQDzGxKMCXGdrgOHx4pFmDZiup_J9aEdG0wlBgo-4b8bcAOU7BzZGgyiRsWxpfyM1lcABX3VTblqbLSKaFMz2v6CidCFt5NelakvGGT-mfccCFPAf1wy-5PyXb--7wX74wfXiPE8RS92ugDZ7n8T1adyTa0xhE653iILnzhw9iT8UZoaERJx0-e1zvS1bHLS2VIV_8_ndAHop4uGWWt5KYFe4nIygZBNMgyyOcxbk4hnmEPoHEJgRtW5AueUH-Yt5kGTde-V9TQ0pmUJrWIFGnightY9VFTMBE0E-ChKo_L0qyMdOpbDwsdOHAFSw9B1Uj6knM1wenYyk5VFMw4g-vfrh4pHn7qYMgaQlRnFF-dCB7a4XMAR1Qmbu6w22_D98G_dmtoBi16I2st3qB7H_gQK4fHpkOjyn8ai-WICWE2xNbhrexY28xhGauW-S3N5V3SlqKL5ncZjlfcDzrY2FVZ6rmXJUmcBQZxocj24XcW5jP6dVy9sK7BfWoqrXh26g3OX83tI_85nC_o2o5j2AgWPCGqUe5zBvXKE_yZ2o0PXxBG0cuL_zPBWDuw2MJurnfwr60Ozic0Erwc-qgpWv_dlmXUWwm26xBtVe7Iq9fXTkj5b5yjANaBigXw424I5BgMa9Lk-vFUX1cIB9p-vuWuQIgjeIT-oe2aPrKvzL3gE1VKXNo4BTBbIj8rVe2yJbPKXxMu5XLrFSpKfaB05BY6UrsOlPW_BI9p0QMoXmIrecxW9Qh3VsuZR-JvF0i-kY4OQcJGX4IlU1jcWAOLN8pBFEvz99ii73WCMKnKS7N3_xRLGOszqJlVdK-mwHuwU34x3QwCseZ_oKcUcZSOaFupIUgGh9MO66ty5CNwoVCxlVlJvE-S3FHjRRueiDejDlMo5wWdJRhmM-L80yo1IJmA9TM65j9c-WQF0tYBMg6XQgY-ReWNSSsKL1US-5Sst49nkZ6L2kiWq-QtJEzs4L1QiBR9A-UbrJq1BsXTdvVS2PR4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1 Show response
servicer.mgid.com/1110058/ 4 KB
2 KB 50ms
40ms Script
application/x-javascript 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://servicer.mgid.com/1110058/1?tcfV2=1&pv=5&src_id=subterfugue.org&cbuster=1642377633260632489466&childs=1110070&consentData=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&gdprApplies=true&niet=4g&nisd=false&jsv=es6&w=0&h=-1&wrongImageSize=1&p3_w=0&p3_h=0&maxw_3=0&maxh_3=0&cols=3&ref=https%3A%2F%2Fkartaplovdiv.com%2F&cxurl=https%3A%2F%2Fsubterfugue.org%2F&pr=kartaplovdiv.com&lu=https%3A%2F%2Fsubterfugue.org%2F&sessionId=61e4b1a1-055db&pageView=1&pvid=17e6555dc9982286d88&implVersion=11&dpr=1
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/leskanaris.com.1110058.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03cc9a5f2e11a2e671db64b20014c83d383ffba8880eafce0416f63844103ed6

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: application/x-javascript; charset=utf-8
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 6ceb4dcffa80048b-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 1 Show response
servicer.mgid.com/1038348/ 4 KB
2 KB 41ms
40ms Script
application/x-javascript 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://servicer.mgid.com/1038348/1?tcfV2=1&w=780&h=266&p3_w=252&p3_h=206&maxw_3=252&maxh_3=206&cols=3&pv=5&src_id=subterfugue.org&cbuster=1642377633273123973213&uniqId=156d3&consentData=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&gdprApplies=true&niet=4g&nisd=false&jsv=es6&ref=https%3A%2F%2Fkartaplovdiv.com%2F&cxurl=https%3A%2F%2Fsubterfugue.org%2F&pr=kartaplovdiv.com&lu=https%3A%2F%2Fsubterfugue.org%2F&sessionId=61e4b1a1-055db&pageView=0&pvid=17e6555dc9982286d88&implVersion=11&dpr=1
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/leskanaris.com.1038348.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 00fefc883435167121ae6de1353b013a327988eeff351dde6f1f4b3f2a6b8ff6

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: application/x-javascript; charset=utf-8
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 6ceb4dd00a83048b-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A831 0
28 B 71ms
71ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BdM5Nn7HkYeXPEOKQ7_UP7f-r6AwAAAAAOAHgBAI&bg=!qqmlqe3NAAaocxMpqHM7ACkAdvg8WvCH3F3sYzxW554ZEskl0wX1QeAbPgO6mL9Z9V9kc8QA0Om08gIAAAIsUgAAAAJoAQeZAxwwHc_n0WCvOVn8HFuWuNtEYt2GuCePdFK1yDfA5mdevEa8ftUoDyB38Y-OjOLnaT4ygi-xmv6KfJfwfBX4WsVn41XqrfhzgHTsk3ZnjKV_mDY7L25s4wFMsuGaUepNvgyIQMqq4lk7NRvvb0m_-p7eNHgJFzLvb5f8DiK9LMjYYDLhxK7JvR1NgKXaTuK3iglAHeDSLZvhjt8wj6VuZm8Ib3sxkRO0sSf997bHk650_2emZtz37Fuvx4wZTqT5ZCjcbBH9PPIm9Af7JKEc7kF7YG_qwYtr9jn9e5Y66R3BbMmxFX6I2SAPUiFuSsXRnl_u7WHim87pA6TsJ39gw0Q0C_fisDtYdG8CmtBdjUcHYYQhWRLi8Da03tPTNhhkP6SrS0gfdB62jIjbCk5Z9OSRsAUpdGWfW2VbELuIgQZp16d6vkIOruwvm28VltBRvMHBk8A6AP7gr-xAhGxEOuhCxgcfnu_atvFKbQyjT0FGGnZDDQZbidxdt37Vup4IZqYXpIIqfE25YaR_GRy8tCHdU-6QppAKzW3UliWVtqFm7j4NbOmfMJQDkR0oM-8FreP6xNK7-7EWPOpU8DMQT0eMOxu9-CeXedFchZ2wzi9qkRSET6p03VzRRrn8uaKEScoiMmDuQrARX6nPedGtMdXRxVBm-8MfEXjgax6GZOcbu2lE-b7dPU0MDaLZrb18wNMLVGMFe4h-w9EkUXuNrLOcOjO1Aq726Z45d9aIBwxg_ZjgPNWfLBDHtx4BbrwQ8TUgSL-pCaAeQg17jOb2lClJ_TeQ6qo3MxyV6xfGiA8lsV7Hc2fzext3xJgattys2d3CPDF_UCKUqWhoO_XXkkmVjICg7e1GYFI77PkzE9A__nI3SOGr-hZXG0mOYqjJ16SKceVG_jJIsizOR9thEhx3KgkRYTaP1lpJ9hPjXz-zMsgWFMeI_VuB-TkEX7ZtQQ7xhs_A9ODT2JAVRjTqFxD60DEmB6epkMm9UaN4Yb4jJs9qERJe_-LnX1OfyQTzdIP39UToXEg9pgVnVySp7Ghjv5MC9oXs06Mo-dS5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C8F4 0
28 B 93ms
93ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BZ7FAn7HkYZ-4DZyf7_UPxOKasAgAAAAAOAHgBAI&bg=!oKOlo-fNAAaocxMpqHM7ACkAdvg8WjISmCpVfepoJJYSrNe9o5d3BDkFVK30UeXR8wFrydn4JG-2LAIAAAKeUgAAAAJoAQeZAw9fPL3-k0Qo95Lfhol8pj2znkqpk5k1NswuEKcF5Agwu215N13YiQux5l2bhFXekpr-enUv-XeVwBdcUAR1Qzgzdjbc4A3VAuN8ZTkoAs5HF-wUfTAHJPjKTbjzLVXp8HPByqUgQQdjrAXLS9wySnXlC2slLFW9-9sLygtFiCfswWQxgWhHUJNnRvxWQnQ1_xpHQY8Sn6ORZDMCaX8FPzDrztQ1HeJ9rfxzIGaDZ6Bo66YbybU230iZ7gMAANrl-ym_8WQ7FvXTsL-gzWWHyzEYvST8dXIy3A8uN318HfpEkWbDUYuCzkxQAFrrxMOB7lV00ZUdQjbZ72xLGu9kjAufKB7_VOIbOA_IZ6QADKGL80j-sALXFodDrltYDVNFfeLygDJIksMyVxW8xfIH2VwrMnm6cVKDbJiS1PbI3jOil4xJ56LpwslNl3G5QkfbYAkklhEMwNJLQD-Qpl1G_NWd-iIJB9HFTI2GWf-gZ_6SnxCrlyEq75MTloetqjQretmLh0ljenp1xdCMePmmZslBlbc_PvCTSMlW-ZUe6LHxhOD5MW2DcaYkTWE9gP20sMtvH-D0qXVA9BE78lpkuovmjjJlHeK5_qBeQtTaME0-eYCoGOTIxND2Dfmk19xnli-MxaLO0Xso8ZmwOGrYaDsDp8xmHZtt2YNmpgw6NVXzGgYZRwd5bFVTiFITiazPHPJWpV2Q_GrfIqHA77gaGCZqRw8llvjo9BeR-Uw6KcNhNRUsIozGiw0H8zszVkA6kBhEx7RaL_7J0LZclt5Pp4b8M4-HnAVYX1mijxiTgqXl3iJa42mQ_-h6ghIMNPQVnRIPl0NMm6JORKwf5uvmJP8jhs_rl7qHgCBVGte2_2DN6yhPYlHu7az_Hu6kgrOm86QaEislKFM_Es1CLZEqRH3V6sfpdFBcFnhgqP8FkyNh-tN56-_MCexa8HeZmKNS9UEAZWHSxeJWFFenCDtAoibvsCOiY4-L2VPHMZonKASff-iqx0-INhCej9ycDRP0j97QaRhst4EkAoToFi7Z39s

