www.bonne-promo.com Open in urlscan Pro
18.159.80.129 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bon-et-reduction.com/
Effective URL:
https://www.bonne-promo.com/
Submission: On July 24 via api (July 24th 2021, 6:07:40 pm UTC) from KR

Summary HTTP 227 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 65 IPs in 8 countries across 66 domains to perform 227 HTTP transactions. The main IP is 18.159.80.129, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is www.bonne-promo.com.
TLS certificate: Issued by R3 on June 8th 2021. Valid for: 3 months.

This is the only time www.bonne-promo.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3 3	213.186.33.2 213.186.33.2	16276 (OVH) (OVH)
1 32	176.31.224.48 176.31.224.48	16276 (OVH) (OVH)
24	18.159.80.129 18.159.80.129	16509 (AMAZON-02) (AMAZON-02)
8	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
3	2606:4700:303... 2606:4700:3036::ac43:a1d1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:214... 2600:9000:214f:4800:2:cb38:840:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2001:4de0:ac1... 2001:4de0:ac18::1:a:1b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:82b::2008	15169 (GOOGLE) (GOOGLE)
13	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
1 2	2a02:2638:1::13 2a02:2638:1::13	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	178.250.0.157 178.250.0.157	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3	52.205.247.225 52.205.247.225	14618 (AMAZON-AES) (AMAZON-AES)
2	35.158.21.212 35.158.21.212	16509 (AMAZON-02) (AMAZON-02)
1	147.75.38.124 147.75.38.124	54825 (PACKET) (PACKET)
1	198.148.27.134 198.148.27.134	19189 (PULSEPOINT) (PULSEPOINT)
10	172.67.71.185 172.67.71.185	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 7	185.33.220.240 185.33.220.240	29990 (ASN-APPNEX) (ASN-APPNEX)
1	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c04::9a	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:800::2001	15169 (GOOGLE) (GOOGLE)
2	51.89.9.252 51.89.9.252	16276 (OVH) (OVH)
9	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
1	51.89.7.110 51.89.7.110	16276 (OVH) (OVH)
1	2.18.232.130 2.18.232.130	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2.18.233.180 2.18.233.180	16625 (AKAMAI-AS) (AKAMAI-AS)
1	198.148.27.140 198.148.27.140	19189 (PULSEPOINT) (PULSEPOINT)
1	185.64.189.115 185.64.189.115	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	185.86.137.132 185.86.137.132	201081 (SMARTADSE...) (SMARTADSERVER)
2 3	37.157.6.245 37.157.6.245	198622 (ADFORM) (ADFORM)
2 3	52.30.222.33 52.30.222.33	16509 (AMAZON-02) (AMAZON-02)
10 22	142.250.185.226 142.250.185.226	15169 (GOOGLE) (GOOGLE)
1	178.250.0.163 178.250.0.163	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3 3	213.19.147.45 213.19.147.45	26120 (RHYTHMONE) (RHYTHMONE)
4 4	76.223.111.131 76.223.111.131	16509 (AMAZON-02) (AMAZON-02)
1 17	185.64.190.80 185.64.190.80	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	38.91.45.7 38.91.45.7	398989 (DEEPINTENT) (DEEPINTENT)
1	63.251.232.170 63.251.232.170	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
1 2	104.111.242.53 104.111.242.53	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	2606:4700::68... 2606:4700::6812:d05	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	38.27.122.158 38.27.122.158	174 (COGENT-174) (COGENT-174)
1 1	18.210.5.212 18.210.5.212	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2a04:4e42:3::300 2a04:4e42:3::300	54113 (FASTLY) (FASTLY)
1	151.101.13.44 151.101.13.44	54113 (FASTLY) (FASTLY)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
2 2	185.29.135.233 185.29.135.233	30419 (MEDIAMATH...) (MEDIAMATH-INC)
2	185.64.189.114 185.64.189.114	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	169.50.137.190 169.50.137.190	36351 (SOFTLAYER) (SOFTLAYER)
1 1	2001:678:cb4:... 2001:678:cb4:bbbb::11	56396 (TURN) (TURN)
2 2	151.101.14.49 151.101.14.49	54113 (FASTLY) (FASTLY)
1	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
2 2	18.156.0.31 18.156.0.31	16509 (AMAZON-02) (AMAZON-02)
1	2a02:fa8:8806... 2a02:fa8:8806:20::2040	41041 (VCLK-EU-SE) (VCLK-EU-SE)
1	52.45.11.130 52.45.11.130	14618 (AMAZON-AES) (AMAZON-AES)
1 1	54.226.209.67 54.226.209.67	14618 (AMAZON-AES) (AMAZON-AES)
1 1	66.155.71.150 66.155.71.150	13768 (COGECO-PEER1) (COGECO-PEER1)
3 3	52.59.128.17 52.59.128.17	16509 (AMAZON-02) (AMAZON-02)
2 2	35.210.178.101 35.210.178.101	15169 (GOOGLE) (GOOGLE)
1 2	204.2.255.233 204.2.255.233	2914 (NTT-COMMU...) (NTT-COMMUNICATIONS-2914)
2 2	2620:116:800d... 2620:116:800d:21:5a23:9c4e:e774:96c1	16509 (AMAZON-02) (AMAZON-02)
1 1	52.48.175.241 52.48.175.241	16509 (AMAZON-02) (AMAZON-02)
1 1	45.35.192.162 45.35.192.162	40676 (AS40676) (AS40676)
2 2	35.156.198.184 35.156.198.184	16509 (AMAZON-02) (AMAZON-02)
1	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
3 5	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	185.94.180.126 185.94.180.126	35220 (SPOTX-AMS) (SPOTX-AMS)
1 1	185.33.223.178 185.33.223.178	29990 (ASN-APPNEX) (ASN-APPNEX)
1	185.255.84.152 185.255.84.152	200271 (IGUANE-) (IGUANE-)
1 1	185.183.112.155 185.183.112.155	60350 (VP) (VP)
5	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
1	185.64.190.81 185.64.190.81	62713 (AS-PUBMATIC) (AS-PUBMATIC)
5	2a00:1450:400... 2a00:1450:4001:82b::2001	15169 (GOOGLE) (GOOGLE)
2	3.66.136.156 3.66.136.156	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:830::2006	15169 (GOOGLE) (GOOGLE)
2	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
1 1	31.172.81.160 31.172.81.160	44066 (DE-FIRSTC...) (DE-FIRSTCOLO www.first-colo.net)
1 1	31.172.81.158 31.172.81.158	44066 (DE-FIRSTC...) (DE-FIRSTCOLO www.first-colo.net)
2 2	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
2 2	76.223.111.18 76.223.111.18	16509 (AMAZON-02) (AMAZON-02)
1 1	185.86.137.107 185.86.137.107	201081 (SMARTADSE...) (SMARTADSERVER)
1 1	35.158.176.66 35.158.176.66	16509 (AMAZON-02) (AMAZON-02)
227	65

3 213.186.33.2 (France) 3 redirects

ASN16276 (OVH, FR)
PTR: cluster002.ovh.net

bon-et-reduction.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.bon-et-reduction.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

32 176.31.224.48 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: ns3128297.ip-176-31-224.eu

codepromo.bonne-promo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
css.bonne-promo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.bonne-promo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 18.159.80.129 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com

www.bonne-promo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:3036::ac43:a1d1 (United States)

ASN13335 (CLOUDFLARENET, US)

go.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
g.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:4800:2:cb38:840:93a1 (United States)

ASN16509 (AMAZON-02, US)

go.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac18::1:a:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 216.58.212.162 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:1::13 (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.0.157 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.205.247.225 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-205-247-225.compute-1.amazonaws.com

pb-server.ezoic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.158.21.212 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-158-21-212.eu-central-1.compute.amazonaws.com

btlr.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.38.124 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.148.27.134 (New York, United States)

ASN19189 (PULSEPOINT, US)

bid.contextweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 172.67.71.185 (United States)

ASN13335 (CLOUDFLARENET, US)

prebid.smilewanted.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
csync.smilewanted.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.smilewanted.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 185.33.220.240 (Amsterdam, Netherlands) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.dk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.89.9.252 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ip252.ip-51-89-9.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.89.7.110 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: p23.id5-sync.com

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.232.130 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-130.deploy.static.akamaitechnologies.com

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.18.233.180 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-180.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.148.27.140 (New York, United States)

ASN19189 (PULSEPOINT, US)

bh.contextweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.115 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.86.137.132 (France) 1 redirects

ASN201081 (SMARTADSERVER, FR)

sync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.157.6.245 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.30.222.33 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-222-33.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 142.250.185.226 (United States) 10 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.0.163 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 213.19.147.45 (United Kingdom) 3 redirects

ASN26120 (RHYTHMONE, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 76.223.111.131 (United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: a97adde81b00f2ca4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 185.64.190.80 (United Kingdom) 1 redirects

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 38.91.45.7 (United States)

ASN398989 (DEEPINTENT, US)

match.deepintent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.251.232.170 (United States)

ASN29791 (VOXEL-DOT-NET, US)
PTR: ams-mon-1.sys.adgear.com

cm.adgrx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.242.53 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-53.deploy.static.akamaitechnologies.com

px.owneriq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:d05 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 38.27.122.158 (Chestertown, United States)

ASN174 (COGENT-174, US)

match.bnmla.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.210.5.212 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-210-5-212.compute-1.amazonaws.com

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:3::300 (United States) 1 redirects

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.13.44 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

match.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.29.135.233 (United Kingdom) 2 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.189.114 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 169.50.137.190 (United States)

ASN36351 (SOFTLAYER, US)
PTR: be.89.32a9.ip4.static.sl-reverse.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:678:cb4:bbbb::11 (United Kingdom) 1 redirects

ASN56396 (TURN, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.14.49 (Frankfurt am Main, Germany) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::8000 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.156.0.31 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:20::2040 (United States)

ASN41041 (VCLK-EU-SE, US)

pubmatic-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.45.11.130 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-11-130.compute-1.amazonaws.com

rtb.adentifi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.226.209.67 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-226-209-67.compute-1.amazonaws.com

sync.ipredictive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.155.71.150 (Portsmouth, United Kingdom) 1 redirects

ASN13768 (COGECO-PEER1, CA)

pixel-sync.sitescout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.59.128.17 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-59-128-17.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.210.178.101 (Brussels, Belgium) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 101.178.210.35.bc.googleusercontent.com

a.volvelle.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 204.2.255.233 (United States) 1 redirects

ASN2914 (NTT-COMMUNICATIONS-2914, US)

pmp.mxptint.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:5a23:9c4e:e774:96c1 (United States) 2 redirects

ASN16509 (AMAZON-02, US)

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.48.175.241 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-48-175-241.eu-west-1.compute.amazonaws.com

rtb.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.35.192.162 (United States) 1 redirects

ASN40676 (AS40676, US)

sync.resetdigital.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.156.198.184 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-198-184.eu-central-1.compute.amazonaws.com

ice.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2.18.234.21 (Frankfurt am Main, Germany) 3 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.94.180.126 (United States) 2 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.33.223.178 (Amsterdam, Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 824.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.255.84.152 (Villeneuve-le-Roi, France)

ASN200271 (IGUANE-, FR)

visitor.omnitagjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.183.112.155 (Paris, France) 1 redirects

ASN60350 (VP, FR)

sync.adotmob.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.dk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.190.81 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

simage4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.66.136.156 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com

g.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:830::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.172.81.160 (Germany) 1 redirects

ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE)

sync3.sniperlog.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.172.81.158 (Germany) 1 redirects

ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE)

sync.bumlam.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.227.252.103 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 76.223.111.18 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.86.137.107 (France) 1 redirects

ASN201081 (SMARTADSERVER, FR)

ssbsync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.158.176.66 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-158-176-66.eu-central-1.compute.amazonaws.com

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
56	bonne-promo.com 1 redirects codepromo.bonne-promo.com www.bonne-promo.com css.bonne-promo.com img.bonne-promo.com	333 KB
37	doubleclick.net 10 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net cm.g.doubleclick.net googleads.g.doubleclick.net googleads4.g.doubleclick.net	188 KB
25	pubmatic.com 1 redirects hbopenbid.pubmatic.com ads.pubmatic.com image6.pubmatic.com simage2.pubmatic.com image4.pubmatic.com image2.pubmatic.com simage4.pubmatic.com	36 KB
21	googlesyndication.com 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	200 KB
12	google.com 1 redirects adservice.google.com www.google.com	2 KB
10	2mdn.net s0.2mdn.net	604 KB
10	smilewanted.com prebid.smilewanted.com csync.smilewanted.com static.smilewanted.com	20 KB
9	adnxs.com 4 redirects ib.adnxs.com acdn.adnxs.com secure.adnxs.com	24 KB
7	google.dk adservice.google.dk	2 KB
5	ampproject.org cdn.ampproject.org	101 KB
5	casalemedia.com 3 redirects ssum-sec.casalemedia.com dsum-sec.casalemedia.com	5 KB
5	criteo.com 1 redirects gum.criteo.com mug.criteo.com dis.criteo.com	2 KB
4	adsrvr.org 4 redirects match.adsrvr.org	2 KB
3	bidswitch.net 3 redirects x.bidswitch.net	1 KB
3	yahoo.com 2 redirects pr-bh.ybp.yahoo.com ups.analytics.yahoo.com	2 KB
3	bidr.io 2 redirects match.prod.bidr.io	2 KB
3	adform.net 2 redirects c1.adform.net	1 KB
3	smartadserver.com 2 redirects sync.smartadserver.com ssbsync.smartadserver.com	889 B
3	sharethrough.com 1 redirects btlr.sharethrough.com match.sharethrough.com	588 B
3	ezoic.com pb-server.ezoic.com	2 KB
3	ezoic.net go.ezoic.net g.ezoic.net	2 KB
3	ezodn.com go.ezodn.com ezodn.com g.ezodn.com	185 KB
3	bon-et-reduction.com 3 redirects bon-et-reduction.com www.bon-et-reduction.com	674 B
2	3lift.com 2 redirects eb2.3lift.com	942 B
2	openx.net 2 redirects rtb.openx.net	764 B
2	googletagservices.com www.googletagservices.com	65 KB
2	spotxchange.com 2 redirects sync.search.spotxchange.com	1 KB
2	360yield.com 2 redirects ice.360yield.com	644 B
2	quantserve.com 2 redirects pixel.quantserve.com cms.quantserve.com	1 KB
2	mxptint.net 1 redirects pmp.mxptint.net	967 B
2	volvelle.tech 2 redirects a.volvelle.tech	1 KB
2	everesttech.net 2 redirects sync-tm.everesttech.net	768 B
2	mathtag.com 2 redirects sync.mathtag.com	1 KB
2	taboola.com 1 redirects trc.taboola.com match.taboola.com	654 B
2	tribalfusion.com 1 redirects a.tribalfusion.com s.tribalfusion.com	1 KB
2	owneriq.net 1 redirects px.owneriq.net	476 B
2	1rx.io 2 redirects sync.1rx.io	1 KB
2	onetag-sys.com onetag-sys.com	2 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	contextweb.com bid.contextweb.com bh.contextweb.com	1 KB
2	gstatic.com fonts.gstatic.com	30 KB
2	jquery.com code.jquery.com	97 KB
1	bumlam.com 1 redirects sync.bumlam.com	680 B
1	sniperlog.ru 1 redirects sync3.sniperlog.ru	369 B
1	adotmob.com 1 redirects sync.adotmob.com	652 B
1	omnitagjs.com visitor.omnitagjs.com	235 B
1	rubiconproject.com pixel.rubiconproject.com
1	resetdigital.co 1 redirects sync.resetdigital.co	485 B
1	gumgum.com 1 redirects rtb.gumgum.com	337 B
1	sitescout.com 1 redirects pixel-sync.sitescout.com	337 B
1	ipredictive.com 1 redirects sync.ipredictive.com	522 B
1	adentifi.com rtb.adentifi.com	88 B
1	dotomi.com pubmatic-match.dotomi.com	104 B
1	turn.com 1 redirects ad.turn.com	518 B
1	simpli.fi um.simpli.fi	609 B
1	rlcdn.com idsync.rlcdn.com	66 B
1	stackadapt.com 1 redirects sync.srv.stackadapt.com	645 B
1	bnmla.com match.bnmla.com	114 B
1	adgrx.com cm.adgrx.com	408 B
1	deepintent.com match.deepintent.com	44 B
1	unrulymedia.com 1 redirects sync.targeting.unrulymedia.com	535 B
1	id5-sync.com id5-sync.com	537 B
1	google.de www.google.de	522 B
1	a-mo.net prebid.a-mo.net	788 B
1	googletagmanager.com www.googletagmanager.com	39 KB
1	googleapis.com fonts.googleapis.com	851 B
227	66

	Domain	Requested by
24	img.bonne-promo.com	www.bonne-promo.com css.bonne-promo.com
24	www.bonne-promo.com	www.bonne-promo.com
18	cm.g.doubleclick.net	10 redirects googleads.g.doubleclick.net 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
13	securepubads.g.doubleclick.net	www.bonne-promo.com securepubads.g.doubleclick.net
12	simage2.pubmatic.com	1 redirects ads.pubmatic.com
10	s0.2mdn.net	www.bonne-promo.com s0.2mdn.net 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
10	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com googleads.g.doubleclick.net
9	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com www.bonne-promo.com 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
8	adservice.google.com	www.bonne-promo.com securepubads.g.doubleclick.net
7	csync.smilewanted.com	go.ezodn.com csync.smilewanted.com
7	adservice.google.dk	securepubads.g.doubleclick.net
7	ib.adnxs.com	3 redirects go.ezodn.com acdn.adnxs.com googleads.g.doubleclick.net
7	css.bonne-promo.com	www.bonne-promo.com code.jquery.com css.bonne-promo.com
5	cdn.ampproject.org	securepubads.g.doubleclick.net
5	image2.pubmatic.com	ads.pubmatic.com
4	match.adsrvr.org	4 redirects
4	www.google.com	1 redirects www.bonne-promo.com tpc.googlesyndication.com 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
3	dsum-sec.casalemedia.com	1 redirects googleads.g.doubleclick.net
3	googleads.g.doubleclick.net	www.bonne-promo.com 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
3	x.bidswitch.net	3 redirects
3	match.prod.bidr.io	2 redirects ads.pubmatic.com
3	c1.adform.net	2 redirects ads.pubmatic.com
3	ads.pubmatic.com	go.ezodn.com ads.pubmatic.com csync.smilewanted.com
3	pb-server.ezoic.com	go.ezodn.com onetag-sys.com
2	eb2.3lift.com	2 redirects
2	rtb.openx.net	2 redirects
2	googleads4.g.doubleclick.net	www.bonne-promo.com
2	www.googletagservices.com	securepubads.g.doubleclick.net 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
2	g.ezoic.net	www.bonne-promo.com
2	sync.search.spotxchange.com	2 redirects
2	ssum-sec.casalemedia.com	2 redirects
2	ice.360yield.com	2 redirects
2	pmp.mxptint.net	1 redirects ads.pubmatic.com
2	a.volvelle.tech	2 redirects
2	ups.analytics.yahoo.com	2 redirects
2	sync-tm.everesttech.net	2 redirects
2	image4.pubmatic.com	ads.pubmatic.com
2	sync.mathtag.com	2 redirects
2	px.owneriq.net	1 redirects ads.pubmatic.com
2	sync.1rx.io	2 redirects
2	sync.smartadserver.com	1 redirects csync.smilewanted.com
2	onetag-sys.com	go.ezodn.com
2	13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	prebid.smilewanted.com	go.ezodn.com
2	btlr.sharethrough.com	go.ezodn.com
2	mug.criteo.com	www.bonne-promo.com
2	gum.criteo.com	1 redirects
2	fonts.gstatic.com	fonts.googleapis.com
2	code.jquery.com	www.bonne-promo.com
2	bon-et-reduction.com	2 redirects
1	match.sharethrough.com	1 redirects
1	ssbsync.smartadserver.com	1 redirects
1	sync.bumlam.com	1 redirects
1	sync3.sniperlog.ru	1 redirects
1	cms.quantserve.com	1 redirects
1	simage4.pubmatic.com	ads.pubmatic.com
1	sync.adotmob.com	1 redirects
1	visitor.omnitagjs.com	csync.smilewanted.com
1	secure.adnxs.com	1 redirects
1	pixel.rubiconproject.com	csync.smilewanted.com
1	sync.resetdigital.co	1 redirects
1	rtb.gumgum.com	1 redirects
1	pixel.quantserve.com	1 redirects
1	pixel-sync.sitescout.com	1 redirects
1	sync.ipredictive.com	1 redirects
1	rtb.adentifi.com	ads.pubmatic.com
1	pubmatic-match.dotomi.com	ads.pubmatic.com
1	pr-bh.ybp.yahoo.com	ads.pubmatic.com
1	ad.turn.com	1 redirects
1	um.simpli.fi	ads.pubmatic.com
1	idsync.rlcdn.com	ads.pubmatic.com
1	match.taboola.com	ads.pubmatic.com
1	trc.taboola.com	1 redirects
1	sync.srv.stackadapt.com	1 redirects
1	match.bnmla.com	ads.pubmatic.com
1	s.tribalfusion.com	ads.pubmatic.com
1	a.tribalfusion.com	1 redirects
1	cm.adgrx.com	ads.pubmatic.com
1	match.deepintent.com	ads.pubmatic.com
1	sync.targeting.unrulymedia.com	1 redirects
1	dis.criteo.com	ads.pubmatic.com
1	static.smilewanted.com	csync.smilewanted.com
1	image6.pubmatic.com	ads.pubmatic.com
1	bh.contextweb.com	go.ezodn.com
1	acdn.adnxs.com	go.ezodn.com
1	id5-sync.com	go.ezodn.com
1	www.google.de	www.bonne-promo.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	hbopenbid.pubmatic.com	go.ezodn.com
1	bid.contextweb.com	go.ezodn.com
1	prebid.a-mo.net	go.ezodn.com
1	g.ezodn.com	ezodn.com
1	ezodn.com	www.bonne-promo.com
1	www.googletagmanager.com	www.bonne-promo.com
1	go.ezoic.net	www.bonne-promo.com
1	fonts.googleapis.com	www.bonne-promo.com
1	go.ezodn.com	www.bonne-promo.com
1	codepromo.bonne-promo.com	1 redirects
1	www.bon-et-reduction.com	1 redirects
227	100

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
accounts.google.com
www.bon-reduc.com
www.ezoic.com

Subject Issuer	Validity	Valid
bonne-promo.com R3	`2021-06-08` - `2021-09-06`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-05` - `2022-07-04`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.ezoic.net Amazon	`2021-02-15` - `2022-03-16`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-06-27` - `2021-09-24`	3 months	crt.sh
*.ezoic.com Sectigo RSA Domain Validation Secure Server CA	`2021-04-19` - `2022-05-20`	a year	crt.sh
*.sharethrough.com Amazon	`2020-09-09` - `2021-10-11`	a year	crt.sh
*.a-mo.net R3	`2021-07-16` - `2021-10-14`	3 months	crt.sh
*.contextweb.com DigiCert SHA2 Secure Server CA	`2020-05-07` - `2022-05-12`	2 years	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2020-12-07` - `2021-12-14`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.google.dk GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
onetag-sys.com R3	`2021-05-02` - `2021-07-31`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.id5-sync.com R3	`2021-07-13` - `2021-10-11`	3 months	crt.sh
cdn.adnxs.com GeoTrust RSA CA 2018	`2021-03-11` - `2022-02-07`	a year	crt.sh
*.smartadserver.com DigiCert ECC Secure Server CA	`2020-01-30` - `2022-02-03`	2 years	crt.sh
track.adform.net DigiCert SHA2 Secure Server CA	`2019-09-16` - `2021-09-20`	2 years	crt.sh
*.match.prod.bidr.io Amazon	`2021-02-26` - `2022-03-27`	a year	crt.sh
*.deepintent.com Go Daddy Secure Certificate Authority - G2	`2020-04-09` - `2022-06-08`	2 years	crt.sh
public1.adgear.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-24` - `2022-03-26`	a year	crt.sh
*.owneriq.net GeoTrust RSA CA 2018	`2021-01-29` - `2022-02-02`	a year	crt.sh
*.bnmla.com Go Daddy Secure Certificate Authority - G2	`2021-01-06` - `2022-02-07`	a year	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-25` - `2021-12-26`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-25` - `2022-03-28`	a year	crt.sh
*.simpli.fi DigiCert SHA2 Secure Server CA	`2019-09-18` - `2021-12-12`	2 years	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-03-29` - `2021-09-22`	6 months	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2019-06-19` - `2021-08-31`	2 years	crt.sh
adentifi.com Amazon	`2020-10-02` - `2021-11-02`	a year	crt.sh
*.mxptint.net DigiCert TLS RSA SHA256 2020 CA1	`2021-06-29` - `2022-07-07`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2020-12-18` - `2022-01-18`	a year	crt.sh
omnitagjs.com Sectigo RSA Domain Validation Secure Server CA	`2021-05-24` - `2022-06-23`	a year	crt.sh
misc-sni.google.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
ezoic.net R3	`2021-07-22` - `2021-10-20`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh

This page contains 37 frames:

Primary Page: https://www.bonne-promo.com/
Frame ID: 6D8F4FD38DC8A4F073E52BFA058F38C4
Requests: 115 HTTP requests in this frame

Frame: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 3C19E8F293CD5A6E5F0C9698BDE2025D
Requests: 1 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?redir=https%3A%2F%2Fpb-server.ezoic.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BUSER_TOKEN%7D
Frame ID: 10B5C3F7BE5705E9A04088BD5424544C
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 64A5CD6C063C841F4464E40E5545A55C
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: BE0A22225CEC5F8B551015FB101AF1D6
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: E734F22C729D0EC9E685EED401B55216
Requests: 3 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?cb=1627150044547&us_privacy=1---
Frame ID: C3876D266CAE90A2E8A4D1C006B9BF8E
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Frame ID: 71CED3650D463482F1DAA646D60CBB91
Requests: 26 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: A2620FE5DB26D8E4035F298BB25E2831
Requests: 2 HTTP requests in this frame

