coupons.service-r.work Open in urlscan Pro
183.90.228.46 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://lisinopril125.com/
Effective URL:
https://coupons.service-r.work/
Submission: On March 18 via api (March 18th 2024, 7:22:09 pm UTC) from US — Scanned from US

Summary HTTP 106 Redirects Behaviour Indicators

Summary

This website contacted 16 IPs in 3 countries across 15 domains to perform 106 HTTP transactions. The main IP is 183.90.228.46, located in Japan and belongs to XSERVER Xserver Inc., JP. The main domain is coupons.service-r.work.
TLS certificate: Issued by R3 on February 17th 2024. Valid for: 3 months.

This is the only time coupons.service-r.work was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 13	183.90.228.46 183.90.228.46	131965 (XSERVER X...) (XSERVER Xserver Inc.)
26	2607:f8b0:400... 2607:f8b0:4006:817::2002	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42::485 2a04:4e42::485	54113 (FASTLY) (FASTLY)
6	2607:f8b0:400... 2607:f8b0:4006:80d::200a	15169 (GOOGLE) (GOOGLE)
9	2607:f8b0:400... 2607:f8b0:4006:80d::2003	15169 (GOOGLE) (GOOGLE)
2 9	2607:f8b0:400... 2607:f8b0:4006:823::2002	15169 (GOOGLE) (GOOGLE)
25	2607:f8b0:400... 2607:f8b0:4006:80e::2001	15169 (GOOGLE) (GOOGLE)
5	2607:f8b0:400... 2607:f8b0:4006:80b::2003	15169 (GOOGLE) (GOOGLE)
4	142.250.72.98 142.250.72.98	15169 (GOOGLE) (GOOGLE)
3 6	142.251.35.162 142.251.35.162	15169 (GOOGLE) (GOOGLE)
2 4	104.18.36.155 104.18.36.155	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 4	68.67.160.117 68.67.160.117	29990 (ASN-APPNEX) (ASN-APPNEX)
4	2607:f8b0:400... 2607:f8b0:4006:809::2006	15169 (GOOGLE) (GOOGLE)
1	2600:1400:900... 2600:1400:9000::6875:b62a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2607:f8b0:400... 2607:f8b0:4006:80e::2004	() ()
106	16

13 183.90.228.46 (Japan) 2 redirects

ASN131965 (XSERVER Xserver Inc., JP)
PTR: sv1145.xserver.jp

lisinopril125.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
nttexpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
coupons.service-r.work	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
richlucky.xsrv.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 2607:f8b0:4006:817::2002 (United States)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4006:80d::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2607:f8b0:4006:80d::2003 (United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2607:f8b0:4006:823::2002 (United States) 2 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 2607:f8b0:4006:80e::2001 (United States)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:80b::2003 (United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.72.98 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s32-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.251.35.162 (Queens, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s78-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.18.36.155 (None, ) 2 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 68.67.160.117 (New York, United States) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:809::2006 (United States)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1400:9000::6875:b62a (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)

code.createjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80e::2004 (None, )

ASN- ()

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
51	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 143 tpc.googlesyndication.com — Cisco Umbrella Rank: 204	863 KB
15	doubleclick.net 5 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 66 cm.g.doubleclick.net — Cisco Umbrella Rank: 353 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 648	190 KB
14	gstatic.com fonts.gstatic.com www.gstatic.com	230 KB
9	service-r.work coupons.service-r.work	204 KB
6	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110	64 KB
4	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 413	127 KB
4	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 371	4 KB
4	casalemedia.com 2 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 1179	3 KB
4	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 168
2	xsrv.jp richlucky.xsrv.jp	23 KB
1	google.com www.google.com	1 KB
1	createjs.com code.createjs.com — Cisco Umbrella Rank: 2323	63 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 437	2 KB
1	nttexpress.com 1 redirects nttexpress.com	97 B
1	lisinopril125.com 1 redirects lisinopril125.com	93 B
106	15

	Domain	Requested by
26	pagead2.googlesyndication.com	coupons.service-r.work pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com
25	tpc.googlesyndication.com	googleads.g.doubleclick.net coupons.service-r.work tpc.googlesyndication.com pagead2.googlesyndication.com
9	googleads.g.doubleclick.net	2 redirects pagead2.googlesyndication.com googleads.g.doubleclick.net
9	fonts.gstatic.com	fonts.googleapis.com
9	coupons.service-r.work	coupons.service-r.work
6	fonts.googleapis.com	coupons.service-r.work googleads.g.doubleclick.net
5	www.gstatic.com	googleads.g.doubleclick.net coupons.service-r.work
4	s0.2mdn.net	coupons.service-r.work s0.2mdn.net googleads.g.doubleclick.net
4	ib.adnxs.com	3 redirects googleads.g.doubleclick.net
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	cm.g.doubleclick.net	3 redirects googleads.g.doubleclick.net
4	www.googleadservices.com	coupons.service-r.work
2	googleads4.g.doubleclick.net	coupons.service-r.work
2	richlucky.xsrv.jp	coupons.service-r.work richlucky.xsrv.jp
1	www.google.com	tpc.googlesyndication.com
1	code.createjs.com	s0.2mdn.net
1	cdn.jsdelivr.net	coupons.service-r.work
1	nttexpress.com	1 redirects
1	lisinopril125.com	1 redirects
106	19

This site contains no links.

Subject Issuer	Validity	Valid
coupons.service-r.work R3	`2024-02-17` - `2024-05-17`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-09-27` - `2024-10-28`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
richlucky.xsrv.jp R3	`2024-03-03` - `2024-06-01`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
tls.adobe.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-12` - `2025-02-11`	a year	crt.sh
www.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh

This page contains 15 frames:

Primary Page: https://coupons.service-r.work/
Frame ID: 52E20778A4DDE57F313F2807B0D1576D
Requests: 28 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&adk=293675617&adf=814277786&lmt=1710690640&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fcoupons.service-r.work%2F&pra=5&wgl=1&easpi=0&asro=0&aseiel=1~2~4~6~8~9~10~11~12~13~14~15~16~17~18~19~20~21&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789723666&bpp=4&bdt=383&idt=623&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&nras=1&correlator=208935012053&frm=20&pv=2&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=648
Frame ID: DB96ED10932104902B1D6B5E83A6F09B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&h=280&slotname=3241243959&adk=3086274948&adf=4169717035&pi=t.ma~as.3241243959&w=1166&fwrn=4&fwrnh=100&lmt=1710690640&rafmt=1&format=1166x280&url=https%3A%2F%2Fcoupons.service-r.work%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789724197&bpp=2&bdt=914&idt=123&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=208935012053&frm=20&pv=1&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=185&ady=380&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=132
Frame ID: CEFCEF750945C07EEF8C95D5BC15A292
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&h=280&slotname=3241243959&adk=3333970730&adf=1475665621&pi=t.ma~as.3241243959&w=1166&fwrn=4&fwrnh=100&lmt=1710690640&rafmt=1&format=1166x280&url=https%3A%2F%2Fcoupons.service-r.work%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789724210&bpp=6&bdt=927&idt=139&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1166x280&nras=1&correlator=208935012053&frm=20&pv=1&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=185&ady=3810&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=142
Frame ID: D6625AFD6F049E9D6C772D33201795D3
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html
Frame ID: 3E9455FCD3D85E0845708286F2820222
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html
Frame ID: E27C3D3547FB3689BF6AE45E542C24E3
Requests: 18 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/baSY2O45eIFBeOgq1vPVnlASrS1AjKGi1V2DTNGFAvs.js
Frame ID: 35759CD7EFB9DD5DC43D9EC68883BF3C
Requests: 1 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Frame ID: 39FA131D1693F28B3D136169FD4E439B
Requests: 7 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/baSY2O45eIFBeOgq1vPVnlASrS1AjKGi1V2DTNGFAvs.js
Frame ID: 3CF6649311EEAFF896A171A1A93E02F9
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6WcRCYwOyiAxiVw_H4ATAB&v=APEucNVlj0giMKJ4eFn5EnBaxDs4pt7FTzOzt4Q0MeLryN_bPN3VKI9U4b_Ob-hIzzeW93X-lN5bcw83LfJWpzKdT5FSdpgPRQ
Frame ID: 024E05B28370956A6B14B779B8A5DABD
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/baSY2O45eIFBeOgq1vPVnlASrS1AjKGi1V2DTNGFAvs.js
Frame ID: F511E22719296B1415816EA1B88C8D4D
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 3E8C02929050D3DE2F4AC0C53F55B538
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/6300375155520534659/728x90/728x90.html?ev=01_250
Frame ID: E00DE17E6D11FE6604B8D6984360DFD9
Requests: 4 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: D6BE6DD0B687ADA29F55F241CDB764F3
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: FFE5B044BC4108A2F3382C6925785057
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Here are some ways to find deals and coupons:

Page URL History Show full URLs

https://lisinopril125.com/ HTTP 301
https://nttexpress.com/a4 HTTP 301
https://coupons.service-r.work/ Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

106
Requests

94 %
HTTPS

67 %
IPv6

15
Domains

19
Subdomains

16
IPs

3
Countries

1766 kB
Transfer

4563 kB
Size

16
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://lisinopril125.com/ HTTP 301
https://nttexpress.com/a4 HTTP 301
https://coupons.service-r.work/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 52

https://googleads.g.doubleclick.net/pagead/adview?ai=CnCunXJT4ZaHGJpi_998PrrOY-Aqlysu-dvW1g6GtEtmjlY-rQhABIOLVxSdgyYaAgNyjxBCgAe79prQ9yAEJqAMByAPLBKoE0wFP0LiosaOBKDnvu5HsEeeUyBkHCOihNpGqXhNmEQHa_ES_s0U0FjOG3XwS4yjNz9zgIcgcEWl07MrG2aIZcR5mf7zWQrhLd88gwQNuoRk4azezhGdK0n0U-MvR9BjdcFCnFT2bD5dpbDAQT-1fAlNSrAkYwD7IKpf0LqW-xSQcgmMTccG0dzaB4iGSTxUZTb1FNaB-QiRkpOPp_5RMB7U2StRs2soD5WOEMY7zv05kssC7hXesSqTv4Iy2DMMiRsUw6iwgTdF_0bddS-lYe9pFlvIdwAS567H0ygSIBZDcl8ROkgUECAQYAZIFBAgFGASgBi6AB-6195MYqAfZtrECqAevvrECqAfVyRuoB6a-G6gHjs4bqAeT2BuoB-6WsQKoB_6esQLYBwDyBwQQgcke0ggkCIBhEAEYHzICigI6CYBAgMCAgICgKEi9_cE6WMvux67E_oQDmgkyaHR0cHM6Ly9vY2VhbnBvaW50bWFyaW5lbGVuZGluZy5jb20vP2djbHNyYz1hdy5kcyaACgHICwHaDBEKCxDQ1Nzsm5fqxpoBEgIBA7gT5APYEw2IFAHQFQGAFwGyFxwKGggAEhRwdWItMjIzMDI2MDI2Mjc1Mzc0NxgAshgJEgLZahguIgEA&sigh=VmX_qafoxBo&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgB7FLtqhol_JYtpm_Ad9QrBMGL_tFU69x0yHGyuQTbZnlp5TvL2hGzCBtqqaHgvQAWw910NMK5eR2KN4WetsqBGDdQTisVlDPG4dt_rqhgB&template_id=484&cbvp=2&vis=1&nis=5 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xbbd57f7bb22452c10000000000000000%22,%222%22:%220xe1fa0c74310179340000000000000000%22,%223%22:%220x47f9f772b1ca27a90000000000000000%22,%224%22:%220x23d89dde001ddaf30000000000000000%22,%225%22:%220x1c3136ed3a2cb6f20000000000000000%22},%22debug_key%22:%2213265987258187172252%22,%22debug_reporting%22:true,%22destination%22:%22https://oceanpointmarinelending.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2216484253422%22],%2222%22:[%22true%22],%224%22:[%2203-18%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2214743697308329233%22}&andc=true

Request Chain 54

https://googleads.g.doubleclick.net/pagead/adview?ai=CTIy9XJT4Zc69JpbE998PityZyA3J8OewdYvq8dH8EY3ckb-XQhABIOLVxSdgyYaAgNyjxBCgAaC6_qUDyAEJqQIbgyqS2_NgPqgDAcgDywSqBNkBT9BFiilzQZoCAKzOvkV-I_kL9teHF4WAui7WI4jxVdFvDyIT42wKLIdAsvAgLxgSuVeV2nA1K8aUDmq78sOIzdpC_B_fL_jVceV7rer0wVS2hss6h09TFD0cC1cx3Jlf-YSsU9_z-EX0-ildrZhXWUe84XRBHlNCqFmFUjvQMtj0G_2xcQSPE5mpY5O9-EeddVLpFz-W55cicWwnUMxjyg_NZ_aQX0B7WYE-sNRRspi3av-mCGo5pmb2d8fWvcrwP4nAj12SkQJfWOpjA9VxyUK_aPYVMZwBm8AEoIGj1dwEiAXIvM2sTZIFBAgEGAGSBQQIBRgEoAYugAfIxYFaqAfZtrECqAevvrECqAfVyRuoB6a-G6gHjs4bqAeT2BuoB-6WsQKoB_6esQLYBwDyBwUQ6OvEAdIIJAiAYRABGB8yAooCOgmAQIDAgICAoChIvf3BOliL1seuxP6EA5oJQWh0dHBzOi8veWllaC5jb20vZW4vUHJvZHVjdC9zdGFpbmxlc3Mtc3RlZWwvc3RhaW5sZXNzLXN0ZWVsLXBsYXRlgAoByAsB2gwRCgsQoPidz8eEzbPOARICAQO4E-QD2BMN0BUBmBYBgBcBshccChoIABIUcHViLTIyMzAyNjAyNjI3NTM3NDcYALIYCRICmGkYLiIBAA&sigh=_MMY6Ivte64&uach_m=%5BUACH%5D&ase=2&cid=CAQSTwB7FLtqJ9ifXCZr8fuBW0JHJei7gurSbiOB13mf0M_FlGkIMoCebdMX2c7V-RdsMkhG3ep2fZTAtScsHRl01rD0_u7A8NxaTzgwI_vwFMUYAQ&template_id=484&cbvp=2&vis=1&nis=5 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x714b8db367a6afce0000000000000000%22,%222%22:%220xcc24ad6806cf98b00000000000000000%22,%223%22:%220x6410b367bca273fc0000000000000000%22,%224%22:%220x60646e038f1441c0000000000000000%22,%225%22:%220xfe9a8279b0f5da720000000000000000%22},%22debug_key%22:%22230507251739208975%22,%22debug_reporting%22:true,%22destination%22:%22https://yieh.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22884972832%22],%2222%22:[%22true%22],%224%22:[%2203-18%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%227226854501861701697%22}&andc=true