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3CF6 0
28 B 60ms
59ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BVtg1n7HkYbnpEdef7_UP8aqbsAQAAAAAOAHgBAI&bg=!y8ilyIzNAAaocxMpqHM7ACkAdvg8Wpol7UG9f_EnIq-0pFhk763C8_6cHUYJN4E-imJN5fkVGPzNnwIAAAJWUgAAAAFoAQcKAE-6h2H6YVSvpZ1wOqTUFj7MEV8ldhmFnxt5rJ-JU-6nSGxLmuRaUnQaF7Y6S8IrNuGC9CgCftrkG6s3hXZdVgkJDnJ-FC2DlSQL25_Ia6PFmQMMez0OmFcWEh2MhYpbxdUkr2Utjn29JDDRKcM8lSl_kFMelrQDYXX-DJwf59Dj1M_BKCiNPuX6-t9ABl8Ai6hVO3n05XFJYBNgiskZn2RWgyKV3K4c3wU9plzyJoaGCkApo09Hlpt9Doh5ATUcocnPDiX_RKnySMb9qgySFWVtnoqi8FF3B-PmjNmZD2HdhgnKoeIAykRfgtGhFsXsPWJD64b8UXTXJKAp0YbXwv8SrhS6NoRBnSvAQiX0ivzRjxiHlKTQjMybBnundggsh1-KSsaUa1FaMbJ9baCCfRZNNXIiF5hU8SMm9EzqAL0oU278VEr4GyKHlTT68qKnZLxOh-qwP2E0SdoBreCNsneQwe8xAwZ5kmjvTh9f9s2AUQTu8IWIJVnL5Du1Qz2lJXEgPeH3XOa-CTmRoWb_vDc8g4y4NVdBfR0ruTHjDgm4527MpqoIzCn3Oe1wjLwfnhknKlJI882uGxPRrtA9Guo9wVCoeM_1uiQh0sLNRU6kMPasFek7GTEOukimd78TV64iKda0bDy5nW9Ay_2ChDHy5wSv1biU-x9LvTDxS6NxzeE8kmYqXCk-_JchBA2VeZqJM5q-YT9RkLzEKkPsyOiGkwFKwwtMetSW_KOOEUJJvnU1utUfEKNleFxLd6ouy0wC1peNKnTHCw-hPUYY083zBgCi8oX8klmyQOYiawLVroEbVX05PF06bjBv2NPKLxqzy80-dQRbMS8RJCva5cAwfEa3_TBobVQIVJky8CtFETXyXUwhukoWQlgno3jz6H_9P3iT2x_zNCPE4NAk4vEH8To5YELZy1lwgAAqM_oDG8qi_9Y0idWODxk30F1I-653TLAzMD66jybmXuVFwpEgxNPtp3r7FXEAMHPq-SqOi9I16uCesxmO0HI7qCzC9ZMzq3q2pKiWINaABKmnF0mDcsTAvmKBj3qv0LW3rEBfvts7pannR_SzKT8NilWFACYumoDle-kA_UXkRHyhp1T1rP-DveRjcSbT0eJhbvMLQl0VA-aj-m9lehNk2Q_C

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C0E8 0
28 B 88ms
88ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BAU0un7HkYenUGZyf7_UPxOKasAgAAAAAOAHgBAI&bg=!ysmlyY3NAAaocxMpqHM7ACkAdvg8WhJ8yyqFcqbc7UGqrftHKl5bItbNszVyBF2SIZVRC2d20JafagIAAAIzUgAAAAJoAQeZA1jQcplx48XkqY2IOSLjSNCBa3sPxOoad6aYqktdUmdi7qw0CrFxkn5r2voPuvXBu6eCIJP4f2HECh-SjEQd5Wq9_EevhNXWro3J7XBE1tRAvO2sMbqoF5FwTFrJ6uwf0cMzVDNcWwk4GORUYltwIiLPg1qvoU6cPyNNjcdgHdVrnIZgQcLVMkfyd5DdTTyDylyYkhT_-Vc7lylhfti80kfiHjH0Lx6MGla5X3U09Xj1s_-4p5OyBDOtJxYe_r0SNmga5uB4MZkCUli9GXZJJwtOo6duj3wgBpRYA475inOV36nE05bsJZ785Z_W-zblQespWg3j0CnyMetaUCIueYpvrm1I1tRy5QfdPJ6WpCKdKCjcc909RTDx79xiL1ya7Lfs6ApqzrVQ5MKYAlKwTnOKJ0QL5JI4D1hARTpelwavcyUtJCA-rd-jNPTLjvqyydQssAV5L6WlHm4RY06PKo6U5NtDifek4fxCP-W11YlmmTr1RZ1uyFVBeL7LxIdSLKiKc1U5IuiC6exospkqfQ1r3mngFkm6HUUTXyIWhBsYq92zNRoNvPyuUwmYi70VLGisGfk0wlOGfgvtwtGgLaOv9LZ1konJGHHBrQi7kCBAgJF3O17Zv909P0da4ZXuKvdaQ63fejpu95Tr7N9orH7bd5Af0JRDa42Tl3N7wbEKTTr-FKEtuLBB6KRpORoaSX7ELGLDeJlJSXnvBmBI8iOX4NrMwR930cPormuV-phCoY6FQQhiUQn4iIII5gUGMeE1IHa9m16uD7hmY0D3_wdvl9poV0DHtQOoMya8ImkEu_m6yV7lFE7VP6-h4GCX1dUhA90DBg7U8-_p4hZguHGhOszrrLdi8MtNmtEX3SWCswVNJtxkmi3Y-YJEpksTrg06nzVlLUyGseLaTLcspMbyb_yYMMOeeNdPbeqYB96WOtfjwR_Z5kuLpUBNVEMZbo6LRXtWGeUi3troJoMKw9UK-ZIzfTTT-v19_GxBS6Y5Cvx0oqzA4vsxfrhhWvHFPCAXVeJokp_ETNAKtrfvvvkugXIhAYjkXmyTeT0kc30WHrciEHjkvVFMvIBHv8i0sJXJZSyWIwhF5PQ59Wy1RAEEysgPWTqrKZTk0B_UZMV2-YlcSMT3Ib44

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 9E14 0
0 60ms
59ms Image
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220112&jk=227882031419255&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js Show response
pagead2.googlesyndication.com/bg/ Frame 5D29 35 KB
13 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oCaBrhzCGlT5mvuc9Dz4nEKrkbyTgapk6W_7TPRun4A.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a02681ae1cc21a54f99afb9cf43cf89c42ab91bc9381aa64e96ffb4cf46e9f80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 21:00:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10794
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13579
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 16 Jan 2023 21:00:39 GMT

GET
H3 200 MGID_plus.svg
cdn.mgid.com/images/logos/ 2 KB
1 KB 27ms
26ms Image
image/svg+xml 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/logos/MGID_plus.svg
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/leskanaris.com.1110058.es6.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 741932350156677164b36a1506347cfd558bc502310bd1d50e246d454c4c1131

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:33 GMT
content-encoding: br
cf-cache-status: HIT
age: 3920
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: B9201827F81D32DC
x-amz-id-2: oKgOzNf5arXSuLpawmQDb8wF7AHHBYdedIxY85YAn8qIfNXdz81xtOQ1yH8O6og8UfPiWO7QqMs=
last-modified: Tue, 23 Feb 2021 16:22:15 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1614097325/ctime:1614097325/gid:0/gname:root/md5:f7525f3a5f32c6f4a8e9867e9f57ab45/mode:33206/mtime:1614097325/uid:0/uname:root
etag: W/"f7525f3a5f32c6f4a8e9867e9f57ab45"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 6ceb4dd0483c4001-CDG
expires: Tue, 18 Jan 2022 00:00:33 GMT

GET
H3 200 Adchoices.svg
cdn.mgid.com/images/logos/ 836 B
1 KB 28ms
27ms Image
image/svg+xml 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/logos/Adchoices.svg
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/leskanaris.com.1110058.es6.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7992a4430843ef8b4bbae534358be3193aa1ae9c78f273e8e8a70b6af1244ac5

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:33 GMT
content-encoding: br
cf-cache-status: HIT
age: 3921
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: 50VWJQBT5W4QYKJG
x-amz-id-2: xhXkWrQ90G/ebA55GK4VP5V6mncDrGDeipe5cahYa8kJ+JMUWbxTCzXMUo5ci9AAJm/Ct0tTCXE=
last-modified: Wed, 17 Feb 2021 18:15:53 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1613585745/ctime:1613585745/gid:0/gname:root/md5:7d59364b7ed2df3f02507c9f92560df9/mode:33206/mtime:1613585745/uid:0/uname:root
etag: W/"7d59364b7ed2df3f02507c9f92560df9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 6ceb4dd0483e4001-CDG
expires: Tue, 18 Jan 2022 00:00:33 GMT

GET
H3 200 close.png
cdn.mgid.com/images/ 358 B
886 B 27ms
26ms Image
image/webp 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/close.png
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/leskanaris.com.1110058.es6.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e4723bb2b6aeaef0c3ae37ff9aff3e908fc8e91fa8a84166eb1590d478b6936

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:33 GMT
cf-cache-status: HIT
age: 6391
cf-polished: origFmt=png, origSize=908
cf-ray: 6ceb4dd058514001-CDG
last-modified: Mon, 04 May 2020 12:16:43 GMT
content-disposition: inline; filename="close.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 358
x-amz-id-2: IGJnCeJUa4P09JMpG2v5zTp0LD6jqmxOE9B/UaxjqqgGbwMU48DY6uZrqQkqcG0dXEf8Q+Ex8Sw=
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "95d9d9aed5585c7eb53e5d487ee4dfb8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-amz-request-id: D8VQDWYC99SMXQ3D
cache-control: public, max-age=86400
accept-ranges: bytes
content-type: image/webp
expires: Tue, 18 Jan 2022 00:00:33 GMT

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8sd185NjAvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjEtMDYvMTAxOTI0LzEwMmU3ZWMyZGVjZDkxZjIwZ...
s-img.mgid.com/g/11740000/200x200/-/ 4 KB
5 KB 208ms
155ms Image
image/webp 104.19.136.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/11740000/200x200/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8sd185NjAvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjEtMDYvMTAxOTI0LzEwMmU3ZWMyZGVjZDkxZjIwZjNkN2E5MWRiMTcyYTlkLmpwZw.webp?v=1642377633-wgnc3bFmyPPIuLycZ3td9TrLV6wSXJCD8QarhwUhaG0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.136.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c5584b954b1c466144f8f1d26cfe934cc7e1210f7ea0740ec68580a15274ef5