Frame: https://bh.contextweb.com/visitormatch
Frame ID: 502B1727E5AF9E61C820004F1B78D86C
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: E6453346338C6C8A47CC35FC0652676C
Requests: 1 HTTP requests in this frame

Frame: https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsmart%2F%5Bsas_uid%5D&cklb=1
Frame ID: 12BA39FA4EB6F3994D1706CEBFE6F851
Requests: 1 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=AE435053-9948-4944-AE8E-BD542B8CAC59
Frame ID: 2E76DD0A282A6BBD84502051B1E13D05
Requests: 1 HTTP requests in this frame

Frame: https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
Frame ID: 896DD96000CA3702309C226ECDA0223F
Requests: 1 HTTP requests in this frame

Frame: https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Frame ID: 657A4BB8BD7802D5549FFF6D19F9C6D8
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-5ed04603-0c4d-4893-9851-43271a6ef1a9-003
Frame ID: 65AF4356E99D784D1F975F76BB52284F
Requests: 1 HTTP requests in this frame

Frame: https://match.deepintent.com/usersync/141?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw%26piggybackCookie%3D%24%7BDI_USER_ID%7D&gdpr=0&gdpr_consent=
Frame ID: 81CD5F0D19F6AADD4FFCEE939D10C4BA
Requests: 1 HTTP requests in this frame

Frame: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Frame ID: 0637154CF7482DD4D60A77F0C8709AC1
Requests: 1 HTTP requests in this frame

Frame: https://px.owneriq.net/noop?ct=image%2Fgif
Frame ID: 6255F30E6A8547A5CE3E2D6794031CA8
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Frame ID: 87BE8B046A84FD5D15228574C4FD5008
Requests: 1 HTTP requests in this frame

Frame: https://match.bnmla.com/usersync?sspid=10738&redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw%26piggybackCookie%3D%5BUUID%5D
Frame ID: C38DC4D107F35CEA81E633E8180D6789
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=DYlBNCjcSu1oSFJUj0WPMlJmFNs
Frame ID: CF1734B88DACA75910807BE6EFC699A5
Requests: 1 HTTP requests in this frame

Frame: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=ba8d6097-208e-423e-bee7-422e8d0340c1-tuct7f5dc5f&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Frame ID: 2A0276D906CFFAD19363F5D81D06F42D
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/improve/e77e7ca9-0314-431b-8df1-cfe6370a180d&partner_id=1010
Frame ID: E756E1CD9F391FF21C90C6407C70C94A
Requests: 1 HTTP requests in this frame

Frame: https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-smilewanted
Frame ID: 7D433DE185A943C3FF412E0CD1C51C8E
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Frame ID: 78A228CA407F6A2096350E2993BD2BAA
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/indexexchange/YPxW4CNvB0dZtdxZdLAQvgAA%26652
Frame ID: 0C0818A1F7CC280422925C38DD94A601
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/spotx/01a7fb8e-ecaa-11eb-9fa9-1860f0710106
Frame ID: 5E1C6E0B2156F2B32FDF4BEC3B109602
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/appnexus/7940331768660304726
Frame ID: 16B959F26A5AF7E12C3DDC8A5D537C67
Requests: 1 HTTP requests in this frame

Frame: https://visitor.omnitagjs.com/visitor/bsync?uid=abf65ec65b3e06310c52d0850494081a&name=SMILE_WANTED&url=%20https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadyoulike%2F%5BBUYER_USERID%5D
Frame ID: BD74BAA8279FA1DCDE4995916B7AEA9B
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adotmob/068122042727ebb516db7864
Frame ID: 2B31C4A84E17CFBCD8443D499BDA761A
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012107130206000/amp4ads-v0.mjs
Frame ID: 06B7EE9FF1347C75E09D2B36772AFB73
Requests: 12 HTTP requests in this frame

Frame: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: A56D6639397A9987BFF9FD324E264910
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL3J7wIQ9bTT8wEYn52RrwEwAQ&v=APEucNUnUsVwAl1OFBRPRK3XBABJAF2PmWgBTdTz0AqaAYa8XE61S4clIltr2PxlXb9Lu-P9p6oh1AIydLJNfgt2DDIF3XGM7HKkUbittU_AZTyEJRX0_I_LD4Le7jmsm-rURourllV1uR2KBB4Nku-UzdYSP8fbDK1cBgLRXfqsUWE2poRCkiqwyg7RCooYPHJ0v0S2YSAI3kyB7vfps87kTU2uA505WA
Frame ID: 14BD2DE76E7F310080DD2460BA79980B
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 9CD3B24AFBE86D42B27FFB6178D37461
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: CBB7D33E8B67C975A0999547DEA29CAD
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/1798194350119714816/index.html
Frame ID: 62F1C7557A5BA2F53FE9BF5FEC11F179
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://bon-et-reduction.com/ HTTP 301
https://bon-et-reduction.com/ HTTP 301
https://www.bon-et-reduction.com/ HTTP 301
https://codepromo.bonne-promo.com/ HTTP 301
https://www.bonne-promo.com/ Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

227
Requests

100 %
HTTPS

31 %
IPv6

66
Domains

100
Subdomains

65
IPs

8
Countries

1957 kB
Transfer

4427 kB
Size

21
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/v2.2/dialog/oauth?client_id=1803504819720309&redirect_uri=https://www.bonne-promo.com/connect_facebook.php&response_type=code&state={%22go%22:%22https:\/\/www.bonne-promo.com\/%22,%22ts%22:1627150043}&scope=email
Title: Se connecter avec Facebook

Search URL Search Domain Scan URL

URL: https://accounts.google.com/o/oauth2/auth?response_type=code&access_type=online&client_id=1093255337947-ssvu3o6c760s33l5ugcad83t15t00h67.apps.googleusercontent.com&redirect_uri=https%3A%2F%2Fwww.bonne-promo.com%2Fconnect_google.php&state=eyJnbyI6Imh0dHBzOi8vd3d3LmJvbm5lLXByb21vLmNvbS8ifQ%3D%3D&scope=openid%20email%20profile&approval_prompt=auto
Title: Se connecter avec Google

Search URL Search Domain Scan URL

URL: https://www.bon-reduc.com/
Title: BON-REDUC

Search URL Search Domain Scan URL

URL: https://www.ezoic.com/what-is-ezoic/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bon-et-reduction.com/ HTTP 301
https://bon-et-reduction.com/ HTTP 301
https://www.bon-et-reduction.com/ HTTP 301
https://codepromo.bonne-promo.com/ HTTP 301
https://www.bonne-promo.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 32

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bonne-promo.com%2F&domain=www.bonne-promo.com&cw=1 HTTP 302
https://mug.criteo.com/sid?cpp=ec4EoXxLa2o2QVYraHY1Umw2VWlaM2RFK0J5bHovcVhFUnZKaE1zcFRmeFRZMTVOTU1sc1RxTUhWNWM5Y2ZqU3lJd0oxd29PMUI0T2xiYlg2dWM1L3R6Q01UYVlETmFTL2w4Z0NPTE9rZU1wNU1Cc0UwNXRJRUkzMzNxYUdqcE9LeU1wVFJJVVN6Y0kxcVEzWHpnSjdTclZpaXJBSnR1dFFhVDZJZFljOGN0NnNhSmRJdzBlWC9tYVpqWGhqTTVObWpFM1VPd2JoVHFWWGJSSlJqczdrblNSRDVJbkhLYW9mVnlYYVEzK2ZTczRwcVlNPXw&cppv=2

Request Chain 93

https://ib.adnxs.com/async_usersync?cbfn=queuePixels HTTP 307
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

Request Chain 100

https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid] HTTP 302
https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsmart%2F%5Bsas_uid%5D&cklb=1

Request Chain 101

https://c1.adform.net/serving/cookie/match?party=14&cid=AE435053-9948-4944-AE8E-BD542B8CAC59 HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=AE435053-9948-4944-AE8E-BD542B8CAC59

Request Chain 102

https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent= HTTP 303
https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1 HTTP 303
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDTnpVN0ItSzRBQUZoLTdiWF9mQQ&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1

Request Chain 104

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5338638681 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5338638681 HTTP 302
https://sync.1rx.io/usersync/tradedesk/315c48e3-25a3-42fc-a569-cdc3759612af HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-5ed04603-0c4d-4893-9851-43271a6ef1a9-003?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-5ed04603-0c4d-4893-9851-43271a6ef1a9-003 HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-5ed04603-0c4d-4893-9851-43271a6ef1a9-003

Request Chain 107

https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
https://px.owneriq.net/noop?ct=image%2Fgif

Request Chain 108

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP 302
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}

Request Chain 110

https://sync.srv.stackadapt.com/sync?nid=11 HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=DYlBNCjcSu1oSFJUj0WPMlJmFNs

Request Chain 111

https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID HTTP 302
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=ba8d6097-208e-423e-bee7-422e8d0340c1-tuct7f5dc5f&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0

Request Chain 112

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=rkNQU5lISUSujr1UK4ysWQ%3D%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=rkNQU5lISUSujr1UK4ysWQ%3D%3D&google_tc= HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

Request Chain 114

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=75cf60fc-56df-4700-8751-60ee4612ce19

Request Chain 115

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QUU0MzUwNTMtOTk0OC00OTQ0LUFFOEUtQkQ1NDJCOENBQzU5&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QUU0MzUwNTMtOTk0OC00OTQ0LUFFOEUtQkQ1NDJCOENBQzU5&gdpr=0&gdpr_consent=&google_tc= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 116

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm=&google_sc=&gdpr=0&gdpr_consent=&google_tc= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEO84z_SemPcowxtPibN5Fpg&google_cver=1

Request Chain 118

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2664328602621352134&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 119

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&_test=YPxW3wADC3uviwAC HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YPxW3wADC3uviwAC&gdpr=0&gdpr_consent=&_test=YPxW3wADC3uviwAC

Request Chain 120

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=315c48e3-25a3-42fc-a569-cdc3759612af

Request Chain 121

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:e91560fc-56df-4b00-ad55-689152560648&gdpr=0&gdpr_consent=

Request Chain 123

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=AE435053-9948-4944-AE8E-BD542B8CAC59&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=AE435053-9948-4944-AE8E-BD542B8CAC59&redir=true&gdpr=0&gdpr_consent=&verify=true HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-lrsY.UJE2uVA7RV1q0h9NgJRyMfOumM-~A&gdpr=0&gdpr_consent=

Request Chain 124

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7940331768660304726&gdpr=0&gdpr_consent=

Request Chain 127

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=01d4f13b-ecaa-11eb-bfce-bf3d145fec43&gdpr=0&gdpr_consent=

Request Chain 128

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=no-consent&gdpr=1&gdpr_consent=

Request Chain 129

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://a.volvelle.tech/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_uid=3148c584-ca6a-4474-8ba1-0ad1f569734b HTTP 302
https://a.volvelle.tech/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_uid=3148c584-ca6a-4474-8ba1-0ad1f569734b HTTP 302
https://x.bidswitch.net/sync?dsp_id=190&expires=14&user_group=1&user_id=8f07bcc4-9e77-46f1-985f-4f09937cc881&ssp=pubmatic HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=3148c584-ca6a-4474-8ba1-0ad1f569734b&gdpr=&gdpr_consent=&gdpr_pd=

Request Chain 130

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R1B342_E0BBAA22_103486041&r=https://pmp.mxptint.net/sn.ashx?ak=1 HTTP 302
https://pmp.mxptint.net/sn.ashx?ak=1

Request Chain 131

https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=ucICdLrEASeiw1EmucBJIO3KAS6iw1xyv8D_Gf-S

Request Chain 132

https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_ac274344-d587-482b-bc5b-4f90c54980f2

Request Chain 133

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=2641632458245132337

Request Chain 134

https://sync.resetdigital.co:10001/csync/pubmatic HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=00000072D1EA6FB1

Request Chain 135

https://ice.360yield.com/server_match?r=https://csync.smilewanted.com/set_partner_userid_get/improve/{PUB_USER_ID}&partner_id=1010 HTTP 302
https://ice.360yield.com/ul_cb/server_match?r=https://csync.smilewanted.com/set_partner_userid_get/improve/%7BPUB_USER_ID%7D&partner_id=1010 HTTP 302
https://csync.smilewanted.com/set_partner_userid_get/improve/e77e7ca9-0314-431b-8df1-cfe6370a180d&partner_id=1010

Request Chain 138

https://ssum-sec.casalemedia.com/usermatchredir?s=193216&cb=https://csync.smilewanted.com/set_partner_userid_get/indexexchange/ HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Findexexchange%2F&s=193216&C=1 HTTP 302
https://csync.smilewanted.com/set_partner_userid_get/indexexchange/YPxW4CNvB0dZtdxZdLAQvgAA%26652

Request Chain 139

https://sync.search.spotxchange.com/partner?adv_id=178357&redir=https://csync.smilewanted.com/set_partner_userid_get/spotx/$SPOTX_USER_ID HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=178357&redir=https://csync.smilewanted.com/set_partner_userid_get/spotx/$SPOTX_USER_ID&__user_check__=1&sync_id=01a7fbf7-ecaa-11eb-9fa9-1860f0710106 HTTP 302
https://csync.smilewanted.com/set_partner_userid_get/spotx/01a7fb8e-ecaa-11eb-9fa9-1860f0710106

Request Chain 140

https://secure.adnxs.com/getuid?https://csync.smilewanted.com/set_partner_userid_get/appnexus/$UID HTTP 302
https://csync.smilewanted.com/set_partner_userid_get/appnexus/7940331768660304726

Request Chain 142

https://sync.adotmob.com/cookie/smilewanted?r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadotmob%2F{amob_user_id} HTTP 302
https://csync.smilewanted.com/set_partner_userid_get/adotmob/068122042727ebb516db7864

Request Chain 174

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 198

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEES9CCq4xXgH_jcoyT7oiK4&google_cver=1

Request Chain 199

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YPxW4CNvB0dZtdxZdLAQvgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEES9CCq4xXgH_jcoyT7oiK4&google_cver=1

Request Chain 200

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEATVLPm9ExnF2SKcj_QymVs&google_cver=1

Request Chain 201

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk0MDMzMTc2ODY2MDMwNDcyNg%3D%3D

Request Chain 208

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEDBsw279AEyrWRg8JmGXL3c&google_cver=1&google_push=AYg5qPJrFDXtrs-FiI9bIuAHgt0io5wYuKA9uum3Ig85XrJxfay6t67-__9p_smbW3H8Hqpj2DqNbTuDy4DtEsMbdq-J8TktPzo HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJrFDXtrs-FiI9bIuAHgt0io5wYuKA9uum3Ig85XrJxfay6t67-__9p_smbW3H8Hqpj2DqNbTuDy4DtEsMbdq-J8TktPzo&google_hm=bpIekCnMuYWmDFX8vaAEEw

Request Chain 209

https://sync3.sniperlog.ru/?src=ggl_nga&google_gid=CAESEP1653HEYRoKnH_MJIAtgYA&google_cver=1&google_push=AYg5qPIkS0rNcStAA7drrlYD4P9gzO265rJRkLA5bN_2yQQn5-Toe2uRlSXVBH1gVrjh-bSeMkspBovBaa3gyyibLFPGWUaNWtY HTTP 301
https://sync.bumlam.com/?src=ggl_nga&google_gid=CAESEP1653HEYRoKnH_MJIAtgYA&google_cver=1&google_push=AYg5qPIkS0rNcStAA7drrlYD4P9gzO265rJRkLA5bN_2yQQn5-Toe2uRlSXVBH1gVrjh-bSeMkspBovBaa3gyyibLFPGWUaNWtY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AYg5qPIkS0rNcStAA7drrlYD4P9gzO265rJRkLA5bN_2yQQn5-Toe2uRlSXVBH1gVrjh-bSeMkspBovBaa3gyyibLFPGWUaNWtY

Request Chain 210

https://rtb.openx.net/sync/dds?google_gid=CAESEHCkNnUynnPiAPuQJ-FCjO0&google_cver=1&google_push=AYg5qPJJXjOyU8ytWQoZTfnYl7Rag6OOQMQvlQxJVj4qmuMHI4_GRP5CMgBSg68OwWP6Aw1ZQlhqchbZ4Xpe2Jj7mkIX2k-1BxcN HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESEHCkNnUynnPiAPuQJ-FCjO0&google_cver=1&google_push=AYg5qPJJXjOyU8ytWQoZTfnYl7Rag6OOQMQvlQxJVj4qmuMHI4_GRP5CMgBSg68OwWP6Aw1ZQlhqchbZ4Xpe2Jj7mkIX2k-1BxcN&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJJXjOyU8ytWQoZTfnYl7Rag6OOQMQvlQxJVj4qmuMHI4_GRP5CMgBSg68OwWP6Aw1ZQlhqchbZ4Xpe2Jj7mkIX2k-1BxcN&google_hm=zybn6gb-z7c_VlptTdrTcQ==

Request Chain 211

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEBjrNZJe_7c7Eb_pMp6Eins&google_cver=1&google_push=AYg5qPJNqCYAdjQb-kADvHacWf5UZuOUMS9l2coNKTGJIR6s0OdowgZjJoE5z2t_tBvaFMwrcz8V37QRaYfPyXmIBbR35q6RC8lC HTTP 302
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPJNqCYAdjQb-kADvHacWf5UZuOUMS9l2coNKTGJIR6s0OdowgZjJoE5z2t_tBvaFMwrcz8V37QRaYfPyXmIBbR35q6RC8lC&google_gid=CAESEBjrNZJe_7c7Eb_pMp6Eins HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTE1Nzk0MDIyNTY4Njc2NzA4NzI%3D&google_push=AYg5qPJNqCYAdjQb-kADvHacWf5UZuOUMS9l2coNKTGJIR6s0OdowgZjJoE5z2t_tBvaFMwrcz8V37QRaYfPyXmIBbR35q6RC8lC

Request Chain 212

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEHAF9iSbRaP78GUPkN4L38M&google_cver=1&google_push=AYg5qPJA2X6iHtKoJAthT6JsVYOPQCBqVt1_5CfvAVwWeZPKOhDrNmSPY0Di72kMF7KfpKFZYob9V3x3ahBDoBGM5pcnnK4xh08 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPJA2X6iHtKoJAthT6JsVYOPQCBqVt1_5CfvAVwWeZPKOhDrNmSPY0Di72kMF7KfpKFZYob9V3x3ahBDoBGM5pcnnK4xh08&google_hm=NjY2ODQyOTc4NTIwMTAxNjYzMA%3D%3D

Request Chain 213

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEMemrSIxH9CSbugJ5mVybu4&google_cver=1&google_push=AYg5qPL4Hb0wAb8QCbBu52-CdAe3LjoIykkSDGUj9FUYy4kOekOIn9fB6VCV96JQkb30_U148eWZ94406lH0Rp7FiLlhkh9gLnSiog HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ODIxODZkMDAtMDNiYy00N2U5LWE4OTEtYjI5NmE1MTRhMjQ1&google_push=AYg5qPL4Hb0wAb8QCbBu52-CdAe3LjoIykkSDGUj9FUYy4kOekOIn9fB6VCV96JQkb30_U148eWZ94406lH0Rp7FiLlhkh9gLnSiog

Request Chain 214

https://ads.avads.net/sync/ggl?google_gid=CAESEFwUuHEOBvpC1nL5YTprC-4&google_cver=1&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://ads.avads.net/sync/ggl?google_gid=CAESEFwUuHEOBvpC1nL5YTprC-4&google_cver=1&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA&av_tc=True HTTP 302
https://ads.avads.net/sync/ggl?google_gid=CAESEFwUuHEOBvpC1nL5YTprC-4&google_cver=1&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA

227 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.bonne-promo.com/
Redirect Chain

http://bon-et-reduction.com/
https://bon-et-reduction.com/
https://www.bon-et-reduction.com/
https://codepromo.bonne-promo.com/
https://www.bonne-promo.com/

151 KB
39 KB

579ms
482ms

Document
text/html

18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bonne-promo.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-159-80-129.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

6c4a7041279c1f3b233e93a709698658b8c07c00f4c125f56eb902bd6f76a6f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.bonne-promo.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: PHPSESSID=csvnv9dhq3kqvsq2f0u8i0jtig; csvnv9dhq3kqvsq2f0u8i0jtig=ufesq9iakjvtfmt52ge1nnau8v
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cache-control: max-age=0, must-revalidate, no-cache, no-store
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 24 Jul 2021 18:07:23 GMT
display: pub_site_sol
expires: Fri, 23 Jul 2021 18:07:23 GMT
pagespeed: off
pragma: no-cache
response: 200
server: nginx
set-cookie: ezoadgid_258923=-1; Path=/; Domain=bonne-promo.com; Expires=Sat, 24 Jul 2021 18:37:23 UTC ezoref_258923=; Path=/; Domain=bonne-promo.com; Expires=Sat, 24 Jul 2021 20:07:23 UTC ezoab_258923=mod31-c; Path=/; Domain=bonne-promo.com; Expires=Sat, 24 Jul 2021 20:07:23 UTC active_template::258923=pub_site.1627150043; Path=/; Domain=bonne-promo.com; Expires=Mon, 26 Jul 2021 18:07:23 UTC ezopvc_258923=1; Path=/; Domain=bonne-promo.com; Expires=Sat, 24 Jul 2021 18:37:23 UTC ezepvv=0; Path=/; Domain=bonne-promo.com; Expires=Sun, 25 Jul 2021 18:07:23 UTC ezovid_258923=1643568915; Path=/; Domain=bonne-promo.com; Expires=Sat, 24 Jul 2021 18:37:23 UTC lp_258923=https://www.bonne-promo.com/; Path=/; Domain=bonne-promo.com; Expires=Sat, 24 Jul 2021 18:37:23 UTC ezovuuidtime_258923=1627150043; Path=/; Domain=bonne-promo.com; Expires=Mon, 26 Jul 2021 18:07:23 UTC ezovuuid_258923=1f5c861d-7aa2-4d86-6910-162e89dd2305; Path=/; Domain=bonne-promo.com; Expires=Sat, 24 Jul 2021 18:37:23 UTC ezCMPCCS=false; Path=/; Domain=bonne-promo.com; Expires=Sun, 24 Jul 2022 18:07:23 GMT
vary: Accept-Encoding Accept-Encoding,User-Agent
x-content-type-options: nosniff
x-ez-proxy-out: true 2.3
x-frame-options: DENY
x-middleton-display: pub_site_sol
x-middleton-response: 200
x-sol: pub_site
x-xss-protection: 1; mode=block

Redirect headers

date: Sat, 24 Jul 2021 18:07:23 GMT
server: Apache/2
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=csvnv9dhq3kqvsq2f0u8i0jtig; path=/; domain=.bonne-promo.com PHPSESSID=csvnv9dhq3kqvsq2f0u8i0jtig; expires=Sun, 08-Aug-2021 18:07:23 GMT; Max-Age=1296000; path=/; domain=.bonne-promo.com csvnv9dhq3kqvsq2f0u8i0jtig=ufesq9iakjvtfmt52ge1nnau8v; path=/; domain=.bonne-promo.com
location: https://www.bonne-promo.com
vary: User-Agent
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 35ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bonne-promo.com

Requested by

Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 dall.js Show response
go.ezodn.com/hb/ 275 KB
84 KB 49ms
22ms Script
application/javascript 2606:4700:3036::ac43:a1d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:a1d1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ee193a39c085abb2ced804a088d9bc35b9b3afaa9c03d5f44cf5780418bb304c

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:23 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 71926
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZLU5LauzxwypGd7QWUmQFlx77dJYvyamAWL35TLN1uap2jvBlIIqN8L9ldwMFyoPIYmqiH7eH44jMvCFZdEbLMiw24BarXqy9ly83JM4%2F%2B9uwiLeCKxKdLyyfigGfv8T1i3cydFbfUrT2ew%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 673f167e7a884339-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 css
fonts.googleapis.com/ 5 KB
851 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto|Cabin|Open+Sans&display=swap

Requested by

Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

58c072a03fada6cb9a89fa9a8cfec112f0c2fc2a47e09bdeab11e712db28c749

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 24 Jul 2021 18:07:23 GMT
server: ESF
date: Sat, 24 Jul 2021 18:07:23 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 24 Jul 2021 18:07:23 GMT

GET
H2 200 bonne-promo-20210602-min.css
css.bonne-promo.com/css/ 60 KB
12 KB 68ms
48ms Stylesheet
text/css 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://css.bonne-promo.com/css/bonne-promo-20210602-min.css
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 3ae273c29bd959a91e07ce773731ceab7b47eccba4ab49d17c261c7f0d9f1d22

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:23 GMT
content-encoding: gzip
last-modified: Wed, 09 Jun 2021 16:20:18 GMT
server: Apache/2
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=2628000, public
accept-ranges: bytes
content-length: 12357

GET
H2 200 bonne-promo-120-bleu.png
img.bonne-promo.com/logo/ 4 KB
4 KB 64ms
40ms Image
image/png 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/logo/bonne-promo-120-bleu.png
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 548b8db8adb3832e6b0397170fc43188877d34c7eae82d91d3b7f6ae908e4234

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:55:29 GMT
server: Apache/2
accept-ranges: bytes
content-length: 3870
content-type: image/png

GET
H2 200 facebook_circle-128.png
img.bonne-promo.com/image/social/ 2 KB
2 KB 64ms
40ms Image
image/png 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/image/social/facebook_circle-128.png
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 17d426743c4a5c730530f372e1b869adf7304185b0efd25dc05cd037489fad33

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 19:31:39 GMT
server: Apache/2
accept-ranges: bytes
content-length: 2010
content-type: image/png

GET
H2 200 google-128.png
img.bonne-promo.com/image/social/ 3 KB
3 KB 64ms
41ms Image
image/png 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/image/social/google-128.png
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 87e096fb76df45c2f8c9b9ac4e01433d4d6c77756d56ebf54e7233f2743fc7fd

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 19:31:40 GMT
server: Apache/2
accept-ranges: bytes
content-length: 3441
content-type: image/png

GET
H2 200 img-loader.gif
img.bonne-promo.com/image/ 5 KB
5 KB 63ms
40ms Image
image/gif 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/image/img-loader.gif
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: c8aa038c4f11b96e214082745ffb8e9955cf0948f3c77063fad29939a759b30d

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:55:21 GMT
server: Apache/2
accept-ranges: bytes
content-length: 5103
content-type: image/gif