Request Chain 75

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELlPF6k0iBT6ukH-51-lHic&google_cver=1

Request Chain 76

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZfiUXcAoJHgAAARLAOVGLwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELlPF6k0iBT6ukH-51-lHic&google_cver=1

Request Chain 77

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEP6jwiT_P93VlnjOw2tc6LU&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEP6jwiT_P93VlnjOw2tc6LU%26google_cver%3D1

Request Chain 78

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjM1NTEwNzg3NDMyODA1Nzk4

106 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
coupons.service-r.work/
Redirect Chain

https://lisinopril125.com/
https://nttexpress.com/a4
https://coupons.service-r.work/

9 KB
3 KB

987ms
223ms

Document
text/html

183.90.228.46
XSERVER Xserver Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://coupons.service-r.work/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 183.90.228.46 , Japan, ASN131965 (XSERVER Xserver Inc., JP),
Reverse DNS: sv1145.xserver.jp
Software: nginx /
Resource Hash: 2423c8239523d9ea95af38a02180c41376baf80a1bfe8128f400726a97c41a35

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: br
content-type: text/html
date: Mon, 18 Mar 2024 19:22:03 GMT
etag: W/"25c8-613dd33eaf400"
last-modified: Sun, 17 Mar 2024 15:50:40 GMT
server: nginx
vary: Accept-Encoding

Redirect headers

content-length: 238
content-type: text/html; charset=iso-8859-1
date: Mon, 18 Mar 2024 19:22:02 GMT
location: https://coupons.service-r.work
server: nginx

GET
H2 200 styles.css
coupons.service-r.work/ 142 KB
25 KB 226ms
224ms Stylesheet
text/css 183.90.228.46
XSERVER Xserver Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://coupons.service-r.work/styles.css?20240317155040
Requested by: Host: coupons.service-r.work
URL: https://coupons.service-r.work/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 183.90.228.46 , Japan, ASN131965 (XSERVER Xserver Inc., JP),
Reverse DNS: sv1145.xserver.jp
Software: nginx /
Resource Hash: b2fe82cab3fc52b994366970d14068b398ccbb6699b496693474dea49564c18e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:03 GMT
content-encoding: br
last-modified: Sun, 18 Feb 2024 08:27:24 GMT
server: nginx
etag: W/"236e0-611a3bf1db300"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=604800
expires: Mon, 25 Mar 2024 19:22:03 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 145 KB
50 KB 271ms
136ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2230260262753747

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68adc837a8ecebdca947ea943b682a67fbfae7ea98a7d285d444e18287946c7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://coupons.service-r.work/
Origin: https://coupons.service-r.work
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:03 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50761
x-xss-protection: 0
server: cafe
etag: 8521725663214304921
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
expires: Mon, 18 Mar 2024 19:22:03 GMT

GET
H2 200 header.jpg
coupons.service-r.work/img/ 101 KB
101 KB 225ms
225ms Image
image/jpeg 183.90.228.46
XSERVER Xserver Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://coupons.service-r.work/img/header.jpg
Requested by: Host: coupons.service-r.work
URL: https://coupons.service-r.work/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 183.90.228.46 , Japan, ASN131965 (XSERVER Xserver Inc., JP),
Reverse DNS: sv1145.xserver.jp
Software: nginx /
Resource Hash: 0d3ae0cfd0aab3dd0bc61dd281e7c754fe6dc489db03516bc561438fd4d57835

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:03 GMT
last-modified: Fri, 23 Feb 2024 08:56:18 GMT
server: nginx
etag: "1946c-61208bbad5080"
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
content-length: 103532
expires: Mon, 25 Mar 2024 19:22:03 GMT

GET
H2 200 siema.min.js Show response
coupons.service-r.work/js/ 13 KB
4 KB 224ms
224ms Script
application/javascript 183.90.228.46
XSERVER Xserver Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://coupons.service-r.work/js/siema.min.js
Requested by: Host: coupons.service-r.work
URL: https://coupons.service-r.work/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 183.90.228.46 , Japan, ASN131965 (XSERVER Xserver Inc., JP),
Reverse DNS: sv1145.xserver.jp
Software: nginx /
Resource Hash: 5556151dd69cbf91629daae58b4ab847123a8ff70658d8bbc8a7b30d447829ef

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:03 GMT
content-encoding: br
last-modified: Fri, 10 Sep 2021 15:30:34 GMT
server: nginx
etag: W/"33a0-5cba5cbdf3a80"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
expires: Mon, 25 Mar 2024 19:22:03 GMT

GET
H2 200 config.js Show response
coupons.service-r.work/js/ 7 KB
2 KB 651ms
649ms Script
application/javascript 183.90.228.46
XSERVER Xserver Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://coupons.service-r.work/js/config.js
Requested by: Host: coupons.service-r.work
URL: https://coupons.service-r.work/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 183.90.228.46 , Japan, ASN131965 (XSERVER Xserver Inc., JP),
Reverse DNS: sv1145.xserver.jp
Software: nginx /
Resource Hash: ffae5b08a564118ecfe13a647ca0cffb74bac906390630d12a968329b2f004fb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:03 GMT
content-encoding: br
last-modified: Mon, 30 May 2022 14:45:24 GMT
server: nginx
etag: W/"1a93-5e03bb4c42900"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
expires: Mon, 25 Mar 2024 19:22:03 GMT

GET
H2 200 ResizeSensor.js Show response
coupons.service-r.work/js/ 12 KB
3 KB 650ms
648ms Script
application/javascript 183.90.228.46
XSERVER Xserver Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://coupons.service-r.work/js/ResizeSensor.js
Requested by: Host: coupons.service-r.work
URL: https://coupons.service-r.work/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 183.90.228.46 , Japan, ASN131965 (XSERVER Xserver Inc., JP),
Reverse DNS: sv1145.xserver.jp
Software: nginx /
Resource Hash: f63a92799f4f4f8331976aa0306b31e1af4d12b1ef2b5e2aac6d4bcfc706ed6f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:03 GMT
content-encoding: br
last-modified: Wed, 08 Sep 2021 15:24:08 GMT
server: nginx
etag: W/"3100-5cb7d792e9600"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
expires: Mon, 25 Mar 2024 19:22:03 GMT

GET
H2 200 ElementQueries.js Show response
coupons.service-r.work/js/ 20 KB
5 KB 650ms
648ms Script
application/javascript 183.90.228.46
XSERVER Xserver Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://coupons.service-r.work/js/ElementQueries.js
Requested by: Host: coupons.service-r.work
URL: https://coupons.service-r.work/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 183.90.228.46 , Japan, ASN131965 (XSERVER Xserver Inc., JP),
Reverse DNS: sv1145.xserver.jp
Software: nginx /
Resource Hash: 8eee421f2f9bdf38445ffe938ab5c0be29ef1855570c2cb871b55de50ac3521b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:03 GMT
content-encoding: br
last-modified: Wed, 08 Sep 2021 15:24:10 GMT
server: nginx
etag: W/"4ee3-5cb7d794d1a80"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
expires: Mon, 25 Mar 2024 19:22:03 GMT

GET
H2 200 lazyload.js Show response
cdn.jsdelivr.net/npm/lazyload@2.0.0-rc.2/ 6 KB
2 KB 101ms
32ms Script
application/javascript 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/lazyload@2.0.0-rc.2/lazyload.js

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

874cad10027313f3620a770d4a338369833ed5b3913f0793cb8500361b19e6ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 18 Mar 2024 19:22:03 GMT
x-content-type-options: nosniff
content-encoding: br
age: 2907527
x-jsd-version: 2.0.0-rc.2
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1734
x-served-by: cache-fra-etou8220104-FRA, cache-mia-kmia1760096-MIA
x-jsd-version-type: version
etag: W/"162a-+bHVRc9Mhd3adT/5YJ7eVp2Ssx8"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 css2
fonts.googleapis.com/ 238 B
657 B 214ms
82ms Stylesheet
text/css 2607:f8b0:4006:80d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@500&display=swap&text=0123456789-

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c8dfd584baddfa5edc68427cf9dd27bb6563aab08e3016bbd3bcd16948be78a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 18 Mar 2024 19:22:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 18 Mar 2024 19:22:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 18 Mar 2024 19:22:03 GMT

GET
H2 200 css2
fonts.googleapis.com/ 1 KB
533 B 233ms
100ms Stylesheet
text/css 2607:f8b0:4006:80d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Poppins:wght@500&display=swap

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a69df85c4cf31aa6d6eda030d8f0e9068e46da62ce6e9859c2fa37e3d983feb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 18 Mar 2024 19:22:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 18 Mar 2024 17:49:20 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 18 Mar 2024 19:22:03 GMT

GET
H2 200 css2
fonts.googleapis.com/ 225 KB
60 KB 269ms
136ms Stylesheet
text/css 2607:f8b0:4006:80d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Noto+Sans+JP:wght@400;700&display=swap

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4f703849c5746dd9d3596d0ac8efb6164669f17e468e7c619a55c5329c34a10a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 18 Mar 2024 19:22:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 18 Mar 2024 18:43:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 18 Mar 2024 19:22:03 GMT

GET
H2 200 partsstyles.css
coupons.service-r.work/css/ 252 KB
42 KB 650ms
649ms Stylesheet
text/css 183.90.228.46
XSERVER Xserver Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://coupons.service-r.work/css/partsstyles.css?20240317155040
Requested by: Host: coupons.service-r.work
URL: https://coupons.service-r.work/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 183.90.228.46 , Japan, ASN131965 (XSERVER Xserver Inc., JP),
Reverse DNS: sv1145.xserver.jp
Software: nginx /
Resource Hash: 00836ddb4344d1fb83ade04db9d05bc3ed647989f2ce3168b1706e26e1be3eda

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:03 GMT
content-encoding: br
last-modified: Sun, 17 Mar 2024 15:50:34 GMT
server: nginx
etag: W/"3ee4d-613dd338f6680"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=604800
expires: Mon, 25 Mar 2024 19:22:03 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403130201/ 405 KB
138 KB 279ms
149ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403130201/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2230260262753747

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

243c847c084bce46b9a57f7dd2740d8e47aa1fc8c315a229b1af460a5f02af61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:03 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 140956
x-xss-protection: 0
server: cafe
etag: 6335361544552648447
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Mar 2024 19:22:03 GMT

GET
H2 200 matomo.js Show response
richlucky.xsrv.jp/piwik/ 65 KB
23 KB 1595ms
448ms Script
application/javascript 183.90.228.46
XSERVER Xserver Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://richlucky.xsrv.jp/piwik/matomo.js
Requested by: Host: coupons.service-r.work
URL: https://coupons.service-r.work/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 183.90.228.46 , Japan, ASN131965 (XSERVER Xserver Inc., JP),
Reverse DNS: sv1145.xserver.jp
Software: nginx /
Resource Hash: b39abd9035f703b76dfed940898d572b9864f676eb1912a9142f0639dca6b2ce

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:05 GMT
content-encoding: br
last-modified: Fri, 08 Mar 2024 05:21:27 GMT
server: nginx
etag: W/"1042f-6131f5d1a5dde"
vary: Accept-Encoding
content-type: application/javascript

GET
DATA 200
OK truncated
/ 288 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 84b524dcafa0a51d06e6c7fb6ea0ada30fbb90a79bfb0372eea6194feb986db0

Request headers

Referer
Origin: https://coupons.service-r.work
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
H2 200 font
fonts.gstatic.com/l/ 4 KB
4 KB 228ms
63ms Font
text/html 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/l/font?kit=KFOlCnqEu92Fr1MmEU9vBgU2B_HDp7t6Tk2DOWA&skey=ee881451c540fdec&v=v30

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@500&display=swap&text=0123456789-

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

48ca88dd11efb5aac3f48e45d97a0984bbc37c63ee88e4a38c7e6c3ee21d7e41

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://coupons.service-r.work
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 03:43:41 GMT
x-content-type-options: nosniff
age: 56303
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="font.woff2"; filename*=UTF-8''font.woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3776
x-xss-protection: 0
last-modified: Thu, 22 Sep 2022 05:27:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
timing-allow-origin: *
expires: Mon, 18 Mar 2024 03:43:41 GMT

GET
H2 200 ecommerce-3082813_640.jpg
coupons.service-r.work/img/ 17 KB
18 KB 223ms
223ms Image
image/jpeg 183.90.228.46
XSERVER Xserver Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://coupons.service-r.work/img/ecommerce-3082813_640.jpg
Requested by: Host: coupons.service-r.work
URL: https://coupons.service-r.work/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 183.90.228.46 , Japan, ASN131965 (XSERVER Xserver Inc., JP),
Reverse DNS: sv1145.xserver.jp
Software: nginx /
Resource Hash: 3ac3cffce45f3d3b0365f2c73152bc3623850dd4b97cf8449da23573c7d8ba30

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:04 GMT
last-modified: Sun, 18 Feb 2024 09:00:05 GMT
server: nginx
etag: "453b-611a434002f40"
content-type: image/jpeg
cache-control: max-age=604800
accept-ranges: bytes
content-length: 17723
expires: Mon, 25 Mar 2024 19:22:04 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DB96 220 KB
60 KB 896ms
759ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&adk=293675617&adf=814277786&lmt=1710690640&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fcoupons.service-r.work%2F&pra=5&wgl=1&easpi=0&asro=0&aseiel=1~2~4~6~8~9~10~11~12~13~14~15~16~17~18~19~20~21&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789723666&bpp=4&bdt=383&idt=623&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&nras=1&correlator=208935012053&frm=20&pv=2&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=648

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403130201/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6cad5052d39ae84444d44c16d74f7595594feb3300d2b3aafe79d2d617c44778