Request headers

Referer: https://subterfugue.org/
Origin: https://subterfugue.org
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:33 GMT
cf-cache-status: MISS
last-modified: Tue, 21 Dec 2021 12:59:25 GMT
x-mg-request-uuid: e6380e10-44bd-4011-addb-5b4359f97619
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6ceb4dd0ae7a40b1-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 4520
server: cloudflare

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8sd185NjAvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjEtMDkvMTAxOTI0LzRmN2Q0NjY4NDI3MDg0MjgxZ...
s-img.mgid.com/g/11739995/200x200/-/ 7 KB
7 KB 188ms
135ms Image
image/webp 104.19.136.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/11739995/200x200/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8sd185NjAvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjEtMDkvMTAxOTI0LzRmN2Q0NjY4NDI3MDg0MjgxZTY0YjJjODdkYjBkYjI1LmpwZw.webp?v=1642377633-hgjKHe-blPZV0Fx6wLeeJSXe7DNCWeFQk5stUre0kZY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.136.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b5f60538d6d5f9fd8babafe9ca3b562018a62b9056636f21593f08fda8a2619a

Request headers

Referer: https://subterfugue.org/
Origin: https://subterfugue.org
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:33 GMT
cf-cache-status: MISS
last-modified: Tue, 21 Dec 2021 12:58:10 GMT
x-mg-request-uuid: 98e34a27-d1b2-4255-877c-303e31b11c51
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6ceb4dd0ae7c40b1-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 7000
server: cloudflare

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8sd185NjAvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjEtMDkvMTAxOTI0LzAyZWY0ZjFkZmMzY2E5NzNiM...
s-img.mgid.com/g/11740037/200x200/-/ 6 KB
6 KB 207ms
154ms Image
image/webp 104.19.136.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/11740037/200x200/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8sd185NjAvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjEtMDkvMTAxOTI0LzAyZWY0ZjFkZmMzY2E5NzNiM2RhZDY0NzA1MmEyMjU3LmpwZw.webp?v=1642377633-pSBeHwlkVY3X4U9QJr_exo4YLo97kvenaY9vM-SPlDI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.136.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cbd906cca2bdc0bd62d5aef5b4a78087e13cd026a6aa322013b38d968487a561

Request headers

Referer: https://subterfugue.org/
Origin: https://subterfugue.org
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:33 GMT
cf-cache-status: MISS
last-modified: Tue, 21 Dec 2021 13:08:47 GMT
x-mg-request-uuid: 533b43e9-c9e7-4177-9d92-780ec693fc54
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6ceb4dd0ae7e40b1-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 6336
server: cloudflare

GET
H3 200 MGID_plus.svg
cdn.mgid.com/images/logos/ 2 KB
1 KB 33ms
32ms Image
image/svg+xml 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/logos/MGID_plus.svg
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/leskanaris.com.1038348.es6.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 741932350156677164b36a1506347cfd558bc502310bd1d50e246d454c4c1131

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:33 GMT
content-encoding: br
cf-cache-status: HIT
age: 3920
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: B9201827F81D32DC
x-amz-id-2: oKgOzNf5arXSuLpawmQDb8wF7AHHBYdedIxY85YAn8qIfNXdz81xtOQ1yH8O6og8UfPiWO7QqMs=
last-modified: Tue, 23 Feb 2021 16:22:15 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1614097325/ctime:1614097325/gid:0/gname:root/md5:f7525f3a5f32c6f4a8e9867e9f57ab45/mode:33206/mtime:1614097325/uid:0/uname:root
etag: W/"f7525f3a5f32c6f4a8e9867e9f57ab45"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 6ceb4dd0989a4001-CDG
expires: Tue, 18 Jan 2022 00:00:33 GMT

GET
H3 200 Adchoices.svg
cdn.mgid.com/images/logos/ 836 B
1 KB 34ms
33ms Image
image/svg+xml 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/logos/Adchoices.svg
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/leskanaris.com.1038348.es6.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7992a4430843ef8b4bbae534358be3193aa1ae9c78f273e8e8a70b6af1244ac5

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:33 GMT
content-encoding: br
cf-cache-status: HIT
age: 3921
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: 50VWJQBT5W4QYKJG
x-amz-id-2: xhXkWrQ90G/ebA55GK4VP5V6mncDrGDeipe5cahYa8kJ+JMUWbxTCzXMUo5ci9AAJm/Ct0tTCXE=
last-modified: Wed, 17 Feb 2021 18:15:53 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1613585745/ctime:1613585745/gid:0/gname:root/md5:7d59364b7ed2df3f02507c9f92560df9/mode:33206/mtime:1613585745/uid:0/uname:root
etag: W/"7d59364b7ed2df3f02507c9f92560df9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 6ceb4dd0989b4001-CDG
expires: Tue, 18 Jan 2022 00:00:33 GMT

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMS0xMS8xMDE5MjQvYzYyZDk5YzYzNmQ4NDQxN...
s-img.mgid.com/g/11740006/492x277/-/ 14 KB
14 KB 151ms
140ms Image
image/webp 104.19.136.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/11740006/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMS0xMS8xMDE5MjQvYzYyZDk5YzYzNmQ4NDQxNGRlODc1Mjk5OTA1MWI5N2MuanBlZw.webp?v=1642377633-quOskzZUWzf3vL-drwis2-u-Jn8w4FDyz6wryOw_rq8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.136.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a55fa09e10d43490b687a0944df9ab637f236a5c35c86f9649e46f09c35c1cd

Request headers

Referer: https://subterfugue.org/
Origin: https://subterfugue.org
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:33 GMT
cf-cache-status: MISS
last-modified: Tue, 21 Dec 2021 12:54:55 GMT
x-mg-request-uuid: 9bd464b8-f53d-45ff-85cc-6639b4f0dd54
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6ceb4dd0ae7f40b1-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 14222
server: cloudflare

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMS0wOC8xMDE5MjQvZTcwYjM3N2VlYjNhMTJmM...
s-img.mgid.com/g/11740009/492x277/-/ 15 KB
16 KB 149ms
139ms Image
image/webp 104.19.136.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/11740009/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMS0wOC8xMDE5MjQvZTcwYjM3N2VlYjNhMTJmMzY4ZjllNzcyMGJiOWNiNDkuanBn.webp?v=1642377633-4jP9O9sFyOwR1IyPHGrAQRdkQ059iii1r44BSvb6ktA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.136.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb9bb3bbff7ecbe21b633b79cd9bb41bd0dc3e533891f1660338ed49dfdb4924

Request headers

Referer: https://subterfugue.org/
Origin: https://subterfugue.org
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:33 GMT
cf-cache-status: MISS
last-modified: Tue, 21 Dec 2021 12:54:50 GMT
x-mg-request-uuid: f34d00ac-9598-4875-9be5-cbd11f2ee1ad
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6ceb4dd0ae8040b1-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 15866
server: cloudflare

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMS0xMS8xMDE5MjQvNDBiMmUyYjk4ZWQxYzgwM...
s-img.mgid.com/g/11740004/492x277/-/ 27 KB
28 KB 146ms
136ms Image
image/webp 104.19.136.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/11740004/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMS0xMS8xMDE5MjQvNDBiMmUyYjk4ZWQxYzgwM2Q5YTkzYThmNzUwNGU5M2YuanBlZw.webp?v=1642377633-2hrSmCC07kgq1rdrOVlHA48J0Hvj2DC8Sg_D1Nz5n8g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.136.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 45279f89218b0b6f63df416f26b222174579f9af27c10562cbf1c7891092fc73

Request headers

Referer: https://subterfugue.org/
Origin: https://subterfugue.org
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:33 GMT
cf-cache-status: MISS
last-modified: Tue, 21 Dec 2021 12:53:43 GMT
x-mg-request-uuid: d45d5fd1-9f65-4396-84a6-c20c19665d10
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 6ceb4dd0ae8140b1-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 27832
server: cloudflare

GET
H2 200 i.js Show response
cm.mgid.com/ 2 KB
975 B 118ms
110ms Script
application/javascript 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.mgid.com/i.js?consentData=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&gdprApplies=1&cbuster=1642377633417780909804
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/leskanaris.com.1110058.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6df2dda5e0900918c05566608fb8dd2b1919268c67b72f338c85baa28b0b1cb3

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: application/javascript
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 6ceb4dd0fb23048b-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 5D29 0
9 B 25ms
24ms Image
text/plain 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?IgzY_A
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 i-noref.js Show response
cm.mgid.com/ Frame 5532 0
185 B 117ms
116ms Script
application/javascript 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.mgid.com/i-noref.js?cbuster=1642377633447885201070
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/leskanaris.com.1110058.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: application/javascript
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 6ceb4dd11b3b048b-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
28 B 62ms
62ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220112&jk=227882031419255&bg=!4-Cl4KTNAAaocxMpqHM7ACkAdvg8WlRsqAoQu45d2Ee63M1F6lJFIlYEE9zWzFrUAr-52ZHmCMHAPAIAAABuUgAAAAJoAQcKAJS0s76VN0WnZq2MBgij41GZyWmCeIeg0KM79nWGf0qhz1irHKXZBgAwVRGhBWq6Rnbt2MLH-QoUe4JZiBUTE_Dg_fMu2-OZWIcoyk4bz_Xaq4NpqAei5wfOfCSykxmnlaP4RNSlCBah4TSUOYH6Xsjzmen4gjB6vTEVtTleOdk5mX0Ilbxkj0NcMNYo9LWZoQBTmUK2mQKxCxIn43VzMvdcSupFuvRwAm-9mAeaCDWurb9B2lQfYs2yDGUIEI61GKODmADjD-YKYHsWnQnFaAGJ2Cg-izGoD-_TS8XkhthjjnuavQvkIwhN5pphydpZRK0KqXlvYLwJEOg0iePbSDxVsT6Uqqc5WpeW4YoQ-smbLx9flicSGr7BH84W8t6BoOlOEXdUFxZK3swsDqK4FWZTWT3G3tcPwVskfd4sAiMHPcYosVWOdyDhnPlQvAc9mPYDt3ilkjzziXSUcSjJHL1wnPlYK7L5hjCebL1wC_rLUKC7ChRvU-1ypuKhYXWzMG3RST3t5ZBtai7oEixwHKzQ6fCP3FWiSZv7bo1RnyONzbtBjg0DFGxbtMD_ePUIQ4ALjENSH5OIVk_G6w_rIM36TjZosro5MKVoN38Nv_vsdbM9tKwYNbKrwkV9sx3ta_SuNcmUWrOUHgD-9qpo3mVe-wj6wM3KMhM-rPimWHHLAP5C5Sv7tLLGmrD_jWaei0h1txC3fo0muRVs8gTkbw4BYCfm-7IazPbH-n9Ei-VJKY4MzZMKkLcXqN2UrQVSoGhkrXaR8YNBfRr0mPmad3Y0mBr1l1zKKCbAxT0Or8xD0QUchvWc3VuMyGm9Vt8Cg7MJ-7iJ1-Ly21JPN2737L38Fi6HgMEBEkoQxvFKqzI-HzVh5ieAfYCPHdkVQSZI7KLaHDooGsmx9_ukgMKnIEqc-4ulAnXTTZ9LleKzyUQiNO61topF9vn5fIRR0Ner2czfthGpxq-t7gMm7jEcMCsrWuPU7_32T0q4pf7G_kU0oCHHx806Xyoly24RnFlfw6u6tdG9KZIWovj1-oUdR46L5qABbDaAuKV6UmN64rjjeHvwa9Ld8EVrpBgZBOGMkqPMaQYE_uyIpz7hWgUh5aA2SnP08NOWvAs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 80F3
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=mgid&endpoint=us-west
https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=us-west