GET
H2 200 smartphone-blanc-50.png
img.bonne-promo.com/image/ 487 B
541 B 64ms
41ms Image
image/png 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/image/smartphone-blanc-50.png
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 9a3733ce00a3ddcb498211e3c21cc27a31d52beb6fad72caf3e5d177f6f252a8

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:55:24 GMT
server: Apache/2
accept-ranges: bytes
content-length: 487
content-type: image/png

GET
H2 200 televiseur.png
img.bonne-promo.com/image/ 426 B
480 B 63ms
40ms Image
image/png 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/image/televiseur.png
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: c89db6f8636223ca90061f635995fc998724683e73daa2c265ec2e053e9c1d27

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:55:27 GMT
server: Apache/2
accept-ranges: bytes
content-length: 426
content-type: image/png

GET
H2 200 electro.png
img.bonne-promo.com/image/ 2 KB
2 KB 40ms
40ms Image
image/png 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/image/electro.png
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: a9a14735882ec8e6c617f833ad702faf7230ab212e6ee6990a9f69fb97e710db

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:55:19 GMT
server: Apache/2
accept-ranges: bytes
content-length: 2368
content-type: image/png

GET
H2 200 jeux-video-blanc-50.png
img.bonne-promo.com/image/ 1 KB
1 KB 40ms
40ms Image
image/png 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/image/jeux-video-blanc-50.png
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 63dbc6ec5e1167f88e9e3b205759c7577791b8a9c9e898820b71eeb0e353fefb

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:55:21 GMT
server: Apache/2
accept-ranges: bytes
content-length: 1307
content-type: image/png

GET
H2 200 comment.png
img.bonne-promo.com/image/ 844 B
875 B 40ms
39ms Image
image/png 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/image/comment.png
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 4412223b83f3dfa829e7f58bec7efc810c2b10432fba5462176874fcda15fedc

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:55:19 GMT
server: Apache/2
accept-ranges: bytes
content-length: 844
content-type: image/png

GET
H2 200 smartphone.jpg
img.bonne-promo.com/image/ 44 KB
44 KB 41ms
40ms Image
image/jpeg 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/image/smartphone.jpg
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 1d0523ee931603dcc173257b769c87121cca3417cf5fe2af12555d069149ae64

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:55:26 GMT
server: Apache/2
accept-ranges: bytes
content-length: 44548
content-type: image/jpeg

GET
H2 200 ezoic.png
go.ezoic.net/utilcave_com/img/ 1 KB
2 KB 32ms
7ms Image
image/png 2600:9000:214f:4800:2:cb38:840:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://go.ezoic.net/utilcave_com/img/ezoic.png
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:4800:2:cb38:840:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 23 Jul 2021 10:44:18 GMT
via: 1.1 1764af62d635a1a6ee51aabc37405452.cloudfront.net (CloudFront)
x-sol: middleton
age: 112986
x-cache: Hit from cloudfront
x-middleton-display: staticcontent_sol
content-length: 1181
x-amz-cf-id: Ag0cCeT8wakGSvDnq9V9l9uWhQfW8yjbOxTqz1Ohy_B63D2jZD5ljA==
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
etag: "49d-5bd497273b080-gzip-gzip"
vary: Accept-Encoding,Accept-Encoding
content-type: image/png
cache-control: max-age=604800
x-amz-cf-pop: FRA53-C1
display: staticcontent_sol
expires: Fri, 30 Jul 2021 10:44:18 GMT

GET
H2 200 ico-45.png
img.bonne-promo.com/logo/ 555 B
609 B 59ms
58ms Image
image/png 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/logo/ico-45.png
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: cdde622f5962fbf1015b9ff944562fb1e4b5c14c8f3be52513f948d0a3f649ff

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:55:31 GMT
server: Apache/2
accept-ranges: bytes
content-length: 555
content-type: image/png

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 27ms
9ms Script
application/javascript 2001:4de0:ac18::1:a:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Origin: https://www.bonne-promo.com
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:23 GMT
content-encoding: gzip
last-modified: Tue, 02 Mar 2021 17:27:20 GMT
server: nginx
etag: W/"603e7578-15d9d"
vary: Accept-Encoding
x-hw: 1627150043.dop244.fr8.t,1627150043.cds230.fr8.hn,1627150043.cds144.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30875

GET
H2 200 jquery-ui.min.js Show response
code.jquery.com/ui/1.12.0/ 247 KB
66 KB 12ms
11ms Script
application/javascript 2001:4de0:ac18::1:a:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/ui/1.12.0/jquery-ui.min.js
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 78613a6e5bab939b078feae691fb0661e2b2671dcce1b1be66517203b2a7b3b1

Request headers

Origin: https://www.bonne-promo.com
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: gzip
last-modified: Fri, 08 Jul 2016 17:14:47 GMT
server: nginx
etag: W/"577fdf87-3ddc9"
vary: Accept-Encoding
x-hw: 1627150044.dop244.fr8.t,1627150044.cds230.fr8.hn,1627150044.cds154.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 67684

GET
H2 200 jquery.tempgauge.js Show response
css.bonne-promo.com/tempgauge/ 5 KB
2 KB 49ms
48ms Script
application/javascript 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://css.bonne-promo.com/tempgauge/jquery.tempgauge.js
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: ed2de1078a718d9e42ae766dc2938802a923b017e955473bfc70cfa069b4c513

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: gzip
last-modified: Wed, 09 Jun 2021 16:24:27 GMT
server: Apache/2
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=2628000, public
accept-ranges: bytes
content-length: 1541

GET
H2 200 slider-20210601-min.css
css.bonne-promo.com/css/ 53 KB
9 KB 45ms
44ms Stylesheet
text/css 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://css.bonne-promo.com/css/slider-20210601-min.css
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 308bb896f607d1a673aa28a61c8dc7c6e8b6abfe79ac097310b1004b4d9102bb

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:23 GMT
content-encoding: gzip
last-modified: Wed, 09 Jun 2021 16:20:24 GMT
server: Apache/2
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=2628000, public
accept-ranges: bytes
content-length: 9066

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 99 KB
39 KB 22ms
22ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-506386-12

Requested by

Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a5de689da6c35b8fe1b1d52e7e6b83b35cb94167dd574b4593d003cb0e9c03d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40096
x-xss-protection: 0
expires: Sat, 24 Jul 2021 18:07:24 GMT

GET
H2 200 altconsent.js Show response
ezodn.com/cmp/ 396 KB
99 KB 32ms
25ms Script
application/javascript 2606:4700:3036::ac43:a1d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ezodn.com/cmp/altconsent.js?v=8
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:a1d1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2b92530616ddbefbed0e825e094cd914f17ae899b42152f17028a0073f5eb62

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:23 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 08 Apr 2021 07:56:09 GMT
server: cloudflare
age: 172207
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FMarYgtovy82HJsy91adMRyWiPAbNp7L%2B6wg5nrTPYDzALWffGlarb4ODI03xnFBeB1BwNAxyEu9Ce23ybECQYaFmnWTOwl2E2uLzQT7U5NH7UzhVrD7OrUwma7bcZaEJUlbsxRsBlE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 673f167eeba54339-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 ezcl.webp Show response
www.bonne-promo.com/utilcave_com/inc/ 1 KB
974 B 61ms
59ms Script
application/javascript 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/utilcave_com/inc/ezcl.webp?cb=4
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1c5ad2fd42dffdf04a0f1d757c1cccb4d840218d7ecada79d6cc9db33ca40319

Request headers

:path: /utilcave_com/inc/ezcl.webp?cb=4
pragma: no-cache
cookie: PHPSESSID=csvnv9dhq3kqvsq2f0u8i0jtig; csvnv9dhq3kqvsq2f0u8i0jtig=ufesq9iakjvtfmt52ge1nnau8v; ezoadgid_258923=-1; ezoref_258923=; ezoab_258923=mod31-c; active_template::258923=pub_site.1627150043; ezopvc_258923=1; ezepvv=0; ezovid_258923=1643568915; lp_258923=https://www.bonne-promo.com/; ezovuuidtime_258923=1627150043; ezovuuid_258923=1f5c861d-7aa2-4d86-6910-162e89dd2305; ezCMPCCS=false
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: br
x-sol: middleton
server: nginx
display: staticcontent_sol
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: staticcontent_sol
cache-control: max-age=86400
set-cookie: ezoab_258923=mod31-c; Path=/; Domain=bonne-promo.com; Expires=Sat, 24 Jul 2021 20:07:24 UTC ezoadgid_258923=-1; Path=/; Domain=bonne-promo.com; Expires=Sat, 24 Jul 2021 18:37:24 UTC ezoref_258923=; Path=/; Domain=bonne-promo.com; Expires=Sat, 24 Jul 2021 20:07:24 UTC active_template::258923=pub_site.1627150044; Path=/; Domain=bonne-promo.com; Expires=Mon, 26 Jul 2021 18:07:24 UTC
content-length: 605

GET
H2 200 denver.js Show response
www.bonne-promo.com/detroitchicago/ 4 KB
1 KB 39ms
38ms Script
application/javascript 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/detroitchicago/denver.js?gcb=0&cb=1
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e45818350fb6700935c0dce924d8317b166845c5516bc391a1dbda39203f143a

Request headers

:path: /detroitchicago/denver.js?gcb=0&cb=1
pragma: no-cache
cookie: PHPSESSID=csvnv9dhq3kqvsq2f0u8i0jtig; csvnv9dhq3kqvsq2f0u8i0jtig=ufesq9iakjvtfmt52ge1nnau8v; ezoadgid_258923=-1; ezoref_258923=; ezoab_258923=mod31-c; active_template::258923=pub_site.1627150043; ezopvc_258923=1; ezepvv=0; ezovid_258923=1643568915; lp_258923=https://www.bonne-promo.com/; ezovuuidtime_258923=1627150043; ezovuuid_258923=1f5c861d-7aa2-4d86-6910-162e89dd2305; ezCMPCCS=false
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex
content-length: 1273

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 68 KB
24 KB 154ms
55ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

sffe /

Resource Hash

c9669dc08c346457c8a4d388965bd811020bff7939449368f677267822f23182

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "939 / 441 of 1000 / last-modified: 1627140646"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24038
x-xss-protection: 0
expires: Sat, 24 Jul 2021 18:07:24 GMT

GET
H2 200 banger.js Show response
www.bonne-promo.com/porpoiseant/ 45 KB
10 KB 40ms
39ms Script
application/javascript 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/porpoiseant/banger.js?cb=195-0&bv=38&v=51&PageSpeed=off
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 82261dc337590b649371d49042d244967e604a42306a05be6317d659d42c7781

Request headers

:path: /porpoiseant/banger.js?cb=195-0&bv=38&v=51&PageSpeed=off
pragma: no-cache
cookie: PHPSESSID=csvnv9dhq3kqvsq2f0u8i0jtig; csvnv9dhq3kqvsq2f0u8i0jtig=ufesq9iakjvtfmt52ge1nnau8v; ezoadgid_258923=-1; ezoref_258923=; ezoab_258923=mod31-c; active_template::258923=pub_site.1627150043; ezopvc_258923=1; ezepvv=0; ezovid_258923=1643568915; lp_258923=https://www.bonne-promo.com/; ezovuuidtime_258923=1627150043; ezovuuid_258923=1f5c861d-7aa2-4d86-6910-162e89dd2305; ezCMPCCS=false
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 cmbv2.js Show response
www.bonne-promo.com/detroitchicago/ 41 KB
11 KB 52ms
51ms Script
application/javascript 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 3166673b6d2cda2fd7e5b54bd95ce529196fa059c6feba829c42fc05031ca4b4

Request headers

:path: /detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
pragma: no-cache
cookie: PHPSESSID=csvnv9dhq3kqvsq2f0u8i0jtig; csvnv9dhq3kqvsq2f0u8i0jtig=ufesq9iakjvtfmt52ge1nnau8v; ezoadgid_258923=-1; ezoref_258923=; ezoab_258923=mod31-c; active_template::258923=pub_site.1627150043; ezopvc_258923=1; ezepvv=0; ezovid_258923=1643568915; lp_258923=https://www.bonne-promo.com/; ezovuuidtime_258923=1627150043; ezovuuid_258923=1f5c861d-7aa2-4d86-6910-162e89dd2305; ezCMPCCS=false
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 sprite-bonne-promo-25.png
img.bonne-promo.com/image/ 5 KB
5 KB 59ms
58ms Image
image/png 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/image/sprite-bonne-promo-25.png
Requested by: Host: css.bonne-promo.com
URL: https://css.bonne-promo.com/css/bonne-promo-20210602-min.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 9c0848cf18163c7e417b88b1516ca9ef93f175254afdf81a4c36839d76c7a4e3

Request headers

Referer: https://css.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:55:26 GMT
server: Apache/2
accept-ranges: bytes
content-length: 4745
content-type: image/png

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto|Cabin|Open+Sans&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.bonne-promo.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 18:26:24 GMT
x-content-type-options: nosniff
age: 430859
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 18:26:24 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v20/ 14 KB
14 KB 5ms
5ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto|Cabin|Open+Sans&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.bonne-promo.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 18:26:10 GMT
x-content-type-options: nosniff
age: 430873
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14440
x-xss-protection: 0
last-modified: Tue, 18 May 2021 21:21:19 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 18:26:10 GMT

GET
H2 200 style.css
g.ezodn.com/cmp/ 13 KB
2 KB 28ms
20ms Stylesheet
text/css 2606:4700:3036::ac43:a1d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezodn.com/cmp/style.css?domainId=258923&version=0&cv=2441A6ffffff000000
Requested by: Host: ezodn.com
URL: https://ezodn.com/cmp/altconsent.js?v=8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:a1d1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f77a57f0a6ee94ba897f0b5790d2749ba645d8846b38d3fb3ecf5e84ac4bd5b9

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 29 Jun 2021 16:36:38 GMT
server: cloudflare
age: 546437
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TxyKFvAowzt1QLXLKq21Dz8laX2CETwlEb4Ptniu7QfjZoy14kxjbwE8PylW1N3id0if%2B3lj59rAk2wsc1qv5lVTKJUjJQcRG3I8zdfjBPxOv62suwRdEGtO1JQvy9XaVxDNFDLMmv56hw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: public, max-age=604800
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 673f167fbe124339-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 39ms
13ms Preflight
application/json 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bonne-promo.com%2F&domain=www.bonne-promo.com&cw=1

Protocol

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://www.bonne-promo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: https://www.bonne-promo.com
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1360
date: Sat, 24 Jul 2021 18:07:23 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bonne-promo.com%2F&domain=www.bonne-promo.com&cw=1
https://mug.criteo.com/sid?cpp=ec4EoXxLa2o2QVYraHY1Umw2VWlaM2RFK0J5bHovcVhFUnZKaE1zcFRmeFRZMTVOTU1sc1RxTUhWNWM5Y2ZqU3lJd0oxd29PMUI0T2xiYlg2dWM1L3R6Q01UYVlETmFTL2w4Z0NPTE9rZU1wNU1Cc0UwNXRJRUkzMzNxYU...

344 B
602 B

127ms
43ms

XHR
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=ec4EoXxLa2o2QVYraHY1Umw2VWlaM2RFK0J5bHovcVhFUnZKaE1zcFRmeFRZMTVOTU1sc1RxTUhWNWM5Y2ZqU3lJd0oxd29PMUI0T2xiYlg2dWM1L3R6Q01UYVlETmFTL2w4Z0NPTE9rZU1wNU1Cc0UwNXRJRUkzMzNxYUdqcE9LeU1wVFJJVVN6Y0kxcVEzWHpnSjdTclZpaXJBSnR1dFFhVDZJZFljOGN0NnNhSmRJdzBlWC9tYVpqWGhqTTVObWpFM1VPd2JoVHFWWGJSSlJqczdrblNSRDVJbkhLYW9mVnlYYVEzK2ZTczRwcVlNPXw&cppv=2

Requested by

Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

f555ff48db1230c650364c7c816b931bcf1367253e5e159de1ea2e116cfcfe45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Sat, 24 Jul 2021 18:07:23 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2152
expires: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Sat, 24 Jul 2021 18:07:23 GMT
location: https://mug.criteo.com/sid?cpp=ec4EoXxLa2o2QVYraHY1Umw2VWlaM2RFK0J5bHovcVhFUnZKaE1zcFRmeFRZMTVOTU1sc1RxTUhWNWM5Y2ZqU3lJd0oxd29PMUI0T2xiYlg2dWM1L3R6Q01UYVlETmFTL2w4Z0NPTE9rZU1wNU1Cc0UwNXRJRUkzMzNxYUdqcE9LeU1wVFJJVVN6Y0kxcVEzWHpnSjdTclZpaXJBSnR1dFFhVDZJZFljOGN0NnNhSmRJdzBlWC9tYVpqWGhqTTVObWpFM1VPd2JoVHFWWGJSSlJqczdrblNSRDVJbkhLYW9mVnlYYVEzK2ZTczRwcVlNPXw&cppv=2
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.bonne-promo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1732
content-length: 482
expires: 0

POST
H/1.1 200
OK cookie_sync Show response
pb-server.ezoic.com/ 269 B
642 B 355ms
121ms XHR
application/json 52.205.247.225
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pb-server.ezoic.com/cookie_sync
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.205.247.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-247-225.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 14375082f18c8501a36b803a80a3489476d037a97867ffa2a1aae1b65df4fa57

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 24 Jul 2021 18:07:24 GMT
Server: nginx/1.14.0 (Ubuntu)
Vary: Origin
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.bonne-promo.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 269
Expires: 0

POST
H/1.1 200
OK auction Show response
pb-server.ezoic.com/openrtb2/ 152 B
510 B 362ms
129ms XHR
application/json 52.205.247.225
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pb-server.ezoic.com/openrtb2/auction
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.205.247.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-247-225.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: ab41a2d709eb3721f3f3f353604200c8bd092e2ec8625209192cc83d3ac32e20

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 24 Jul 2021 18:07:24 GMT
Server: nginx/1.14.0 (Ubuntu)
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://www.bonne-promo.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 152
Expires: 0

POST
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
117 B 108ms
36ms XHR
text/plain 35.158.21.212
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.158.21.212 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-158-21-212.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bonne-promo.com
date: Sat, 24 Jul 2021 18:07:24 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
116 B 108ms
36ms XHR
text/plain 35.158.21.212
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.158.21.212 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-158-21-212.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bonne-promo.com
date: Sat, 24 Jul 2021 18:07:24 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 200 c Show response
prebid.a-mo.net/a/ 861 B
788 B 349ms
151ms XHR
application/json 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: d1cdf840213fc72966930737038dee0d55892000f6cf8d3961a9a85eb93d100e

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 24 Jul 2021 18:07:23 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bonne-promo.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 45
content-length: 355

POST
H2 204 ortb Show response
bid.contextweb.com/header/ 0
614 B 412ms
193ms XHR
text/plain 198.148.27.134
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL: https://bid.contextweb.com/header/ortb?src=prebid
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.148.27.134 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
server: envoy
cwdl: 22/2600,22/2600
access-control-allow-origin: https://www.bonne-promo.com
access-control-expose-headers: Access-Control-Allow-Origin
access-control-allow-credentials: true
x-envoy-upstream-service-time: 17
cw-server: bid-deployment-78d977bf95-fs5qp

POST
H2 200 / Show response
prebid.smilewanted.com/ 0
285 B 187ms
141ms XHR
application/javascript 172.67.71.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.smilewanted.com/
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.71.185 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/javascript
access-control-allow-origin: https://www.bonne-promo.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7mGg%2FBH4IzXn%2BVhtDBYhYK7syJ%2BDjGIYvHKLyRoZHf56bD6OMtmpTCta%2FiE53kul3RqtEdomBmIAaiMW583eUxr97qKl9Op62dafpCHYagQUkPrFQSU1fYfw%2Byfwb7QtkPU%2F%2BFD5Bfw%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 673f16805d1b7383-CPH
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

POST
H2 200 / Show response
prebid.smilewanted.com/ 0
692 B 180ms
134ms XHR
application/javascript 172.67.71.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.smilewanted.com/
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.71.185 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/javascript
access-control-allow-origin: https://www.bonne-promo.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Nl73xAk7M5ugwxp489hmCpJ0gjMsiOjJi7HctEB2wfcLQ2SsgWtMd93B8SdA1HUK0KvgTLdbcU9FoYLyhPBVLVixv8WVOrQVPvmCClzW8hOeE9cLeGhg6kR%2FYXLXD2K%2BaWs%2BsHXVbDI%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 673f16805d1f7383-CPH
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 129ms
60ms XHR
application/json 185.33.220.240
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.240 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

3da4bbee65b454ad5e681f82817fdb83faa1beaa26bb309e1aabb15a48933ca8

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 24 Jul 2021 18:07:24 GMT
X-Proxy-Origin: 82.102.20.219; 82.102.20.219; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 4edac6c1-b733-461b-867c-709164f27bfb
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.bonne-promo.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
119 B 162ms
93ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bonne-promo.com
date: Sat, 24 Jul 2021 18:07:22 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 imp.gif Show response
www.bonne-promo.com/detroitchicago/ 43 B
128 B 39ms
39ms XHR
image/gif 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A0%2C%22ad_count_adjustment%22%3A1%2C%22ad_lazyload_version%22%3A0%2C%22ad_load_version%22%3A0%2C%22ad_location_ids%22%3A%225%2C4%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A2%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A3%2C%22city%22%3A%22Copenhagen%22%2C%22country%22%3A%22DK%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A1%2C%22domain_id%22%3A258923%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A0%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A0%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A3%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%221100%2C1103%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%22dbcbd1fa-2baf-44ea-6809-4fc62fd12fcd%22%2C%22position_selection_id%22%3A39%2C%22postal_code%22%3A%222750%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A49039%2C%22response_time_orig%22%3A147%2C%22serverid%22%3A%2235.158.98.47%3A9405%22%2C%22state%22%3A%2284%22%2C%22sub_page_ad_positions%22%3A%221100%2C1103%22%2C%22t_epoch%22%3A1627150043%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Fwww.bonne-promo.com%2F%22%2C%22user_id%22%3A0%2C%22word_count%22%3A1416%2C%22worst_bad_word_level%22%3A0%7D
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:path: /detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A0%2C%22ad_count_adjustment%22%3A1%2C%22ad_lazyload_version%22%3A0%2C%22ad_load_version%22%3A0%2C%22ad_location_ids%22%3A%225%2C4%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A2%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A3%2C%22city%22%3A%22Copenhagen%22%2C%22country%22%3A%22DK%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A1%2C%22domain_id%22%3A258923%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A0%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A0%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A3%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%221100%2C1103%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%22dbcbd1fa-2baf-44ea-6809-4fc62fd12fcd%22%2C%22position_selection_id%22%3A39%2C%22postal_code%22%3A%222750%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A49039%2C%22response_time_orig%22%3A147%2C%22serverid%22%3A%2235.158.98.47%3A9405%22%2C%22state%22%3A%2284%22%2C%22sub_page_ad_positions%22%3A%221100%2C1103%22%2C%22t_epoch%22%3A1627150043%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Fwww.bonne-promo.com%2F%22%2C%22user_id%22%3A0%2C%22word_count%22%3A1416%2C%22worst_bad_word_level%22%3A0%7D
pragma: no-cache
cookie: PHPSESSID=csvnv9dhq3kqvsq2f0u8i0jtig; csvnv9dhq3kqvsq2f0u8i0jtig=ufesq9iakjvtfmt52ge1nnau8v; ezoadgid_258923=-1; ezoref_258923=; ezoab_258923=mod31-c; ezopvc_258923=1; ezepvv=0; ezovid_258923=1643568915; lp_258923=https://www.bonne-promo.com/; ezovuuidtime_258923=1627150043; ezovuuid_258923=1f5c861d-7aa2-4d86-6910-162e89dd2305; ezCMPCCS=false; active_template::258923=pub_site.1627150044; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; ezouspvv=0; ezouspva=0; _pbjs_userid_consent_data=3524755945110770
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/gif
x-middleton-display: imp_sol
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 47

GET
H2 200 cmbdv2.js Show response
www.bonne-promo.com/detroitchicago/ 46 KB
11 KB 49ms
49ms Script
application/javascript 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/detroitchicago/cmbdv2.js?gcb=195-0&cb=03-4y0c-5y18-3y34-14y57-21&cmbcb=20&sj=x03x0cx18x34x57
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 57e9af9d54ab53d00c34fde2ea173f431f7541e1a508cca98f1b9ec7cac5e752

Request headers

:path: /detroitchicago/cmbdv2.js?gcb=195-0&cb=03-4y0c-5y18-3y34-14y57-21&cmbcb=20&sj=x03x0cx18x34x57
pragma: no-cache
cookie: PHPSESSID=csvnv9dhq3kqvsq2f0u8i0jtig; csvnv9dhq3kqvsq2f0u8i0jtig=ufesq9iakjvtfmt52ge1nnau8v; ezoadgid_258923=-1; ezoref_258923=; ezoab_258923=mod31-c; ezopvc_258923=1; ezepvv=0; ezovid_258923=1643568915; lp_258923=https://www.bonne-promo.com/; ezovuuidtime_258923=1627150043; ezovuuid_258923=1f5c861d-7aa2-4d86-6910-162e89dd2305; ezCMPCCS=false; active_template::258923=pub_site.1627150044; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; ezouspvv=0; ezouspva=0; _pbjs_userid_consent_data=3524755945110770
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 nmash.js
www.bonne-promo.com/porpoiseant/ 24 KB
6 KB 39ms
38ms Other
application/javascript 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/porpoiseant/nmash.js?v=38
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: dc48161214298afa70fd306b5a0a247f62c6042238e3dcadbd32015adedcc263

Request headers

:path: /porpoiseant/nmash.js?v=38
pragma: no-cache
cookie: PHPSESSID=csvnv9dhq3kqvsq2f0u8i0jtig; csvnv9dhq3kqvsq2f0u8i0jtig=ufesq9iakjvtfmt52ge1nnau8v; ezoadgid_258923=-1; ezoref_258923=; ezoab_258923=mod31-c; ezopvc_258923=1; ezepvv=0; ezovid_258923=1643568915; lp_258923=https://www.bonne-promo.com/; ezovuuidtime_258923=1627150043; ezovuuid_258923=1f5c861d-7aa2-4d86-6910-162e89dd2305; ezCMPCCS=false; active_template::258923=pub_site.1627150044; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; ezouspvv=0; ezouspva=0; _pbjs_userid_consent_data=3524755945110770
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: same-origin
accept: */*
cache-control: no-cache
sec-fetch-dest: worker
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: br
last-modified: Sat, 24 Jul 2021 12:12:30 GMT
server: nginx
etag: "60c7-5c7dd6f25f894;5c701b9c2cf40-gzip"
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, public
accept-ranges: bytes
x-robots-tag: noindex