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://coupons.service-r.work/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 61111
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 18 Mar 2024 19:22:05 GMT
expires: Mon, 18 Mar 2024 19:22:05 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame CEFC 118 KB
40 KB 731ms
594ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&h=280&slotname=3241243959&adk=3086274948&adf=4169717035&pi=t.ma~as.3241243959&w=1166&fwrn=4&fwrnh=100&lmt=1710690640&rafmt=1&format=1166x280&url=https%3A%2F%2Fcoupons.service-r.work%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789724197&bpp=2&bdt=914&idt=123&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=208935012053&frm=20&pv=1&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=185&ady=380&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=132

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403130201/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9db7ffecd075e6337a3e046b38ac9bde5fe8e70d997335c1425a62e7378097eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://coupons.service-r.work/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 40882
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 18 Mar 2024 19:22:05 GMT
expires: Mon, 18 Mar 2024 19:22:05 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame D662 119 KB
40 KB 808ms
672ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&h=280&slotname=3241243959&adk=3333970730&adf=1475665621&pi=t.ma~as.3241243959&w=1166&fwrn=4&fwrnh=100&lmt=1710690640&rafmt=1&format=1166x280&url=https%3A%2F%2Fcoupons.service-r.work%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789724210&bpp=6&bdt=927&idt=139&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1166x280&nras=1&correlator=208935012053&frm=20&pv=1&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=185&ady=3810&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=142

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403130201/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35afef1c028b611ee4c5deb2e17e7faf0f36bc1c998a4835a443ef5328e3d404

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://coupons.service-r.work/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 40990
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 18 Mar 2024 19:22:05 GMT
expires: Mon, 18 Mar 2024 19:22:05 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 64ms
63ms Font
font/woff2 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://coupons.service-r.work
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 09:02:25 GMT
x-content-type-options: nosniff
age: 469179
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7748
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:21:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Mar 2025 09:02:25 GMT

GET
H2 200 -F62fjtqLzI2JPCgQBnw7HFow2oe2EcP5pp0erwTqsSWs9Jezazjcb4.119.woff2
fonts.gstatic.com/s/notosansjp/v52/ 77 KB
77 KB 85ms
84ms Font
font/woff2 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notosansjp/v52/-F62fjtqLzI2JPCgQBnw7HFow2oe2EcP5pp0erwTqsSWs9Jezazjcb4.119.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+JP:wght@400;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9151040be84927c7e12fe497ef65d29af26874d9df53c4e62bcbc43c4a668e83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://coupons.service-r.work
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 21:13:52 GMT
x-content-type-options: nosniff
age: 425292
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 78972
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:42:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Mar 2025 21:13:52 GMT

GET
H2 200 -F62fjtqLzI2JPCgQBnw7HFow2oe2EcP5pp0erwTqsSWs9Jezazjcb4.117.woff2
fonts.gstatic.com/s/notosansjp/v52/ 13 KB
13 KB 69ms
68ms Font
font/woff2 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notosansjp/v52/-F62fjtqLzI2JPCgQBnw7HFow2oe2EcP5pp0erwTqsSWs9Jezazjcb4.117.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+JP:wght@400;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4ef32d9cbe1aae87a030055a413910355b58d0bd381b110e2d989900bbe18cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://coupons.service-r.work
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 20:44:06 GMT
x-content-type-options: nosniff
age: 427078
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12996
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:40:24 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Mar 2025 20:44:06 GMT

GET
H2 200 -F62fjtqLzI2JPCgQBnw7HFow2oe2EcP5pp0erwTqsSWs9Jezazjcb4.115.woff2
fonts.gstatic.com/s/notosansjp/v52/ 19 KB
19 KB 146ms
146ms Font
font/woff2 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notosansjp/v52/-F62fjtqLzI2JPCgQBnw7HFow2oe2EcP5pp0erwTqsSWs9Jezazjcb4.115.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+JP:wght@400;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f4611b598af12323855fc5300325fd72987d10296222285778ee5aa79a1b670

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://coupons.service-r.work
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 20:47:00 GMT
x-content-type-options: nosniff
age: 426904
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19684
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:33:32 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Mar 2025 20:47:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame CEFC 4 KB
775 B 82ms
81ms Stylesheet
text/css 2607:f8b0:4006:80d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&h=280&slotname=3241243959&adk=3086274948&adf=4169717035&pi=t.ma~as.3241243959&w=1166&fwrn=4&fwrnh=100&lmt=1710690640&rafmt=1&format=1166x280&url=https%3A%2F%2Fcoupons.service-r.work%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789724197&bpp=2&bdt=914&idt=123&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=208935012053&frm=20&pv=1&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=185&ady=380&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=132

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8753541a3a44842cd815d81c4f8c589e0a0d763112d622f3088cd6f064e825fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 18 Mar 2024 19:22:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 18 Mar 2024 18:02:59 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 18 Mar 2024 19:22:05 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/ Frame CEFC 2 KB
875 B 225ms
82ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:05 GMT

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/1593228197838271786/ Frame CEFC 40 KB
40 KB 337ms
199ms Image
image/jpeg 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1593228197838271786/14763004658117789537?w=600&h=314&tw=1&q=75

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

220a96f646d8b64eb709d9a8ec075d0fb512d857fe4fcbcdddb9b66d4885e700

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

allow-fenced-frame-automatic-beacons: true
date: Mon, 18 Mar 2024 19:22:05 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40572
x-xss-protection: 0
last-modified: Fri, 29 Sep 2023 14:38:25 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 18 Mar 2025 19:22:05 GMT

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/3075224222751468969/ Frame CEFC 2 KB
3 KB 334ms
197ms Image
image/jpeg 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3075224222751468969/14763004658117789537?w=100&h=100&tw=1&q=75

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

454987ac85d741e686f48be8fd9a076ac4f43b6baf4c33f4267ebbe298a06f0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

allow-fenced-frame-automatic-beacons: true
date: Mon, 18 Mar 2024 19:22:05 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2461
x-xss-protection: 0
last-modified: Wed, 27 Jul 2022 02:46:18 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 18 Mar 2025 19:22:05 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame D662 4 KB
752 B 83ms
80ms Stylesheet
text/css 2607:f8b0:4006:80d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&h=280&slotname=3241243959&adk=3333970730&adf=1475665621&pi=t.ma~as.3241243959&w=1166&fwrn=4&fwrnh=100&lmt=1710690640&rafmt=1&format=1166x280&url=https%3A%2F%2Fcoupons.service-r.work%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789724210&bpp=6&bdt=927&idt=139&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1166x280&nras=1&correlator=208935012053&frm=20&pv=1&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=185&ady=3810&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=142

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8753541a3a44842cd815d81c4f8c589e0a0d763112d622f3088cd6f064e825fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 18 Mar 2024 19:22:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 18 Mar 2024 18:33:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 18 Mar 2024 19:22:05 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240313/r20110914/ Frame CEFC 23 KB
9 KB 204ms
83ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240313/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0585c17865b250df20a5c5dbf25274d44443f26d24ed58bbe3215dd54dd864b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8954
x-xss-protection: 0
server: cafe
etag: 11417926956348271285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:05 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/ Frame CEFC 3 KB
1 KB 364ms
244ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:05 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/ Frame CEFC 20 KB
8 KB 184ms
64ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

594ea28ece633b47536a3549082809e82c6772e5f2f324f26f8bc0f5de6842d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8219
x-xss-protection: 0
server: cafe
etag: 17239101513064691842
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:05 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame CEFC 208 KB
63 KB 71ms
70ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3edca7294f70460740b307b1b70e7356a6165cb7a76c774f65398d0d052ac8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:36:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2707
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64315
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 18 Mar 2024 19:36:58 GMT

GET
H2 200 b671e646565d0c2f8b43853dd556e31b.js Show response
www.gstatic.com/mysidia/ Frame CEFC 36 KB
15 KB 211ms
63ms Script
text/javascript 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/b671e646565d0c2f8b43853dd556e31b.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e37a5df91b0ea8648ef4923fcec72c2bba1a56ed3c5d80de765078df38c06f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Thu, 14 Mar 2024 04:31:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 399060
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15272
x-xss-protection: 0
last-modified: Thu, 14 Mar 2024 02:02:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 12 Jun 2024 04:31:05 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/ Frame D662 2 KB
856 B 336ms
241ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&h=280&slotname=3241243959&adk=3333970730&adf=1475665621&pi=t.ma~as.3241243959&w=1166&fwrn=4&fwrnh=100&lmt=1710690640&rafmt=1&format=1166x280&url=https%3A%2F%2Fcoupons.service-r.work%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789724210&bpp=6&bdt=927&idt=139&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1166x280&nras=1&correlator=208935012053&frm=20&pv=1&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=185&ady=3810&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=142

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:05 GMT

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/4462530399524056105/ Frame D662 48 KB
49 KB 220ms
132ms Image
image/jpeg 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4462530399524056105/14763004658117789537?w=600&h=314&tw=1&q=75

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&h=280&slotname=3241243959&adk=3333970730&adf=1475665621&pi=t.ma~as.3241243959&w=1166&fwrn=4&fwrnh=100&lmt=1710690640&rafmt=1&format=1166x280&url=https%3A%2F%2Fcoupons.service-r.work%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789724210&bpp=6&bdt=927&idt=139&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1166x280&nras=1&correlator=208935012053&frm=20&pv=1&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=185&ady=3810&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=142

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81f3758a85cd5ce0de0ee6efa3e751c4927acdb7ec7d2190899d593e852b138a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

expires: Sun, 16 Mar 2025 16:25:06 GMT
date: Sat, 16 Mar 2024 16:25:06 GMT
x-content-type-options: nosniff
age: 183419
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49362
x-xss-protection: 0
last-modified: Wed, 06 Mar 2024 20:07:05 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/544512408269707347/ Frame D662 2 KB
2 KB 260ms
173ms Image
image/jpeg 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/544512408269707347/14763004658117789537?w=100&h=100&tw=1&q=75

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&h=280&slotname=3241243959&adk=3333970730&adf=1475665621&pi=t.ma~as.3241243959&w=1166&fwrn=4&fwrnh=100&lmt=1710690640&rafmt=1&format=1166x280&url=https%3A%2F%2Fcoupons.service-r.work%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789724210&bpp=6&bdt=927&idt=139&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1166x280&nras=1&correlator=208935012053&frm=20&pv=1&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=185&ady=3810&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=142

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77799392603d0b38a9f72933aedec4daaa725b7f77cd17eb796f630adb6eb28b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

expires: Sun, 16 Mar 2025 16:25:06 GMT
date: Sat, 16 Mar 2024 16:25:06 GMT
x-content-type-options: nosniff
age: 183419
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1854
x-xss-protection: 0
last-modified: Wed, 06 Mar 2024 21:28:18 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240313/r20110914/ Frame D662 23 KB
9 KB 319ms
235ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240313/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&h=280&slotname=3241243959&adk=3333970730&adf=1475665621&pi=t.ma~as.3241243959&w=1166&fwrn=4&fwrnh=100&lmt=1710690640&rafmt=1&format=1166x280&url=https%3A%2F%2Fcoupons.service-r.work%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789724210&bpp=6&bdt=927&idt=139&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1166x280&nras=1&correlator=208935012053&frm=20&pv=1&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=185&ady=3810&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=142

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0585c17865b250df20a5c5dbf25274d44443f26d24ed58bbe3215dd54dd864b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8954
x-xss-protection: 0
server: cafe
etag: 11417926956348271285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:05 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/ Frame D662 3 KB
1 KB 327ms
243ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&h=280&slotname=3241243959&adk=3333970730&adf=1475665621&pi=t.ma~as.3241243959&w=1166&fwrn=4&fwrnh=100&lmt=1710690640&rafmt=1&format=1166x280&url=https%3A%2F%2Fcoupons.service-r.work%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789724210&bpp=6&bdt=927&idt=139&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1166x280&nras=1&correlator=208935012053&frm=20&pv=1&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=185&ady=3810&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=142

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:05 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/ Frame D662 20 KB
8 KB 155ms
71ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&h=280&slotname=3241243959&adk=3333970730&adf=1475665621&pi=t.ma~as.3241243959&w=1166&fwrn=4&fwrnh=100&lmt=1710690640&rafmt=1&format=1166x280&url=https%3A%2F%2Fcoupons.service-r.work%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789724210&bpp=6&bdt=927&idt=139&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1166x280&nras=1&correlator=208935012053&frm=20&pv=1&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=185&ady=3810&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=142

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

594ea28ece633b47536a3549082809e82c6772e5f2f324f26f8bc0f5de6842d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8219
x-xss-protection: 0
server: cafe
etag: 17239101513064691842
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:05 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame D662 208 KB
63 KB 65ms
64ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&h=280&slotname=3241243959&adk=3333970730&adf=1475665621&pi=t.ma~as.3241243959&w=1166&fwrn=4&fwrnh=100&lmt=1710690640&rafmt=1&format=1166x280&url=https%3A%2F%2Fcoupons.service-r.work%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789724210&bpp=6&bdt=927&idt=139&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1166x280&nras=1&correlator=208935012053&frm=20&pv=1&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=185&ady=3810&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=142

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3edca7294f70460740b307b1b70e7356a6165cb7a76c774f65398d0d052ac8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:36:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2707
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64315
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 18 Mar 2024 19:36:58 GMT

GET
H2 200 fae6ba9c9cb9ec876bbde5988f04c6f7.js Show response
www.gstatic.com/mysidia/ Frame D662 36 KB
15 KB 192ms
80ms Script
text/javascript 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/fae6ba9c9cb9ec876bbde5988f04c6f7.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&h=280&slotname=3241243959&adk=3333970730&adf=1475665621&pi=t.ma~as.3241243959&w=1166&fwrn=4&fwrnh=100&lmt=1710690640&rafmt=1&format=1166x280&url=https%3A%2F%2Fcoupons.service-r.work%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789724210&bpp=6&bdt=927&idt=139&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1166x280&nras=1&correlator=208935012053&frm=20&pv=1&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=185&ady=3810&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=142

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

32993a86c58685503a2a375f9ed0ec5813961836562a3b5656fd9eb149a27d4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 21:11:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 425437
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15132
x-xss-protection: 0
last-modified: Thu, 07 Mar 2024 03:02:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 11 Jun 2024 21:11:28 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403130201/ 166 KB
56 KB 142ms
141ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403130201/reactive_library_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403130201/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49019f749e63e975ebe2380a9bfadaf73ce0ae801718a1fb5bcde0203fef25cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:05 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57242
x-xss-protection: 0
server: cafe
etag: 14200427736077961318
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Mar 2024 19:22:05 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 123ms
123ms Image
image/gif 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_auto_rs&sts=pfno&evt=place&vh=1200&eid=42532562&hl=en&pvc=2011834358434650