281 B
554 B

93ms
25ms

Document
text/html

104.117.200.100
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=us-west
Requested by: Host: cm.mgid.com
URL: https://cm.mgid.com/i.js?consentData=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&gdprApplies=1&cbuster=1642377633417780909804
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.117.200.100 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-117-200-100.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "402b2-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 17 Jan 2022 00:00:33 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

server: AkamaiGHost
content-length: 0
location: https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=us-west
date: Mon, 17 Jan 2022 00:00:33 GMT
access-control-allow-credentials: true
access-control-allow-origin: *

GET
H/1.1 200
OK sync.html Show response
s.adtelligent.com/ Frame E7FE 1 KB
883 B 101ms
18ms Document
text/html 2a0c:5c81:5139::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adtelligent.com/sync.html?aid=658327
Requested by: Host: cm.mgid.com
URL: https://cm.mgid.com/i.js?consentData=CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&gdprApplies=1&cbuster=1642377633417780909804
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5139::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: 16e04bdf6c116d4ad9220245c02b90483beaee2275b489e27d687f3b519d382e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

Server: VertaMedia 1.0
Date: Mon, 17 Jan 2022 00:00:33 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 600
Access-Control-Allow-Origin: https://subterfugue.org
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Encoding: gzip

GET
H3

200

m
cm.mgid.com/
Redirect Chain

https://x.bidswitch.net/sync?ssp=mgid
https://x.bidswitch.net/ul_cb/sync?ssp=mgid
https://a.volvelle.tech/sync?ssp=bidswitch&bidswitch_ssp_id=mgid&bsw_uid=aed6b269-6563-498a-9e40-2c9b6d1c5ed9
https://a.volvelle.tech/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=mgid&bsw_uid=aed6b269-6563-498a-9e40-2c9b6d1c5ed9
https://x.bidswitch.net/sync?dsp_id=190&expires=14&user_group=1&user_id=d5f3cb78-cc93-4bec-b947-398c054f77b2&ssp=mgid
https://cm.mgid.com/m?cdsp=433145&c=aed6b269-6563-498a-9e40-2c9b6d1c5ed9&gdpr=&gdpr_consent=&us_privacy=

43 B
577 B

128ms
128ms

Image
image/gif

104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.mgid.com/m?cdsp=433145&c=aed6b269-6563-498a-9e40-2c9b6d1c5ed9&gdpr=&gdpr_consent=&us_privacy=
Protocol: H3
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:34 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: image/gif
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 6ceb4dd48dda4001-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

Location: //cm.mgid.com/m?cdsp=433145&c=aed6b269-6563-498a-9e40-2c9b6d1c5ed9&gdpr=&gdpr_consent=&us_privacy=
Date: Mon, 17 Jan 2022 00:00:33 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H3

200

m
cm.mgid.com/
Redirect Chain

https://rtb-usw.mfadsrvr.com/sync?ssp=mgid
https://rtb-usw.mfadsrvr.com/ul_cb/sync?ssp=mgid
https://cm.mgid.com/m?cdsp=287839&c=af9ee8c1-6bcd-4a84-9731-21cf8717b181

43 B
609 B

116ms
115ms

Image
image/gif

104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.mgid.com/m?cdsp=287839&c=af9ee8c1-6bcd-4a84-9731-21cf8717b181
Protocol: H3
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:34 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: image/gif
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 6ceb4dd668824001-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

location: //cm.mgid.com/m?cdsp=287839&c=af9ee8c1-6bcd-4a84-9731-21cf8717b181
date: Mon, 17 Jan 2022 00:00:34 GMT
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H3

200

m
cm.mgid.com/
Redirect Chain

https://ad.360yield.com/server_match?partner_id=1944&r=https%3A%2F%2Fcm.mgid.com%2Fm%3Fcdsp%3D665953%26c%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=1944&r=https%3A%2F%2Fcm.mgid.com%2Fm%3Fcdsp%3D665953%26c%3D%7BPUB_USER_ID%7D
https://cm.mgid.com/m?cdsp=665953&c=6d63c51f-f6cb-4c24-9ed2-0e73ac5bf0c6

43 B
562 B

131ms
131ms

Image
image/gif

104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.mgid.com/m?cdsp=665953&c=6d63c51f-f6cb-4c24-9ed2-0e73ac5bf0c6
Protocol: H3
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: image/gif
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 6ceb4dd29b5e4001-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

location: https://cm.mgid.com/m?cdsp=665953&c=6d63c51f-f6cb-4c24-9ed2-0e73ac5bf0c6
date: Mon, 17 Jan 2022 00:00:33 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H3

200

m
cm.mgid.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=omn67hl&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=omn67hl&ttd_tpi=1
https://cm.mgid.com/m?cdsp=371158&c=539ec31f-aef6-4c67-b64a-cb8f0e96b7db&ttl=1644969633

43 B
561 B

204ms
204ms

Image
image/gif

104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.mgid.com/m?cdsp=371158&c=539ec31f-aef6-4c67-b64a-cb8f0e96b7db&ttl=1644969633
Protocol: H3
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: image/gif
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 6ceb4dd2bb7f4001-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.mgid.com/m?cdsp=371158&c=539ec31f-aef6-4c67-b64a-cb8f0e96b7db&ttl=1644969633
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 205

GET
H2

200

/
onetag-sys.com/match/
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=303&user_id=m0gxR0SLV10g
https://x.bidswitch.net/ul_cb/sync?dsp_id=303&user_id=m0gxR0SLV10g
https://onetag-sys.com/match/?int_id=30&uid=aed6b269-6563-498a-9e40-2c9b6d1c5ed9&gdpr=&gdpr_consent=&us_privacy=

0
151 B

76ms
22ms

Image
text/plain

51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=30&uid=aed6b269-6563-498a-9e40-2c9b6d1c5ed9&gdpr=&gdpr_consent=&us_privacy=

Protocol

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip251.ip-51-89-9.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Location: //onetag-sys.com/match/?int_id=30&uid=aed6b269-6563-498a-9e40-2c9b6d1c5ed9&gdpr=&gdpr_consent=&us_privacy=
Date: Mon, 17 Jan 2022 00:00:33 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2 200 mw
mwzeom.zeotap.com/ 95 B
455 B 90ms
38ms Image
image/png 2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=m0gxR0SLV10g&zpartnerid=1532&zdid=1532
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 00:00:33 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://subterfugue.org
access-control-allow-credentials: true
cf-ray: 6ceb4dd20f5e3b0d-CDG
access-control-allow-headers: *
content-length: 95

GET
H/1.1

204
No Content

sync.php
pixel.rubiconproject.com/exchange/
Redirect Chain

https://sync.e-volution.ai/34b9aae5baa016b251b9fc488f4a97cd.gif?puid=m0gxR0SLV10g
https://ssbsync.smartadserver.com/api/sync?callerId=24&gdpr=0&gdpr_consent=&us_privacy=
https://sync.e-volution.ai/a02d62607dea0c97e41ff36ebd422945.gif?puid=2761247471444811859&gdpr=0&gdpr_consent=
https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-pashadv&gdpr=0&gdpr_consent=&us_privacy=

0
239 B

92ms
22ms

Image
image/gif

69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-pashadv&gdpr=0&gdpr_consent=&us_privacy=
Protocol: HTTP/1.1
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Content-Type: image/gif

Redirect headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 00:00:33 GMT
Server: nginx
Transfer-Encoding: chunked
Location: https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-pashadv&gdpr=0&gdpr_consent=&us_privacy=
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Expires: 0

GET
H3

200

google
cm.mgid.com/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=marketgid&google_cm=&google_ula={guid}&google_hm=bTBneFIwU0xWMTBn&muidn=m0gxR0SLV10g
https://cm.mgid.com/google?muidn=m0gxR0SLV10g&google_ula={guid},5&google_gid=CAESEF5AB8bcU5b2UXvjJ3Hne-g&google_cver=1

0
376 B

115ms
114ms

Image
text/plain

104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.mgid.com/google?muidn=m0gxR0SLV10g&google_ula={guid},5&google_gid=CAESEF5AB8bcU5b2UXvjJ3Hne-g&google_cver=1
Protocol: H3
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: text/plain
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 6ceb4dd1ea8a4001-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.mgid.com/google?muidn=m0gxR0SLV10g&google_ula={guid},5&google_gid=CAESEF5AB8bcU5b2UXvjJ3Hne-g&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 327
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

m
cm.mgid.com/
Redirect Chain

https://creativecdn.com/cm-notify?pi=mgid
https://creativecdn.com/cm-notify?pi=mgid&tc=1
https://cm.mgid.com/m?cdsp=501037&c=WumIru5KttjS00pFDF24&pi=mgid&tc=1

43 B
561 B

133ms
132ms

Image
image/gif

104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.mgid.com/m?cdsp=501037&c=WumIru5KttjS00pFDF24&pi=mgid&tc=1
Protocol: H3
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: image/gif
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 6ceb4dd24aed4001-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

location: https://cm.mgid.com/m?cdsp=501037&c=WumIru5KttjS00pFDF24&pi=mgid&tc=1
pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT, Mon, 17 Jan 2022 00:00:33 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 /
cm.lentainform.com/setmuidn/ 0
495 B 145ms
92ms Image
image/gif 104.19.217.61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.lentainform.com/setmuidn/?muidf=m0gxR0SLV10g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.217.61 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6ceb4dd20e1f3a29-CDG
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 /
cm.idealmedia.io/setmuidn/ 0
412 B 191ms
140ms Image
image/gif 104.16.199.73
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.idealmedia.io/setmuidn/?muidf=m0gxR0SLV10g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.199.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:33 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6ceb4dd22f54edb3-CDG
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: image/gif