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-506386-12

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 0
date: Sat, 24 Jul 2021 18:07:24 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Sat, 24 Jul 2021 20:07:24 GMT

GET
H3-29 200 pubads_impl_2021071401.js Show response
securepubads.g.doubleclick.net/gpt/ 329 KB
115 KB 106ms
53ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

sffe /

Resource Hash

65506c87a4e71875a107df7ca37f45ccfd40688cf8e01f65c7e71792dbd6818c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 14 Jul 2021 08:38:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117283
x-xss-protection: 0
expires: Sat, 24 Jul 2021 18:07:24 GMT

GET
H3-29 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 38 B
78 B 132ms
66ms XHR
application/json 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.bonne-promo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

afd52daf37ffe311a6399f524f1a32bfcc8d09d9b0b662d9e59c6cfe0c5cdb5c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54
x-xss-protection: 0
expires: Sat, 24 Jul 2021 18:07:24 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 27ms
13ms XHR
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j91&a=1089275951&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bonne-promo.com%2F&ul=en-us&de=UTF-8&dt=Offre%20de%20remboursement%20et%20bons%20plans%20-%20Bonne-Promo&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1978686469&gjid=1842706353&cid=1757086823.1627150044&tid=UA-506386-12&_gid=1066146526.1627150044&_r=1&gtm=2ou7l1&tc=x&z=107888844

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bonne-promo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 131ms
41ms Preflight
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: null
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1004
date: Sat, 24 Jul 2021 18:07:23 GMT
content-encoding: gzip
vary: Accept-Encoding

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
437 B 43ms
16ms XHR
text/plain 2a00:1450:400c:c04::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j91&tid=UA-506386-12&cid=1757086823.1627150044&jid=1978686469&gjid=1842706353&_gid=1066146526.1627150044&_u=YEBAAUAAAAAAAC~&z=2124955340

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sat, 24 Jul 2021 18:07:24 GMT
content-type: text/plain
access-control-allow-origin: https://www.bonne-promo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
308 B 18ms
17ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-506386-12&cid=1757086823.1627150044&jid=1978686469&_u=YEBAAUAAAAAAAC~&z=784662997

Requested by

Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:24 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
522 B 37ms
17ms Image
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-506386-12&cid=1757086823.1627150044&jid=1978686469&_u=YEBAAUAAAAAAAC~&z=784662997

Requested by

Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:24 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.dk/adsid/ 107 B
853 B 44ms
16ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.dk/adsid/integrator.js?domain=www.bonne-promo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 29ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bonne-promo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 468 B
284 B 532ms
532ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4367645153186623&correlator=652438927658693&output=ldjh&impl=fif&eid=31061180%2C31061843%2C20211866&vrg=2021071401&ptt=17&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20210724&iu_parts=1254144%2Cbonne_promo_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C970x250%7C120x240%7C200x200%7C970x90%7C180x150%7C728x90%7C300x250%7C468x60%7C320x100%7C234x60%7C320x50%7C250x250%7C125x125&fluid=height&prev_scp=iid12%3D1145730%26eid%3D2026941314961159482%26t%3D134%26d%3D258923%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26a%3D%257C5%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dbonne_promo_com-medrectangle-1-1145730%26eb_br%3D12a3b3570adcf20fd41a00445219acaa%26eba%3D1%26ebss%3D10061%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D2000%26br2%3D1000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C28%252C4%252C51%252C0%252C88%252C0%252C71%252C30%252C0%252C31%26deal1%3D22%2C23%2C24%2C25%2C26%2C919&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1627150044&dt=1627150044443&dlt=1627150043890&idt=519&frm=20&biw=1600&bih=1200&oid=3&adxs=200&adys=6238&adks=1656279579&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bonne-promo.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x64&msz=1200x50&ga_vid=1757086823.1627150044&ga_sid=1627150044&ga_hid=1089275951&ga_fc=false&fws=0&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

0d041d67973983cb9838b546ffc38a84c134904487f6fa90a9a218263bff99ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 254
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bonne-promo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 3C19 6 KB
3 KB 45ms
13ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bonne-promo.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bonne-promo.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Sat, 24 Jul 2021 18:07:24 GMT
expires: Sun, 24 Jul 2022 18:07:24 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 466 B
282 B 390ms
390ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4367645153186623&correlator=3504233762426938&output=ldjh&impl=fif&eid=31061180%2C31061843%2C20211866&vrg=2021071401&ptt=17&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20210724&iu_parts=1254144%2Cbonne_promo_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&prev_scp=iid12%3D1151730%26eid%3D8511056429833110665%26t%3D134%26d%3D258923%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26a%3D%257C6%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dbonne_promo_com-medrectangle-2-1151730%26eb_br%3D12a3b3570adcf20fd41a00445219acaa%26eba%3D1%26ebss%3D10061%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D2000%26br2%3D1000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C28%252C4%252C51%252C0%252C88%252C0%252C71%252C30%252C0%252C31%26deal1%3D22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1627150044&dt=1627150044454&dlt=1627150043890&idt=519&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1110&adks=669493002&ucis=2&ifi=2&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bonne-promo.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&ga_vid=1757086823.1627150044&ga_sid=1627150044&ga_hid=1089275951&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

e02b3e285daa4c3f6e90f0513f57d3b7cfbe202beca3400f59c358651dd3f831

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 252
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bonne-promo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bonne-promo-20210415.min.js Show response
css.bonne-promo.com/js/ 58 KB
15 KB 53ms
52ms Script
application/javascript 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://css.bonne-promo.com/js/bonne-promo-20210415.min.js
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.6.0.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: f37c7332fe7f42bc029bba0a2eb023bbd4aa816868fd8347ce87f02bdf815e03

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: gzip
last-modified: Wed, 09 Jun 2021 16:23:50 GMT
server: Apache/2
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=2628000, public
accept-ranges: bytes
content-length: 15501

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 10B5 2 KB
872 B 116ms
38ms Document
text/html 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?redir=https%3A%2F%2Fpb-server.ezoic.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BUSER_TOKEN%7D

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip252.ip-51-89-9.eu

Software

Resource Hash

ee22f683394ec9d609b8c7b90e446dc4fde1cdcf0895322f7004078b5d3ed549

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:method: GET
:authority: onetag-sys.com
:scheme: https
:path: /usync/?redir=https%3A%2F%2Fpb-server.ezoic.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BUSER_TOKEN%7D
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bonne-promo.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bonne-promo.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 780
strict-transport-security: max-age=15552000

GET
H2 200 categorie-20210521.js Show response
css.bonne-promo.com/js/ 12 KB
2 KB 40ms
40ms Script
application/javascript 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://css.bonne-promo.com/js/categorie-20210521.js
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.6.0.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 238fb35f40ffc6e57fa879d348c2a01defa33a192f7dc7254ac9609625976c9f

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: gzip
last-modified: Wed, 09 Jun 2021 16:23:52 GMT
server: Apache/2
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=2628000, public
accept-ranges: bytes
content-length: 2489

GET
H2 200 delete.gif
css.bonne-promo.com/css/ 752 B
806 B 41ms
40ms Image
image/gif 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://css.bonne-promo.com/css/delete.gif
Requested by: Host: css.bonne-promo.com
URL: https://css.bonne-promo.com/css/bonne-promo-20210602-min.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 32cd2462f0572cc6d63fba76837141950a47108f0015cee8f116f69002d1019f

Request headers

Referer: https://css.bonne-promo.com/css/bonne-promo-20210602-min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:20:20 GMT
server: Apache/2
accept-ranges: bytes
content-length: 752
content-type: image/gif

GET
H2 200 star.gif
css.bonne-promo.com/css/ 2 KB
2 KB 41ms
40ms Image
image/gif 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://css.bonne-promo.com/css/star.gif
Requested by: Host: css.bonne-promo.com
URL: https://css.bonne-promo.com/css/bonne-promo-20210602-min.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 1a01f5c56a03de3347e9c661a903b8f83de48337a327374f222107b561052b0a

Request headers

Referer: https://css.bonne-promo.com/css/bonne-promo-20210602-min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:20:25 GMT
server: Apache/2
accept-ranges: bytes
content-length: 2460
content-type: image/gif

GET
H2 200 3458.jpg
img.bonne-promo.com/categorie/ 5 KB
5 KB 42ms
40ms Image
image/jpeg 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/categorie/3458.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 18c3abf723851b8b8221b3dc8e54630bbee330a93851642b451538804dccb97c

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:44:55 GMT
server: Apache/2
accept-ranges: bytes
content-length: 5355
content-type: image/jpeg

GET
H2 200 3902.jpg
img.bonne-promo.com/categorie/ 11 KB
11 KB 43ms
41ms Image
image/jpeg 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/categorie/3902.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 5a8bc86b1ac97d268ad475d3060d59e0597e8f3c1c934d11a127e3f68ad644f0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:47:56 GMT
server: Apache/2
accept-ranges: bytes
content-length: 11322
content-type: image/jpeg

GET
H2 200 4347.jpg
img.bonne-promo.com/categorie/ 11 KB
12 KB 42ms
41ms Image
image/jpeg 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/categorie/4347.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: bab0a173448c8c6cd59fc8df45916dbecc9c72eb3e0ea2af3eea75f73be6b75c

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:50:40 GMT
server: Apache/2
accept-ranges: bytes
content-length: 11697
content-type: image/jpeg

GET
H2 200 2722.jpg
img.bonne-promo.com/categorie/ 12 KB
12 KB 43ms
41ms Image
image/jpeg 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/categorie/2722.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: eba29be11636bc018215eb1dcd43ad549a179196410bd1006e0d65144efb78f4

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:39:54 GMT
server: Apache/2
accept-ranges: bytes
content-length: 12308
content-type: image/jpeg

GET
H2 200 3314.jpg
img.bonne-promo.com/categorie/ 20 KB
20 KB 42ms
40ms Image
image/jpeg 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/categorie/3314.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: fbd71435e486090a3e634501a0ba4992c005e0753e0dacc4573975527d8d9fd9

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:43:59 GMT
server: Apache/2
accept-ranges: bytes
content-length: 20273
content-type: image/jpeg

GET
H2 200 3798.jpg
img.bonne-promo.com/categorie/ 18 KB
18 KB 42ms
41ms Image
image/jpeg 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/categorie/3798.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: eb303b5f50e3956196be7170ab56163f2a10a4a721604d7ff2d1dbcad3f52576

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:47:03 GMT
server: Apache/2
accept-ranges: bytes
content-length: 18560
content-type: image/jpeg

GET
H2 200 4053.jpg
img.bonne-promo.com/categorie/ 9 KB
9 KB 40ms
40ms Image
image/jpeg 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/categorie/4053.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 880008a768d7c6b45d53344c829cf2a6e0e11315f92034cba73f49a79b1594e5

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:48:53 GMT
server: Apache/2
accept-ranges: bytes
content-length: 8795
content-type: image/jpeg

GET
H2 200 4668.jpg
img.bonne-promo.com/categorie/ 14 KB
14 KB 40ms
40ms Image
image/jpeg 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/categorie/4668.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: ba32310ed9d42f6c8cde2a1d7524e8d336ad0924654164e3d4fea7daaf986376

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Mon, 05 Jul 2021 09:13:01 GMT
server: Apache/2
accept-ranges: bytes
content-length: 14484
content-type: image/jpeg

GET
H2 200 1028.jpg
img.bonne-promo.com/odr/ 7 KB
7 KB 40ms
40ms Image
image/jpeg 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/odr/1028.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: e895a497e3209104eed037111118b98c1e1de025f3f667d5cef7643a36c96678

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 17:00:06 GMT
server: Apache/2
accept-ranges: bytes
content-length: 6919
content-type: image/jpeg

GET
H2 200 1210.jpg
img.bonne-promo.com/odr/ 17 KB
17 KB 40ms
40ms Image
image/jpeg 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/odr/1210.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 2644f44d6c65d45b1e900322bb4ebbbe4e48f1223e442c67e91bf5907f4c6e3a

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Mon, 28 Jun 2021 06:05:25 GMT
server: Apache/2
accept-ranges: bytes
content-length: 17096
content-type: image/jpeg

GET
H2 200 1079.JPG
img.bonne-promo.com/odr/ 6 KB
6 KB 41ms
41ms Image
image/jpeg 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/odr/1079.JPG
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: de5a0fdb3840afdfdf340d32da717392dc7885e85b55c0b1c49c0da810d992dc

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
last-modified: Wed, 09 Jun 2021 17:11:37 GMT
server: Apache/2
accept-ranges: bytes
content-length: 6384
content-type: image/jpeg

GET
H2 200 1020.jpg
img.bonne-promo.com/odr/ 9 KB
9 KB 41ms
40ms Image
image/jpeg 176.31.224.48
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.bonne-promo.com/odr/1020.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 176.31.224.48 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3128297.ip-176-31-224.eu
Software: Apache/2 /
Resource Hash: 16def75cf70ee8dbb1e8b37b3b30e10422cf5e2bf24a60e3d97228fee8e0b089

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: max-age=31536000, public
last-modified: Wed, 09 Jun 2021 16:59:35 GMT
server: Apache/2
accept-ranges: bytes
content-length: 9501
content-type: image/jpeg

GET
H/1.1 200
OK setuid
pb-server.ezoic.com/ Frame 10B5 0
465 B 116ms
116ms Image
text/plain 52.205.247.225
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pb-server.ezoic.com/setuid?bidder=onetag&gdpr=0&gdpr_consent=&uid=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?redir=https%3A%2F%2Fpb-server.ezoic.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BUSER_TOKEN%7D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.205.247.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-247-225.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 24 Jul 2021 18:07:24 GMT
Server: nginx/1.14.0 (Ubuntu)
Vary: Origin
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H2 200 greenoaks.gif Show response
www.bonne-promo.com/detroitchicago/ 0
19 B 38ms
36ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiZG9tYWluX2lkIjoiMjU4OTIzIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDctMjQifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMCJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI2In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfcHJpbWFyeV9zdWJ0YWciLCJ2YWwiOiJlbiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6ImRiY2JkMWZhLTJiYWYtNDRlYS02ODA5LTRmYzYyZmQxMmZjZCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInRfZXBvY2giOjE2MjcxNTAwNDMsImRhdGEiOlt7Im5hbWUiOiJuYXZpZ2F0aW9uX3R5cGUiLCJ2YWwiOiIwIn0seyJuYW1lIjoicmVkaXJlY3RfY291bnQiLCJ2YWwiOiIwIn1dfV0=
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiZG9tYWluX2lkIjoiMjU4OTIzIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDctMjQifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMCJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI2In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfcHJpbWFyeV9zdWJ0YWciLCJ2YWwiOiJlbiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6ImRiY2JkMWZhLTJiYWYtNDRlYS02ODA5LTRmYzYyZmQxMmZjZCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInRfZXBvY2giOjE2MjcxNTAwNDMsImRhdGEiOlt7Im5hbWUiOiJuYXZpZ2F0aW9uX3R5cGUiLCJ2YWwiOiIwIn0seyJuYW1lIjoicmVkaXJlY3RfY291bnQiLCJ2YWwiOiIwIn1dfV0=
pragma: no-cache
cookie: PHPSESSID=csvnv9dhq3kqvsq2f0u8i0jtig; csvnv9dhq3kqvsq2f0u8i0jtig=ufesq9iakjvtfmt52ge1nnau8v; ezoadgid_258923=-1; ezoref_258923=; ezoab_258923=mod31-c; ezopvc_258923=1; ezepvv=0; ezovid_258923=1643568915; lp_258923=https://www.bonne-promo.com/; ezovuuidtime_258923=1627150043; ezovuuid_258923=1f5c861d-7aa2-4d86-6910-162e89dd2305; ezCMPCCS=false; active_template::258923=pub_site.1627150044; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; ezouspvv=0; ezouspva=0; _pbjs_userid_consent_data=3524755945110770; _ga=GA1.2.1757086823.1627150044; _gid=GA1.2.1066146526.1627150044; _gat_gtag_UA_506386_12=1; cto_bidid=54WaVV9vZDF6M0xyaFlVOTFlRDJBd0RQbEhxb29ob3MxJTJCY0x5eTlSMnJoSGp1Tk1XQWlsMTd5TngzVmJBS255ZmZLb3hUNlFxZWZ3QWtxQndaQW9uR1RDUE1RJTNEJTNE; cto_bundle=N-dm5190U3RWUDJtbEd3WXV0eFZONVRxUFI3Rm1YUjBYY05EY0k2cmhLTW1XN1RjTXRYak12U0U2JTJCVUpDUkJjVW1IVG5XVjNHYVR4S01ka2dDMENWWGE1VGw0JTJGQnBGSFJxdmhPR0tWdFdyOWU4SmtVYSUyQmpUN2JwdmdiZ3dVVzc4VTElMkIy
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Fri, 23 Jul 2021 18:07:24 UTC

GET
H2 200 greenoaks.gif Show response
www.bonne-promo.com/detroitchicago/ 0
104 B 36ms
35ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJkYXRhIjpbeyJuYW1lIjoicGVyZl9pc190cmFja2VkIiwidmFsIjoiMSJ9LHsibmFtZSI6InBlcmZfbmF2X3RvX2Nvbm5lY3QiLCJ2YWwiOiI1OTQifSx7Im5hbWUiOiJwZXJmX2Nvbm5lY3RfdG9fcmVzcF9zdGFydCIsInZhbCI6IjEwNzYifSx7Im5hbWUiOiJwZXJmX3Jlc3BfdGltZSIsInZhbCI6IjI4In0seyJuYW1lIjoicGVyZl9pbnRlcmFjdGl2ZSIsInZhbCI6IjE5NyJ9LHsibmFtZSI6InBlcmZfY29udGVudGxvYWRlZCIsInZhbCI6IjIxNiJ9LHsibmFtZSI6InBlcmZfY29tcGxldGUiLCJ2YWwiOiI1MTIifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJkYXRhIjpbeyJuYW1lIjoiZmlyc3RfcGFpbnQiLCJ2YWwiOiIxMjYzIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiZG9tYWluX2lkIjoiMjU4OTIzIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiZGF0YSI6W3sibmFtZSI6ImZpcnN0X2NvbnRlbnRmdWxfcGFpbnQiLCJ2YWwiOiIxMjYzIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiZG9tYWluX2lkIjoiMjU4OTIzIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiZGF0YSI6W3sibmFtZSI6ImNvbm5lY3Rpb25fZWZmZWN0aXZlX3R5cGUiLCJ2YWwiOiI0ZyJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6ImRiY2JkMWZhLTJiYWYtNDRlYS02ODA5LTRmYzYyZmQxMmZjZCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInRfZXBvY2giOjE2MjcxNTAwNDMsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX2Rvd25saW5rIiwidmFsIjoiMTAifV19XQ==
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJkYXRhIjpbeyJuYW1lIjoicGVyZl9pc190cmFja2VkIiwidmFsIjoiMSJ9LHsibmFtZSI6InBlcmZfbmF2X3RvX2Nvbm5lY3QiLCJ2YWwiOiI1OTQifSx7Im5hbWUiOiJwZXJmX2Nvbm5lY3RfdG9fcmVzcF9zdGFydCIsInZhbCI6IjEwNzYifSx7Im5hbWUiOiJwZXJmX3Jlc3BfdGltZSIsInZhbCI6IjI4In0seyJuYW1lIjoicGVyZl9pbnRlcmFjdGl2ZSIsInZhbCI6IjE5NyJ9LHsibmFtZSI6InBlcmZfY29udGVudGxvYWRlZCIsInZhbCI6IjIxNiJ9LHsibmFtZSI6InBlcmZfY29tcGxldGUiLCJ2YWwiOiI1MTIifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJkYXRhIjpbeyJuYW1lIjoiZmlyc3RfcGFpbnQiLCJ2YWwiOiIxMjYzIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiZG9tYWluX2lkIjoiMjU4OTIzIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiZGF0YSI6W3sibmFtZSI6ImZpcnN0X2NvbnRlbnRmdWxfcGFpbnQiLCJ2YWwiOiIxMjYzIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiZG9tYWluX2lkIjoiMjU4OTIzIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiZGF0YSI6W3sibmFtZSI6ImNvbm5lY3Rpb25fZWZmZWN0aXZlX3R5cGUiLCJ2YWwiOiI0ZyJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6ImRiY2JkMWZhLTJiYWYtNDRlYS02ODA5LTRmYzYyZmQxMmZjZCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInRfZXBvY2giOjE2MjcxNTAwNDMsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX2Rvd25saW5rIiwidmFsIjoiMTAifV19XQ==
pragma: no-cache
cookie: PHPSESSID=csvnv9dhq3kqvsq2f0u8i0jtig; csvnv9dhq3kqvsq2f0u8i0jtig=ufesq9iakjvtfmt52ge1nnau8v; ezoadgid_258923=-1; ezoref_258923=; ezoab_258923=mod31-c; ezopvc_258923=1; ezepvv=0; ezovid_258923=1643568915; lp_258923=https://www.bonne-promo.com/; ezovuuidtime_258923=1627150043; ezovuuid_258923=1f5c861d-7aa2-4d86-6910-162e89dd2305; ezCMPCCS=false; active_template::258923=pub_site.1627150044; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; ezouspvv=0; ezouspva=0; _pbjs_userid_consent_data=3524755945110770; _ga=GA1.2.1757086823.1627150044; _gid=GA1.2.1066146526.1627150044; _gat_gtag_UA_506386_12=1; cto_bidid=54WaVV9vZDF6M0xyaFlVOTFlRDJBd0RQbEhxb29ob3MxJTJCY0x5eTlSMnJoSGp1Tk1XQWlsMTd5TngzVmJBS255ZmZLb3hUNlFxZWZ3QWtxQndaQW9uR1RDUE1RJTNEJTNE; cto_bundle=N-dm5190U3RWUDJtbEd3WXV0eFZONVRxUFI3Rm1YUjBYY05EY0k2cmhLTW1XN1RjTXRYak12U0U2JTJCVUpDUkJjVW1IVG5XVjNHYVR4S01ka2dDMENWWGE1VGw0JTJGQnBGSFJxdmhPR0tWdFdyOWU4SmtVYSUyQmpUN2JwdmdiZ3dVVzc4VTElMkIy
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Fri, 23 Jul 2021 18:07:23 UTC

GET
H2 200 greenoaks.gif Show response
www.bonne-promo.com/detroitchicago/ 0
47 B 37ms
36ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9ydHQiLCJ2YWwiOiIwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiZG9tYWluX2lkIjoiMjU4OTIzIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiZGF0YSI6W3sibmFtZSI6InRpbWVyX2ZpcnN0X2FkX3JlcXVlc3QiLCJ2YWwiOiI5NTcifV19XQ==
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9ydHQiLCJ2YWwiOiIwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiZG9tYWluX2lkIjoiMjU4OTIzIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiZGF0YSI6W3sibmFtZSI6InRpbWVyX2ZpcnN0X2FkX3JlcXVlc3QiLCJ2YWwiOiI5NTcifV19XQ==
pragma: no-cache
cookie: PHPSESSID=csvnv9dhq3kqvsq2f0u8i0jtig; csvnv9dhq3kqvsq2f0u8i0jtig=ufesq9iakjvtfmt52ge1nnau8v; ezoadgid_258923=-1; ezoref_258923=; ezoab_258923=mod31-c; ezopvc_258923=1; ezepvv=0; ezovid_258923=1643568915; lp_258923=https://www.bonne-promo.com/; ezovuuidtime_258923=1627150043; ezovuuid_258923=1f5c861d-7aa2-4d86-6910-162e89dd2305; ezCMPCCS=false; active_template::258923=pub_site.1627150044; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; ezouspvv=0; ezouspva=0; _pbjs_userid_consent_data=3524755945110770; _ga=GA1.2.1757086823.1627150044; _gid=GA1.2.1066146526.1627150044; _gat_gtag_UA_506386_12=1; cto_bidid=54WaVV9vZDF6M0xyaFlVOTFlRDJBd0RQbEhxb29ob3MxJTJCY0x5eTlSMnJoSGp1Tk1XQWlsMTd5TngzVmJBS255ZmZLb3hUNlFxZWZ3QWtxQndaQW9uR1RDUE1RJTNEJTNE; cto_bundle=N-dm5190U3RWUDJtbEd3WXV0eFZONVRxUFI3Rm1YUjBYY05EY0k2cmhLTW1XN1RjTXRYak12U0U2JTJCVUpDUkJjVW1IVG5XVjNHYVR4S01ka2dDMENWWGE1VGw0JTJGQnBGSFJxdmhPR0tWdFdyOWU4SmtVYSUyQmpUN2JwdmdiZ3dVVzc4VTElMkIy
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Fri, 23 Jul 2021 18:07:24 UTC

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 42ms
20ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021071401&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ebc55986f73d6daa2d1ed97ed198b35d13cfafc3de93f8c4fc5f60c1eadc7027

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8413
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 40ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Sat, 24 Jul 2021 18:07:24 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 64A5 12 KB
5 KB 24ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bonne-promo.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bonne-promo.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Sat, 24 Jul 2021 15:02:13 GMT
expires: Sun, 24 Jul 2022 15:02:13 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 11111
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame BE0A 783 B
532 B 27ms
24ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b379601c8de553ff9087103812a203b765ce4d520ab9e03e96590cf2f3c99e67

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-wKWOvfu0IUI3feZl4lC0+Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bonne-promo.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bonne-promo.com/