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame CEFC 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 121726d42a4096e6429194ae038b8d2c739c169624cf4f0394dcb51cca6ddb1c

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame CEFC 16 KB
16 KB 64ms
63ms Font
font/woff2 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 09:13:39 GMT
x-content-type-options: nosniff
age: 468506
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Mar 2025 09:13:39 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame CEFC 15 KB
15 KB 68ms
67ms Font
font/woff2 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 08:56:32 GMT
x-content-type-options: nosniff
age: 469533
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Mar 2025 08:56:32 GMT

GET
DATA 200
OK truncated
/ Frame D662 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6f4ddffa3a628df1cfb5d555c2f7fc8a9485773727a2567739f8a47af140c6e7

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/ Frame 3E94 9 KB
4 KB 63ms
62ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403130201/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df7a397b8ce58f6251a395e02608b4f620e934a958bdfe6702c6f2033593eed0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://coupons.service-r.work/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 84563
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4155
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 17 Mar 2024 19:52:42 GMT
etag: 5035419970550746386
expires: Sun, 31 Mar 2024 19:52:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/ Frame E27C 9 KB
4 KB 63ms
62ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403130201/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df7a397b8ce58f6251a395e02608b4f620e934a958bdfe6702c6f2033593eed0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://coupons.service-r.work/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 84563
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4155
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 17 Mar 2024 19:52:42 GMT
etag: 5035419970550746386
expires: Sun, 31 Mar 2024 19:52:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame D662 16 KB
16 KB 64ms
63ms Font
font/woff2 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 09:13:39 GMT
x-content-type-options: nosniff
age: 468506
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Mar 2025 09:13:39 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame D662 15 KB
15 KB 87ms
87ms Font
font/woff2 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 08:56:32 GMT
x-content-type-options: nosniff
age: 469533
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Mar 2025 08:56:32 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame D662
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CnCunXJT4ZaHGJpi_998PrrOY-Aqlysu-dvW1g6GtEtmjlY-rQhABIOLVxSdgyYaAgNyjxBCgAe79prQ9yAEJqAMByAPLBKoE0wFP0LiosaOBKDnvu5HsEeeUyBkHCOihNpGqXhNmEQHa_ES...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xbbd57f7bb22452c10000000000000000%22,%222%22:%220xe1fa0c74310179340000000000000000%22,%223%22:%220x47f9f7...

0
0

250ms
126ms

Fetch
text/css

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xbbd57f7bb22452c10000000000000000%22,%222%22:%220xe1fa0c74310179340000000000000000%22,%223%22:%220x47f9f772b1ca27a90000000000000000%22,%224%22:%220x23d89dde001ddaf30000000000000000%22,%225%22:%220x1c3136ed3a2cb6f20000000000000000%22},%22debug_key%22:%2213265987258187172252%22,%22debug_reporting%22:true,%22destination%22:%22https://oceanpointmarinelending.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2216484253422%22],%2222%22:[%22true%22],%224%22:[%2203-18%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2214743697308329233%22}&andc=true

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:06 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xbbd57f7bb22452c10000000000000000","2":"0xe1fa0c74310179340000000000000000","3":"0x47f9f772b1ca27a90000000000000000","4":"0x23d89dde001ddaf30000000000000000","5":"0x1c3136ed3a2cb6f20000000000000000"},"debug_key":"13265987258187172252","debug_reporting":true,"destination":"https://oceanpointmarinelending.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["16484253422"],"22":["true"],"4":["03-18"],"6":["true"]},"priority":"500","source_event_id":"14743697308329233"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 18 Mar 2024 19:22:06 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 18 Mar 2024 19:22:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0xbbd57f7bb22452c10000000000000000","2":"0xe1fa0c74310179340000000000000000","3":"0x47f9f772b1ca27a90000000000000000","4":"0x23d89dde001ddaf30000000000000000","5":"0x1c3136ed3a2cb6f20000000000000000"},"debug_key":"13265987258187172252","debug_reporting":true,"destination":"https://oceanpointmarinelending.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["16484253422"],"22":["true"],"4":["03-18"],"6":["true"]},"priority":"500","source_event_id":"14743697308329233"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 baSY2O45eIFBeOgq1vPVnlASrS1AjKGi1V2DTNGFAvs.js Show response
pagead2.googlesyndication.com/bg/ Frame 3575 51 KB
20 KB 69ms
68ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/baSY2O45eIFBeOgq1vPVnlASrS1AjKGi1V2DTNGFAvs.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2230260262753747&output=html&h=280&slotname=3241243959&adk=3333970730&adf=1475665621&pi=t.ma~as.3241243959&w=1166&fwrn=4&fwrnh=100&lmt=1710690640&rafmt=1&format=1166x280&url=https%3A%2F%2Fcoupons.service-r.work%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1710789724210&bpp=6&bdt=927&idt=139&shv=r20240313&mjsv=m202403130201&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1166x280&nras=1&correlator=208935012053&frm=20&pv=1&ga_vid=448454305.1710789724&ga_sid=1710789724&ga_hid=2063192789&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=185&ady=3810&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31081577%2C95325421%2C95325974%2C95327950%2C95327955%2C95321957&oid=2&pvsid=2011834358434650&tmod=1266483127&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=142

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6da498d8ee3978814178e82ad6f3d59e5012ad2d408ca1a2d55d834cd18502fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Fri, 15 Mar 2024 03:14:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 317243
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20207
x-xss-protection: 0
last-modified: Mon, 11 Mar 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Mar 2025 03:14:42 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame CEFC
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CTIy9XJT4Zc69JpbE998PityZyA3J8OewdYvq8dH8EY3ckb-XQhABIOLVxSdgyYaAgNyjxBCgAaC6_qUDyAEJqQIbgyqS2_NgPqgDAcgDywSqBNkBT9BFiilzQZoCAKzOvkV-I_kL9teHF4W...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x714b8db367a6afce0000000000000000%22,%222%22:%220xcc24ad6806cf98b00000000000000000%22,%223%22:%220x6410b3...

0
0

248ms
124ms

Fetch
text/css

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x714b8db367a6afce0000000000000000%22,%222%22:%220xcc24ad6806cf98b00000000000000000%22,%223%22:%220x6410b367bca273fc0000000000000000%22,%224%22:%220x60646e038f1441c0000000000000000%22,%225%22:%220xfe9a8279b0f5da720000000000000000%22},%22debug_key%22:%22230507251739208975%22,%22debug_reporting%22:true,%22destination%22:%22https://yieh.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22884972832%22],%2222%22:[%22true%22],%224%22:[%2203-18%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%227226854501861701697%22}&andc=true

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:06 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x714b8db367a6afce0000000000000000","2":"0xcc24ad6806cf98b00000000000000000","3":"0x6410b367bca273fc0000000000000000","4":"0x60646e038f1441c0000000000000000","5":"0xfe9a8279b0f5da720000000000000000"},"debug_key":"230507251739208975","debug_reporting":true,"destination":"https://yieh.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["884972832"],"22":["true"],"4":["03-18"],"6":["true"]},"priority":"500","source_event_id":"7226854501861701697"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 18 Mar 2024 19:22:06 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 18 Mar 2024 19:22:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x714b8db367a6afce0000000000000000","2":"0xcc24ad6806cf98b00000000000000000","3":"0x6410b367bca273fc0000000000000000","4":"0x60646e038f1441c0000000000000000","5":"0xfe9a8279b0f5da720000000000000000"},"debug_key":"230507251739208975","debug_reporting":true,"destination":"https://yieh.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["884972832"],"22":["true"],"4":["03-18"],"6":["true"]},"priority":"500","source_event_id":"7226854501861701697"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame 39FA 6 KB
728 B 86ms
85ms Stylesheet
text/css 2607:f8b0:4006:80d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bdb7d822d6afd1c8354749a111f68d56ce5e5db03b8a3028698acfc78358e06d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 18 Mar 2024 19:22:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 18 Mar 2024 19:05:54 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 18 Mar 2024 19:22:05 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/ Frame 39FA 2 KB
856 B 65ms
65ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:05 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240313/r20110914/ Frame 39FA 23 KB
9 KB 69ms
67ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240313/r20110914/abg_lite_fy2021.js

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0585c17865b250df20a5c5dbf25274d44443f26d24ed58bbe3215dd54dd864b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8954
x-xss-protection: 0
server: cafe
etag: 11417926956348271285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:05 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/ Frame 39FA 3 KB
1 KB 72ms
70ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/window_focus_fy2021.js

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:05 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/ Frame 39FA 20 KB
8 KB 66ms
64ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

594ea28ece633b47536a3549082809e82c6772e5f2f324f26f8bc0f5de6842d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8219
x-xss-protection: 0
server: cafe
etag: 17239101513064691842
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:05 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 39FA 208 KB
63 KB 65ms
63ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3edca7294f70460740b307b1b70e7356a6165cb7a76c774f65398d0d052ac8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:36:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2707
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64315
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 18 Mar 2024 19:36:58 GMT

GET
H2 200 b671e646565d0c2f8b43853dd556e31b.js Show response
www.gstatic.com/mysidia/ Frame 39FA 36 KB
15 KB 64ms
62ms Script
text/javascript 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/b671e646565d0c2f8b43853dd556e31b.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e37a5df91b0ea8648ef4923fcec72c2bba1a56ed3c5d80de765078df38c06f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Thu, 14 Mar 2024 04:31:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 399060
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15272
x-xss-protection: 0
last-modified: Thu, 14 Mar 2024 02:02:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 12 Jun 2024 04:31:05 GMT

GET
H2 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240313/r20110914/elements/html/ Frame 3E94 15 KB
6 KB 72ms
62ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240313/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b5a4e5208642cc79fa1cbf1c0bc831d41a4bbab2f3be66ae814dd26a9ba9bbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4702
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6460
x-xss-protection: 0
server: cafe
etag: 5807243554008179978
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:43 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 3E94 205 B
520 B 70ms
63ms Image
image/png 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 20:53:42 GMT
x-content-type-options: nosniff
age: 426503
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 13 Mar 2025 20:53:42 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 3E94 604 B
696 B 71ms
63ms Image
image/png 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 20:52:19 GMT
x-content-type-options: nosniff
age: 426586
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 13 Mar 2025 20:52:19 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240313/r20110914/elements/html/ Frame 3E94 22 KB
9 KB 72ms
65ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240313/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7b2685ea894c514e15f58420b40933b08f0b2baa4cef2a68479acc9a01323b0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9102
x-xss-protection: 0
server: cafe
etag: 3566326672948847535
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:05 GMT

GET
H3 200 baSY2O45eIFBeOgq1vPVnlASrS1AjKGi1V2DTNGFAvs.js Show response
pagead2.googlesyndication.com/bg/ Frame 3CF6 51 KB
20 KB 66ms
66ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/baSY2O45eIFBeOgq1vPVnlASrS1AjKGi1V2DTNGFAvs.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6da498d8ee3978814178e82ad6f3d59e5012ad2d408ca1a2d55d834cd18502fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Fri, 15 Mar 2024 03:14:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 317243
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20207
x-xss-protection: 0
last-modified: Mon, 11 Mar 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Mar 2025 03:14:42 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 024E 624 B
246 B 134ms
132ms Document
text/html 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6WcRCYwOyiAxiVw_H4ATAB&v=APEucNVlj0giMKJ4eFn5EnBaxDs4pt7FTzOzt4Q0MeLryN_bPN3VKI9U4b_Ob-hIzzeW93X-lN5bcw83LfJWpzKdT5FSdpgPRQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 18 Mar 2024 19:22:05 GMT
expires: Mon, 18 Mar 2024 19:22:05 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame E27C 94 KB
33 KB 137ms
136ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cdb7911dd984dc9b0840a0a94e711600b05dd72d612465fdb18ecfb67ea9e66c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:05 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33555
x-xss-protection: 0
server: cafe
etag: 7173713561822972903
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 18 Mar 2024 19:22:05 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E27C 42 B
63 B 124ms
122ms Image
image/gif 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BCgp2QaXHS8Z3tbCuZaznk-jAVbV3t3KtNvEkA9oPGSvC-QCM37o30yJmI66T14KGFDf-cuMrC5Ns5OkoexZec3Et6aZZQBWTrE1pOtM64Z-PS5Sc

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/ Frame E27C 3 KB
1 KB 68ms
66ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:05 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/ Frame E27C 20 KB
8 KB 65ms
64ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240313/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

594ea28ece633b47536a3549082809e82c6772e5f2f324f26f8bc0f5de6842d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8219
x-xss-protection: 0
server: cafe
etag: 17239101513064691842
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:05 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame E27C 208 KB
63 KB 72ms
71ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3edca7294f70460740b307b1b70e7356a6165cb7a76c774f65398d0d052ac8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:36:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2707
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64315
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 18 Mar 2024 19:36:58 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 266ms
123ms Preflight
text/html 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 18 Mar 2024 19:22:05 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 237ms
123ms Preflight
text/html 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 18 Mar 2024 19:22:05 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 024E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELlPF6k0iBT6ukH-51-lHic&google_cver=1

43 B
768 B

75ms
75ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELlPF6k0iBT6ukH-51-lHic&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6WcRCYwOyiAxiVw_H4ATAB&v=APEucNVlj0giMKJ4eFn5EnBaxDs4pt7FTzOzt4Q0MeLryN_bPN3VKI9U4b_Ob-hIzzeW93X-lN5bcw83LfJWpzKdT5FSdpgPRQ
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:06 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZDVSpjkj7WiNYc4BuUSO4oxLaIl%2BQC3DyVErO4MTZ58F3LYuavyiek9tebTupbBRgC9pKraFdK29cRpFOc3awe%2Bbwj5IhHYtI2BV8fHN4%2FsRYLda8QaANGAJen1cF7cgiIeQn%2BYtlHqXcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 866796ec39e5dab9-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:06 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELlPF6k0iBT6ukH-51-lHic&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 024E
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZfiUXcAoJHgAAARLAOVGLwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELlPF6k0iBT6ukH-51-lHic&google_cver=1