GET
H3

200

m
cm.mgid.com/ Frame E7FE
Redirect Chain

https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fcm.mgid.com%2Fm%3Fcdsp%3D617666%26c%3D%7Buid%7D
https://cm.mgid.com/m?cdsp=617666&c=bd5997dcc7895545

43 B
593 B

112ms
112ms

Image
image/gif

104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.mgid.com/m?cdsp=617666&c=bd5997dcc7895545
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=658327
Protocol: H3
Server: 104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://s.adtelligent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:34 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: image/gif
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 6ceb4dd5af4d4001-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

Location: https://cm.mgid.com/m?cdsp=617666&c=bd5997dcc7895545
Date: Mon, 17 Jan 2022 00:00:33 GMT
Server: VertaMedia 1.0
Etag: bd5997dcc7895545
Content-Length: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 80F3 32 KB
10 KB 26ms
25ms Script
text/html 104.117.200.100
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=us-west
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.117.200.100 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-117-200-100.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 88fc98437230e70daa16917c0885ee963bbb1657e1bc4770ecbca21124fdd061

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=us-west
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 00:00:33 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Dec 2021 23:04:16 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=47437
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9704
Expires: Mon, 17 Jan 2022 13:11:10 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 80F3 284 B
536 B 108ms
23ms Image
image/jpg 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=us-west
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Content-Type: image/jpg

GET
H/1.1 204
No Content sync.php
pixel-us-west.rubiconproject.com/exchange/ Frame 80F3 0
239 B 704ms
159ms Image
image/gif 8.39.36.142
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-us-west.rubiconproject.com/exchange/sync.php?p=mgid
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=us-west
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 8.39.36.142 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: b2a5c63b17f16a8024ffc6259157eaa8
Content-Type: image/gif

POST
H2 200 65397514 Show response
mc.yandex.ru/webvisor/ 43 B
73 B 531ms
52ms XHR
image/gif 2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/webvisor/65397514?wmode=0&wv-part=1&wv-hit=400475593&page-url=https%3A%2F%2Fsubterfugue.org%2F&rn=494111784&wv-type=3&browser-info=bt%3A1%3Agdpr%3A14%3Aet%3A1642377634%3Aw%3A1600x1200%3Av%3A730%3Az%3A0%3Ai%3A20220117000034%3Au%3A1642377630608242204%3Avf%3A3u9fu6axod71lkz4p33%3Awe%3A1%3Ast%3A1642377634&t=gdpr(14)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://subterfugue.org/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:34 GMT
last-modified: Mon, 17-Jan-2022 00:00:34 GMT
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: https://subterfugue.org
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Mon, 17-Jan-2022 00:00:34 GMT

POST
H2 200 65397514 Show response
mc.yandex.ru/webvisor/ 43 B
145 B 75ms
54ms XHR
image/gif 2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/webvisor/65397514?wmode=0&wv-part=2&wv-hit=400475593&page-url=https%3A%2F%2Fsubterfugue.org%2F&rn=592368269&wv-type=3&browser-info=bt%3A1%3Agdpr%3A14%3Aet%3A1642377634%3Aw%3A1600x1200%3Av%3A730%3Az%3A0%3Ai%3A20220117000034%3Au%3A1642377630608242204%3Avf%3A3u9fu6axod71lkz4p33%3Awe%3A1%3Ast%3A1642377634&t=gdpr(14)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://subterfugue.org/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:34 GMT
last-modified: Mon, 17-Jan-2022 00:00:34 GMT
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: https://subterfugue.org
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Mon, 17-Jan-2022 00:00:34 GMT

POST
H2 200 65397514 Show response
mc.yandex.ru/webvisor/ 43 B
73 B 52ms
51ms XHR
image/gif 2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/webvisor/65397514?wmode=0&wv-part=1&wv-hit=400475593&page-url=https%3A%2F%2Fsubterfugue.org%2F&rn=34180857&wv-type=3&browser-info=gdpr%3A14%3Aet%3A1642377635%3Aw%3A1600x1200%3Av%3A730%3Az%3A0%3Ai%3A20220117000034%3Au%3A1642377630608242204%3Avf%3A3u9fu6axod71lkz4p33%3Awe%3A1%3Ast%3A1642377635&t=gdpr(14)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://subterfugue.org/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:34 GMT
last-modified: Mon, 17-Jan-2022 00:00:34 GMT
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: https://subterfugue.org
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Mon, 17-Jan-2022 00:00:34 GMT

POST
H2 200 65397514 Show response
mc.yandex.ru/webvisor/ 43 B
145 B 56ms
55ms XHR
image/gif 2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/webvisor/65397514?wmode=0&wv-part=3&wv-hit=400475593&page-url=https%3A%2F%2Fsubterfugue.org%2F&rn=442526198&wv-type=3&browser-info=bt%3A1%3Agdpr%3A14%3Aet%3A1642377635%3Aw%3A1600x1200%3Av%3A730%3Az%3A0%3Ai%3A20220117000034%3Au%3A1642377630608242204%3Avf%3A3u9fu6axod71lkz4p33%3Awe%3A1%3Ast%3A1642377635&t=gdpr(14)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://subterfugue.org/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:35 GMT
last-modified: Mon, 17-Jan-2022 00:00:35 GMT
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: https://subterfugue.org
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Mon, 17-Jan-2022 00:00:35 GMT

GET
H2

200

1x1.png Show response
cdn.1vag.com/ Frame 4931
Redirect Chain

https://rtbbnr.com/get/?go=1&data=eyJpbXAiOlt7InNlY3VyZSI6MSwiZXh0Ijp7ImlkIjoxNjk1LCJzcGFjZWlkIjoxNjk1LCJpZHpvbmUiOm51bGwsImFkX3RhZ3MiOiIiLCJsYWJlbHMiOiI0LDUsNiw3LDgsOSwyNiw0Niw0Nyw1NCw1NSw2MSIsInR...
https://rtbbnr.com/banner/in/show/?mid=531202963&pid=0&site=10599&sc=FR&usage_type=DCH&subid=915166196&sid=0&cid=0&price=0&is_cpm=0&cpm=0&ecpm=0&crid=&crtid=&tcid=0&out_id=&ver=&ver_c=&refdom=subte...
https://btds.zog.link/in/912/?sid=10599&source=915166196&idzone=0&w=1&h=1&mo=&ve=&site_id=10599&utm1=&utm2=&utm3=&utm4=&ad_tags=&spot_id=10599&p=https%3A%2F%2Fsubterfugue.org%2F&tds_labels=4,5,6,7,...
https://cdn.1vag.com/1x1.png

68 B
334 B

90ms
24ms

Document
image/png

45.133.44.25
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.1vag.com/1x1.png
Requested by: Host: js.cabnnr.com
URL: https://js.cabnnr.com/banner-admanager/build.m.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.25 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9
Referer: https://subterfugue.org/

Response headers

date: Mon, 17 Jan 2022 00:00:35 GMT
content-type: image/png
content-length: 68
server: nginx/1.18.0
last-modified: Wed, 15 Apr 2020 13:30:15 GMT
etag: "5e970c67-44"
cache-control: max-age=3600
x-request-id: ca150492f89aa3524abbd9ed8cdd50d2
expires: Mon, 17 Jan 2022 01:00:35 GMT
x-proxy-cache: HIT
access-control-allow-origin: *
accept-ranges: bytes

Redirect headers

server: nginx/1.17.2
date: Mon, 17 Jan 2022 00:00:35 GMT
content-type: text/html; charset=UTF-8
content-length: 0
location: https://cdn.1vag.com/1x1.png
pragma: no-cache
vary: *
cache-control: no-cache, no-store, must-revalidate

POST
H2 200 65397514 Show response
mc.yandex.ru/webvisor/ 43 B
145 B 54ms
54ms XHR
image/gif 2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/webvisor/65397514?wmode=0&wv-part=4&wv-hit=400475593&page-url=https%3A%2F%2Fsubterfugue.org%2F&rn=633365371&wv-type=3&browser-info=bt%3A1%3Agdpr%3A14%3Aet%3A1642377637%3Aw%3A1600x1200%3Av%3A730%3Az%3A0%3Ai%3A20220117000036%3Au%3A1642377630608242204%3Avf%3A3u9fu6axod71lkz4p33%3Awe%3A1%3Ast%3A1642377637&t=gdpr(14)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://subterfugue.org/
Accept-Language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 00:00:36 GMT
last-modified: Mon, 17-Jan-2022 00:00:36 GMT
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: https://subterfugue.org
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Mon, 17-Jan-2022 00:00:36 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s7.addthis.com
URL: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