Response headers

expires: Sat, 24 Jul 2021 18:07:24 GMT
date: Sat, 24 Jul 2021 18:07:24 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-wKWOvfu0IUI3feZl4lC0+Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js Show response
pagead2.googlesyndication.com/bg/ Frame 64A5 35 KB
13 KB 22ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac2ffd30d773ba387806848181aa66fddcaceec404f090c696c6da4011c20965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 23 Jul 2021 15:24:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 96198
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13334
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 07:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 23 Jul 2022 15:24:07 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 42ms
42ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021071401&jk=4367645153186623&bg=!Xl2lXRnNAAbnC78O5ws7ACkAdvg8WuzcF_np2SKpmeGiF8tLtG1pJIaLZHfJCwPp6JbfYepeKPyZIAIAAABfUgAAAAloAQeZAnYG0P3vHc3_lN8AM542myJ3pZjjLON1iBW-INhbm0rw1UwA7EOeJMApOkeLi7MdUcNzHgW5gfAw6FeEecVhfm8TJ79Rw9K7-XD3cGIWVp1wUXDCm7JG6GlPOz7ZZTop5Az-Pz2tWtjnvPMZz6jqD8OENAV-3-twr50tTuE_XsSKyUUr8nNfTgd10AV4f1foGFW1AOU09tpxHdDvBudlyG8E57Lmm86_VgP059riQ9G6T1VzebcwptkrdAq7GTJKRJ4LZl8v7wavutQOxjzsB1AQfY61RAzIs54ady0sSnLx0HQAaPY8Bn1BFymYE05Z-jXqUucsJOyXv-smZYkveRuGLMBAWnD6xeC4vO1Zgp-r7Gc4NV_E90JnJRPPROpWWfYt0aScezNgMwVyM834wkkFFKm1bUs3CrzysJ0xLphYVFOzpo8Bq-F5TUH2tQwtSWL-2zpxjuLFC9B1g6UREgE9yoMhC6ZM10CtUJkYZRQ7C6X-NcLkFzFVe-1aBN3oEMEAlNiAH5FiXVFcHoMXh8X6NVK7_gzfuPsg3sOWr0BUpcI-9bAoMEBPGg7GHDdACu7WJg8PVlpQq2tQvf1Wxl-_cJe1wcUKxsuWk20jyFa3-5uIabJ-mtrIqv8iXBrTM4ccD075anUW-5MMlqX1UHbWsBsm-TXy_S3ZSYs1cD2dIhOyj45r8-fPJMhjkTayPChEUsUsX3KiYrXRsxoXoDtuL332TjZFhWSrNUeTinQii3ihNXw447PjsZ-74B8QoaHBn01jsyEr92zuRdI7LXVPjLa9KmeOCsrKoPlyFhmVhcBstuEAh3SP21KSPs4v828JXNS9JWw

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200 457.json Show response
id5-sync.com/g/v2/ 213 B
537 B 158ms
39ms XHR
application/json 51.89.7.110
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/457.json

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

51.89.7.110 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

p23.id5-sync.com

Software

Resource Hash

d216690457c596c62a275eb6351af23fec418a9062912fd6e67abd606425d02a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.bonne-promo.com
Date: Sat, 24 Jul 2021 18:07:27 GMT
Access-Control-Allow-Credentials: true
Vary: Origin
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Type: application/json;charset=UTF-8

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame E734 52 KB
17 KB 122ms
53ms Document
text/html 2.18.232.130
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-130.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.bonne-promo.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: icu=ChgIkfo_EAoYASABKAEw3K3xhwY4AUABSAEQ3K3xhwYYAA..; uuid2=1531694660558406068
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bonne-promo.com/

Response headers

Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: "5fc7ff8f-cf34"
Server: nginx/1.13.10
Access-Control-Allow-Origin: *
Content-Type: text/html
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Sun, 25 Jul 2021 18:07:29 GMT
Date: Sat, 24 Jul 2021 18:07:27 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame C387 2 KB
823 B 39ms
38ms Document
text/html 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1627150044547&us_privacy=1---

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip252.ip-51-89-9.eu

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:method: GET
:authority: onetag-sys.com
:scheme: https
:path: /usync/?cb=1627150044547&us_privacy=1---
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bonne-promo.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bonne-promo.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 71CE 14 KB
5 KB 103ms
34ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

:method: GET
:authority: ads.pubmatic.com
:scheme: https
:path: /AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bonne-promo.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bonne-promo.com/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=44491
expires: Sun, 25 Jul 2021 06:28:58 GMT
date: Sat, 24 Jul 2021 18:07:27 GMT
vary: Accept-Encoding

GET
H2 200 / Show response
csync.smilewanted.com/ Frame A262 6 KB
2 KB 129ms
128ms Document
text/html 172.67.71.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/?us_privacy=1---
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.71.185 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6da851b5c9e30b71de10162d65135d679b279d518036f81178092af7f5e9970e

Request headers

:method: GET
:authority: csync.smilewanted.com
:scheme: https
:path: /?us_privacy=1---
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bonne-promo.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bonne-promo.com/

Response headers

date: Sat, 24 Jul 2021 18:07:27 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oAp1Nt1T2nuPGkJAom90GiD0VhNuuM6rYpQVblZFsOlFrqTuAyLE1cQPl2aWB%2FcJR0HdBsthU%2BDbERoQ%2FeJbRxOTwsyt5uNHiNp6NZ2Ws7BGmCvA4DJ%2BFjGdo0V7tIev200SDdcGlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 673f16957ae67383-CPH
content-encoding: br

GET
H2 200 visitormatch Show response
bh.contextweb.com/ Frame 502B 27 B
497 B 301ms
100ms Document
text/html 198.148.27.140
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL

https://bh.contextweb.com/visitormatch

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,smilewanted&cb=195-0-26

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.140 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(9.4.14.v20181114) /

Resource Hash

ec2f44e7dbd2ebb1268ac7e7a0602ec2106bc7fd9da17b9012db81be55cbd485

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

:method: GET
:authority: bh.contextweb.com
:scheme: https
:path: /visitormatch
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bonne-promo.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: vf=1; V=8x8IAAlWnJgX; wf=0; ccpa=1---
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bonne-promo.com/

Response headers

p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cw-server: bh-deployment-589cbd599f-mx4r4
cache-control: private, max-age=0, no-cache, no-store
expires: -1
content-language: en-US
content-type: text/html;charset=iso-8859-1
set-cookie: V=;Version=0;Secure;Path=/;Domain=.contextweb.com;Expires=Sat, 24-Jul-2021 18:07:27 GMT;Max-Age=0;SameSite=None INGRESSCOOKIE=729b66ce19743733; path=/; HttpOnly; Secure; SameSite=None
server: Jetty(9.4.14.v20181114)
strict-transport-security: max-age=15768000

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 71CE 5 KB
6 KB 104ms
35ms Script
text/html 185.64.189.115
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=38322594&p=156983&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.115 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e9c818dfb2edfd3add59bb72332cf88e96eb0fa3f55481d23ad9fd1e394de3b5

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:26 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1

200
OK

bounce Show response
ib.adnxs.com/ Frame E734
Redirect Chain

https://ib.adnxs.com/async_usersync?cbfn=queuePixels
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

0
803 B

34ms
33ms

Script
text/html

185.33.220.240
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.240 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 24 Jul 2021 18:07:27 GMT
X-Proxy-Origin: 82.102.20.219; 82.102.20.219; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 25e6362f-5725-4578-8e84-5b55a48f3c4d
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 24 Jul 2021 18:07:27 GMT
X-Proxy-Origin: 82.102.20.219; 82.102.20.219; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f4171156-b3dd-4479-a4b7-382adb8339fb
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 decode_consent.js Show response
static.smilewanted.com/js/decode_consent/ Frame A262 48 KB
12 KB 38ms
37ms Script
application/javascript 172.67.71.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.smilewanted.com/js/decode_consent/decode_consent.js

Requested by

Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.71.185 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://csync.smilewanted.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1370402
vary: Accept-Encoding
x-xss-protection: 1; mode=block
referrer-policy: strict-origin
last-modified: Thu, 15 Apr 2021 17:11:55 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"607873db-c1ce"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3XRArMNuSsspjYVHjDTGZCOkJMg0ZruiabAC%2FbEr7f3aM8M1CIkVx5lcjMO0x8k0yG%2FtZE0frGDab8drpdwkbr%2BIqL56vHpvOloPfm%2BHwJI49vjzExQbcsvYlZ%2BGURPiKnGvpM%2B%2Fe9E%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 673f16964bbf7383-CPH
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 integrator.js Show response
adservice.google.dk/adsid/ 107 B
165 B 15ms
14ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.dk/adsid/integrator.js?domain=www.bonne-promo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 16ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bonne-promo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 468 B
793 B 370ms
370ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4367645153186623&correlator=859981415811855&output=ldjh&impl=fif&eid=31061180%2C31061843%2C20211866&vrg=2021071401&ptt=17&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20210724&iu_parts=1254144%2Cbonne_promo_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C970x250%7C120x240%7C200x200%7C970x90%7C180x150%7C728x90%7C300x250%7C468x60%7C320x100%7C234x60%7C320x50%7C250x250%7C125x125&fluid=height&ris=3&rcs=1&prev_scp=iid12%3D1145730%26eid%3D2026941314961159482%26t%3D134%26d%3D258923%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26a%3D%257C5%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dbonne_promo_com-medrectangle-1-1145730%26eb_br%3Dc5429b6ddd929d0bc40a832a87789a7c%26eba%3D1%26ebss%3D10061%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D1000%26br2%3D1000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C28%252C4%252C51%252C0%252C88%252C0%252C71%252C30%252C0%252C31%26deal1%3D22%2C23%2C24%2C25%2C26%2C919%2C21%26lb%3D2000%26reqt%3D1627150047736&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1627150047&dt=1627150047741&dlt=1627150043890&idt=519&frm=20&biw=1600&bih=1200&oid=3&adxs=200&adys=6238&adks=1656279579&ucis=3&ifi=3&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bonne-promo.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x64&msz=1200x50&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1757086823.1627150044&ga_sid=1627150044&ga_hid=1089275951&ga_fc=false&fws=0&ohw=0&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

72a6f60303973c5ffe153aff6bd00a121f6a81139415236de13a2a1fb41b9d05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 249
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bonne-promo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 466 B
431 B 553ms
553ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4367645153186623&correlator=1169643067066372&output=ldjh&impl=fif&eid=31061180%2C31061843%2C20211866&vrg=2021071401&ptt=17&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20210724&iu_parts=1254144%2Cbonne_promo_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ris=3&rcs=1&prev_scp=iid12%3D1151730%26eid%3D8511056429833110665%26t%3D134%26d%3D258923%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26a%3D%257C6%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dbonne_promo_com-medrectangle-2-1151730%26eb_br%3Dc5429b6ddd929d0bc40a832a87789a7c%26eba%3D1%26ebss%3D10061%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D1000%26br2%3D1000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C28%252C4%252C51%252C0%252C88%252C0%252C71%252C30%252C0%252C31%26deal1%3D22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C21%26lb%3D2000%26reqt%3D1627150047743&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1627150047&dt=1627150047746&dlt=1627150043890&idt=519&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1110&adks=669493002&ucis=4&ifi=4&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bonne-promo.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1757086823.1627150044&ga_sid=1627150044&ga_hid=1089275951&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

79d84501e7c458fa0180494d7b63d9c3e56db557c58211c4ec492ca548bd6cb5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 253
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bonne-promo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 drop_cookie_sw.php Show response
csync.smilewanted.com/ Frame E645 0
526 B 59ms
59ms Document
text/html 172.67.71.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/drop_cookie_sw.php
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.71.185 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: csync.smilewanted.com
:scheme: https
:path: /drop_cookie_sw.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://csync.smilewanted.com/?us_privacy=1---
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://csync.smilewanted.com/?us_privacy=1---

Response headers

date: Sat, 24 Jul 2021 18:07:27 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: sw_user_params_infos=8sdRREvsw7LjLys0YvGw80Tu4fZyrrbmxnoqFBxAEW5%2FnMJqeVXYy4%2BVFDI74lW4lxiB0Qwi5RRTN9H0ZEMsAAETzxb2ORoHNPFOLNmDEN6Mia0dNse%2BBrdIA0FOk2u6DXeNuL%2B3t68AjC%2FgKx2J8A%3D%3D; expires=Sun, 24-Jul-2022 23:56:39 GMT; Max-Age=31556952; path=/; SameSite=None; Secure; domain=smilewanted.com; secure; HttpOnly
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OL44klUKzBv0TAXKSclQoppJHym83xiUutEwIZgYiITPdgzRZott%2BtAvio8Wi%2Bvbbz5dT%2By9GhxFfCp9oY75lUf4K15XLMhDdgRhhcPPCyiIOY8xtEUstnqbrjNTvpRWSfu8OHyOhg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 673f16969c127383-CPH
content-encoding: br

GET
H/1.1

200
OK

getuid Show response
sync.smartadserver.com/ Frame 12BA
Redirect Chain

https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid]
https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsmart%2F%5Bsas_uid%5D&cklb=1

0
75 B

42ms
42ms

Document
text/plain

185.86.137.132
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsmart%2F%5Bsas_uid%5D&cklb=1
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.132 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Host: sync.smartadserver.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://csync.smilewanted.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://csync.smilewanted.com/

Response headers

date: Sat, 24 Jul 2021 18:07:27 GMT
content-length: 0

Redirect headers

date: Sat, 24 Jul 2021 18:07:27 GMT
content-length: 0
cache-control: no-cache,no-store
pragma: no-cache
location: https://sync.smartadserver.com:443/getuid?gdpr_consent=&nwid=2491&url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsmart%2F%5Bsas_uid%5D&cklb=1
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 2E76
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=AE435053-9948-4944-AE8E-BD542B8CAC59
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=AE435053-9948-4944-AE8E-BD542B8CAC59

35 B
467 B

21ms
21ms

Document
image/gif

37.157.6.245
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=AE435053-9948-4944-AE8E-BD542B8CAC59

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.245 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: c1.adform.net
:scheme: https
:path: /serving/cookie/match?CC=1&party=14&cid=AE435053-9948-4944-AE8E-BD542B8CAC59
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: C=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Sat, 24 Jul 2021 18:07:27 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
set-cookie: uid=2641632458245132337; expires=Wed, 22 Sep 2021 18:07:27 GMT; domain=adform.net; path=/; secure; samesite=none
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

server: nginx
date: Sat, 24 Jul 2021 18:07:27 GMT
content-length: 0
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=AE435053-9948-4944-AE8E-BD542B8CAC59
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
set-cookie: C=1; expires=Tue, 24 Aug 2021 18:07:27 GMT; domain=adform.net; path=/; secure; samesite=none
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

adx Show response
match.prod.bidr.io/cookie-sync/ Frame 896D
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDTnpVN0ItSzRBQUZoLTdiWF9mQQ&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sy...
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1

43 B
430 B

49ms
48ms

Document
image/gif

52.30.222.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.30.222.33 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-30-222-33.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Host: match.prod.bidr.io
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://ads.pubmatic.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: bito=AACNzU7B-K4AAFh-7bX_fA; bitoIsSecure=ok
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, must-revalidate
content-type: image/gif
Date: Sat, 24 Jul 2021 18:07:28 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
pragma: no-cache
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
Content-Length: 43
Connection: keep-alive

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
date: Sat, 24 Jul 2021 18:07:28 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)
content-length: 355
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 usersync.aspx Show response
dis.criteo.com/dis/ Frame 657A 43 B
338 B 135ms
43ms Document
image/gif 178.250.0.163
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

:method: GET
:authority: dis.criteo.com
:scheme: https
:path: /dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache
pragma: no-cache
content-type: image/gif
expires: Sat, 24 Jul 2021 00:00:00 GMT
server: Microsoft-IIS/10.0
x-errorlevel: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1695
date: Sat, 24 Jul 2021 18:07:27 GMT
content-length: 43

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 65AF
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5338638681
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5338638681
https://sync.1rx.io/usersync/tradedesk/315c48e3-25a3-42fc-a569-cdc3759612af
https://sync.targeting.unrulymedia.com/csync/RX-5ed04603-0c4d-4893-9851-43271a6ef1a9-003?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-5ed04603-0c4d-4893-9851-43271a6ef1a9-003

42 B
270 B

41ms
41ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-5ed04603-0c4d-4893-9851-43271a6ef1a9-003
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

:method: GET
:authority: simage2.pubmatic.com
:scheme: https
:path: /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-5ed04603-0c4d-4893-9851-43271a6ef1a9-003
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: KADUSERCOOKIE=AE435053-9948-4944-AE8E-BD542B8CAC59; chkChromeAb67Sec=1; DPSync3=1628294400%3A201_197%7C1627689600%3A164%7C1627171200%3A174; SyncRTB3=1628294400%3A21_54_231_233_3_99_166_8_222_48_189_220_55_165_176_22_71_104_57_56_13_7_178%7C1627948800%3A63%7C1627516800%3A216%7C1627689600%3A15_2_223_38%7C1628380800%3A35; KRTBCOOKIE_22=14911-2664328602621352134; PUBMDCID=3; KRTBCOOKIE_27=16735-uid:e91560fc-56df-4b00-ad55-689152560648&KRTB&16736-uid:e91560fc-56df-4b00-ad55-689152560648&KRTB&23019-uid:e91560fc-56df-4b00-ad55-689152560648&KRTB&23114-uid:e91560fc-56df-4b00-ad55-689152560648; SPugT=1627150046; KRTBCOOKIE_377=6810-315c48e3-25a3-42fc-a569-cdc3759612af&KRTB&22918-315c48e3-25a3-42fc-a569-cdc3759612af&KRTB&23031-315c48e3-25a3-42fc-a569-cdc3759612af; KRTBCOOKIE_80=22987-CAESEO84z_SemPcowxtPibN5Fpg&KRTB&16514-CAESEO84z_SemPcowxtPibN5Fpg&KRTB&23025-CAESEO84z_SemPcowxtPibN5Fpg; KRTBCOOKIE_218=22978-YPxW3wADC3uviwAC&KRTB&23194-YPxW3wADC3uviwAC&KRTB&23209-YPxW3wADC3uviwAC&KRTB&23244-YPxW3wADC3uviwAC; PugT=1627150048; KRTBCOOKIE_57=22776-7940331768660304726; KRTBCOOKIE_153=19420-ucICdLrEASeiw1EmucBJIO3KAS6iw1xyv8D_Gf-S&KRTB&22979-ucICdLrEASeiw1EmucBJIO3KAS6iw1xyv8D_Gf-S; KRTBCOOKIE_391=22924-2641632458245132337&KRTB&23263-2641632458245132337
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Sat, 24 Jul 2021 18:07:28 GMT
content-type: image/gif; charset=utf-8
content-length: 42
set-cookie: KRTBCOOKIE_594=17105-RX-5ed04603-0c4d-4893-9851-43271a6ef1a9-003&KRTB&17107-RX-5ed04603-0c4d-4893-9851-43271a6ef1a9-003; domain=pubmatic.com; SameSite=None; secure; expires=Fri, 22-Oct-2021 18:07:28 GMT; path=/ PugT=1627150048; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 23-Aug-2021 18:07:28 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Fri, 22-Oct-2021 18:07:28 GMT; path=/
x-lat: lhrpug008:0:553
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

server: Tengine
date: Sat, 24 Jul 2021 18:07:28 GMT
content-type: text/html
set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-5ed04603-0c4d-4893-9851-43271a6ef1a9-003%22%7D; path=/; expires=Sun, 24 Jul 2022 18:07:28 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-5ed04603-0c4d-4893-9851-43271a6ef1a9-003
etag: RX5ed046030c4d4893985143271a6ef1a9003

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 81CD 0
44 B 375ms
123ms Document
text/plain 38.91.45.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to

Full URL: https://match.deepintent.com/usersync/141?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw%26piggybackCookie%3D%24%7BDI_USER_ID%7D&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.91.45.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: match.deepintent.com
:scheme: https
:path: /usersync/141?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw%26piggybackCookie%3D%24%7BDI_USER_ID%7D&gdpr=0&gdpr_consent=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

content-length: 0
date: Sat, 24 Jul 2021 18:07:27 GMT
server: b

GET
H/1.1 200
OK bridge Show response
cm.adgrx.com/ Frame 0637 43 B
408 B 109ms
33ms Document
image/gif 63.251.232.170
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.251.232.170 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS: ams-mon-1.sys.adgear.com
Software: Cowboy /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Host: cm.adgrx.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://ads.pubmatic.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Date: Sat, 24 Jul 2021 18:07:27 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
server: Cowboy
X-RealServer-NX: ams-delivery-2
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate
Pragma: no-cache
Expires: Thu, 23 Sep 2004 17:42:04 GMT
P3P: CP="NOI OTC OTP OUR NOR"
Access-Control-Allow-Origin: *

GET
H/1.1

200
OK

noop Show response
px.owneriq.net/ Frame 6255
Redirect Chain

https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
https://px.owneriq.net/noop?ct=image%2Fgif

0
287 B

34ms
34ms

Document
image/gif

104.111.242.53
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://px.owneriq.net/noop?ct=image%2Fgif
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.242.53 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-53.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Host: px.owneriq.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://ads.pubmatic.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Length: 0
Content-Type: image/gif
Date: Sat, 24 Jul 2021 18:07:27 GMT
Connection: keep-alive

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://px.owneriq.net/noop?ct=image%2Fgif
Date: Sat, 24 Jul 2021 18:07:27 GMT
Connection: keep-alive

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame 87BE
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
447 B

179ms
172ms

Document
image/gif

2606:4700::6812:d05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

:method: GET
:authority: s.tribalfusion.com
:scheme: https
:path: /z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: ANON_ID=aanoeUx2eNNSE0UdcqlP2X4dyM1pyVNHpCGYZaBlE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
content-type: image/gif; charset=utf-8
content-length: 43
p3p: CP="NOI DEVo TAIa OUR BUS"
x-function: 302
cache-control: no-cache private
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
set-cookie: ANON_ID=annsIHoZdUQcR2Hp9vcgf7QSb6iALtQl2ZaBpU15CCSqvm6l3b5BOWr2ZbMIiYh2OcwZceZbk9yYTriuAZbJgVfFSHdAWI; path=/; domain=.tribalfusion.com; expires=Fri, 22-Oct-2021 18:07:28 GMT; SameSite=None; Secure; ANON_ID_old=annsIHoZdUQcR2Hp9vcgf7QSb6iALtQl2ZaBpU15CCSqvm6l3b5BOWr2ZbMIiYh2OcwZceZbk9yYTriuAZbJgVfFSHdAWI; path=/; domain=.tribalfusion.com; expires=Fri, 22-Oct-2021 18:07:28 GMT;
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 673f1697f8af4df4-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

date: Sat, 24 Jul 2021 18:07:27 GMT
content-type: text/html
p3p: CP="NOI DEVo TAIa OUR BUS"
x-function: 206
x-reuse-index: 1736
cache-control: no-cache private
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
set-cookie: ANON_ID=aanoeUx2eNNSE0UdcqlP2X4dyM1pyVNHpCGYZaBlE; path=/; domain=.tribalfusion.com; expires=Fri, 22-Oct-2021 18:07:27 GMT; SameSite=None; Secure; ANON_ID_old=aanoeUx2eNNSE0UdcqlP2X4dyM1pyVNHpCGYZaBlE; path=/; domain=.tribalfusion.com; expires=Fri, 22-Oct-2021 18:07:27 GMT;
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 673f1696edcd4df4-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H/1.1 200
OK usersync Show response
match.bnmla.com/ Frame C38D 0
114 B 374ms
125ms Document
text/plain 38.27.122.158
COGENT-174

General

Check archive.org

Show headers Download Go to

Full URL: https://match.bnmla.com/usersync?sspid=10738&redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw%26piggybackCookie%3D%5BUUID%5D
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 38.27.122.158 Chestertown, United States, ASN174 (COGENT-174, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Host: match.bnmla.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://ads.pubmatic.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Server: nginx
Date: Sat, 24 Jul 2021 18:07:28 GMT
Content-Length: 0
Connection: keep-alive

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame CF17
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=DYlBNCjcSu1oSFJUj0WPMlJmFNs

42 B
219 B

41ms
41ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=DYlBNCjcSu1oSFJUj0WPMlJmFNs
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

:method: GET
:authority: simage2.pubmatic.com
:scheme: https
:path: /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=DYlBNCjcSu1oSFJUj0WPMlJmFNs
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: KADUSERCOOKIE=AE435053-9948-4944-AE8E-BD542B8CAC59; chkChromeAb67Sec=1; DPSync3=1628294400%3A201_197%7C1627689600%3A164%7C1627171200%3A174; SyncRTB3=1628294400%3A21_54_231_233_3_99_166_8_222_48_189_220_55_165_176_22_71_104_57_56_13_7_178%7C1627948800%3A63%7C1627516800%3A216%7C1627689600%3A15_2_223_38%7C1628380800%3A35; KRTBCOOKIE_22=14911-2664328602621352134; PUBMDCID=3; KRTBCOOKIE_27=16735-uid:e91560fc-56df-4b00-ad55-689152560648&KRTB&16736-uid:e91560fc-56df-4b00-ad55-689152560648&KRTB&23019-uid:e91560fc-56df-4b00-ad55-689152560648&KRTB&23114-uid:e91560fc-56df-4b00-ad55-689152560648; SPugT=1627150046; KRTBCOOKIE_377=6810-315c48e3-25a3-42fc-a569-cdc3759612af&KRTB&22918-315c48e3-25a3-42fc-a569-cdc3759612af&KRTB&23031-315c48e3-25a3-42fc-a569-cdc3759612af; KRTBCOOKIE_80=22987-CAESEO84z_SemPcowxtPibN5Fpg&KRTB&16514-CAESEO84z_SemPcowxtPibN5Fpg&KRTB&23025-CAESEO84z_SemPcowxtPibN5Fpg; KRTBCOOKIE_218=22978-YPxW3wADC3uviwAC&KRTB&23194-YPxW3wADC3uviwAC&KRTB&23209-YPxW3wADC3uviwAC&KRTB&23244-YPxW3wADC3uviwAC; PugT=1627150048; KRTBCOOKIE_57=22776-7940331768660304726; KRTBCOOKIE_153=19420-ucICdLrEASeiw1EmucBJIO3KAS6iw1xyv8D_Gf-S&KRTB&22979-ucICdLrEASeiw1EmucBJIO3KAS6iw1xyv8D_Gf-S; KRTBCOOKIE_391=22924-2641632458245132337&KRTB&23263-2641632458245132337; KRTBCOOKIE_594=17105-RX-5ed04603-0c4d-4893-9851-43271a6ef1a9-003&KRTB&17107-RX-5ed04603-0c4d-4893-9851-43271a6ef1a9-003
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Sat, 24 Jul 2021 18:07:28 GMT
content-type: image/gif; charset=utf-8
content-length: 42
set-cookie: KRTBCOOKIE_860=16335-DYlBNCjcSu1oSFJUj0WPMlJmFNs; domain=pubmatic.com; SameSite=None; secure; expires=Fri, 22-Oct-2021 18:07:28 GMT; path=/ PugT=1627150048; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 23-Aug-2021 18:07:28 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Fri, 22-Oct-2021 18:07:28 GMT; path=/
x-lat: lhrpug003:0:735
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

Content-Type: text/html; charset=utf-8
Date: Sat, 24 Jul 2021 18:07:28 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=DYlBNCjcSu1oSFJUj0WPMlJmFNs
Set-Cookie: sa-user-id=s%3A0-0d894134-28dc-4aed-6848-52548f458f32.QX5H96r4CUI341g2cmGJ3JGDXisqZoZOqnnolLne3WQ; Max-Age=31536000; Secure; SameSite=None sa-user-id-v2=s%3A0-0d894134-28dc-4aed-6848-52548f458f32%24ip%2482.102.20.219.euZAD%2FMBDXQaErB8sfuDSSuRwPiMjNSzK8JoMhg7y84; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None
Content-Length: 159
Connection: keep-alive

GET
H2

200

rtb-h Show response
match.taboola.com/sg/pubmatic-ssp-network/1/ Frame 2A02
Redirect Chain

https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=ba8d6097-208e-423e-bee7-422e8d0340c1-tuct7f5dc5f&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdSe...