43 B
733 B

87ms
86ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELlPF6k0iBT6ukH-51-lHic&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6WcRCYwOyiAxiVw_H4ATAB&v=APEucNVlj0giMKJ4eFn5EnBaxDs4pt7FTzOzt4Q0MeLryN_bPN3VKI9U4b_Ob-hIzzeW93X-lN5bcw83LfJWpzKdT5FSdpgPRQ
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:06 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=omDatIwg%2BvU9vt8cWplyU%2BfCmGGwUw8upt%2Bf13OoxfNWgCxHxuvYUTKzjcBicvqyImQiYPgX7FNbhvO%2BtsfF5gtL1oDr6X9N2XNkFwn4D61PGGlKJJyhDyMQfDEiSRI56o5jqMheY6UeEw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 866796ecbb02dab9-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:06 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELlPF6k0iBT6ukH-51-lHic&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
ib.adnxs.com/ Frame 024E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEP6jwiT_P93VlnjOw2tc6LU&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEP6jwiT_P93VlnjOw2tc6LU%26google_cver%3D1

43 B
1 KB

137ms
137ms

Image
image/gif

68.67.160.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEP6jwiT_P93VlnjOw2tc6LU%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6WcRCYwOyiAxiVw_H4ATAB&v=APEucNVlj0giMKJ4eFn5EnBaxDs4pt7FTzOzt4Q0MeLryN_bPN3VKI9U4b_Ob-hIzzeW93X-lN5bcw83LfJWpzKdT5FSdpgPRQ

Protocol

Server

68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:06 GMT
an-x-request-uuid: 39a387d1-7e82-413e-9494-5a33dfda6c36
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:06 GMT
an-x-request-uuid: 045150af-ece4-4938-99b8-2026268ddebb
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEP6jwiT_P93VlnjOw2tc6LU%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 024E
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjM1NTEwNzg3NDMyODA1Nzk4

170 B
188 B

257ms
256ms

Image
image/png

142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjM1NTEwNzg3NDMyODA1Nzk4

Requested by

Protocol

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:06 GMT
an-x-request-uuid: 1308969e-16d1-4627-ad6d-ce0d4087ccce
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjM1NTEwNzg3NDMyODA1Nzk4
x-proxy-origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E27C 0
20 B 122ms
122ms Ping
image/gif 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=942751227601&version=m202402290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E27C 0
20 B 122ms
122ms Ping
image/gif 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=942751227601&version=m202402290101&ct=76&x=1&cor=8000004446891656000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E27C 91 KB
38 KB 120ms
120ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BNWd0V-3HYfAHtGanxIA3odye_l1ZNvRkJ4Yhh9xNE-lYEWXYPpACAeZy030yGzh_64haqezSqvLb-XMGCeHwoLc6lmdS9INCrqb1Lm9YLdlqRUaXXtTTg0GKHwWrEi_cboZH92nZWDRIRfZ503RGZNArzysD58smSFCu7wVkmQ3c2ZkBh6xZ2Y9Scq-isxr3nFYXE5kzN9GhgR9yMDl-Et4dGgQ&dbm_d=AKAmf-C4K3uJHoWWsxrk1RVoHplsPalk7xCECHLqlAvSCNetkaHDOt4uE88-1bHABLUlUZgZhxqnfyGGShmhIzM9m4-HJ9pvKLjF_0yD9TDlWzGFQDjQYHZQmgsq4bR4-HxoLsG2u_lofJ8oLA8evvfOcyvS0XzyFLLRlrD40IEev23w7CkPcUubzz_guSrRNVh4eRyYmSWbiDHdDvtOVQBhmOkQntlP4OHRfLk7TOvdJvB1etFP3WoNKaGnhgqcfFmfqSvpkFtTjt-ZfvTXcSCLum9hnvslWDFlLcqEzVodTP74i716h82kwr_pAnhuK9C1QlWpEbPVcjWxQO3XPlgiryfawK5s3jIvrl9YzxSHzB1X-7v1tlWxQynjqmfZYNsWXGjfznyZL9m6jw6I8bMIbaNlEvk63MH_-PbCGsISzsq5ZUMrru_N6G5jhCfhPkdcSI1D3-yxnKfDPMR1Vn0jAsDoX4Iv3ImohR0vY7Vnt9uDFrh3Hx-e1JwbRw3mhsYZptjEXHhFFaDougvI3mb5bC_ScLP9V2JPH4HOENvZnrzrPIz9F6QZ6f5a2D_5V4NZmYHK5b-3dSoBs0bKqny5FCMRIKGg_NMGJbvFOzDkVdR-bpr4Ux-E_XCVIDCS5EnAsPA3mr3cl3vQX6S0XHWu8ylvu8qEItdJ-norC-RqzcoMxvhGVrEDYWFw3cgrSbt7lz_G93Cd8tDJiN4_c5tVjDzMvhGNMUfHHWaK2PacGUjcKGgWXlDPpAk9A4qxXwroRl4oWUJ8pMqPJkp-Ut3Q5nY47jCdxEU-2sAAAZDYYbDDq3AbOD3tnoMSvSujDOfaAqolS5-g-nP-fyShhn9esX_Bu85AFdad_IK_Hy4xdGmxKTuiiFlqRVk50UEbjmZ49rKWcD1Mb9avbGhcV7ACRMYim5_2LZK26jVYkI-V3nFeiek6ELSMyjxAhJMYNWMDkgbxbRkbcgrq8w9hdkDQT6mTrTnUgiA5OWBiuAikEe4uyIeJnY5Iw42dk6YaEAzoL9JREAVxHgJKJOUJuVGTkzRuBm4phYunRydI7XleSBy2DIAeQihocBbA5zlPp0-IDOKr4w0z02N6JuJB0hoaa9eEXm-n-RbgBDdO-xBVC7L9wvfep5s9mL1zitDPaeaR5weAFJKx9DKGj-lTatAHZGNqG1gOrZK1WYbXi1LATEEVMTqrcNg4mz0NLtb2a3hBl00VEki-buZ5TqwcTCZLVB4jR5STcbpheyZ-CCEhzhwFjDJvM40D30RCXNwmrTsQgeFawnnfRSsQfpvlOzIvrPNaoiG3t0YQBowDO9bHdXH_hg1qxKpO8gniqXhFBjMJA2ulfhF1rkh1AJlaN-8iU0qfT3CejynDqDdfItBB4PQzF35_k-EczMDl2OUTwTCJpopOQ7cCXtZC_1sgAQmkzFEOHbRVP3Cb-9VArjajvTrglh5tiPCylV3fhlBCD7wHIvkXDPpl6LMAhjJC_8G2WXiqKBIQbDOPWEh1PJlhTU0ugWPKHmpXvmq8kK1fIraOuVM9SqD8_dc2K7g3D8IgU15EK3jLFVWm2-jNKsfwLIpFGvKAHJpAtJj2TTvS1m-0sZDzy4y1VMCDzhBVY7RA5tapyxs5IC35eABeAa1KlRcC_NopnoiWES3CJuGdBwizqVD67NduI7X7okjZYrpD6znZFeRIzioU1dcAtYeB4DVmjnDjWtQHmTnsAP_VBgelmZqRREsgKb15lPd2ACq1TOVzjVNutDhMM8TFR6gXGug1KoSHHW7hR2MemGB4Ltb3vixUdsP9WHmVJeY2TdnCHKc5dBdl3XYQDvH9NS5XEwYRPQnY3ZCIbQyJg4B_xyCp5MDSiyh71OdbCzXaB0uHsXgv8AkxHhyriBzDr3MAzeluM9QxKs3QMpxws4I9ad6abxXaZvwMbTKjFncCzbQENoLShM41H5rAKdVQabhjJPYimmyj66z_HBCHYE1UP1dKTHK3R6zRL-wpJQTqx0G8xfrJdPgsxiigZIIZBZeuD_YxRJQZunxET7Y20YriBoTDHJBqBXsspqYfOZLqFU8plSD0zlYXRGhrLblLBXPFeB8d27PzagY0B_MJjKcON_1mgDBzAcf9m5qtQcW0CYIPuWIQqPx52sVmE324Nyz_dY_4EHF-psoTBNYIh78LGtIyCcwBeO6JxmYImb-tmBhZvqjzfEq7KlwiI0FarqmSH9hDLYurpqrl1VLPHPhDJQlp121bK0WpGg8ThzFyypxGLg6BUvXe0BcmQH4lG_5tsEa7w3dtZHnnIXtee9x3TFER8DOfXpJ8o2cDjTv6bQhvyz7JyfQkNpkgXN6Qg3lYkFPnN4Yc2VwVTKBvFHrgXzyU_6Hg1k4WhJ0V9xcBPnxgb-2U9ED3O-Soct1MAdH3x5qJfQJEKA8YlSBtc1TUQ3YBmMgCLCyroYkLAoKrELjbzGewqWA2PGNvWeQGNW9Opz4BP3GpptdqFPi30twCK1LXnnBrjUnr1bRkrEVSugdbx-9vCEAkAK2MJ8WZJFRi_Q1ZtH9sPYjVGUwP3FeDkewC68uba2_9enwHDvDdv1N1xONlLSBeQpm0Do-i_eY1F-zgM6WV3i4GWM0GoniaAALwMyxyHWp_WZDeMr_9oQTM5DpXbIlD1ZNDa3zAmp-7LiiTYc5irsAN6MTU3lUDy-T-5apQ2h_OiMLt3mKZPIYWdRsMkEUicz03z8X4w8sIYxn8-Qe_UXcUI7OCrGo3yB5IBFFlp9ldfQywd7l1sgtbQMubtL5uRxx8vwgSHN7EagG7P851G5R6XAltS7D_7fUls0Mp38Su-ZgF6MVyirs8Iap5aVuK22JEZ5ntRv9zzASjk8XHm_my8qh7A-IwH6uA92V8sFS2mOgfPYy49uE8yGe1agNu92PXuaBLwSCyjW8x-2lN7D5OKPYMnBSoqPIZoIiVL5-P9kpApYPiM4jLH68YXo4y1R3wmDfK45FLX3gbmYpBZgRHD2aaRimn0AXkm_W9ZJbGpIjFpZcB8x1kyxQltvLJXULynUCKEELX-MQngZPRsP86If8lSVhVsowO2ZopHP9VOEI37e0fbWS7uZPYNclayX7_QWE5zJZ5gF399xMA6lBZkAyPHkvnKKS7uXxOH9LUjk_g-Qg-T5M9cw-sxEt5UJZMRFeAVID-onWRmVp6rmbOyCXlFamQKzW_H4XuMGDFTRBckmNlj5uvgvlKHdRk9AhoWoNY4hFSeDn10zvume2hxGciIsMa549ZWYEdRtU-_ZHeVWOSuLC2H_vWnOhN-9xRxYI6BsC9986L33tofcWszOZ8v5xaTOSV7P4sSmZye4quLR8lhc-Z5i2_CdASPktGvp0acuPZfvCg1hGSH_pDGC8fPWyDa_JtLfemqPCFRT38t6EvtjnuMKDFwTRXNR0QQn3bqY4GaS697aGD33WMXYopUXljxR6twClBHSqSzaRmGUWvdxuNiYa5v16wXdKUWupJiI2umm0dhobYAf1vJOdC3i7_WXTdaBJ3hUai6NITbyx7xt8a55_TSbEkf5cjzaHHqpV-2BWgFQFGkUlN9GxuSdayUL6ako9B6SzW-5rtv7paGnxijsOeX5Ht7pilOrWHisMP3m2QUTDaM_Uvxq3TR7PyU1FcWGFZgckRFRfuCdUbX2OR8E4Ja27p7cPXceMPupGVkkmWdylejQT-1uMahB-YK7-0TVlCpyH2&cid=CAQSTwB7FLtq0SudVLdEVy9FB4EfRmhYS4PspqBhToK8wtfZfI36PboBhl0OtbKq4Vw6DP7HUNYV2B3On8dqRA3EAkln9QJAE4fd0T73twV6n0UYAQ&dv3_ver=m202402290101&rfl=https%3A%2F%2Fcoupons.service-r.work%2F&ds=l&xdt=1&iif=1&cor=8000004446891656000&adk=1964084971&idt=151&cac=0&dtd=34

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c99f2da131e5339bc72a415d529420f012163b2e929ebbb950eee24403ae65ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39276
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 baSY2O45eIFBeOgq1vPVnlASrS1AjKGi1V2DTNGFAvs.js Show response
pagead2.googlesyndication.com/bg/ Frame F511 51 KB
20 KB 64ms
63ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/baSY2O45eIFBeOgq1vPVnlASrS1AjKGi1V2DTNGFAvs.js

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6da498d8ee3978814178e82ad6f3d59e5012ad2d408ca1a2d55d834cd18502fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Fri, 15 Mar 2024 03:14:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 317244
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20207
x-xss-protection: 0
last-modified: Mon, 11 Mar 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Mar 2025 03:14:42 GMT

POST
H2 204 matomo.php
richlucky.xsrv.jp/piwik/ 0
112 B 679ms
678ms Ping
text/plain 183.90.228.46
XSERVER Xserver Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://richlucky.xsrv.jp/piwik/matomo.php?action_name=Here%20are%20some%20ways%20to%20find%20deals%20and%20coupons%3A&idsite=17&rec=1&r=818782&h=9&m=22&s=5&url=https%3A%2F%2Fcoupons.service-r.work%2F&_id=2367fde519d2e074&_idn=1&send_image=0&_refts=0&pv_id=fJVtZI&pf_net=763&pf_srv=223&pf_tfr=0&pf_dm1=940&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200
Requested by: Host: richlucky.xsrv.jp
URL: https://richlucky.xsrv.jp/piwik/matomo.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 183.90.228.46 , Japan, ASN131965 (XSERVER Xserver Inc., JP),
Reverse DNS: sv1145.xserver.jp
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://coupons.service-r.work/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

access-control-allow-origin: https://coupons.service-r.work
date: Mon, 18 Mar 2024 19:22:06 GMT
access-control-allow-credentials: true
server: nginx