226 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

73 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
kartaplovdiv.com/	1970-01-20 00:13:01	Name: 0112c74f4b2b7355487aca0a861c3e86 Value: 0
.mgid.com/	1970-01-20 00:12:59	Name: __cf_bm Value: RfC1HQLerLNLhlDMRdSr9iCX_TSrxWQl11k.IxHFSr4-1642377629-0-AcoI+7JRhPgpd53uoQqg27Sz3KvE+UmRfkY+2d2PAmowb4mTZB/jbfvU10IkXp14sVUQXP10wLD8ChvMqstx6dQ=
.go9s.biz/	1970-01-20 00:56:09	Name: uuid Value: cd6bc892-b72f-44b7-955f-b1e0b55167d4
subterfugue.org/	1970-01-20 09:43:12	Name: __atuvc Value: 1%7C3
subterfugue.org/	1970-01-20 00:12:59	Name: __atuvs Value: 61e4b19de8b280a8000
.yadro.ru/	1970-01-20 08:58:22	Name: FTID Value: 1XvB6k1FwKuF1XvB6k002CTQ
.yadro.ru/	1970-01-20 08:58:22	Name: VID Value: 1FpEJf34BJeF1XvB6k002CWX
.addthis.com/	1970-01-20 09:43:12	Name: uvc Value: 1%7C3
.subterfugue.org/	1970-01-20 08:58:33	Name: _ym_uid Value: 1642377630608242204
.subterfugue.org/	1970-01-20 08:58:33	Name: _ym_d Value: 1642377630
.yandex.ru/	1970-01-20 08:58:33	Name: yandexuid Value: 4610151661642377630
.yandex.ru/	1970-01-20 08:58:33	Name: yuidss Value: 4610151661642377630
mc.yandex.ru/	1969-12-31 23:59:59	Name: yabs-sid Value: 399886741642377630
.yandex.ru/	1970-01-23 15:48:57	Name: i Value: N56i654EBiadnLgyIecSsxxm47TJ6Ao/hV9GI6DjfVFkimtnFOYnXXZiPTl62VMIUBBMshpBeqvmRVvMjLRaWLEiomM=
.yandex.ru/	1970-01-20 08:58:33	Name: ymex Value: 1673913630.yrts.1642377630#1673913630.yrtsi.1642377630
.addthis.com/	1970-01-20 09:43:12	Name: loc Value: MDAwMDBFVUZSMDAyMzA3MTgzMjA1OTAwMDBDSA==
.subterfugue.org/	1970-01-20 08:58:33	Name: didomi_token Value: eyJ1c2VyX2lkIjoiMTdlNjU1NWQtMDIxNC02NDIxLWIwY2MtMTJmZmM1M2Q2NzAyIiwiY3JlYXRlZCI6IjIwMjItMDEtMTdUMDA6MDA6MzAuNDM1WiIsInVwZGF0ZWQiOiIyMDIyLTAxLTE3VDAwOjAwOjMwLjQzNVoiLCJ2ZW5kb3JzIjp7ImVuYWJsZWQiOlsiZ29vZ2xlIl19LCJ2ZW5kb3JzX2xpIjp7ImVuYWJsZWQiOlsiZ29vZ2xlIl19LCJ2ZXJzaW9uIjoyfQ==
.subterfugue.org/	1970-01-20 08:58:33	Name: euconsent-v2 Value: CPS7vAwPS7vAwAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA
.subterfugue.org/	1970-01-20 00:14:09	Name: _ym_isad Value: 2
.subterfugue.org/	1970-01-20 00:12:59	Name: _ym_visorc Value: w
.tradedoubler.com/	1970-01-20 08:58:33	Name: BT Value: 1z11zzs9zu0Co2zctGCnqhzzJx1z9yctGCnqh
.tradedoubler.com/	1970-01-20 08:58:33	Name: UI Value: 1z11zzs9zYbVEez1U1oyLc10
.casalemedia.com/	1970-01-20 02:22:33	Name: CMPS Value: 1212
.casalemedia.com/	1970-01-20 08:58:33	Name: CMID Value: YeSxnsgJnEB3749r8NiCxQAA
.adnxs.com/	1970-01-20 02:22:33	Name: anj Value: dTM7k!M41.D>6NRF']wIg2GVNk`B'0!]tbPl1M>e)ZlrFUfJ+tGXxoyYR>Xn<`zS=GSFK]c2(CQ@fZn[80)iTT[w]bpRzqF1`b_Gl*/8im
.casalemedia.com/	1970-01-20 02:22:33	Name: CMPRO Value: 1199
.adnxs.com/	1970-01-20 02:22:33	Name: uuid2 Value: 6683004576060904216
.doubleclick.net/	1970-01-20 09:34:33	Name: IDE Value: AHWqTUnD3IjYD4qwpTcrn2qRM2eNPz2BVYUHywTaUFwiw6D75xPBMvwlaeS3sMYZvkw
.subterfugue.org/	1970-01-20 09:34:33	Name: __gads Value: ID=aaa912183f31b3bd:T=1642377629:S=ALNI_MawE4JnOcex7gtXlFRFmhZ9_fPRlQ
.casalemedia.com/	1970-01-20 00:14:24	Name: CMST Value: YeSxnmHksZ8A
.casalemedia.com/	1970-01-20 08:58:33	Name: CMRUM3 Value: 2d61e4b19f2760CAESEGRuKmIPm02e_9zH1M2HluI
.openx.net/	1970-01-20 08:58:33	Name: i Value: 791a5fd7-2585-4a3b-871f-4cabd2329539\|1642377631
.tradedoubler.com/	1970-01-20 08:58:33	Name: PI Value: 1z11z1zs9z1KGnEGzDu2ly1y24Kq8y1eGbyyyB90by1Y6Ny2HVm10yyy
.advertising.com/	1970-01-20 09:00:00	Name: APID Value: UP7ca79f54-7728-11ec-97b8-061e8df12308
.spotxchange.com/	1970-01-20 08:58:37	Name: audience Value: 7cac4029-7728-11ec-a33a-1be234f70106
.yahoo.com/	1970-01-20 08:58:55	Name: A3 Value: d=AQABBJ-x5GECEGgBpJHi0gw_Q8aXZ-lyepwFEgEBAQED5mHuYQAAAAAA_eMAAA&S=AQAAAndjZp66WEaw6n92MJQqQz8
.smartadserver.com/	1970-01-20 09:43:12	Name: pid Value: 2761247471444811859
.smartadserver.com/	1970-01-20 09:43:12	Name: TestIfCookieP Value: ok
ads.stickyadstv.com/	1970-01-20 00:56:09	Name: UID Value: a75bcc8517f4ab30593d248e656ea43
ads.stickyadstv.com/	1970-01-20 01:39:21	Name: uid-bp-159 Value: CAESEAaQpKeidAB0K9h5_d2olsg
ads.stickyadstv.com/	1969-12-31 23:59:59	Name: sessionId Value: 50cfbe4639c2c2c13e33faefed9c2b
.teads.tv/	1970-01-20 08:57:07	Name: tt_viewer Value: f923dbe9-b913-43bd-88da-1109a74f9428
.smartadserver.com/	1970-01-20 09:43:12	Name: csync Value: 76:CAESEGG4SWtgRFYGpNxnBkYVsho
.analytics.yahoo.com/	1970-01-20 09:00:00	Name: IDSYNC Value: "18yl~22pb:1762~22pb"
.yahoo.com/	1970-01-20 00:34:33	Name: APID Value: UP7ca79f54-7728-11ec-97b8-061e8df12308
.yahoo.com/	1970-01-20 00:14:24	Name: APIDTS Value: 1642377631
.doubleclick.net/	1970-01-20 00:13:01	Name: DSID Value: NO_DATA
.mgid.com/	1970-01-25 20:31:23	Name: muidn Value: m0gxR0SLV10g
servicer.mgid.com/	1970-01-20 00:12:58	Name: __mglb Value: ed02bb11b748a9279413c1eb8e47c448
subterfugue.org/	1969-12-31 23:59:59	Name: MarketGidStorage Value: %7B%220%22%3A%7B%7D%2C%22C1110058%22%3A%7B%22page%22%3A1%2C%22time%22%3A1642377633326%7D%2C%22C1038348%22%3A%7B%22page%22%3A1%2C%22time%22%3A1642377633364%7D%7D
.creativecdn.com/	1970-01-20 08:58:33	Name: u Value: WumIru5KttjS00pFDF24
.creativecdn.com/	1970-01-20 08:58:33	Name: ts Value: 1642377633
.e-volution.ai/	1970-01-20 00:33:07	Name: v_usr Value: 2ce712ef-842d-4422-89ed-deaf26185e1a
.zeotap.com/	1970-01-20 08:58:33	Name: zc Value: 872fe216-cc5b-46b3-7b6a-bfcc020ebcb5
.bidswitch.net/	1970-01-20 08:58:33	Name: c Value: 1642377633
.bidswitch.net/	1970-01-20 08:58:33	Name: tuuid_lu Value: 1642377633
.bidswitch.net/	1970-01-20 08:58:33	Name: tuuid Value: aed6b269-6563-498a-9e40-2c9b6d1c5ed9
.360yield.com/	1970-01-20 02:22:33	Name: tuuid Value: 6d63c51f-f6cb-4c24-9ed2-0e73ac5bf0c6
.360yield.com/	1970-01-20 02:22:33	Name: tuuid_lu Value: 1642377633
.adsrvr.org/	1970-01-20 08:58:33	Name: TDID Value: 539ec31f-aef6-4c67-b64a-cb8f0e96b7db
.lentainform.com/	1970-01-25 20:31:23	Name: muidn Value: m0gxR0SLV10g
.adsrvr.org/	1970-01-20 08:58:33	Name: TDCPM Value: CAEYBSABKAIyCwj6j8HT49WsOhAFOAE.
.idealmedia.io/	1970-01-25 20:31:23	Name: muidn Value: m0gxR0SLV10g
.volvelle.tech/	1970-01-20 08:58:33	Name: ouuid Value: d5f3cb78-cc93-4bec-b947-398c054f77b2
.volvelle.tech/	1970-01-20 08:58:33	Name: c Value: 1642377633
.volvelle.tech/	1970-01-20 08:58:33	Name: ouuid_lu Value: 1642377633
.mfadsrvr.com/	1970-01-20 17:44:09	Name: tuuid Value: af9ee8c1-6bcd-4a84-9731-21cf8717b181
.mfadsrvr.com/	1970-01-20 17:44:09	Name: c Value: 1642377634
.mfadsrvr.com/	1970-01-20 17:44:09	Name: tuuid_lu Value: 1642377634
.adtelligent.com/	1970-01-20 01:42:14	Name: vmuid Value: bd5997dcc7895545
.mfadsrvr.com/	1970-01-20 17:44:09	Name: ssh Value: !mgid,1642377634
cm.mgid.com/	1970-01-20 00:56:09	Name: mg_sync Value: {"265689":1642377633,"287839":1642377634,"341189":1642377633,"363887":1642377633,"371158":1642377633,"433145":1642377634,"433146":1642377633,"516418":1642377633,"549534":1642377633,"617666":1642377634}
btds.zog.link/	1970-01-20 00:14:24	Name: 912.0 Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