0
148 B

122ms
55ms

Document
text/plain

151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=ba8d6097-208e-423e-bee7-422e8d0340c1-tuct7f5dc5f&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: match.taboola.com
:scheme: https
:path: /sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=ba8d6097-208e-423e-bee7-422e8d0340c1-tuct7f5dc5f&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: t_gid=ba8d6097-208e-423e-bee7-422e8d0340c1-tuct7f5dc5f
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
accept-ranges: bytes
date: Sat, 24 Jul 2021 18:07:27 GMT
via: 1.1 varnish
x-served-by: cache-fra19121-FRA
x-cache: MISS
x-cache-hits: 0
x-timer: S1627150048.945581,VS0,VE15
content-length: 0

Redirect headers

server: nginx
set-cookie: t_gid=ba8d6097-208e-423e-bee7-422e8d0340c1-tuct7f5dc5f;Version=1;Path=/;Domain=.taboola.com;Expires=Sun, 24-Jul-2022 18:07:27 GMT;Max-Age=31536000;Secure;SameSite=None
location: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=ba8d6097-208e-423e-bee7-422e8d0340c1-tuct7f5dc5f&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
accept-ranges: bytes
date: Sat, 24 Jul 2021 18:07:27 GMT
via: 1.1 varnish
x-served-by: cache-fra19129-FRA
x-cache: MISS
x-cache-hits: 0
x-timer: S1627150048.829484,VS0,VE19
x-vcl-time-ms: 19
content-length: 0

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 71CE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=rkNQU5lISUSujr1UK4ysWQ%3D%3D
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=rkNQU5lISUSujr1UK4ysWQ%3D%3D&google_tc=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

14 KB
14 KB

36ms
35ms

Image
text/html

2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
content-encoding: gzip
last-modified: Tue, 15 Jun 2021 06:08:03 GMT
server: Apache/2.2.15 (CentOS)
etag: "1300708-3945-5c4c7cc02bd56"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=44490
accept-ranges: bytes
content-type: text/html; charset=UTF-8
content-length: 5054
expires: Sun, 25 Jul 2021 06:28:58 GMT

Redirect headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:28 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 451 420486.gif
idsync.rlcdn.com/ Frame 71CE 0
66 B 172ms
69ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/420486.gif?partner_uid=AE435053-9948-4944-AE8E-BD542B8CAC59
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:27 GMT
via: 1.1 google
alt-svc: clear
content-length: 0

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 71CE
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=75cf60fc-56df-4700-8751-60ee4612ce19

0
260 B

104ms
35ms

Image
text/plain

185.64.189.114
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=75cf60fc-56df-4700-8751-60ee4612ce19
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.114 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:26 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Sat, 24 Jul 2021 18:10:21 GMT
Server: MT3 3810 5cb7d7e master cdg-pixel-x28
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=75cf60fc-56df-4700-8751-60ee4612ce19
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sat, 24 Jul 2021 18:10:20 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 71CE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QUU0MzUwNTMtOTk0OC00OTQ0LUFFOEUtQkQ1NDJCOENBQzU5&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QUU0MzUwNTMtOTk0OC00OTQ0LUFFOEUtQkQ1NDJCOENBQzU5&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
110 B

41ms
41ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug019:0:381
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:28 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 71CE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm=&google_sc=&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEO84z_SemPcowxtPibN5Fpg&google_cver=1

42 B
280 B

42ms
41ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEO84z_SemPcowxtPibN5Fpg&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:27 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug018:0:461
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:28 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEO84z_SemPcowxtPibN5Fpg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubmatic
um.simpli.fi/ Frame 71CE 43 B
609 B 108ms
31ms Image
image/gif 169.50.137.190
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

169.50.137.190 , United States, ASN36351 (SOFTLAYER, US),

Reverse DNS

be.89.32a9.ip4.static.sl-reverse.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:27 GMT
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Fri, 23 Jul 2021 18:07:27 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 71CE
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2664328602621352134&gdpr=0&gdpr_consent=&us_privacy=

1 B
478 B

124ms
41ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2664328602621352134&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:27 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug006:0:399
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2664328602621352134&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Sat, 24 Jul 2021 18:07:27 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 71CE
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YPxW3wADC3uviwAC&gdpr=0&gdpr_consent=&_test=YPxW3wADC3uviwAC

1 B
238 B

41ms
41ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YPxW3wADC3uviwAC&gdpr=0&gdpr_consent=&_test=YPxW3wADC3uviwAC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug005:0:494
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:28 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1627150048.025390,VS0,VE0
x-served-by: cache-fra19126-FRA
x-cache: HIT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YPxW3wADC3uviwAC&gdpr=0&gdpr_consent=&_test=YPxW3wADC3uviwAC
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 71CE
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=315c48e3-25a3-42fc-a569-cdc3759612af

42 B
448 B

43ms
42ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=315c48e3-25a3-42fc-a569-cdc3759612af
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug009:0:2408
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:27 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=315c48e3-25a3-42fc-a569-cdc3759612af
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 313

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 71CE
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:e91560fc-56df-4b00-ad55-689152560648&gdpr=0&gdpr_consent=

42 B
359 B

61ms
42ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:e91560fc-56df-4b00-ad55-689152560648&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:27 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug001:0:899
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Sat, 24 Jul 2021 18:10:21 GMT
Server: MT3 3810 5cb7d7e master cdg-pixel-x11
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:e91560fc-56df-4b00-ad55-689152560648&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sat, 24 Jul 2021 18:10:20 GMT

GET
H2 200 AE435053-9948-4944-AE8E-BD542B8CAC59
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 71CE 43 B
843 B 102ms
34ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/AE435053-9948-4944-AE8E-BD542B8CAC59?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:27 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 71CE
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=AE435053-9948-4944-AE8E-BD542B8CAC59&redir=true&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=AE435053-9948-4944-AE8E-BD542B8CAC59&redir=true&gdpr=0&gdpr_consent=&verify=true
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-lrsY.UJE2uVA7RV1q0h9NgJRyMfOumM-~A&gdpr=0&gdpr_consent=

0
48 B

35ms
35ms

Image
text/plain

185.64.189.114
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-lrsY.UJE2uVA7RV1q0h9NgJRyMfOumM-~A&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.114 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:26 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Sat, 24 Jul 2021 18:07:28 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-lrsY.UJE2uVA7RV1q0h9NgJRyMfOumM-~A&gdpr=0&gdpr_consent=
Connection: keep-alive
Content-Length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 71CE
Redirect Chain

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7940331768660304726&gdpr=0&gdpr_consent=

42 B
209 B

41ms
41ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7940331768660304726&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug012:0:427
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma: no-cache
Date: Sat, 24 Jul 2021 18:07:28 GMT
X-Proxy-Origin: 82.102.20.219; 82.102.20.219; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f45e09fb-d0f4-4253-af45-89bd519ed710
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7940331768660304726&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 204 current
pubmatic-match.dotomi.com/match/bounce/ Frame 71CE 0
104 B 92ms
66ms Image
text/plain 2a02:fa8:8806:20::2040
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=AE435053-9948-4944-AE8E-BD542B8CAC59&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:20::2040 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:28 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H/1.1 200
OK CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 71CE 0
88 B 450ms
112ms Image
text/plain 52.45.11.130
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.45.11.130 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-11-130.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0
Content-Type: text/plain

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 71CE
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=01d4f13b-ecaa-11eb-bfce-bf3d145fec43&gdpr=0&gdpr_consent=

1 B
215 B

41ms
41ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=01d4f13b-ecaa-11eb-bfce-bf3d145fec43&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug008:0:690
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=01d4f13b-ecaa-11eb-bfce-bf3d145fec43&gdpr=0&gdpr_consent=
Date: Sat, 24 Jul 2021 18:07:28 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: 01d4f13c-ecaa-11eb-bfce-bf3d145fec43

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 71CE
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=no-consent&gdpr=1&gdpr_consent=

42 B
203 B

41ms
41ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=no-consent&gdpr=1&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug016:0:502
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:27 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=no-consent&gdpr=1&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 71CE
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://a.volvelle.tech/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_uid=3148c584-ca6a-4474-8ba1-0ad1f569734b
https://a.volvelle.tech/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_uid=3148c584-ca6a-4474-8ba1-0ad1f569734b
https://x.bidswitch.net/sync?dsp_id=190&expires=14&user_group=1&user_id=8f07bcc4-9e77-46f1-985f-4f09937cc881&ssp=pubmatic
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=3148c584-ca6a-4474-8ba1-0ad1f569734b&gdpr=&gdpr_consent=&gdpr_pd=

1 B
218 B

41ms
41ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=3148c584-ca6a-4474-8ba1-0ad1f569734b&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug013:0:457
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=3148c584-ca6a-4474-8ba1-0ad1f569734b&gdpr=&gdpr_consent=&gdpr_pd=
date: Sat, 24 Jul 2021 18:07:28 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame 71CE
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R1B342_E0BBAA22_103486041&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
266 B

150ms
150ms

Image
image/gif

204.2.255.233
NTT-COMMUNICATION...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.2.255.233 , United States, ASN2914 (NTT-COMMUNICATIONS-2914, US),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-310136849; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 24 Jul 2021 18:07:28 GMT
Cache-Control: no-cache
Expires: -1
Content-Length: 43
Strict-Transport-Security: max-age=-310136849; includeSubDomains
Content-Type: image/gif

Redirect headers

location: https://pmp.mxptint.net/sn.ashx?ak=1
date: Sat, 24 Jul 2021 18:07:28 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug013:0:440
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 71CE
Redirect Chain

https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=ucICdLrEASeiw1EmucBJIO3KAS6iw1xyv8D_Gf-S

42 B
270 B

41ms
41ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=ucICdLrEASeiw1EmucBJIO3KAS6iw1xyv8D_Gf-S
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug005:0:415
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:28 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=ucICdLrEASeiw1EmucBJIO3KAS6iw1xyv8D_Gf-S
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 71CE
Redirect Chain

https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_ac274344-d587-482b-bc5b-4f90c54980f2

42 B
514 B

41ms
41ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_ac274344-d587-482b-bc5b-4f90c54980f2
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:29 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug014:0:369
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_ac274344-d587-482b-bc5b-4f90c54980f2
date: Sat, 24 Jul 2021 18:07:29 GMT
p3p: CP="This is not a P3P policy"
server: nginx
timing-allow-origin: *
content-length: 0
content-language: en-US

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 71CE
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=2641632458245132337

42 B
233 B

41ms
41ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=2641632458245132337
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug008:0:361
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:28 GMT
server: nginx
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=2641632458245132337
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 71CE
Redirect Chain

https://sync.resetdigital.co:10001/csync/pubmatic
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=00000072D1EA6FB1

42 B
403 B

42ms
41ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=00000072D1EA6FB1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:32 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug016:0:741
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Sat, 24 Jul 2021 18:07:32 GMT
Server: nginx/1.18.0 (Ubuntu)
Front-End-Https: on
Content-Type: text/html
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=00000072D1EA6FB1
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 0

GET
H2

200

e77e7ca9-0314-431b-8df1-cfe6370a180d&partner_id=1010 Show response
csync.smilewanted.com/set_partner_userid_get/improve/ Frame E756
Redirect Chain

https://ice.360yield.com/server_match?r=https://csync.smilewanted.com/set_partner_userid_get/improve/{PUB_USER_ID}&partner_id=1010
https://ice.360yield.com/ul_cb/server_match?r=https://csync.smilewanted.com/set_partner_userid_get/improve/%7BPUB_USER_ID%7D&partner_id=1010
https://csync.smilewanted.com/set_partner_userid_get/improve/e77e7ca9-0314-431b-8df1-cfe6370a180d&partner_id=1010

0
944 B

55ms
55ms

Document
text/html

172.67.71.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/improve/e77e7ca9-0314-431b-8df1-cfe6370a180d&partner_id=1010
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.71.185 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: csync.smilewanted.com
:scheme: https
:path: /set_partner_userid_get/improve/e77e7ca9-0314-431b-8df1-cfe6370a180d&partner_id=1010
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://csync.smilewanted.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: sw_user_params_infos=8sdRREvsw7LjLys0YvGw80Tu4fZyrrbmxnoqFBxAEW5%2FnMJqeVXYy4%2BVFDI74lW4lxiB0Qwi5RRTN9H0ZEMsAAETzxb2ORoHNPFOLNmDEN6Mia0dNse%2BBrdIA0FOk2u6DXeNuL%2B3t68AjC%2FgKx2J8A%3D%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://csync.smilewanted.com/

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: sw_user_params_infos=KAl0ehTLh6CnRUZlvDdrAJ8L3n%2FE99ucYCQU7oB2iFlcuY%2F9nkN33UxnDsnoisNdJ74svY%2BYPIWRelinPpk4vcf%2F6wzsKn6T0d6CXfVB%2FG5dKMNh3nc3qLGax7ipWrGufbczgR8t2ffUV5E3kljJXXp65ZDvJcbkYOuqtN1hN%2Bu4TYYX3MFReWfC37PqWi%2FQTJ4ik1yHzs%2FhIvnuI6MEBQn%2FICUSlSzgwm6lcUyT2Gg%3D; expires=Sun, 24-Jul-2022 23:56:39 GMT; Max-Age=31556952; path=/; SameSite=None; Secure; domain=smilewanted.com; secure; HttpOnly
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ml9l%2FAeLUvxq1JzC3X%2BE3mq8pcxrYnwfUJUJlzCbCJhdSJVpKtDQ%2FCHXXDTBZh%2Br6XdqevF17iQELIJjelX7idU5ZLj0SAOfiA0qpDa%2Fek%2BzK3XAWnwrI7M%2FnV6ig%2BYY34DKNhGE5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 673f1697de6c7383-CPH
content-encoding: br

Redirect headers

date: Sat, 24 Jul 2021 18:07:27 GMT
content-type: text/plain
content-length: 0
location: https://csync.smilewanted.com/set_partner_userid_get/improve/e77e7ca9-0314-431b-8df1-cfe6370a180d&partner_id=1010
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame 7D43 0
0 176ms
44ms Document
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-smilewanted
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Host: pixel.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://csync.smilewanted.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://csync.smilewanted.com/

Response headers

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma: no-cache
Cache-Control: no-cache,no-store,must-revalidate
Expires: 0
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Content-Type: image/gif

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 78A2 14 KB
5 KB 35ms
34ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

:method: GET
:authority: ads.pubmatic.com
:scheme: https
:path: /AdServer/js/user_sync.html?p=158810&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://csync.smilewanted.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: KCCH=YES; KADUSERCOOKIE=AE435053-9948-4944-AE8E-BD542B8CAC59; chkChromeAb67Sec=1; DPSync3=1628294400%3A201_197%7C1627689600%3A164%7C1627171200%3A174; SyncRTB3=1628294400%3A21_54_231_233_3_99_166_8_222_48_189_220_55_165_176_22_71_104_57_56_13_7_178%7C1627948800%3A63%7C1627516800%3A216%7C1627689600%3A15_2_223_38%7C1628380800%3A35
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://csync.smilewanted.com/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=44491
expires: Sun, 25 Jul 2021 06:28:58 GMT
date: Sat, 24 Jul 2021 18:07:27 GMT
vary: Accept-Encoding

GET
H2

200

YPxW4CNvB0dZtdxZdLAQvgAA%26652 Show response
csync.smilewanted.com/set_partner_userid_get/indexexchange/ Frame 0C08
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=193216&cb=https://csync.smilewanted.com/set_partner_userid_get/indexexchange/
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Findexexchange%2F&s=193216&C=1
https://csync.smilewanted.com/set_partner_userid_get/indexexchange/YPxW4CNvB0dZtdxZdLAQvgAA%26652

0
688 B

120ms
120ms

Document
text/html

172.67.71.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/indexexchange/YPxW4CNvB0dZtdxZdLAQvgAA%26652
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.71.185 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: csync.smilewanted.com
:scheme: https
:path: /set_partner_userid_get/indexexchange/YPxW4CNvB0dZtdxZdLAQvgAA%26652
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://csync.smilewanted.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: sw_user_params_infos=KAl0ehTLh6CnRUZlvDdrAJ8L3n%2FE99ucYCQU7oB2iFlcuY%2F9nkN33UxnDsnoisNdJ74svY%2BYPIWRelinPpk4vcf%2F6wzsKn6T0d6CXfVB%2FG5dKMNh3nc3qLGax7ipWrGufbczgR8t2ffUV5E3kljJXXp65ZDvJcbkYOuqtN1hN%2Bu4TYYX3MFReWfC37PqWi%2FQTJ4ik1yHzs%2FhIvnuI6MEBQn%2FICUSlSzgwm6lcUyT2Gg%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://csync.smilewanted.com/

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: sw_user_params_infos=mf2dodhqSZtaZs9sMj0nPSBuMKyGJs4bTjg8zM27iLCEqWxi7iHlp6V40R%2FkGokCEM3aQZG%2F3O%2FUEktJjhmL7oAyaaI%2F3lNppMfbCHgEp8rHMe0NKsqVx2BCujZWA6c94ATL2%2FYjblNE3j33e7Dt5UtKfjxLUsBAFS3Luv882oR5rZL0Bo4s3chReaWWoCfW%2BmIr51m7S4L16x%2BL6r57hw0j9WgDRFm1qCgUZkN3fFLXBkoUlnwZqJrPh85H9KoB896H3dAhw4%2BHmGDIowBmdpdVVUqpgdgR4rP0L7BJLE4J%2FyAlEpUs4MJupXFMk9ho; expires=Sun, 24-Jul-2022 23:56:40 GMT; Max-Age=31556952; path=/; SameSite=None; Secure; domain=smilewanted.com; secure; HttpOnly
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W9OfcvhOzNn4NwwKOeAclp0ngsYhxlrxEttxWW0dbJSLCxTYnL1KMnSKyt5nxahcbbSuA8erkuG2px0T8JMDP%2B%2B43PKw%2Fc5w2xMnrNZxk%2BXIYBPYYtWtJUZnxQw11Wc%2B%2FjkMlT%2B8Vw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 673f16992fdf7383-CPH
content-encoding: br

Redirect headers

Server: Apache
Content-Length: 281
Content-Type: text/html; charset=iso-8859-1
Location: https://csync.smilewanted.com/set_partner_userid_get/indexexchange/YPxW4CNvB0dZtdxZdLAQvgAA%26652
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Expires: Sat, 24 Jul 2021 18:07:28 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 24 Jul 2021 18:07:28 GMT
Connection: keep-alive
Set-Cookie: CMID=YPxW4CNvB0dZtdxZdLAQvgAA;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sun, 24 Jul 2022 18:07:28 GMT CMPS=650;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Fri, 22 Oct 2021 18:07:28 GMT CMPRO=652;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Fri, 22 Oct 2021 18:07:28 GMT CMST=YPxW4GD8VuAA;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sun, 25 Jul 2021 18:07:28 GMT

GET
H2

200

01a7fb8e-ecaa-11eb-9fa9-1860f0710106 Show response
csync.smilewanted.com/set_partner_userid_get/spotx/ Frame 5E1C
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=178357&redir=https://csync.smilewanted.com/set_partner_userid_get/spotx/$SPOTX_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=178357&redir=https://csync.smilewanted.com/set_partner_userid_get/spotx/$SPOTX_USER_ID&__user_check__=1&sync_id=01a7fbf7-ecaa-11eb-9fa9-1860f0710106
https://csync.smilewanted.com/set_partner_userid_get/spotx/01a7fb8e-ecaa-11eb-9fa9-1860f0710106

0
647 B

60ms
60ms

Document
text/html

172.67.71.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/spotx/01a7fb8e-ecaa-11eb-9fa9-1860f0710106
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.71.185 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: csync.smilewanted.com
:scheme: https
:path: /set_partner_userid_get/spotx/01a7fb8e-ecaa-11eb-9fa9-1860f0710106
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://csync.smilewanted.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: sw_user_params_infos=KAl0ehTLh6CnRUZlvDdrAJ8L3n%2FE99ucYCQU7oB2iFlcuY%2F9nkN33UxnDsnoisNdJ74svY%2BYPIWRelinPpk4vcf%2F6wzsKn6T0d6CXfVB%2FG5dKMNh3nc3qLGax7ipWrGufbczgR8t2ffUV5E3kljJXXp65ZDvJcbkYOuqtN1hN%2Bu4TYYX3MFReWfC37PqWi%2FQTJ4ik1yHzs%2FhIvnuI6MEBQn%2FICUSlSzgwm6lcUyT2Gg%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://csync.smilewanted.com/

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: sw_user_params_infos=1w2Z%2BqqaIIZbfLRr%2FneGTJCVQoYQDw4C8yh0Ev8Bhdd2pZERnJNFhUYmLN%2BwAJpgMQ6a9zEaXDluo2zeAxlOxV2rSdMxk7hi75xpYEKbdXu%2B404GMPU7dVt4%2FxAkiXpVjZlInSd%2B1xUYr2idBOcUsGdD147I2PH7AFH7qRdKZAvrxRvAMc0yQSZiiaj1eRAGGBzJNQacmDT1qC4kUKjiQORxAbQfdiTn0efAetrpccvoQNfpRvNB59U7FfRUsG244vJJcGnsNItyM5mDaSilyQ%3D%3D; expires=Sun, 24-Jul-2022 23:56:40 GMT; Max-Age=31556952; path=/; SameSite=None; Secure; domain=smilewanted.com; secure; HttpOnly
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ihD3oYaTAAac00lXt%2B%2B%2BeHAK1dszaX9%2FH1RB6RWUuWffcYkWLfmzG2AatYScJlT7s2UowAa6NFY2tIPQMw6fPCBwCNbB%2FBfOT5CsFGCdvxkJLNdCfPxde1k%2B1BKVvuThBFyUdlZC9A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 673f16993fe97383-CPH
content-encoding: br

Redirect headers

Server: nginx
Date: Sat, 24 Jul 2021 18:07:28 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Set-Cookie: audience=01a7fb8e-ecaa-11eb-9fa9-1860f0710106; expires=Sun, 24-Jul-2022 19:14:08 GMT; path=/; domain=.spotxchange.com; SameSite=none; Secure
Location: https://csync.smilewanted.com/set_partner_userid_get/spotx/01a7fb8e-ecaa-11eb-9fa9-1860f0710106
X-fe: 123
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0

GET
H2

200

7940331768660304726 Show response
csync.smilewanted.com/set_partner_userid_get/appnexus/ Frame 16B9
Redirect Chain

https://secure.adnxs.com/getuid?https://csync.smilewanted.com/set_partner_userid_get/appnexus/$UID
https://csync.smilewanted.com/set_partner_userid_get/appnexus/7940331768660304726

0
1 KB

123ms
123ms

Document
text/html

172.67.71.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/appnexus/7940331768660304726
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.71.185 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: csync.smilewanted.com
:scheme: https
:path: /set_partner_userid_get/appnexus/7940331768660304726
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://csync.smilewanted.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: sw_user_params_infos=Elj22LZd7gBjZsL4u9K00rd1QyikShhkYfqmfhH%2FZ4xv02LaUtWdowU%2FcYn7o0vhenxe4xE2MITtl%2FHn12KbD3XX%2FkFfcSW6Gg2Za8IEqpZaL6HLiPdxNF%2Bk3wRQTYUmSQGQynwhg0DjfBCZvxUlsjgmnrQmjWpc1fKgdkCgEcQnOylnzLYq8%2FtQTSTfP%2FSpBs3TYO3LrzvRBcoaw1NgEGLHBTIitKkFozPGYvUOoVxF8JTBJYacOvWMAuVWkXA89AHkFWd19HA82vrQERretdFokLpBx2tVaa8eN8h7xThCkG%2BwLmOQM56v2lrsKR%2BfXkR%2BGVWbgANto3vhq2cp4WxniimK4rwmEPzjRsy%2F214%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://csync.smilewanted.com/