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame E27C 111 KB
39 KB 444ms
85ms Script
text/javascript 2607:f8b0:4006:809::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Sun, 17 Mar 2024 22:14:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76084
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 18 Mar 2024 22:14:02 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240313/r20110914/elements/html/ Frame E27C 12 KB
4 KB 64ms
63ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240313/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BNWd0V-3HYfAHtGanxIA3odye_l1ZNvRkJ4Yhh9xNE-lYEWXYPpACAeZy030yGzh_64haqezSqvLb-XMGCeHwoLc6lmdS9INCrqb1Lm9YLdlqRUaXXtTTg0GKHwWrEi_cboZH92nZWDRIRfZ503RGZNArzysD58smSFCu7wVkmQ3c2ZkBh6xZ2Y9Scq-isxr3nFYXE5kzN9GhgR9yMDl-Et4dGgQ&dbm_d=AKAmf-C4K3uJHoWWsxrk1RVoHplsPalk7xCECHLqlAvSCNetkaHDOt4uE88-1bHABLUlUZgZhxqnfyGGShmhIzM9m4-HJ9pvKLjF_0yD9TDlWzGFQDjQYHZQmgsq4bR4-HxoLsG2u_lofJ8oLA8evvfOcyvS0XzyFLLRlrD40IEev23w7CkPcUubzz_guSrRNVh4eRyYmSWbiDHdDvtOVQBhmOkQntlP4OHRfLk7TOvdJvB1etFP3WoNKaGnhgqcfFmfqSvpkFtTjt-ZfvTXcSCLum9hnvslWDFlLcqEzVodTP74i716h82kwr_pAnhuK9C1QlWpEbPVcjWxQO3XPlgiryfawK5s3jIvrl9YzxSHzB1X-7v1tlWxQynjqmfZYNsWXGjfznyZL9m6jw6I8bMIbaNlEvk63MH_-PbCGsISzsq5ZUMrru_N6G5jhCfhPkdcSI1D3-yxnKfDPMR1Vn0jAsDoX4Iv3ImohR0vY7Vnt9uDFrh3Hx-e1JwbRw3mhsYZptjEXHhFFaDougvI3mb5bC_ScLP9V2JPH4HOENvZnrzrPIz9F6QZ6f5a2D_5V4NZmYHK5b-3dSoBs0bKqny5FCMRIKGg_NMGJbvFOzDkVdR-bpr4Ux-E_XCVIDCS5EnAsPA3mr3cl3vQX6S0XHWu8ylvu8qEItdJ-norC-RqzcoMxvhGVrEDYWFw3cgrSbt7lz_G93Cd8tDJiN4_c5tVjDzMvhGNMUfHHWaK2PacGUjcKGgWXlDPpAk9A4qxXwroRl4oWUJ8pMqPJkp-Ut3Q5nY47jCdxEU-2sAAAZDYYbDDq3AbOD3tnoMSvSujDOfaAqolS5-g-nP-fyShhn9esX_Bu85AFdad_IK_Hy4xdGmxKTuiiFlqRVk50UEbjmZ49rKWcD1Mb9avbGhcV7ACRMYim5_2LZK26jVYkI-V3nFeiek6ELSMyjxAhJMYNWMDkgbxbRkbcgrq8w9hdkDQT6mTrTnUgiA5OWBiuAikEe4uyIeJnY5Iw42dk6YaEAzoL9JREAVxHgJKJOUJuVGTkzRuBm4phYunRydI7XleSBy2DIAeQihocBbA5zlPp0-IDOKr4w0z02N6JuJB0hoaa9eEXm-n-RbgBDdO-xBVC7L9wvfep5s9mL1zitDPaeaR5weAFJKx9DKGj-lTatAHZGNqG1gOrZK1WYbXi1LATEEVMTqrcNg4mz0NLtb2a3hBl00VEki-buZ5TqwcTCZLVB4jR5STcbpheyZ-CCEhzhwFjDJvM40D30RCXNwmrTsQgeFawnnfRSsQfpvlOzIvrPNaoiG3t0YQBowDO9bHdXH_hg1qxKpO8gniqXhFBjMJA2ulfhF1rkh1AJlaN-8iU0qfT3CejynDqDdfItBB4PQzF35_k-EczMDl2OUTwTCJpopOQ7cCXtZC_1sgAQmkzFEOHbRVP3Cb-9VArjajvTrglh5tiPCylV3fhlBCD7wHIvkXDPpl6LMAhjJC_8G2WXiqKBIQbDOPWEh1PJlhTU0ugWPKHmpXvmq8kK1fIraOuVM9SqD8_dc2K7g3D8IgU15EK3jLFVWm2-jNKsfwLIpFGvKAHJpAtJj2TTvS1m-0sZDzy4y1VMCDzhBVY7RA5tapyxs5IC35eABeAa1KlRcC_NopnoiWES3CJuGdBwizqVD67NduI7X7okjZYrpD6znZFeRIzioU1dcAtYeB4DVmjnDjWtQHmTnsAP_VBgelmZqRREsgKb15lPd2ACq1TOVzjVNutDhMM8TFR6gXGug1KoSHHW7hR2MemGB4Ltb3vixUdsP9WHmVJeY2TdnCHKc5dBdl3XYQDvH9NS5XEwYRPQnY3ZCIbQyJg4B_xyCp5MDSiyh71OdbCzXaB0uHsXgv8AkxHhyriBzDr3MAzeluM9QxKs3QMpxws4I9ad6abxXaZvwMbTKjFncCzbQENoLShM41H5rAKdVQabhjJPYimmyj66z_HBCHYE1UP1dKTHK3R6zRL-wpJQTqx0G8xfrJdPgsxiigZIIZBZeuD_YxRJQZunxET7Y20YriBoTDHJBqBXsspqYfOZLqFU8plSD0zlYXRGhrLblLBXPFeB8d27PzagY0B_MJjKcON_1mgDBzAcf9m5qtQcW0CYIPuWIQqPx52sVmE324Nyz_dY_4EHF-psoTBNYIh78LGtIyCcwBeO6JxmYImb-tmBhZvqjzfEq7KlwiI0FarqmSH9hDLYurpqrl1VLPHPhDJQlp121bK0WpGg8ThzFyypxGLg6BUvXe0BcmQH4lG_5tsEa7w3dtZHnnIXtee9x3TFER8DOfXpJ8o2cDjTv6bQhvyz7JyfQkNpkgXN6Qg3lYkFPnN4Yc2VwVTKBvFHrgXzyU_6Hg1k4WhJ0V9xcBPnxgb-2U9ED3O-Soct1MAdH3x5qJfQJEKA8YlSBtc1TUQ3YBmMgCLCyroYkLAoKrELjbzGewqWA2PGNvWeQGNW9Opz4BP3GpptdqFPi30twCK1LXnnBrjUnr1bRkrEVSugdbx-9vCEAkAK2MJ8WZJFRi_Q1ZtH9sPYjVGUwP3FeDkewC68uba2_9enwHDvDdv1N1xONlLSBeQpm0Do-i_eY1F-zgM6WV3i4GWM0GoniaAALwMyxyHWp_WZDeMr_9oQTM5DpXbIlD1ZNDa3zAmp-7LiiTYc5irsAN6MTU3lUDy-T-5apQ2h_OiMLt3mKZPIYWdRsMkEUicz03z8X4w8sIYxn8-Qe_UXcUI7OCrGo3yB5IBFFlp9ldfQywd7l1sgtbQMubtL5uRxx8vwgSHN7EagG7P851G5R6XAltS7D_7fUls0Mp38Su-ZgF6MVyirs8Iap5aVuK22JEZ5ntRv9zzASjk8XHm_my8qh7A-IwH6uA92V8sFS2mOgfPYy49uE8yGe1agNu92PXuaBLwSCyjW8x-2lN7D5OKPYMnBSoqPIZoIiVL5-P9kpApYPiM4jLH68YXo4y1R3wmDfK45FLX3gbmYpBZgRHD2aaRimn0AXkm_W9ZJbGpIjFpZcB8x1kyxQltvLJXULynUCKEELX-MQngZPRsP86If8lSVhVsowO2ZopHP9VOEI37e0fbWS7uZPYNclayX7_QWE5zJZ5gF399xMA6lBZkAyPHkvnKKS7uXxOH9LUjk_g-Qg-T5M9cw-sxEt5UJZMRFeAVID-onWRmVp6rmbOyCXlFamQKzW_H4XuMGDFTRBckmNlj5uvgvlKHdRk9AhoWoNY4hFSeDn10zvume2hxGciIsMa549ZWYEdRtU-_ZHeVWOSuLC2H_vWnOhN-9xRxYI6BsC9986L33tofcWszOZ8v5xaTOSV7P4sSmZye4quLR8lhc-Z5i2_CdASPktGvp0acuPZfvCg1hGSH_pDGC8fPWyDa_JtLfemqPCFRT38t6EvtjnuMKDFwTRXNR0QQn3bqY4GaS697aGD33WMXYopUXljxR6twClBHSqSzaRmGUWvdxuNiYa5v16wXdKUWupJiI2umm0dhobYAf1vJOdC3i7_WXTdaBJ3hUai6NITbyx7xt8a55_TSbEkf5cjzaHHqpV-2BWgFQFGkUlN9GxuSdayUL6ako9B6SzW-5rtv7paGnxijsOeX5Ht7pilOrWHisMP3m2QUTDaM_Uvxq3TR7PyU1FcWGFZgckRFRfuCdUbX2OR8E4Ja27p7cPXceMPupGVkkmWdylejQT-1uMahB-YK7-0TVlCpyH2&cid=CAQSTwB7FLtq0SudVLdEVy9FB4EfRmhYS4PspqBhToK8wtfZfI36PboBhl0OtbKq4Vw6DP7HUNYV2B3On8dqRA3EAkln9QJAE4fd0T73twV6n0UYAQ&dv3_ver=m202402290101&rfl=https%3A%2F%2Fcoupons.service-r.work%2F&ds=l&xdt=1&iif=1&cor=8000004446891656000&adk=1964084971&idt=151&cac=0&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:06 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240313/r20110914/ Frame E27C 30 KB
11 KB 63ms
63ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240313/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4665fbd1c393f6a6340aa12fdfe61c9481dd3a6e9292a850feef98a621e89ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 18:03:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11526
x-xss-protection: 0
server: cafe
etag: 10374153479694904093
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Apr 2024 18:03:06 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame E27C 41 KB
14 KB 63ms
63ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 20:50:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 426667
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Mar 2025 20:50:59 GMT

GET
DATA 200
OK truncated
/ Frame E27C 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3eef7d3ccf1367fc6849dfea5b05d97395b2d3d8c009a11d3621dd5c68a3e8a0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 3E8C 38 KB
13 KB 63ms
62ms Document
text/html 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 426412
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 13 Mar 2024 20:55:14 GMT
expires: Thu, 13 Mar 2025 20:55:14 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 baSY2O45eIFBeOgq1vPVnlASrS1AjKGi1V2DTNGFAvs.js Show response
pagead2.googlesyndication.com/bg/ Frame 3E8C 51 KB
20 KB 247ms
247ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/baSY2O45eIFBeOgq1vPVnlASrS1AjKGi1V2DTNGFAvs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6da498d8ee3978814178e82ad6f3d59e5012ad2d408ca1a2d55d834cd18502fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Fri, 15 Mar 2024 03:14:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 317244
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20207
x-xss-protection: 0
last-modified: Mon, 11 Mar 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Mar 2025 03:14:42 GMT