17052e5944.1691ba9d92.com
a.volvelle.tech
ad.360yield.com
ads.stickyadstv.com
ads.yahoo.com
adservice.google.com
adservice.google.fr
ajax.googleapis.com
btds.zog.link
c.mgid.com
cdn.1vag.com
cdn.jsdelivr.net
cdn.mgid.com
cdn.zx-adnet.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
cm.idealmedia.io
cm.lentainform.com
cm.mgid.com
counter.yadro.ru
creativecdn.com
d9dec64fcf189365c7b266c1b50e9cf2.safeframe.googlesyndication.com
dsum-sec.casalemedia.com
eus.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
get.optad360.io
go9s.biz
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
impes.tradedoubler.com
js.cabnnr.com
js.natsdk.com
js.wpadmngr.com
js.wpushsdk.com
jsc.mgid.com
kartaplovdiv.com
m.addthis.com
match.adsrvr.org
mc.yandex.ru
mwzeom.zeotap.com
na.nawpush.com
onetag-sys.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel-us-west.rubiconproject.com
pixel.advertising.com
pixel.rubiconproject.com
rtb-csync.smartadserver.com
rtb-usw.mfadsrvr.com
rtbbnr.com
s-img.mgid.com
s.adtelligent.com
s0.2mdn.net
s7.addthis.com
secure-assets.rubiconproject.com
securepubads.g.doubleclick.net
servicer.mgid.com
ssbsync.smartadserver.com
subterfugue.org
sync.adtelligent.com
sync.e-volution.ai
sync.search.spotxchange.com
sync.teads.tv
token.rubiconproject.com
tpc.googlesyndication.com
ups.analytics.yahoo.com
us-u.openx.net
v1.addthisedge.com
vht.tradedoubler.com
www.google.com
www.googletagservices.com
www.gstatic.com
x.bidswitch.net
z.moatads.com
s7.addthis.com
104.111.242.245
104.117.200.100
104.16.199.73
104.19.135.78
104.19.136.78
104.19.217.61
104.75.88.126
109.206.161.21
142.250.186.130
142.250.186.66
151.101.1.195
18.184.241.76
18.185.129.183
185.184.8.65
185.86.139.103
185.86.139.89
185.94.180.125
188.166.135.13
2.18.234.21
2.18.234.233
2.18.235.40
216.58.212.162
23.37.42.132
2600:9000:206f:8e00:11:a4de:2580:93a1
2606:4700:10::6816:1957
2606:4700:3035::6815:25c2
2606:4700:3036::ac43:8f96
2606:4700::6810:135e
2606:4700::6810:5514
2a00:1288:80:800::7000
2a00:1450:4001:801::2006
2a00:1450:4001:803::2003
2a00:1450:4001:808::2003
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2001
2a00:1450:4001:811::200a
2a00:1450:4001:813::2002
2a00:1450:4001:813::2004
2a00:1450:4001:828::2002
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::2001
2a01:4f8:252:564d::2
2a02:128:7:4715::2
2a02:6b8::1:119
2a0c:5c81:5139::2
3.126.56.137
3.251.21.8
35.186.231.97
35.210.178.101
35.212.212.222
35.244.159.8
37.252.172.45
45.133.44.25
51.89.9.251
52.223.40.198
62.149.0.72
65.9.58.6
69.173.144.138
69.173.144.165
8.39.36.142
88.212.201.204
001acbb15d9c69510c0817e6dde361bff098406fad182ab3c367f86ff3da8343
00ce4bc9ba9c11806156e7807aae588d2381653a2aedff75c6f731eddf222c57
00fefc883435167121ae6de1353b013a327988eeff351dde6f1f4b3f2a6b8ff6
01ebeb3fcdc269ef402f29f9fba025d3266fcd5c54ae7bca44aaa7c2cf738d93
03cc9a5f2e11a2e671db64b20014c83d383ffba8880eafce0416f63844103ed6
04149c43558d59b2f0f2cc3f679979b915401ca5c94e833479ca9ea754db0b89
043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da
04d5b64074508ee4686eb133c1383ddf34ad0e881ea724c752a1403bd94aa36b
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
053e6fc6fdaefafe22674e38fdfbab47c68816d36d22f108ebcf398d85f4b80f
06497b51a0447daa94b5232d51e7d52989bc3c15baaab474373b7908d3b587cb
0678ce624028582f1afe0bd9f4b10b5711a70a1c9a0b5892e6adf805d035ae39
06c7eb7d2b0fa0dd095a4f24246053d5585bca68a30dfd720f0d400b4d7f76f0
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c93d33a708948e8d7961af7b8577264f4516737ac56425ca4c6e222de60e269
0f9353a29d11cd20f5209ac71733aea6bf320c2402975770ab6a2142460d7ff0
10b362945d3b5db70b6bd7f958cc91b4f01eec543decb1b60a06a808fcf93057
11e9c6e92ac0b2e97cd8c8e797104054a3a48cf6c2776d1940b0da4afb09893b
1207631b5f539be3e5da265efeefd84366f57dfe8a49997ad0ea937fbce5bdb7
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
13e7b076410ea419238acae6a0750405b8107b8625fe1ac1521c8293606d6ce9
144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8
14f8ba90ae55f120df9ad242a6dcb942e7e10215cf98e146b14b749b0f397bb8
1615c2e3d17908a83ce2bb47f12ba97cb9d497a8cd444cd1ddd8c33f9dedb233
169debe2e8bfd45adfcf9f86f40fde1f663151ecfb3ef642635514b9bc4ee339
16e04bdf6c116d4ad9220245c02b90483beaee2275b489e27d687f3b519d382e
17d23f4a23d308c999d1f507b638383779066009cf052949690fe7a52a88bf7c
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
19314521548989105e51494ca91d24d19804a40695334246ad3b73f241abc965
199797e420dd8f79de2ef71e8cb58b69763c33119777e8bf93f5c7cae5a96965
1ba1d6d86d57086cd8f44e0fafc5e7b3aa5999ff09773e1c8e024267706f425a
2039446f8956518da2c2d70116d18c92fac3b04110942de074748aa4041067fb
238cfc53a4a082194de298645f76342d3d7450a3675e8962aab983d6a1c1073c
25409163c38f98e2f0e6fb77d54ed55cf85d063a57adc62f69d84e1d60fab757
26db92df9c260b7429e23c55870bfb165bb3c710587cfeb2e30c426d47c03e0e
27229fa6f0e812f79a505216bc3401de3c4f59f1053887814485109f9da52f85
2756cd8e40d9a4f9bfc7cc8cf917f4ae1edbc3612d5f88167587cf6e2332101b
28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9
2a448d3034187b2f6296329966fb62876b351dc9859db127a8cc3968c9d81f3a
2d03f5a4be41744fc36104d13b1b443e7c4331365df7ac9a7b74eb632ce23256
2d0744b54be7eab148245653f8fad2e4a0e8875b886bcacbb2c70741872eda55
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e4dc0d5f0fdd5bf4ffd54f1db0bd1d49b0f1c8ba2db5c4570ffc148602ef577
2ebcbb2299bdcd27f16421a0ee7c77f7692265e8dbf6d9f02662b051beed25c6
2f499c632d806f66b96dda6cbd4cac0363d331885476a8ac1d9e8ac60954d720
3135160ee3b34e2d1e58bf80944a1ed2cef3f073528ea98f11916a397b4c6ac9
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
365c29cf3c1d163c2ab9d7538cb20595022865e1fbcbbf483aec60100cd58f48
388b3987d0561195b56b5f7dad2a7e8c97e618e5d6a9aec4444dbd0c9edbb108
3a55fa09e10d43490b687a0944df9ab637f236a5c35c86f9649e46f09c35c1cd
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3f24ccf2549c43ae12ff95013908bf58a923c5cb6d58bdd2c7535e108c638271
3fab1a185dee2b44c2308af821ff07b21d83f300afa2266b85d915707776a4b5
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
4055b6e9d938e55d9677ed223d8431e1170f8e2f54c94041d31cb176b4f555d9
40f94a2692115bd6079b150ab723a47eebea10c138fd329008b8c53cb9b8718d
425b48211e0ebe795b6ead9ec2f1bcd9e04e9930a7dd30e08cdb2fef0bcb834c
426c774eb86397fe759d99340b242ea3974416632d24b66de3c74aeea458f50a
4419664f9f206c7d60c4561e6639aea9c37af465a2d03186c9fd924a344180bb
45279f89218b0b6f63df416f26b222174579f9af27c10562cbf1c7891092fc73
46a9e8e4ce1b82aba880255e13b95995b2f715c92660c4afddf51ec3f5216d5a
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e4723bb2b6aeaef0c3ae37ff9aff3e908fc8e91fa8a84166eb1590d478b6936
4ecde2d2133c88aed7c545af11fc8fb7e8196c95a855dc8078fdb9a73864e1ec
4fe8af60f27d59c74d4f5455ea19ce2ae3beeae393256074a1243c5250c0ae00
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
51702aa11105f27bc4d6cb3a70224cf3bdb28bed3f656de6e79f068fe9b1e2c1
5387523cc6450cf70641cf6713be4823a61337a123e9419ec40370c575dfc97e
53b4896c94b0a893242ec78d96a48884e343e5a1feaf547af28c3691326bbe67
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba
59224296096d4e4ed92815a296ddbbacb1f48a709693c52aa7f10f6ccbc1a746
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5c54ada4c1fe76299eab98a7317e0fce4db13eef0964e6df4b56c505c6b894e7
5e784374584414fe75e14ef1f94eb3065994ed88e22ddcacf19ed375313f8a65
605877ca3b26126b85ef03a88833e291b0ffcda21d0405bef47797585c561ad9
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
6182a51197155267dead5c37ebab5a7aaadc8e84fe09eda5e1f57318996683a6
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
62e66035db438fc345c8512f2421d5a45f8e322f171e6d30be145f5d09ef057b
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
642fda7f69c324f7d196e62c474b7bcb45d9e6b3084f48cc829fe42f57568f38
669ae9613c508815efd2d0133211d667b4d7dbc678062ce270065d1ef05c1734
677e4f1a1159d87ad5704ac1521a0500c32e5af3c5750a5e2f24a5a7ff584271
68731aa017ecb42e44c079c3e31b03813bbaf7e9630c1f2a5c01e8e6f07bfa20
68c740e3aa224cedc70e150dd08ab731789bd29a7f0bdf595ed06da2056b74ca
6903f47ca7d4c007a6e3d63831958fd8eed2fd7104da065023a3949a0df31fd5