Response headers

date: Sat, 24 Jul 2021 18:07:29 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: sw_user_params_infos=KQZpkmuwz076VmiDqfKQoqw4zanExuiP%2BPEBH3I7yc6JxaU6JshIJgGeGa%2BnDavimLhuTWDpPweLBJRHYOx4dv8X64z%2FJmqCI%2FGkT9nd9a6b8LW0YWuidajstCVtM8ZfX9ACmeAD%2BYcl5N%2F%2BwbYLLPAUDftl%2FG9Wp8mUnyMkBQ0tnlaWPpeBb01PNRw1N1sBqK5k%2FdHBfdlTihKDjM1VGA9pQ6ZGehHhykZZA7xcUoVZh4DRCQfeN6GFY9IarSNsKhlrD1FqU4yP2SM4%2Bn7UGQVSXcRnZWlrvubMMQnXm%2F9Nh9sXanGgahliOV6SJk%2BUF4VlvonfSrVvRHABsL9lJWN%2B6nANnLslsLLnrfxd5gZewhG%2FTfJp6n3lfUHDlxkyCf8gJRKVLODCbqVxTJPYaA%3D%3D; expires=Sun, 24-Jul-2022 23:56:41 GMT; Max-Age=31556952; path=/; SameSite=None; Secure; domain=smilewanted.com; secure; HttpOnly
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VclfJiZHP%2FPBANUyAN1jd67bKfgpa0QH8g3OQeX9TRkwZK52PoyXurqO29YDL3odztrqDun8RDZcn1ajQe2WQx4sfOemmvqGhhXPzbA87Hg1SWBf82jMdS58EhGSLAG8Q2Qx7U%2FOkA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 673f169f98867383-CPH
content-encoding: br

Redirect headers

Server: nginx/1.17.9
Date: Sat, 24 Jul 2021 18:07:29 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Location: https://csync.smilewanted.com/set_partner_userid_get/appnexus/7940331768660304726
AN-X-Request-Uuid: 70eecc38-d744-455e-b51c-f96851df3071
Set-Cookie: uuid2=7940331768660304726; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 22-Oct-2021 18:07:29 GMT; Domain=.adnxs.com; Secure; HttpOnly
X-Proxy-Origin: 82.102.20.219; 82.102.20.219; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com

GET
H2 200 bsync Show response
visitor.omnitagjs.com/visitor/ Frame BD74 49 B
235 B 131ms
41ms Document
image/gif 185.255.84.152
IGUANE-

General

Check archive.org

Show headers Download Go to

Full URL

https://visitor.omnitagjs.com/visitor/bsync?uid=abf65ec65b3e06310c52d0850494081a&name=SMILE_WANTED&url=%20https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadyoulike%2F%5BBUYER_USERID%5D

Requested by

Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.255.84.152 Villeneuve-le-Roi, France, ASN200271 (IGUANE-, FR),

Reverse DNS

Software

ayl-lb-fra02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: visitor.omnitagjs.com
:scheme: https
:path: /visitor/bsync?uid=abf65ec65b3e06310c52d0850494081a&name=SMILE_WANTED&url=%20https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadyoulike%2F%5BBUYER_USERID%5D
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://csync.smilewanted.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://csync.smilewanted.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
expires: 0
pragma: no-cache
vary: Accept-Encoding
x-content-type-options: nosniff
date: Sat, 24 Jul 2021 18:07:27 GMT
content-length: 49
x-envoy-upstream-service-time: 0
server: ayl-lb-fra02

GET
H2

200

068122042727ebb516db7864 Show response
csync.smilewanted.com/set_partner_userid_get/adotmob/ Frame 2B31
Redirect Chain

https://sync.adotmob.com/cookie/smilewanted?r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadotmob%2F{amob_user_id}
https://csync.smilewanted.com/set_partner_userid_get/adotmob/068122042727ebb516db7864

0
709 B

127ms
127ms

Document
text/html

172.67.71.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.smilewanted.com/set_partner_userid_get/adotmob/068122042727ebb516db7864
Requested by: Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.71.185 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: csync.smilewanted.com
:scheme: https
:path: /set_partner_userid_get/adotmob/068122042727ebb516db7864
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://csync.smilewanted.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: sw_user_params_infos=mf2dodhqSZtaZs9sMj0nPSBuMKyGJs4bTjg8zM27iLCEqWxi7iHlp6V40R%2FkGokCEM3aQZG%2F3O%2FUEktJjhmL7oAyaaI%2F3lNppMfbCHgEp8rHMe0NKsqVx2BCujZWA6c94ATL2%2FYjblNE3j33e7Dt5UtKfjxLUsBAFS3Luv882oR5rZL0Bo4s3chReaWWoCfW%2BmIr51m7S4L16x%2BL6r57hw0j9WgDRFm1qCgUZkN3fFLXBkoUlnwZqJrPh85H9KoB896H3dAhw4%2BHmGDIowBmdpdVVUqpgdgR4rP0L7BJLE4J%2FyAlEpUs4MJupXFMk9ho
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://csync.smilewanted.com/

Response headers

date: Sat, 24 Jul 2021 18:07:28 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: sw_user_params_infos=Elj22LZd7gBjZsL4u9K00rd1QyikShhkYfqmfhH%2FZ4xv02LaUtWdowU%2FcYn7o0vhenxe4xE2MITtl%2FHn12KbD3XX%2FkFfcSW6Gg2Za8IEqpZaL6HLiPdxNF%2Bk3wRQTYUmSQGQynwhg0DjfBCZvxUlsjgmnrQmjWpc1fKgdkCgEcQnOylnzLYq8%2FtQTSTfP%2FSpBs3TYO3LrzvRBcoaw1NgEGLHBTIitKkFozPGYvUOoVxF8JTBJYacOvWMAuVWkXA89AHkFWd19HA82vrQERretdFokLpBx2tVaa8eN8h7xThCkG%2BwLmOQM56v2lrsKR%2BfXkR%2BGVWbgANto3vhq2cp4WxniimK4rwmEPzjRsy%2F214%3D; expires=Sun, 24-Jul-2022 23:56:40 GMT; Max-Age=31556952; path=/; SameSite=None; Secure; domain=smilewanted.com; secure; HttpOnly
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CJyKpHivO29k31TZETOWuerBMH4%2F%2B02Fwujmumu15Pz4c8swCc4awYJDPNWFag5DMOi%2BWhGLJgQIvEHqekBQnVIl%2BpVdDJzPmoP3BlvbRhQ5KnCl0xH%2Bm%2Fi6OyEfp3p7GaH70WPBcg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 673f169bcb997383-CPH
content-encoding: br

Redirect headers

X-Powered-By: Express
Vary: Origin
Access-Control-Allow-Credentials: true
Set-Cookie: uid=068122042727ebb516db7864; Domain=.adotmob.com; Path=/; Expires=Tue, 23 Aug 2022 18:07:28 GMT; Secure; SameSite=None uuid=068122042727ebb516db7864; Domain=.adotmob.com; Path=/; Expires=Tue, 23 Aug 2022 18:07:28 GMT; Secure; SameSite=None partners=SMW%3A1627150048574; Domain=.adotmob.com; Path=/; Expires=Tue, 23 Aug 2022 18:07:28 GMT; Secure; SameSite=None
Location: https://csync.smilewanted.com/set_partner_userid_get/adotmob/068122042727ebb516db7864
Date: Sat, 24 Jul 2021 18:07:28 GMT
Content-Length: 0

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame E734 0
731 B 40ms
39ms Script
text/html 185.33.220.240
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.240 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 24 Jul 2021 18:07:28 GMT
X-Proxy-Origin: 82.102.20.219; 82.102.20.219; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: a99ae001-8103-4e5a-919e-cd2dd8bd15eb
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.dk/adsid/ 107 B
122 B 30ms
15ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.dk/adsid/integrator.js?domain=www.bonne-promo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bonne-promo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 451 B
269 B 532ms
531ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4367645153186623&correlator=744421786162435&output=ldjh&impl=fif&eid=31061180%2C31061843%2C20211866&vrg=2021071401&ptt=17&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20210724&iu_parts=1254144%2Cbonne_promo_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C970x250%7C120x240%7C200x200%7C970x90%7C180x150%7C728x90%7C300x250%7C468x60%7C320x100%7C234x60%7C320x50%7C250x250%7C125x125&fluid=height&ris=2&rcs=2&prev_scp=iid12%3D1145730%26eid%3D2026941314961159482%26t%3D134%26d%3D258923%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26a%3D%257C5%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dbonne_promo_com-medrectangle-1-1145730%26eb_br%3D9e0a1ce5b2455cb9b48d5df4c6bf4053%26eba%3D1%26ebss%3D10061%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D350%26br2%3D1000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C28%252C4%252C51%252C0%252C88%252C0%252C71%252C30%252C0%252C31%26deal1%3D22%2C23%2C24%2C25%2C26%2C919%2C21%2C21%26lb%3D1000%26reqt%3D1627150048249&eri=1&cookie=ID%3D98404ba529addd45-220442cf8ac800a1%3AT%3D1627150047%3AS%3DALNI_MZR7FYblKPco9QND9Fg0E9CtJQxWA&bc=31&abxe=1&lmt=1627150049&dt=1627150049255&dlt=1627150043890&idt=519&frm=20&biw=1600&bih=1200&oid=3&adxs=200&adys=6238&adks=1656279579&ucis=5&ifi=5&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bonne-promo.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x64&msz=1200x50&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1757086823.1627150044&ga_sid=1627150044&ga_hid=1089275951&ga_fc=false&fws=0&ohw=0&btvi=3&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

c6220a44e10ed1a867107ececc722c0eb7a0743c429420218a57a1e2bcd1afc4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:29 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 240
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bonne-promo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.dk/adsid/ 107 B
122 B 15ms
14ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.dk/adsid/integrator.js?domain=www.bonne-promo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bonne-promo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 449 B
267 B 499ms
499ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4367645153186623&correlator=2967506140622262&output=ldjh&impl=fif&eid=31061180%2C31061843%2C20211866&vrg=2021071401&ptt=17&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20210724&iu_parts=1254144%2Cbonne_promo_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ris=2&rcs=2&prev_scp=iid12%3D1151730%26eid%3D8511056429833110665%26t%3D134%26d%3D258923%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26a%3D%257C6%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dbonne_promo_com-medrectangle-2-1151730%26eb_br%3D9e0a1ce5b2455cb9b48d5df4c6bf4053%26eba%3D1%26ebss%3D10061%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D350%26br2%3D1000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C28%252C4%252C51%252C0%252C88%252C0%252C71%252C30%252C0%252C31%26deal1%3D22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C21%2C21%26lb%3D1000%26reqt%3D1627150048316&eri=1&cookie=ID%3D98404ba529addd45-220442cf8ac800a1%3AT%3D1627150047%3AS%3DALNI_MZR7FYblKPco9QND9Fg0E9CtJQxWA&bc=31&abxe=1&lmt=1627150049&dt=1627150049321&dlt=1627150043890&idt=519&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1110&adks=669493002&ucis=6&ifi=6&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bonne-promo.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1757086823.1627150044&ga_sid=1627150044&ga_hid=1089275951&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

cb381469707d9f3d026118f83f65bc46153737a2c690a30d651c716272508f8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:29 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 238
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bonne-promo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
www.bonne-promo.com/porpoiseant/ 0
65 B 36ms
36ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjQ3NyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE0NTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjE1MDcifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjQ3NyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE0NTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjE1MDcifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-07-24T18%3A07%3A27.709814Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Sat%2C%2024%20Jul%202021%2018%3A07%3A27%20GMT; __gads=ID=98404ba529addd45-220442cf8ac800a1:T=1627150047:S=ALNI_MZR7FYblKPco9QND9Fg0E9CtJQxWA
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:29 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Fri, 23 Jul 2021 18:07:27 UTC

GET
H2 200 army.gif Show response
www.bonne-promo.com/porpoiseant/ 0
19 B 36ms
36ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMTEwNCJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoidHJ1ZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE0NTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMjAwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiI2MjM4In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMTEwNCJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoidHJ1ZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE0NTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMjAwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiI2MjM4In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-07-24T18%3A07%3A27.709814Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Sat%2C%2024%20Jul%202021%2018%3A07%3A27%20GMT; __gads=ID=98404ba529addd45-220442cf8ac800a1:T=1627150047:S=ALNI_MZR7FYblKPco9QND9Fg0E9CtJQxWA
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:29 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Fri, 23 Jul 2021 18:07:27 UTC

GET
H3-29 200 integrator.js Show response
adservice.google.dk/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.dk/adsid/integrator.js?domain=www.bonne-promo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bonne-promo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 347 B
180 B 322ms
322ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4367645153186623&correlator=4494107899350185&output=ldjh&impl=fif&eid=31061180%2C31061843%2C20211866&vrg=2021071401&ptt=17&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20210724&iu_parts=1254144%2Cbonne_promo_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C970x250%7C120x240%7C200x200%7C970x90%7C180x150%7C728x90%7C300x250%7C468x60%7C320x100%7C234x60%7C320x50%7C250x250%7C125x125&fluid=height&ris=1&rcs=3&prev_scp=iid12%3D1145730%26eid%3D2026941314961159482%26t%3D134%26d%3D258923%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26a%3D%257C5%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dbonne_promo_com-medrectangle-1-1145730%26eb_br%3Da7a863b24978e69c4cdbb5a49be70d5e%26eba%3D1%26ebss%3D10061%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D34%26br2%3D1000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C28%252C4%252C51%252C0%252C88%252C0%252C71%252C30%252C0%252C31%26deal1%3D22%2C23%2C24%2C25%2C26%2C919%2C21%2C21%2C17%2C19%2C20%2C21%2C732%26lb%3D350%26reqt%3D1627150049792&eri=1&cookie=ID%3D98404ba529addd45%3AT%3D1627150047%3AS%3DALNI_MaIqwS5Edwxs655Q_-i0ltxfH7UYg&bc=31&abxe=1&lmt=1627150049&dt=1627150049797&dlt=1627150043890&idt=519&frm=20&biw=1600&bih=1200&oid=3&adxs=200&adys=6238&adks=1656279579&ucis=7&ifi=7&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bonne-promo.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x64&msz=1200x50&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1757086823.1627150044&ga_sid=1627150044&ga_hid=1089275951&ga_fc=false&fws=0&ohw=0&btvi=4&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

523456a41f734ca688c0cf19f8377da02078680281decf2c4eb1d24ba476b5ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:30 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 151
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bonne-promo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 71CE 0
260 B 125ms
42ms Script
text/plain 185.64.190.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156983&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 13:31:40 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3-29 200 integrator.js Show response
adservice.google.dk/adsid/ 107 B
122 B 14ms
13ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.dk/adsid/integrator.js?domain=www.bonne-promo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bonne-promo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 41 KB
10 KB 368ms
368ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4367645153186623&correlator=1978685499880444&output=ldjh&impl=fif&eid=31061180%2C31061843%2C20211866&vrg=2021071401&ptt=17&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20210724&iu_parts=1254144%2Cbonne_promo_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ris=1&rcs=3&prev_scp=iid12%3D1151730%26eid%3D8511056429833110665%26t%3D134%26d%3D258923%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26a%3D%257C6%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dbonne_promo_com-medrectangle-2-1151730%26eb_br%3Da7a863b24978e69c4cdbb5a49be70d5e%26eba%3D1%26ebss%3D10061%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D34%26br2%3D1000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C28%252C4%252C51%252C0%252C88%252C0%252C71%252C30%252C0%252C31%26deal1%3D22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C21%2C21%2C17%2C19%2C20%2C21%2C732%26lb%3D350%26reqt%3D1627150049825&eri=1&cookie=ID%3D98404ba529addd45%3AT%3D1627150047%3AS%3DALNI_MaIqwS5Edwxs655Q_-i0ltxfH7UYg&bc=31&abxe=1&lmt=1627150049&dt=1627150049830&dlt=1627150043890&idt=519&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1110&adks=669493002&ucis=8&ifi=8&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bonne-promo.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1757086823.1627150044&ga_sid=1627150044&ga_hid=1089275951&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

4e32401487ee2b8c1f2cbdcb9809d778ae684a8087594e83ac572188b7d4797d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:30 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10421
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bonne-promo.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012107130206000/ Frame 06B7 188 KB
54 KB 34ms
11ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107130206000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1caacdebd86c67f86ab89cdbd30b056a8c1141638aafdd35ec453c4bae91692b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 189750
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55160
x-xss-protection: 0
server: sffe
date: Thu, 22 Jul 2021 13:25:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "b724d3ee8cec1601"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Jul 2022 13:25:00 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012107130206000/v0/ Frame 06B7 13 KB
6 KB 28ms
6ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107130206000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b16e9c1da7045c9057350282766a114be2070b065e5e8a42ae635d0610ba6d0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 189751
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4795
x-xss-protection: 0
server: sffe
date: Thu, 22 Jul 2021 13:24:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "392d0f0d5f27c169"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Jul 2022 13:24:59 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012107130206000/v0/ Frame 06B7 87 KB
27 KB 41ms
18ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107130206000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

faf5e994ddbada86a873b5d14c1bc0f449a097e61e6fbe0c04e0691b70ec5644

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 189750
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27843
x-xss-protection: 0
server: sffe
date: Thu, 22 Jul 2021 13:25:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f120bcb28bbafed0"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Jul 2022 13:25:00 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012107130206000/v0/ Frame 06B7 4 KB
2 KB 40ms
18ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107130206000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d398520ac47945ab429cf02b444202f4db1cf7fee5b5335cf98fb009ce56ab8e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 189751
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1658
x-xss-protection: 0
server: sffe
date: Thu, 22 Jul 2021 13:24:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "6fba3cabb8cd86f8"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Jul 2022 13:24:59 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012107130206000/v0/ Frame 06B7 40 KB
13 KB 29ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107130206000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29d096500cc94cbe347c613cb34199c274da1fe8b5df04fdb49ee75ace5edbec

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 189750
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12840
x-xss-protection: 0
server: sffe
date: Thu, 22 Jul 2021 13:25:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "6d4edf2414c2591f"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Jul 2022 13:25:00 GMT

GET
DATA 200
OK truncated
/ Frame 06B7 207 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7a681f864fef66e4afaf867943f58cc5d174e12b6a1e002fdb7640a3a86a036

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 3786325652202537092
tpc.googlesyndication.com/simgad/ Frame 06B7 100 KB
100 KB 7ms
7ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3786325652202537092?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qnRWbln-GDDTtp7MlojMxaGA_YsAw

Requested by

Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e7b4d82f5e920738166b1db6c532065bff57f335bdfae74a8e57085dd4d9f22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 17 Jul 2021 21:14:38 GMT
x-content-type-options: nosniff
last-modified: Wed, 16 Jun 2021 09:23:58 GMT
server: sffe
age: 593572
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 102186
x-xss-protection: 0
expires: Sun, 17 Jul 2022 21:14:38 GMT

GET
H2 200 fr.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 06B7 3 KB
3 KB 7ms
6ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/fr.png

Requested by

Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bb10b8a273579cd997035d04ad3d87002aefa416b6ebe91b6c25e4eb0aa6ffcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 08:17:08 GMT
x-content-type-options: nosniff
server: cafe
age: 35422
etag: 12021612326893382710
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2724
x-xss-protection: 0
expires: Sun, 25 Jul 2021 08:17:08 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 06B7 295 B
568 B 6ms
6ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 13:07:41 GMT
x-content-type-options: nosniff
server: cafe
age: 17989
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Sun, 25 Jul 2021 13:07:41 GMT

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 06B7 0
0 82ms
81ms Image
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C0B134Vb8YKqCN8KL3gPO_bEg0ei98mP57-6Wgw7a2R4QASD0-cYlYNGBuYLQB6ABpsiDzALIAQLgAgCoAwHIAwiqBNgBT9CSRA3d42X6_2OoLeCwzFjT9JuGXSWNruIH7auBJ9D8Jz-KrtzbNxgxZCqd7yry-MZBG7oA5P-WuHtTC4T3B_cyNXEDJQ0hRQruO8K8eWm17DwDuWBfHkME2RVvPV8U9pFF7YT-IeDRwIRwGfiV_Kf5zww8tLEF1AWEWRZ6zAq0DUNJCN2LetZ8RKm8zYF2WTH3NKK2Vabn_4sNVptH14rBUnisTcnaNXARnl4ZY72z9-aIEEZIRjP5H-0G_QMvv3vOLEhiEUZyVXExiIvJJKBKeP1kzQRtwAT--uXdwgPgBAGSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGAoAHwrf8swGoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQy9070ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi01NDM1MzU4NjQ1NjA1ODg5gAoDyAsB2BMN0BUBgBcBshcaChgIABIUcHViLTYzOTY4NDQ3NDI0OTcyMDg&sigh=qzkzXzXasj8
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 greenoaks.gif Show response
www.bonne-promo.com/detroitchicago/ 0
65 B 36ms
36ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjYzMzYifV19XQ==
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjYzMzYifV19XQ==
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-07-24T18%3A07%3A27.709814Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Sat%2C%2024%20Jul%202021%2018%3A07%3A27%20GMT; __gads=ID=98404ba529addd45:T=1627150047:S=ALNI_MaIqwS5Edwxs655Q_-i0ltxfH7UYg; ezouspvv=34; ezouspva=1; ezouspvh=34
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:30 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Fri, 23 Jul 2021 18:07:28 UTC

GET
H2 200 army.gif Show response
www.bonne-promo.com/porpoiseant/ 0
42 B 37ms
37ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiI0In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUxNzMwIiwiZG9tYWluX2lkIjoiMjU4OTIzIiwidW5pdCI6ImRpdi1ncHQtYWQtYm9ubmVfcHJvbW9fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTIzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiYTdhODYzYjI0OTc4ZTY5YzRjZGJiNWE0OWJlNzBkNWUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTE3MzAiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ1bml0IjoiZGl2LWdwdC1hZC1ib25uZV9wcm9tb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjcxNTAwNDMsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDM0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMzQsImJpZF9mbG9vcl9wcmV2IjowLjAwMzUsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImRiY2JkMWZhLTJiYWYtNDRlYS02ODA5LTRmYzYyZmQxMmZjZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUxNzMwIiwiZG9tYWluX2lkIjoiMjU4OTIzIiwidW5pdCI6ImRpdi1ncHQtYWQtYm9ubmVfcHJvbW9fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTIzLCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwNDM1MjMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTE3MzAiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ1bml0IjoiZGl2LWdwdC1hZC1ib25uZV9wcm9tb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjcxNTAwNDMsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImRiY2JkMWZhLTJiYWYtNDRlYS02ODA5LTRmYzYyZmQxMmZjZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjI4Njg3Mjc0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiI0In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUxNzMwIiwiZG9tYWluX2lkIjoiMjU4OTIzIiwidW5pdCI6ImRpdi1ncHQtYWQtYm9ubmVfcHJvbW9fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTIzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiYTdhODYzYjI0OTc4ZTY5YzRjZGJiNWE0OWJlNzBkNWUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTE3MzAiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ1bml0IjoiZGl2LWdwdC1hZC1ib25uZV9wcm9tb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjcxNTAwNDMsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDM0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMzQsImJpZF9mbG9vcl9wcmV2IjowLjAwMzUsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImRiY2JkMWZhLTJiYWYtNDRlYS02ODA5LTRmYzYyZmQxMmZjZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUxNzMwIiwiZG9tYWluX2lkIjoiMjU4OTIzIiwidW5pdCI6ImRpdi1ncHQtYWQtYm9ubmVfcHJvbW9fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTIzLCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwNDM1MjMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTE3MzAiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ1bml0IjoiZGl2LWdwdC1hZC1ib25uZV9wcm9tb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjcxNTAwNDMsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImRiY2JkMWZhLTJiYWYtNDRlYS02ODA5LTRmYzYyZmQxMmZjZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjI4Njg3Mjc0In1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-07-24T18%3A07%3A27.709814Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Sat%2C%2024%20Jul%202021%2018%3A07%3A27%20GMT; __gads=ID=98404ba529addd45:T=1627150047:S=ALNI_MaIqwS5Edwxs655Q_-i0ltxfH7UYg; ezouspvv=34; ezouspva=1; ezouspvh=34
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:30 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Fri, 23 Jul 2021 18:07:25 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
88 B 113ms
36ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/porpoiseant/banger.js?cb=195-0&bv=38&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sat, 24 Jul 2021 18:07:30 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
www.bonne-promo.com/porpoiseant/ 0
19 B 36ms
36ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDctMjQifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMCJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI2In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDctMjQifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMCJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI2In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-07-24T18%3A07%3A27.709814Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Sat%2C%2024%20Jul%202021%2018%3A07%3A27%20GMT; __gads=ID=98404ba529addd45:T=1627150047:S=ALNI_MaIqwS5Edwxs655Q_-i0ltxfH7UYg; ezouspvv=34; ezouspva=1; ezouspvh=34
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:30 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Fri, 23 Jul 2021 18:07:28 UTC

GET
H2 200 army.gif Show response
www.bonne-promo.com/porpoiseant/ 0
42 B 35ms
35ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYXVjdGlvbl9lcG9jaCI6MTYyNzE1MDA1MCwiYWRfcG9zaXRpb24iOjExMDAsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJiaWRfZmxvb3JfaW5pdGlhbCI6MjAwMCwiYmlkX2Zsb29yX3ByZXYiOjM1MCwiYmlkX2Zsb29yX2ZpbGxlZCI6MzQsImF1Y3Rpb25fY291bnQiOjQsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjM4OSwibXVsdGlfYWRfdW5pdCI6MCwibXVsdGlfYWRfY291bnQiOjAsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjoyODY4NzI3NH1d
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYXVjdGlvbl9lcG9jaCI6MTYyNzE1MDA1MCwiYWRfcG9zaXRpb24iOjExMDAsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJiaWRfZmxvb3JfaW5pdGlhbCI6MjAwMCwiYmlkX2Zsb29yX3ByZXYiOjM1MCwiYmlkX2Zsb29yX2ZpbGxlZCI6MzQsImF1Y3Rpb25fY291bnQiOjQsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjM4OSwibXVsdGlfYWRfdW5pdCI6MCwibXVsdGlfYWRfY291bnQiOjAsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjoyODY4NzI3NH1d
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-07-24T18%3A07%3A27.709814Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Sat%2C%2024%20Jul%202021%2018%3A07%3A27%20GMT; __gads=ID=98404ba529addd45:T=1627150047:S=ALNI_MaIqwS5Edwxs655Q_-i0ltxfH7UYg; ezouspvv=34; ezouspva=1; ezouspvh=34
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:30 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Fri, 23 Jul 2021 18:07:29 UTC

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 06B7
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