GET
H3 200 728x90.html Show response
s0.2mdn.net/sadbundle/6300375155520534659/728x90/ Frame E00D 8 KB
3 KB 321ms
64ms Document
text/html 2607:f8b0:4006:809::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6300375155520534659/728x90/728x90.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6917631db0f55ff9092fc23133bbd0a0f74a1cc28aad82162c463f5261437ed2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 396992
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2802
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 14 Mar 2024 05:05:34 GMT
expires: Fri, 14 Mar 2025 05:05:34 GMT
last-modified: Wed, 07 Feb 2024 16:15:10 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame E27C 0
0 151ms
132ms Fetch
image/gif 142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvCDVmfiS7Fytrb5nk4w2ds15TRDyjw0EzeftIawNaJ4XTfqE6CBnv-Cce2dqQp0K6ad9-DZ2qJTkJ3oTuwuA8l1sc6nuSpyKAixf-lH1YpS_xTb37VcwBBQNJxxTHcKXWfMb0sQrNsZSsSZ5dOImuLhCDO16KIcvyGBk11IugxxWbq4mzpTRLb3uousu4mpRr5JPw8Vt6fuykddBscuTRzpysFt6pzLTFfpQ6W9TujxVdZnZsVs0sMSczw5dFAr9CvzvOhg8nxctvEBD0QNGX1nAr6FTRwG_smk0n5ckfmguXDp-4jm2LNwO4Ikyg4ujm9Qqn2KQDpb9Gn3msrw-pF7SbZL1_RkrWgSpfJhPFwypOO2Wslhgd5d1dmKWGZGRfsf9NZcu63b_vvEFlBVBMy6oETocHq-i1tShqE9VOZFxg5baDUx3AWKn_Uf7aVNLoCdzTLhiD3Gh0x1JrwCurN2Qfpitn9y4wmOcQcKtYUyAVUr5Eo3dzrPkmFnP9NHKjRh1cKL9Qcs1ZfEV9_kaQVAAfk-5iUm82CDFUeyA1OClAptvhwTO31jWTDe24hD4KkyoiEZzqUNOJQs1wAlFvAOE5RZ30-uaWHf6gjyNoyWvUK72Pu0mYmPGGvuwqTZhc7c90Z0Tg5GA-_5uDkG7ngVSoEjwmGi9Q3heO10kYBZ70GkOiqZSHFkM1glumuAX5AUs0aG0fOVUX3YrCJ9Zt9E0qmGfi74UQexsOTa9SbRnTFuqsYdGcP2hnLC44mcImiEVAjQ1TKa1BApVq7VNiraniGAgzjdAIXcnBNoaK4fEjToJGw-X-enXRVSUqehaDek9ZdY51x9M34tU7Nql9oi75subk8PckkzWyTyiEC7YkoeFtNQv6c0N0MnXe2GXM_4jSMcI3NBXj16N0Yl6ZmCBkRGDt3T68pyFOAPqs-bfP4wjO4IEd2rX3Hv0dGDBYVq016i_iSt0VoUzlsY40GX7QvXASrJLW6kOvl44gFNdvbskeRH1UQj2FsGGrw66Wvy4ius13ZxabU1-Aze6-Kq6VWxsSEpePT_dLAMTr3EB5fJMStBOBX_SgzrSjofJUbdCO74ZChPBFFrk1y78IPL8jBjQ8xKccPD1VvWhQQIfLJ6Jkl5Ufhu2M8zjzlPXbH3oq5tBGcqoKoT8-QKXFbfVwyl9nm2ptU34FRGd1-TWTjsU48aC5Zjee2qzEpNHfVK3Wkjf5P1MQPAhyQQnqSFEJmCbp-OFQWsMJrAOFlKyZNDvAhPXafDCNzt5EKDkeRJetU4jjPWC2bVmzf_0A0wL81J8n4EQk_YF4GXyzuB2APtbLN94gKqDn_eSMGq4bBBaXzCeKfAKhuPmxz_tMFtwCsJUbik1L2u_RnYUgqF7EBb9PBDL4neBJXkt6Owp-TmGY9WyJBP-UjPjOwpAyVyCwusAMaAR7mgy6Qg1k_2FIYAnQA1K1QC2nYBb2XfghxGaiyL7iXz78&sai=AMfl-YTvK_-Wg3d_chbN__4jvEUh-T_7Nk9O1i88Q3RgNZ9jYFesGOMlWY8D3YLrGPWgPVRACf6b3kngNhkkk0ZD1deVfDMr8IL8WQcq23QQUocyKmWI0Fe4PGaXQ6kb2EFC97aLegDFk1dkx82Zc5pX3N-2My9GzqKmoXbtZKqjkwdSG50tH2YPegGMDgUVMMSSXCw8XPIQKKmoeG7ZcoT2UuXsocn5ZiS4BTxrd0Yof17K5fTCJxOwABbK2buSOho2k5jbBLTE9DQEQAooeuQUSZI-ICH7QFpxxz7tUQb83YVEdgu2HjnB4B3gOx773xuxP4QJ&sig=Cg0ArKJSzOg3g4ml0AdeEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=540&cbvp=1&cstd=536&cisv=r20240313.99246&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 18 Mar 2024 19:22:06 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Mon, 18 Mar 2024 19:22:06 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame CEFC 42 B
174 B 127ms
125ms Fetch
image/gif 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssfpREbzSzaeOpDAm-iAE7tzu5g0YvV7R9LNbh0qCQ9UgZyn6Hgle3VQNgBx50I9aPGr104ioljTXuGENoThw_ym3WhSNrrxmSoWjAHDV41CT_3z0-IvtXK6c3JS0skkmeh0sWFmaF6zen_rbzWde1_oX1t4qNyomo&sai=AMfl-YQ67wDYAnNxp4tsiYbTwDuS0x9K4BT_UFgewhk7mgVnGWr8KXVZM_zAIOzfuMVT7OFF_Qj5J3lqzcO4S2okEG0KIIY3FsKK5aFWCnIPcr07daF3WFiEDAY9muzCxBDImDvaDOcHvt4ybUGY5oIzQA&sig=Cg0ArKJSzDQ2NQP1fnWOEAE&cid=CAQSTwB7FLtqJ9ifXCZr8fuBW0JHJei7gurSbiOB13mf0M_FlGkIMoCebdMX2c7V-RdsMkhG3ep2fZTAtScsHRl01rD0_u7A8NxaTzgwI_vwFMUYAQ&id=lidar2&mcvt=1003&p=0,0,280,1166&mtos=1003,1003,1003,1003,1003&tos=1003,0,0,0,0&v=20240313&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=3086274948&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=672252500&rst=1710789724331&rpt=1313&met=mue&wmsd=0&pbe=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3E8C 0
20 B 126ms
126ms Image
image/gif 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BcMYQXpT4ZZPiAeGSoPMPu5-7wAcAAAAAOAHgBAI&bg=!fH-lfzDNAAb_2pXa39o7ADQBe5WfOAalMj1RWYQ4QE0mWJkfH_QWXCRk57HDiNV5B3hs05FaX5JfL-49NkfoU53ZvdQ-AgAAAF1SAAAAAmgBB5kC-CBWTzNPUUgwoRTiowNKgqpFUbIkNQb_aOqdJh7-QLciYLVLHM2CeO0C2wzy4NO2iM7ISfzPzGTawxpDoBpdMtK5wvkz2mSd84Nu2HJ30ri57tsXAk27u03sm9M3Gsdf6P_h5Li7G88ZR0Fnkgz7oCIkagAIqzDnDOm47pDsd5UscdYYAkfybeEipTX7maqqbPK3QvxV2PKWbRvAmzuo8z5MkU6HCB7qKC_uHYbT0JLbNKcnq3_IC2kay14CEz8G5n67u-hd_sTBEZHMoTCoJG-_yDGeJcmao4tepOjmtNo1xIU7TvcOlTL-Tp9cN9oYazH5MNv9_vWVsNU3LmCNezrY6RiWIlg7haiv6uDHPkX_uuzLySl4VQvbG4WYighb5XpZQ5ggty8M2o-ife-PoBdkGnuvl1EkLmCrsPNhYaLJ2NSTtYC44QsmcVoSHNkO0fvQzcSnhjx7z8cFjGuQ4NXt-ctcYNEWIAmny27pa4QqeWt2PTFBqsxmssjmXZFPWASNtYSRznjdS1W9UQGEF2KFt_34UhbrczOohoAtpnTeHH4P9_0X5HT2T4RXM7TXaJLjUWFdo5S_cquqHZYdvlCLBSH-DcbNge3750bc6_ND0xUE4r2mZ6YvJ0lhLNE5eQf7uOgy6hLDhF9TUZNcXjp2aOksUQ58fK2SGWwi7HsmUQnGrY0aothZShCs9bsSDARmEMdpYApDHujsfHYy2G9FXdeb-aPstlp2uPVy0XtLB9OxmgGjAhEqSryM_FYkENA9iKR_anRLbdCUV_xm0Qxan1NJ4kybrbUBaxipE0dbME6tgwemTPtVBzL03anumRwwo66jdS-9PhsSZEuVgEZTrYI0OSHbC0I6F6HIJ8MEf36VOflwZGQ955AMJKSzvLfdmsSU_8tHcBbJn__i3gnErmXzKvZdN_672pdahI97MJcaFBWKBCFWBi3BVPrGu_tANfVKDSo_MqQnHi99uAxZaZxU9AvDM-TG0H_D454_XF5pp-QUQkw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 createjs.min.js Show response
code.createjs.com/1.0.0/ Frame E00D 236 KB
63 KB 248ms
80ms Script
text/javascript 2600:1400:9000::6875:b62a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://code.createjs.com/1.0.0/createjs.min.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6300375155520534659/728x90/728x90.html?ev=01_250
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1400:9000::6875:b62a New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Apache /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:07 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=900
x-n: S
accept-ranges: bytes
expires: Mon, 18 Mar 2024 19:37:07 GMT

GET
H3 200 728x90.js Show response
s0.2mdn.net/sadbundle/6300375155520534659/728x90/ Frame E00D 45 KB
10 KB 69ms
69ms Script
application/x-javascript 2607:f8b0:4006:809::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6300375155520534659/728x90/728x90.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6300375155520534659/728x90/728x90.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c65deff2a07f3a37ea3de624f630f223d33a6a683379e06021c6c816d794555

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6300375155520534659/728x90/728x90.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

expires: Fri, 14 Mar 2025 05:24:02 GMT
date: Thu, 14 Mar 2024 05:24:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 395885
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9805
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 16:15:10 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 GettyImages1401577518.jpg
s0.2mdn.net/sadbundle/6300375155520534659/728x90/images/ Frame E00D 75 KB
75 KB 67ms
67ms Image
image/jpeg 2607:f8b0:4006:809::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6300375155520534659/728x90/images/GettyImages1401577518.jpg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240313/r20110914/zrt_lookup_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5226d6a2761b300aa6f7788d0920ff45aac64645191257d65dfd157e97d3ed20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6300375155520534659/728x90/728x90.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

expires: Fri, 14 Mar 2025 05:10:14 GMT
date: Thu, 14 Mar 2024 05:10:14 GMT
x-content-type-options: nosniff
age: 396713
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77162
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 16:15:10 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame E27C 0
0 124ms
123ms Fetch
image/gif 142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvCDVmfiS7Fytrb5nk4w2ds15TRDyjw0EzeftIawNaJ4XTfqE6CBnv-Cce2dqQp0K6ad9-DZ2qJTkJ3oTuwuA8l1sc6nuSpyKAixf-lH1YpS_xTb37VcwBBQNJxxTHcKXWfMb0sQrNsZSsSZ5dOImuLhCDO16KIcvyGBk11IugxxWbq4mzpTRLb3uousu4mpRr5JPw8Vt6fuykddBscuTRzpysFt6pzLTFfpQ6W9TujxVdZnZsVs0sMSczw5dFAr9CvzvOhg8nxctvEBD0QNGX1nAr6FTRwG_smk0n5ckfmguXDp-4jm2LNwO4Ikyg4ujm9Qqn2KQDpb9Gn3msrw-pF7SbZL1_RkrWgSpfJhPFwypOO2Wslhgd5d1dmKWGZGRfsf9NZcu63b_vvEFlBVBMy6oETocHq-i1tShqE9VOZFxg5baDUx3AWKn_Uf7aVNLoCdzTLhiD3Gh0x1JrwCurN2Qfpitn9y4wmOcQcKtYUyAVUr5Eo3dzrPkmFnP9NHKjRh1cKL9Qcs1ZfEV9_kaQVAAfk-5iUm82CDFUeyA1OClAptvhwTO31jWTDe24hD4KkyoiEZzqUNOJQs1wAlFvAOE5RZ30-uaWHf6gjyNoyWvUK72Pu0mYmPGGvuwqTZhc7c90Z0Tg5GA-_5uDkG7ngVSoEjwmGi9Q3heO10kYBZ70GkOiqZSHFkM1glumuAX5AUs0aG0fOVUX3YrCJ9Zt9E0qmGfi74UQexsOTa9SbRnTFuqsYdGcP2hnLC44mcImiEVAjQ1TKa1BApVq7VNiraniGAgzjdAIXcnBNoaK4fEjToJGw-X-enXRVSUqehaDek9ZdY51x9M34tU7Nql9oi75subk8PckkzWyTyiEC7YkoeFtNQv6c0N0MnXe2GXM_4jSMcI3NBXj16N0Yl6ZmCBkRGDt3T68pyFOAPqs-bfP4wjO4IEd2rX3Hv0dGDBYVq016i_iSt0VoUzlsY40GX7QvXASrJLW6kOvl44gFNdvbskeRH1UQj2FsGGrw66Wvy4ius13ZxabU1-Aze6-Kq6VWxsSEpePT_dLAMTr3EB5fJMStBOBX_SgzrSjofJUbdCO74ZChPBFFrk1y78IPL8jBjQ8xKccPD1VvWhQQIfLJ6Jkl5Ufhu2M8zjzlPXbH3oq5tBGcqoKoT8-QKXFbfVwyl9nm2ptU34FRGd1-TWTjsU48aC5Zjee2qzEpNHfVK3Wkjf5P1MQPAhyQQnqSFEJmCbp-OFQWsMJrAOFlKyZNDvAhPXafDCNzt5EKDkeRJetU4jjPWC2bVmzf_0A0wL81J8n4EQk_YF4GXyzuB2APtbLN94gKqDn_eSMGq4bBBaXzCeKfAKhuPmxz_tMFtwCsJUbik1L2u_RnYUgqF7EBb9PBDL4neBJXkt6Owp-TmGY9WyJBP-UjPjOwpAyVyCwusAMaAR7mgy6Qg1k_2FIYAnQA1K1QC2nYBb2XfghxGaiyL7iXz78&sai=AMfl-YTvK_-Wg3d_chbN__4jvEUh-T_7Nk9O1i88Q3RgNZ9jYFesGOMlWY8D3YLrGPWgPVRACf6b3kngNhkkk0ZD1deVfDMr8IL8WQcq23QQUocyKmWI0Fe4PGaXQ6kb2EFC97aLegDFk1dkx82Zc5pX3N-2My9GzqKmoXbtZKqjkwdSG50tH2YPegGMDgUVMMSSXCw8XPIQKKmoeG7ZcoT2UuXsocn5ZiS4BTxrd0Yof17K5fTCJxOwABbK2buSOho2k5jbBLTE9DQEQAooeuQUSZI-ICH7QFpxxz7tUQb83YVEdgu2HjnB4B3gOx773xuxP4QJ&sig=Cg0ArKJSzOg3g4ml0AdeEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1195&vt=11&dtpt=655&dett=3&cstd=536&cisv=r20240313.99246&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: coupons.service-r.work
URL: https://coupons.service-r.work/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:07 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 18 Mar 2024 19:22:07 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 142ms
142ms XHR
application/json 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20240313&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403130201/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

95fc8eab5281e9e7af69f61887de830707b7e6f345e557e8a8c1656fe7f45709

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12421
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 612ms
611ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202403130201/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 18 Mar 2024 19:22:08 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E27C 42 B
64 B 127ms
126ms Fetch
image/gif 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstScY35qj0CaLZdBmVQhXqnvYOMPByg6uHK5ErGBb4YJtSF740h1nmBLDhSWWX9y6mLVgc_ddm5rvdsberU1S1mjASzJdd1WX_58jad7TgNNgYfMN_-9P5_dJT688qcZObhZPEU3o-wR9mwfksindfio4eFEeLvmQA&sai=AMfl-YQ65Nui-1nB8xeJlz2h_CesAHc3vkflf8ewoPVbIYN0y9rTHWt8-aI4_e7Ncg1sAR9yeLTcGSKUqeJFmufEHRUF0LYHX461KLEVyWt8-VbF4QaTrdVA4XAdCEbYM2vSeeiV7NJgCTJpc86cSGel0A&sig=Cg0ArKJSzAMwYc5TZTA9EAE&cid=CAQSTwB7FLtq0SudVLdEVy9FB4EfRmhYS4PspqBhToK8wtfZfI36PboBhl0OtbKq4Vw6DP7HUNYV2B3On8dqRA3EAkln9QJAE4fd0T73twV6n0UYAQ&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=997,1000,1000,1000,1000&tos=997,3,0,0,0&v=20240313&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=293675611&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=672252600&rst=1710789725573&rpt=1015&met=ce&wmsd=0&pbe=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:07 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame D6BE 13 KB
5 KB 62ms
62ms Document
text/html 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://coupons.service-r.work/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 344304
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 14 Mar 2024 19:43:44 GMT
expires: Fri, 14 Mar 2025 19:43:44 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame FFE5 829 B
1 KB 222ms
87ms Document
text/html 2607:f8b0:4006:80e::2004