6ac690961a43f46b8d59277c1f6e182c8ca1e4dfe9c20122b3e4c11e4d9d64a9
6b369487053a4e2536ca674aa24991d9a9cffeffbd4171a4d9f7d4bca8e01aa7
6c1927405979dc7fdd8b64e3cd57c476bad4d032bfe38d31c6053e3a1afde031
6df2dda5e0900918c05566608fb8dd2b1919268c67b72f338c85baa28b0b1cb3
6e6e3228dc18ebca7170c145cde9ef9c030a59d3f69a93fa3be896e37b5fb1c4
6fb4217048f333e23e0fd0ba2ab05e05fd7500f86a5a80a7cf04a2f94b257bec
7109518959a6958168f639860050324f4f063fd1697f32677cf9d0180ab02453
730d1a9f03f2d5088ddc8b00bf3da8fc2bf3112b229a227b5eaa6d9b3410d6c2
73a6ba10b8b15eaf8d951731b6560ec798bbd8144f2434628f17924c14c79505
741932350156677164b36a1506347cfd558bc502310bd1d50e246d454c4c1131
77119836d65555901ae15fd4b0ba7fcfa661a02fbcbe7112614538d4ab9b056f
7769b5aa853474681fcbdae789a9f87890d2a7b890a607a04a52af3e2e1f8f90
77af123eccd522ffd300351bc7a536ab646bf129d4a7871268c2e5f99f4515b7
7992a4430843ef8b4bbae534358be3193aa1ae9c78f273e8e8a70b6af1244ac5
7a0ddf19daf579bd555f452419df573625463c5a1f974739cf226edcd1b8632c
7a3c4c7a374f4306d2bae677e251655803f5583deddb90dfc0daaa009c9b5263
7ab854cc22d028b4cdbe236179c0b0908b7722063c816444a3837ba7a1b8af8b
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
7cb23a8c81d8e04f278b4ebbcc8c169c2f602398e4fb0f336dbf71e4752470c8
7cce378f390402bc0bbecf88ad6a38b490970f5167f1a5412a35447c5c7cdac3
7cee78edf15d9bc8a2de584de60623e3ba6972abd5751b6ba1ed2274085790af
7e06ab26d8a49c264af0a3561a8f3a8a851b14d71f32bafa2d50c97b15bea9fe
7fa0d5c3f538c76f878e012ac390597faecaabfe6fb9d459b919258e76c5df8e
805b47504861e3c404cabf1cb8f084a497595842cf27262911d4be25777c5324
8169972c106cb4795c727e8377df60f69b7aa056b4a5c0af24575cf4c67e279e
83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79
83b0697bfdd22e34bceaab565132404bdf52804164c4319c63d550696fccce20
845c43373348d5a606b741dfaface41a9b16d2edfba7cc8523e23e6832a60f85
869485db860da1770cce5102fd5dccbd06b38045c8a39ec20fc9efb1e0aeb38d
88fc98437230e70daa16917c0885ee963bbb1657e1bc4770ecbca21124fdd061
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
96abf03b0943cfabe3d8dbb501fe427cd759c4b4740416e1352a3b07136660a7
96b4e47816e94ae89a84538106ce3aada5858ba9660e3aa04384724f9f7624d4
984fe06711f530b7c8834f049dabbcf659c8b1f224ec69ac8019a26b15abb941
999b09170824782ecd49f750470e7966f9cf6c5802178f308bf5f73435b5f079
9b9e47902eb881075fd12fb88ebdee21f2bc08bd20473c077962d8a5f7f06cd1
9c5584b954b1c466144f8f1d26cfe934cc7e1210f7ea0740ec68580a15274ef5
9fd5a5d610b53c738139de0f61895e4b12fdfa96ad752bac65d41aa3755e6d4c
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a00d4579f77231643a0621c0b078d0b3191508ebd318e9e89d13f8aecbd3e9b0
a02681ae1cc21a54f99afb9cf43cf89c42ab91bc9381aa64e96ffb4cf46e9f80
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a087741d89c871c74a686dba096a819e5f4335e8012b906d438c3342654e3c02
a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73
a46ad61348a625a356a7a336415313b2887644f5ea3f5f0d41ea4fffd15cb86d
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a56587059a91f758aeedd61405ed8dc6b28a925aeedb000a802fc6e42d01d4af
a56996bb81bff7f9058ea049e00898181cc4a545b67cc3dcdf3778ecea325af1
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a9ba3383bb4ec1ee471bc2e81d22e428d54eb303fe13041d41e5265cddaa551c
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
ab31dfc1634780370354066975de975ead374c78282d629cce708da49610348f
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
ab8e9a790b32ee1d121b22e664721eed938e586faf7c9b5bfd7d8a545b463318
abcbe0423061bbf5caca8b070eb57c5ea831fde8cca4af206f8b48938142b4e1
abee342fe45437a1537b3d4a0bc39f2621512948480e4b5289a235d464755051
ac5cf388ff063a63147988b5556cc65c0d76bd07b3d93ed887e80a859a12f98b
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
acd6327ad08e4e3512a73e03cbf398d1367b04b4b6446454454a575a4920d5ab
ae5ae7cbba65c7c58755e64da5be8dfa71bc322fa3fe465176d4dee33098ea6e
af3f2fbeab751413a28b53708390fe82ef2785fdb9ac4e2b85fba21c388c505d
b07b4e0d02a41172ffb5b11e33f997583021a5fe04d18ffb2c5262ad4555dd74
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3a969a673c13d6979bd4e322e4aaa227216cef9fae37ffc31b7721cc94e2a0a
b3ac4d3608ec040d97d6d6eb8e865ef8f85c4c2f7aa4237340b617dbac6fb427
b42bcfbcfc518df929d97de684b7875247a33a19c07f4173420016598f186700
b46b0112a83a3a5f24762558e66428a0f3b4394c5eb609137ec197c7e131945e
b5f60538d6d5f9fd8babafe9ca3b562018a62b9056636f21593f08fda8a2619a
b6e0d219c4feb530d46bdb0ddcfd48d64eae4d93af724f4dc7bb0bdc72e616b3
b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477
b8a14b3c987a84d8a50e27a96a8d6df8d38280f156aef61b8c9c3dcdb08a1f59
b919007160bb7daeba86584f0657e7d6e97f6c41ae9700d275210e7679673a00
bc17aea396be654f0f3aba069b42be33778af34f6f3ceb88b8de800b89dae15c
bc3b8e3e076ed12d7d62e1b9e226d323ee196918f7051a89d80f81a3cf241498
bd9eb6fbeabbacf9fd97ef8d5a670ecff3484a316f989ab8cabe226d39acb239
bec4ade172f991fd6a0d3c2004729964a6015e2aea0ce28de642008bb3d3daa7
c2474ee60c4d7f1184b36ba843b776d3093bb97f48c159ba4642e9d1815104d8
c3954905eae16fa888a3e7e785d0cb8a0d0171bfbea2221157e5425596538fed
c47f2a8f938666ae3105c52ff904c711f261db3845d46f41bc0e6d6cfd388528
c5af0d98409f31b38267d810da56cff8835e0b6aa97e9c8e2bbf5449b6a5cc51
c66f9bb4cea975c97e5f75d3a277dd0809f6a1a96fccfd43dceb24db645a9ee8
c68b5d235bcb13e7170f861c133612c882e34d9e9d5255991cc6829a40a92c62
c6997dd75309ff66fe274e6e7af455dd7e1d6088f040118023a0b17b54fb2013
c883dec0dc4b34cb4c0d23fb1e1496a1dcf3c46ca1d55a6ccc3f67b3a5d7b41b
ca66ce214f061f6bef74fe6efa1ece7f0a35eedae738ebbc3fd1b4dbffad00be
cb9bb3bbff7ecbe21b633b79cd9bb41bd0dc3e533891f1660338ed49dfdb4924
cbd906cca2bdc0bd62d5aef5b4a78087e13cd026a6aa322013b38d968487a561
cc099cfa43207002863e1913578a1a914ab94b469d5f52dfbfe9c48cdbe49a6a
cd2002cdf21b9a1c068b3b6f24ece6d21d00ecdf3b14de9b37372425e8045e90
d05430dc588e8e1d3ab13b49bf63f499498e971bcb1ca685733c2bf1f4d1f207
d320756a48563cd43fab9001351f72d3edd7241e9a61135acd6806eb24a63f3a
d49e447ea7189c83a39404fab2b4c9323ecf38b36c0b78996376f2c5d9125b0c
d597a9e8d2186ef677813921d7c5b4abe7b6f1d8a0ae3086200bddbc396370af
d715a30a66e548ffb68a8eddc5ca4c320d13effba6fc5500423275c11d72ce2e
d969417ae1567efbf2991eea9343d4f81b7eafa8e4e77cf1b1f32bee17f0fa10
dbf2f498cf22f59ce80e398562af1e02080fa09d5b28d33be583da4ee3c32f42
e0b5a4c5a222720eb46c0effe46b2ed52f24f427d99227445011150b4b4b70db
e106b971637d55f5cc298e92213ccd6241bd273cb95626a7265e6396e487614e
e263183c6224121c90f2227f04d28e162c811aa9ddba70db42776c5d50244cad
e37d902789e65199ec0e64d8b1544052056c1f1d8a8f398778d010364febd4f0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e608e935f2a110d32f390f88ffe17e2a40bb0dc6b8509b9a0bade5bb0117697c
e87e542e34fc3af7847f53ae5c258f82ff2d8739646ed8d249c9a54ede9f7128
eeef8426fc4212100085a35f3a90cea98bfd3064c77f2700354a0d8c058c1b41
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0b09631fbb338d03727ac8d7bf6b141702c2dfc5179c3acf78fcf27bc4ab31e
f6560dc78e511a529a60724c2d2268db1e410e0d4d54d317dfacb3e1741f33f0
f6bd3a2d62fb9cfba2ae6a21baaec2882fb4a0821f14297318171151d8e72818
f813c405f7ba4f60e0af2d6265bcf5fcb6b3c29789d4673afe8ae1483e913272
faf91dcea1840cedca0a76b4471e70915f475e9f968d059ad29aa202ead75736
fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e
fd11fa353cc6a8560f4c35e67c6fb8a3a4061ed3de4309cdf83fca65f8319bb4
fd72df046ba6a7f3d65b48d4d4b29000e1db17c84b1105cd8ab4c496686b99c2
fee21c28692a8e704d88300e60bb27015e87859f69de8d215248ee6a0c60116b
ff4b703a37dc11dbca28199ebaa29bfd85fb3793138fdc9bb2b952954d098b68

subterfugue.org Open in urlscan Pro 2606:4700:3035::6815:25c2 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

473 Requests

93 %HTTPS

36 %IPv6

54 Domains

76 Subdomains

45 IPs

11 Countries

7653 kBTransfer

14501 kBSize

73 Cookies

12 Outgoing links

Page URL History

Redirected requests

473 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

subterfugue.org Open in urlscan Pro
2606:4700:3035::6815:25c2 Public Scan

Screenshot
Live screenshot

Full Image

473
Requests

93 %
HTTPS

36 %
IPv6

54
Domains

76
Subdomains

45
IPs

11
Countries

7653 kB
Transfer

14501 kB
Size

73
Cookies

473 HTTP transactions
10 data transactions