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2004 -, , ASN (),

Reverse DNS

Software

GSE /

Resource Hash

cfc54b2b5c5279e365c9ff9cf75b650327955ac6a1c24e46e87cc2de4caa85ab

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-eTItndlLdloxaD1AHSpwnw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://coupons.service-r.work/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-eTItndlLdloxaD1AHSpwnw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 18 Mar 2024 19:22:08 GMT
expires: Mon, 18 Mar 2024 19:22:08 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 J7jMHEcdr0lVSatsUU1en4le0CiJfA3--2xrJ7e0v4U.js Show response
pagead2.googlesyndication.com/bg/ Frame D6BE 40 KB
15 KB 65ms
64ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/J7jMHEcdr0lVSatsUU1en4le0CiJfA3--2xrJ7e0v4U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

27b8cc1c471daf495549ab6c514d5e9f895ed028897c0dfefb6c6b27b7b4bf85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Thu, 14 Mar 2024 19:36:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 344711
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15583
x-xss-protection: 0
last-modified: Mon, 11 Mar 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 14 Mar 2025 19:36:57 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame D6BE 0
10 B 64ms
64ms Image
text/plain 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?dgg0cA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Mon, 18 Mar 2024 19:22:08 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E27C 0
20 B 122ms
122ms Ping
image/gif 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=942751227601&version=m202402290101&ct=76&x=1&cor=8000004446891656000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Mar 2024 19:22:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame FFE5 0
0 123ms
122ms Image
text/html 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20240313&jk=2011834358434650&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 126ms
125ms Image
text/html 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20240313&jk=2011834358434650&bg=!w8ClwI_NAAY_ejuoH3o7ADQBe5WfOCG_lIareMKE5as43o_HonX79HXk_r-p6xqSMvMjhbeKzGkl1bZE6y3GxYOn_z2qAgAAAElSAAAAA2gBBwoAO9NvqIfHrdYYAm1HY3Ds39ROLVuN202wzh7s1wkwfMicMLFdsu_98Z1_g7GESnubDVO_G2MZWp5bFYMsmQLP0JImfx4pBxcw5YboGcEsm97lDGiamGd_i56cAxpeTX-dgG4BHsuM43AIXr-ZyKulG24X00nggYNazxb7qZDMOT0ZzIVs69foXh1Yitp-Oz2fBLBojopvkbb-fEKBuBGot7D9Xn1mDIUj-AeX_IewFZA9e6nbS9O7elhOO9cdJoG4eLfrPgQCbFUWwfoq75-7CTMoMW49fjkxffDGOHSR3-J1u3bALzf_OeURFkkhsrU4JBCWmbGb3To88KiWw7n2G2brY0A9OwID8hi8TLnNhv5SSJXcJLZuUX5l6-G34o_LY2kBAPJAExgkBcfkwAarjQi5Ze8bxxfRadRWAAgFfRoDaGCQ88wcMRFs9P5hIgeO1XzJVUzr65QMLYFD3FjHUa7L9yZN9iUhdDXqe1Rq2iRG9Vf7nPdRlm-Yita9EL6cc81Y3EKVzCLfT3Myqi4SgPh6Fy5HItqPJnSKnp-e5JyCc3I3wPhKXEDu6INJXuJBaUYi_bOOl_aKQ0eCE0JK7B-O0hiM3dlXMaxxXCHS60On5gXzcNWsWa-jdxeUUAK02Qbm1iry_xsG0B7-x8FNidU9EKicCafPnTX3jillXr03Vu5Mg2Cx99CIj90xMF_j2C3MJ3JgQHavwaPyJl2bIJuzme8tCWt4aVbrgOUzhymY5NnfCYq05NHkudiUVYiggEo2jyQmqwVrdYZzXI4Rgc_67G9cY9nSxaUwob_02hmkPqNMqZvKtFP15jGMFKRzCNc13AWp9rMUCiUEHn9QnT5iSAZJcFmgV5sH5uaoCCnsiRXEO3G6J-FDXBquUtLqT-U0aCSs4k8pIIJmCC8l3CF484Yfu8ehZstf34o7yRkK_MXtgbqB9Ac7jceQk6ns82InSan0n9eRVpC3ASsW2vEkjlIcii02sMJc3tIpRrGzIgAkTxI9RDN6r4BUKyJ3VL9Hvh8W_syUu4zWRJo
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://coupons.service-r.work/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

49 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

16 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.service-r.work/	1970-01-21 04:34:45	Name: __gads Value: ID=fe528d0cbfb24d81:T=1710789724:RT=1710789724:S=ALNI_MbDr0TMONLVgd0Wivmu2oMxYFrZGw
.service-r.work/	1970-01-21 04:34:45	Name: __gpi Value: UID=00000dd38cbbd5bd:T=1710789724:RT=1710789724:S=ALNI_Ma3cLPHyFeURcbwzzIukCS53nXfvQ
.service-r.work/	1970-01-20 23:32:21	Name: __eoi Value: ID=ef5729fe86f27e36:T=1710789724:RT=1710789724:S=AA-AfjaC4YhwVkoqsJtNTsZ9HX4U
.doubleclick.net/	1970-01-21 04:49:09	Name: IDE Value: AHWqTUk-hJhweU28Ed_wWJcUBJ7HOVu8maakRrzpvAllZ5irzaQUH1PqwLN305Qz
coupons.service-r.work/	1970-01-21 04:39:04	Name: _pk_id.17.fef0 Value: 2367fde519d2e074.1710789726.
coupons.service-r.work/	1970-01-20 19:13:11	Name: _pk_ses.17.fef0 Value: 1
.casalemedia.com/	1970-01-21 03:58:45	Name: CMID Value: ZfiUXcAoJHgAAARLAOVGLwAA
.casalemedia.com/	1970-01-20 21:22:45	Name: CMPS Value: 1566
.casalemedia.com/	1970-01-20 21:22:45	Name: CMPRO Value: 1566
.doubleclick.net/	1970-01-20 23:32:21	Name: APC Value: AfxxVi7Zsz10BnqDOUv0l3Y1qxc3N3V351uQm0bzNqx9n6JVREaxCw
.doubleclick.net/	1970-01-20 23:32:21	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 04:49:09	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-20 21:22:45	Name: XANDR_PANID Value: VYqgw5SymIG15BI0zEdbnLPjTYevrAgbd3FT14lDLj6dE6KHtcd_hpPlI2LWroxk6-2ug6RlX4QduDHseuBwXtxnE2cxrboUclanzveWifY.
.adnxs.com/	1970-01-20 21:22:45	Name: uuid2 Value: 635510787432805798
.googleadservices.com/	1970-01-20 21:22:45	Name: ar_debug Value: 1
.adnxs.com/	1970-01-20 21:22:45	Name: anj Value: dTM7k!M41.D>6NRF']wIg2GVNnk].$!]tbPl1M>e)ZlrFUfJ+tGXvX+AbXk`<>8wfIIKyFUDLKF<`Af`[80*bS7P]23If)y3KL9D3I?+dAZmgT

48 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://coupons.service-r.work/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
cm.g.doubleclick.net
code.createjs.com
coupons.service-r.work
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
lisinopril125.com
nttexpress.com
pagead2.googlesyndication.com
richlucky.xsrv.jp
s0.2mdn.net
tpc.googlesyndication.com
www.google.com
www.googleadservices.com
www.gstatic.com
104.18.36.155
142.250.72.98
142.251.35.162
183.90.228.46
2600:1400:9000::6875:b62a
2607:f8b0:4006:809::2006
2607:f8b0:4006:80b::2003
2607:f8b0:4006:80d::2003
2607:f8b0:4006:80d::200a
2607:f8b0:4006:80e::2001
2607:f8b0:4006:80e::2004
2607:f8b0:4006:817::2002
2607:f8b0:4006:823::2002
2a04:4e42::485
68.67.160.117
00836ddb4344d1fb83ade04db9d05bc3ed647989f2ce3168b1706e26e1be3eda
0585c17865b250df20a5c5dbf25274d44443f26d24ed58bbe3215dd54dd864b1
0b5a4e5208642cc79fa1cbf1c0bc831d41a4bbab2f3be66ae814dd26a9ba9bbf
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0d3ae0cfd0aab3dd0bc61dd281e7c754fe6dc489db03516bc561438fd4d57835
121726d42a4096e6429194ae038b8d2c739c169624cf4f0394dcb51cca6ddb1c
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
220a96f646d8b64eb709d9a8ec075d0fb512d857fe4fcbcdddb9b66d4885e700
2423c8239523d9ea95af38a02180c41376baf80a1bfe8128f400726a97c41a35
243c847c084bce46b9a57f7dd2740d8e47aa1fc8c315a229b1af460a5f02af61
27b8cc1c471daf495549ab6c514d5e9f895ed028897c0dfefb6c6b27b7b4bf85
2f4611b598af12323855fc5300325fd72987d10296222285778ee5aa79a1b670
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
32993a86c58685503a2a375f9ed0ec5813961836562a3b5656fd9eb149a27d4a
35afef1c028b611ee4c5deb2e17e7faf0f36bc1c998a4835a443ef5328e3d404
3ac3cffce45f3d3b0365f2c73152bc3623850dd4b97cf8449da23573c7d8ba30
3edca7294f70460740b307b1b70e7356a6165cb7a76c774f65398d0d052ac8c8
3eef7d3ccf1367fc6849dfea5b05d97395b2d3d8c009a11d3621dd5c68a3e8a0
41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
454987ac85d741e686f48be8fd9a076ac4f43b6baf4c33f4267ebbe298a06f0c
48ca88dd11efb5aac3f48e45d97a0984bbc37c63ee88e4a38c7e6c3ee21d7e41
49019f749e63e975ebe2380a9bfadaf73ce0ae801718a1fb5bcde0203fef25cc
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4f703849c5746dd9d3596d0ac8efb6164669f17e468e7c619a55c5329c34a10a
5226d6a2761b300aa6f7788d0920ff45aac64645191257d65dfd157e97d3ed20
5556151dd69cbf91629daae58b4ab847123a8ff70658d8bbc8a7b30d447829ef
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
594ea28ece633b47536a3549082809e82c6772e5f2f324f26f8bc0f5de6842d2
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5c65deff2a07f3a37ea3de624f630f223d33a6a683379e06021c6c816d794555
5e37a5df91b0ea8648ef4923fcec72c2bba1a56ed3c5d80de765078df38c06f6
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
68adc837a8ecebdca947ea943b682a67fbfae7ea98a7d285d444e18287946c7e
6917631db0f55ff9092fc23133bbd0a0f74a1cc28aad82162c463f5261437ed2
6cad5052d39ae84444d44c16d74f7595594feb3300d2b3aafe79d2d617c44778
6da498d8ee3978814178e82ad6f3d59e5012ad2d408ca1a2d55d834cd18502fb
6f4ddffa3a628df1cfb5d555c2f7fc8a9485773727a2567739f8a47af140c6e7
77799392603d0b38a9f72933aedec4daaa725b7f77cd17eb796f630adb6eb28b
7b2685ea894c514e15f58420b40933b08f0b2baa4cef2a68479acc9a01323b0a
81f3758a85cd5ce0de0ee6efa3e751c4927acdb7ec7d2190899d593e852b138a
84b524dcafa0a51d06e6c7fb6ea0ada30fbb90a79bfb0372eea6194feb986db0
874cad10027313f3620a770d4a338369833ed5b3913f0793cb8500361b19e6ea
8753541a3a44842cd815d81c4f8c589e0a0d763112d622f3088cd6f064e825fd
8eee421f2f9bdf38445ffe938ab5c0be29ef1855570c2cb871b55de50ac3521b
9151040be84927c7e12fe497ef65d29af26874d9df53c4e62bcbc43c4a668e83
9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287
95fc8eab5281e9e7af69f61887de830707b7e6f345e557e8a8c1656fe7f45709
9db7ffecd075e6337a3e046b38ac9bde5fe8e70d997335c1425a62e7378097eb
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a69df85c4cf31aa6d6eda030d8f0e9068e46da62ce6e9859c2fa37e3d983feb1
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2fe82cab3fc52b994366970d14068b398ccbb6699b496693474dea49564c18e
b39abd9035f703b76dfed940898d572b9864f676eb1912a9142f0639dca6b2ce
b4665fbd1c393f6a6340aa12fdfe61c9481dd3a6e9292a850feef98a621e89ba
bdb7d822d6afd1c8354749a111f68d56ce5e5db03b8a3028698acfc78358e06d
c8dfd584baddfa5edc68427cf9dd27bb6563aab08e3016bbd3bcd16948be78a0
c99f2da131e5339bc72a415d529420f012163b2e929ebbb950eee24403ae65ab
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
cdb7911dd984dc9b0840a0a94e711600b05dd72d612465fdb18ecfb67ea9e66c
cfc54b2b5c5279e365c9ff9cf75b650327955ac6a1c24e46e87cc2de4caa85ab
df7a397b8ce58f6251a395e02608b4f620e934a958bdfe6702c6f2033593eed0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5
e4ef32d9cbe1aae87a030055a413910355b58d0bd381b110e2d989900bbe18cf
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f63a92799f4f4f8331976aa0306b31e1af4d12b1ef2b5e2aac6d4bcfc706ed6f
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
ffae5b08a564118ecfe13a647ca0cffb74bac906390630d12a968329b2f004fb

coupons.service-r.work Open in urlscan Pro 183.90.228.46 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

106 Requests

94 %HTTPS

67 %IPv6

15 Domains

19 Subdomains

16 IPs

3 Countries

1766 kBTransfer

4563 kBSize

16 Cookies

0 Outgoing links

Page URL History

Redirected requests

106 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

coupons.service-r.work Open in urlscan Pro
183.90.228.46 Public Scan

Screenshot
Live screenshot

Full Image

106
Requests

94 %
HTTPS

67 %
IPv6

15
Domains

19
Subdomains

16
IPs

3
Countries

1766 kB
Transfer

4563 kB
Size

16
Cookies

106 HTTP transactions
4 data transactions