68ms
67ms

Image
text/html

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.185.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s53-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

date: Sat, 24 Jul 2021 18:07:30 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.dk/adsid/ 107 B
122 B 15ms
14ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.dk/adsid/integrator.js?domain=www.bonne-promo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bonne-promo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
9 KB 301ms
301ms XHR
text/plain 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4367645153186623&correlator=3174958730603852&output=ldjh&impl=fif&eid=31061180%2C31061843%2C20211866&vrg=2021071401&ptt=17&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20210724&iu_parts=1254144%2Cbonne_promo_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C970x250%7C120x240%7C200x200%7C970x90%7C180x150%7C728x90%7C300x250%7C468x60%7C320x100%7C234x60%7C320x50%7C250x250%7C125x125&fluid=height&ris=2&rcs=4&prev_scp=iid12%3D1145730%26eid%3D2026941314961159482%26t%3D134%26d%3D258923%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26a%3D%257C5%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod31-c%26ic%3D5%26at%3Dbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dbonne_promo_com-medrectangle-1-1145730%26eb_br%3Dzero%26eba%3D1%26ebss%3D10061%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D0%26br2%3D1000%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C28%252C4%252C51%252C0%252C88%252C0%252C71%252C30%252C0%252C31%26deal1%3D22%2C23%2C24%2C25%2C26%2C919%2C21%2C21%2C17%2C19%2C20%2C21%2C732%2C17%2C18%2C19%2C20%2C21%2C1428%2C732%26lb%3D34%26reqt%3D1627150050317%26ss38%3D1%26ss9%3D1&eri=1&cookie=ID%3D98404ba529addd45%3AT%3D1627150047%3AS%3DALNI_MaIqwS5Edwxs655Q_-i0ltxfH7UYg&bc=31&abxe=1&lmt=1627150051&dt=1627150051323&dlt=1627150043890&idt=519&frm=20&biw=1600&bih=1200&oid=3&adxs=200&adys=6238&adks=1656279579&ucis=9&ifi=9&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bonne-promo.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x64&msz=1200x50&ga_vid=1757086823.1627150044&ga_sid=1627150044&ga_hid=1089275951&ga_fc=false&fws=0&ohw=0&btvi=5&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

f831b0851e6cbdf68a59095d77d7567b8599f1bd6cb85bc6c751c41839e9f23d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:31 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8882
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bonne-promo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 06B7 42 B
231 B 74ms
74ms Image
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuHDfyt_GuJmR7kRz3-z4bVvX4cMP2hsePaRg3S-fHVRI_kwU-qOjRvB0AfK8wI1MCravsV3P6U1xBE_lrJgilMjOg2Zra2Mm54OzkMQ11Ov9GoKHyl3CVWJxP-Xg&sai=AMfl-YS5zC5AkyLfqSriAIRR4CFW3AB3Uql1gCh4w3HMqm8y1XWdQ0eeTwIyMfPBO6gST5zui2gdtOYWdK8fRx0kNjAowCoW9AA7PY8lKy-oWpYxmDKkQ6CoUKaFoUei&sig=Cg0ArKJSzA15fPIKj_w3EAE&cid=CAASF-Rop_F5Mr6VxY7kqtsbfLJ2ZbttZtKh&id=ampim&o=315,1110&d=970,90&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=71&tls=1072&g=100&h=100&tt=1072&r=v&avms=ampa&adk=669493002

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
www.bonne-promo.com/porpoiseant/ 0
42 B 38ms
36ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-07-24T18%3A07%3A27.709814Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Sat%2C%2024%20Jul%202021%2018%3A07%3A27%20GMT; __gads=ID=98404ba529addd45:T=1627150047:S=ALNI_MaIqwS5Edwxs655Q_-i0ltxfH7UYg; ezouspvv=34; ezouspva=1; ezouspvh=34
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:31 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Fri, 23 Jul 2021 18:07:29 UTC

GET
H2 200 container.html Show response
13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A56D 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bonne-promo.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bonne-promo.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Sat, 24 Jul 2021 18:07:24 GMT
expires: Sun, 24 Jul 2022 18:07:24 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 7
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 35ms
14ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021071401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5073fab4fddb9f037315ac9c663dce6681b03976250cab681638dfe17475466f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:31 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627039897272555"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27998
x-xss-protection: 0
expires: Sat, 24 Jul 2021 18:07:31 GMT

GET
H2 200 army.gif Show response
www.bonne-promo.com/porpoiseant/ 0
42 B 37ms
36ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE0NTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgxNCwiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiI1In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTQ1NzMwIiwiZG9tYWluX2lkIjoiMjU4OTIzIiwidW5pdCI6ImRpdi1ncHQtYWQtYm9ubmVfcHJvbW9fY29tLW1lZHJlY3RhbmdsZS0xLTAiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzODE0LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiemVybyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE0NTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAuMDAwMDAyLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDAyLCJiaWRfZmxvb3JfcHJldiI6MC4wMDAzNCwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgxNCwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNDU3MzAiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ1bml0IjoiZGl2LWdwdC1hZC1ib25uZV9wcm9tb19jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjcxNTAwNDMsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImRiY2JkMWZhLTJiYWYtNDRlYS02ODA5LTRmYzYyZmQxMmZjZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MTQsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDA0MzgxNCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE0NTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgxNCwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiNzE2MTQzOTQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE0NTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgxNCwiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiI1In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTQ1NzMwIiwiZG9tYWluX2lkIjoiMjU4OTIzIiwidW5pdCI6ImRpdi1ncHQtYWQtYm9ubmVfcHJvbW9fY29tLW1lZHJlY3RhbmdsZS0xLTAiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzODE0LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiemVybyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE0NTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAuMDAwMDAyLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDAyLCJiaWRfZmxvb3JfcHJldiI6MC4wMDAzNCwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgxNCwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNDU3MzAiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ1bml0IjoiZGl2LWdwdC1hZC1ib25uZV9wcm9tb19jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjcxNTAwNDMsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImRiY2JkMWZhLTJiYWYtNDRlYS02ODA5LTRmYzYyZmQxMmZjZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MTQsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDA0MzgxNCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE0NTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgxNCwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiNzE2MTQzOTQifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-07-24T18%3A07%3A27.709814Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Sat%2C%2024%20Jul%202021%2018%3A07%3A27%20GMT; __gads=ID=98404ba529addd45:T=1627150047:S=ALNI_MaIqwS5Edwxs655Q_-i0ltxfH7UYg; ezouspvv=34; ezouspvh=34; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:31 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Fri, 23 Jul 2021 18:07:30 UTC

GET
H2 200 71614394 Show response
g.ezoic.net/dac/ 0
40 B 37ms
36ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/71614394
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/porpoiseant/banger.js?cb=195-0&bv=38&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sat, 24 Jul 2021 18:07:31 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
www.bonne-promo.com/porpoiseant/ 0
19 B 37ms
36ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE0NTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgxNCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDctMjQifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMCJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI2In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE0NTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgxNCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDctMjQifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMCJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI2In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-07-24T18%3A07%3A27.709814Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Sat%2C%2024%20Jul%202021%2018%3A07%3A27%20GMT; __gads=ID=98404ba529addd45:T=1627150047:S=ALNI_MaIqwS5Edwxs655Q_-i0ltxfH7UYg; ezouspvv=34; ezouspvh=34; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:31 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Fri, 23 Jul 2021 18:07:27 UTC

GET
H2 200 army.gif Show response
www.bonne-promo.com/porpoiseant/ 0
42 B 35ms
35ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTE0NTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYXVjdGlvbl9lcG9jaCI6MTYyNzE1MDA1MiwiYWRfcG9zaXRpb24iOjExMDMsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJiaWRfZmxvb3JfaW5pdGlhbCI6MjAwMCwiYmlkX2Zsb29yX3ByZXYiOjM0LCJiaWRfZmxvb3JfZmlsbGVkIjowLCJhdWN0aW9uX2NvdW50Ijo1LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjozMjMsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6NzE2MTQzOTR9XQ==
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTE0NTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYXVjdGlvbl9lcG9jaCI6MTYyNzE1MDA1MiwiYWRfcG9zaXRpb24iOjExMDMsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJiaWRfZmxvb3JfaW5pdGlhbCI6MjAwMCwiYmlkX2Zsb29yX3ByZXYiOjM0LCJiaWRfZmxvb3JfZmlsbGVkIjowLCJhdWN0aW9uX2NvdW50Ijo1LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjozMjMsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6NzE2MTQzOTR9XQ==
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-07-24T18%3A07%3A27.709814Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Sat%2C%2024%20Jul%202021%2018%3A07%3A27%20GMT; __gads=ID=98404ba529addd45:T=1627150047:S=ALNI_MaIqwS5Edwxs655Q_-i0ltxfH7UYg; ezouspvv=34; ezouspvh=34; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:31 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Fri, 23 Jul 2021 18:07:31 UTC

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 14BD 624 B
299 B 45ms
44ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CL3J7wIQ9bTT8wEYn52RrwEwAQ&v=APEucNUnUsVwAl1OFBRPRK3XBABJAF2PmWgBTdTz0AqaAYa8XE61S4clIltr2PxlXb9Lu-P9p6oh1AIydLJNfgt2DDIF3XGM7HKkUbittU_AZTyEJRX0_I_LD4Le7jmsm-rURourllV1uR2KBB4Nku-UzdYSP8fbDK1cBgLRXfqsUWE2poRCkiqwyg7RCooYPHJ0v0S2YSAI3kyB7vfps87kTU2uA505WA

Requested by

Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CL3J7wIQ9bTT8wEYn52RrwEwAQ&v=APEucNUnUsVwAl1OFBRPRK3XBABJAF2PmWgBTdTz0AqaAYa8XE61S4clIltr2PxlXb9Lu-P9p6oh1AIydLJNfgt2DDIF3XGM7HKkUbittU_AZTyEJRX0_I_LD4Le7jmsm-rURourllV1uR2KBB4Nku-UzdYSP8fbDK1cBgLRXfqsUWE2poRCkiqwyg7RCooYPHJ0v0S2YSAI3kyB7vfps87kTU2uA505WA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmCHMGfV6B7xasQ0aVbqvsWY5NnOcle4sr9gjbJD1_cu9qkMCYWQPiUohEANHk; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 24 Jul 2021 18:07:31 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 24 Jul 2021 18:07:31 GMT

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A56D 60 KB
24 KB 65ms
65ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BUjkHcwcu1YyD7TYQwOa8TuhrjJvG9Ln5zEGD4CPr_qy3NTNjgRs0koiQeHitUDT0vb4fswJePD0Du8lrtIdhgIxOBPRe64lXtWMoBPzjnRYvnY-W_B-3cVltjgFvs2q2DMKlBOu0JVERYgny2lRaoaEAjVz915OV4CXkwYUCWkbW2jGc&cry=1&dbm_d=AKAmf-AIwDuN79hP6Zv9QsHhOL7DGoXmh7wdLeieA9wbMz_-OSTsz8CjZ4AQ2QQVYbD-Ix7i8WDB29MGP33MF2zYsGvmdqWtTe5IZ5bycKWo-1t3LIrLGstze9Ax8C70SczacMbyvWldG09VaAXLCgysRj30W7I89Rxpk77TkK_0n_Gg4DUJhXjS89p40okbXcylAtRUOdOqXZURXN_mG4HMEU6h6vb24LqucklDJXPSGJQMjnKkRxUFBmB4QA6Tho9WTgjym5-IHPsm9Xq2kly0RAMFnGnHNo_Ct4QuTKXSlndTfshLGlmvujnS5IIAMbYVKvLQSZehi5RTQ-ZWofAUMeH-Mg2fTHB4RbOCtkT1K90dNiaeBoprtpkr2C5awWQmyF2EvCqjo6MtHSkyWjKfk1ndo21MPfGQPKoE158JcJ8ZWOXQocOsTnWRf-fvLmEZNyyj7jJLWAUdaaJMrpJcrXCKCawws7-ejSyKezfHyQLoo7s9qtqOtnxGqqVzL0h5LQhTPA-_tt7DpSBVWUA1TWFaAtwZubR-jysOikT3c0AwqagDHm9q9zcuw2DcJ1QYxHTXOD5YRCVVyhtntnaibC8NwqJnTy68Tm8gxUnzorzIxQXOEJo-cNfR-QlLgOeXFwsCbYdBAQTvc_9kTPVZ1DKcLNYFl5_TSrTq8XY8XeHSxBZh8_GSMgqzkFLojFdIqPSt25p1IP28ntTb2m0FBfzn1NzvnHZ_LZ06MdxmRKRw0yLyIb8V84WPDaPqY8x3OlmcWM8Z5AewW5ySYUzWrcwuAfJI4RlAzQ3Q0DJTKiiP9whtgUg_1N_UndahwrgjDGep-1EUlH95f1Le73SkG0KbanvuJFT_cpZF0zP06cMjkn_E6U8hX59Rnb21oCUalWTqqzqqL4CnOPvpamyPsRnZ7olXUoiRprdHcuL2zIs-6mT5-64MnR4Nq1jpAWfJzzNFEbuZX9sbdRAYEIvzq9_CzrjbGKkBqaK2iH384n8mg0Il06fomku81X72fvvYiB00xwIAixIPTnwSJg3r_10pBcOjsYVa7Qy528tDfW3j5dDlwjRyLsTuxaR7AxC_r3FBsXReaipPOWijJPebGDVjyyVGlmoPBD285z_vsXCwfkqCYWL9Umx8mmVB7fiKj2OHeLqsvp9xW4mB2mYWbiSWhLRvaSO3xJErEpqzY3utp5di6RkTBtXNysyqVcTCqrdj0PrZy90MjmyTbtfR0Zl1PCrTbUJz0apc0qJ7caDsgQauXzTcCWiy4OoCZnzc_UI4N--oKKUXlecCkHBijtvWp_J7xcRFuN5ItLUCZe8WNAl8cPAoQFP1Skxyyc0yDKR9EaLRnUVSPsATqomnWaHLvh9lINBSBWsXvp1zqTJmfzyyh_UEOVOD5NWC2IABkBGLUj1h5RSgNCrO_RWMzrQwDBlpcxhiVdrbWBQJ4UZTO0-XEd2hvbDrZXDMxeEdgy41L3jh7UPqvKjnaqrGmnwAfN88izUg6t2ctl1-4i4rlVAo1obj4nsiqaNB3xodxmntEh1dc89eLlVlRLTuBjLqXHQqM3LGeNGq0BnQBOeNAJcSMwPEyx5OqMF4kWJw3j0eSgvINVBe2TE2p94khtusiDAyDLHfo_iWAI9c1TIkPjt7hydFONZwUEPzPN7TusCcd7rm3EyC3BDtDRFWMZuvFMl-l-GvPhn6QwYhY7n2c3jPF0lC7Zazku7CnvEWu9qxm5glC6liEAwt90OQ0CMn42XvC45Q7laCsmLUr1he6RMhbKOrEQMI2eQinjNoY8EWiNu3YRqv_UdBCJfgcy_TLN6NkifYyV0BT-nuEZ0JG6HKqebO5KI8vltlxFcx5Ztpc03GSJasPsqS-2O5vhaJ1XBZU9ZhGMCaQumlpcKbolAs5Wdu83IMAKLwKIo6Dsrfr0yBevypJcrLPWhi2OnGBxxPvlLTXrywAaaJMkgv69ZKsoVKZRdsL4Dj4GoClK2phxtgM6L8hLA2HH1mkCPwITSqO-yGWfwbH1kXwN8_eYvL_gQu19esVtZ_29pmHXafwwq6u-E-HrQ9-49uyh5MsmJ-sg7MBJ7kFb-sPREufRdOXuSCje17DotrBrDfLB4L2DCR9lax_eDiLK8fxexaIMEkUgsHt_1Xo6I-R3DhVG1b_2KLP7PTDB32nJXoW6keI5jm6puJrbIaMmKjZ0BFh_zNukijMR1Yhz2cPmiaT-NPEKr4jd66SLl95AkmDt2-lJgBBOW9tSTAPS_pbYqsqmP1Vvn4JU53Dn2bUf3XlbjwDQVu2n6Du0WNtqRKb51fHG1qAAMApbMUCDqgBtknK-6ymeyMvBhSOSf_8HFVD2qdxsgCDuqiSkQyqH-XGH3n-4ROFC7xhHpjlZcdiNtOWdcNauO6PRElmrIcKEFRlmiwG-wR3LRl0lxohBQTKrdV2ieQpqZUNkCQ11rj1PK58hwsrS6l5D2iMh_nN3eyeJMIFl8hIxRAmSxy5qHikwLTduuYS4G6rJcaV9YEtMd_l6a15DZFfZxUmEdKgDSh752Zc0V3k1nikkgoaV-K9U6BaVfrVHUQFTChvLPJIsFkedgbXzQbag6YoZZPPmL75PWoUpUoduQxObrRN3bR7j6jHzClVrMxuih8z9RAXT1G0h_irrTmna_V5GgDJIWcRMlZdQ835XeLOFrq0IrGavaiBQZuT-hiYdTVqqappVDwqqbKqlbrokcNgOkkKMUfuv-Bn7GCMk1XAtFey_P2naXUxKuIHN8LVFHqsl8kAGhhfVVUVzqYtrrrUuCkDVW680mJHbeD7JZMGIgA6Bm6H2ZXw3b78iK8WaJuSHykKNN1wLiToiMV7sqdDszZ5T-lKYcPqPWRRR6z6WIXljiVsOgiLEqk_TidrHDhCoJNo8DeuEIDj1JRiRScoVpGM2hBR188QRUoYcGfmw_VOM_NaUz4SC2IZ7XVJKOpzjt6mTStz86QkpVJWCL_Q7KvzdzwU7f9TI5X8zka8IUWwrplAeOYwx4yEGlgSsKARXjokEADx5UaFRWEv88kwzVXnKEIDgjrr2SIsk1KzPyqDn0SLWl7GsTB4NU8237FNkTq3JmQrNRvMQcR760wOJ8MYv_wdN9F7TLA9uwrayhyY6Cx5dEk_Yw1hK0AISG1YHIVLQofEeQhWBumUPSFOdTfqnlxyZOso_SWsO2wVB7KXt_zXJWvVYEavuf7cbFJ5heKElOpfdtSzw&cid=CAASEuRoE9fPPb__pGFw_ejhEc_Wfw&rfl=1%2Chttps%253A%252F%252Fwww.bonne-promo.com%252F%240

Requested by

Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

440eb2947a8e7d93999e713c828fef42441a0e7e9cfbe5d6611895ae0c79b53a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24934
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A56D 42 B
63 B 42ms
41ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DijgHUFzDdgfbgGF8Q6MsRJaoKuc6hjoR9dfHJwTXyBm64rgJBBn93l2PLroEI6HJe5Aup0OpKMjgvIUdRf6N8tO0Hn2VSPCphngkWaK-v_YGHwvU

Requested by

Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame A56D 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/window_focus_fy2019.js

Requested by

Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:06:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 45
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Aug 2021 18:06:46 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A56D 124 KB
37 KB 25ms
21ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4409f886851d18b5071cc08d25845e0d959d51fd1e9eec92118d0f12a44e5eeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:31 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627039891503395"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Sat, 24 Jul 2021 18:07:31 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame A56D 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b1a4081a8a32bc714fbb7a2509141683bc3eb707a421c0db556ed856f6d8e99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6195
x-xss-protection: 0
server: cafe
etag: 10716856519410487149
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Aug 2021 18:07:30 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame A56D 0
0 14ms
14ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaReioVVwuAzpH0ol_g9KB89G2bAfNYOhU4MoFkrYWMcce0m7ndB6bjmtyUMrwmQvdM9IQrECEGyrhJObRYHniNNf1F_LA
Requested by: Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 army.gif Show response
www.bonne-promo.com/porpoiseant/ 0
42 B 36ms
35ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzk3MCw5MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTE3MzAiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ1bml0IjoiZGl2LWdwdC1hZC1ib25uZV9wcm9tb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjcxNTAwNDMsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImRiY2JkMWZhLTJiYWYtNDRlYS02ODA5LTRmYzYyZmQxMmZjZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfZmx1aWQiLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzk3MCw5MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTE3MzAiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ1bml0IjoiZGl2LWdwdC1hZC1ib25uZV9wcm9tb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjcxNTAwNDMsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImRiY2JkMWZhLTJiYWYtNDRlYS02ODA5LTRmYzYyZmQxMmZjZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfZmx1aWQiLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-07-24T18%3A07%3A27.709814Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Sat%2C%2024%20Jul%202021%2018%3A07%3A27%20GMT; __gads=ID=98404ba529addd45:T=1627150047:S=ALNI_MaIqwS5Edwxs655Q_-i0ltxfH7UYg; ezouspvv=34; ezouspvh=34; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:31 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Fri, 23 Jul 2021 18:07:36 UTC

GET
H2 200 greenoaks.gif Show response
www.bonne-promo.com/detroitchicago/ 0
19 B 37ms
36ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJkYXRhIjpbeyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX3ZpZXdwb3J0X2NvdW50IiwidmFsIjoiMSJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjAifSx7Im5hbWUiOiJuYXRpdmVfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoiZGlzcGxheV9hZF9kb2NfcHgiLCJ2YWwiOiIzODczMDAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19jb3VudCIsInZhbCI6IjIifSx7Im5hbWUiOiJuYXRpdmVfYWRfZG9jX3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoidmlld3BvcnRfc2l6ZSIsInZhbCI6IjE2MDB4MTIwMCJ9LHsibmFtZSI6InZpZXdwb3J0X3B4IiwidmFsIjoiMTkyMDAwMCJ9LHsibmFtZSI6ImRvY19weCIsInZhbCI6IjEwODQ5MTQwIn0seyJuYW1lIjoiZG9jX2hlaWdodCIsInZhbCI6IjY2OTcifV19XQ==
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJkYXRhIjpbeyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX3ZpZXdwb3J0X2NvdW50IiwidmFsIjoiMSJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjAifSx7Im5hbWUiOiJuYXRpdmVfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoiZGlzcGxheV9hZF9kb2NfcHgiLCJ2YWwiOiIzODczMDAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19jb3VudCIsInZhbCI6IjIifSx7Im5hbWUiOiJuYXRpdmVfYWRfZG9jX3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoidmlld3BvcnRfc2l6ZSIsInZhbCI6IjE2MDB4MTIwMCJ9LHsibmFtZSI6InZpZXdwb3J0X3B4IiwidmFsIjoiMTkyMDAwMCJ9LHsibmFtZSI6ImRvY19weCIsInZhbCI6IjEwODQ5MTQwIn0seyJuYW1lIjoiZG9jX2hlaWdodCIsInZhbCI6IjY2OTcifV19XQ==
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-07-24T18%3A07%3A27.709814Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Sat%2C%2024%20Jul%202021%2018%3A07%3A27%20GMT; __gads=ID=98404ba529addd45:T=1627150047:S=ALNI_MaIqwS5Edwxs655Q_-i0ltxfH7UYg; ezouspvv=34; ezouspvh=34; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:31 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Fri, 23 Jul 2021 18:07:27 UTC

GET
H2 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame A56D 111 KB
39 KB 28ms
6ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
Referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 00:44:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 62604
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 25 Jul 2021 00:44:07 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210720/r20110914/elements/html/ Frame A56D 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210720/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BUjkHcwcu1YyD7TYQwOa8TuhrjJvG9Ln5zEGD4CPr_qy3NTNjgRs0koiQeHitUDT0vb4fswJePD0Du8lrtIdhgIxOBPRe64lXtWMoBPzjnRYvnY-W_B-3cVltjgFvs2q2DMKlBOu0JVERYgny2lRaoaEAjVz915OV4CXkwYUCWkbW2jGc&cry=1&dbm_d=AKAmf-AIwDuN79hP6Zv9QsHhOL7DGoXmh7wdLeieA9wbMz_-OSTsz8CjZ4AQ2QQVYbD-Ix7i8WDB29MGP33MF2zYsGvmdqWtTe5IZ5bycKWo-1t3LIrLGstze9Ax8C70SczacMbyvWldG09VaAXLCgysRj30W7I89Rxpk77TkK_0n_Gg4DUJhXjS89p40okbXcylAtRUOdOqXZURXN_mG4HMEU6h6vb24LqucklDJXPSGJQMjnKkRxUFBmB4QA6Tho9WTgjym5-IHPsm9Xq2kly0RAMFnGnHNo_Ct4QuTKXSlndTfshLGlmvujnS5IIAMbYVKvLQSZehi5RTQ-ZWofAUMeH-Mg2fTHB4RbOCtkT1K90dNiaeBoprtpkr2C5awWQmyF2EvCqjo6MtHSkyWjKfk1ndo21MPfGQPKoE158JcJ8ZWOXQocOsTnWRf-fvLmEZNyyj7jJLWAUdaaJMrpJcrXCKCawws7-ejSyKezfHyQLoo7s9qtqOtnxGqqVzL0h5LQhTPA-_tt7DpSBVWUA1TWFaAtwZubR-jysOikT3c0AwqagDHm9q9zcuw2DcJ1QYxHTXOD5YRCVVyhtntnaibC8NwqJnTy68Tm8gxUnzorzIxQXOEJo-cNfR-QlLgOeXFwsCbYdBAQTvc_9kTPVZ1DKcLNYFl5_TSrTq8XY8XeHSxBZh8_GSMgqzkFLojFdIqPSt25p1IP28ntTb2m0FBfzn1NzvnHZ_LZ06MdxmRKRw0yLyIb8V84WPDaPqY8x3OlmcWM8Z5AewW5ySYUzWrcwuAfJI4RlAzQ3Q0DJTKiiP9whtgUg_1N_UndahwrgjDGep-1EUlH95f1Le73SkG0KbanvuJFT_cpZF0zP06cMjkn_E6U8hX59Rnb21oCUalWTqqzqqL4CnOPvpamyPsRnZ7olXUoiRprdHcuL2zIs-6mT5-64MnR4Nq1jpAWfJzzNFEbuZX9sbdRAYEIvzq9_CzrjbGKkBqaK2iH384n8mg0Il06fomku81X72fvvYiB00xwIAixIPTnwSJg3r_10pBcOjsYVa7Qy528tDfW3j5dDlwjRyLsTuxaR7AxC_r3FBsXReaipPOWijJPebGDVjyyVGlmoPBD285z_vsXCwfkqCYWL9Umx8mmVB7fiKj2OHeLqsvp9xW4mB2mYWbiSWhLRvaSO3xJErEpqzY3utp5di6RkTBtXNysyqVcTCqrdj0PrZy90MjmyTbtfR0Zl1PCrTbUJz0apc0qJ7caDsgQauXzTcCWiy4OoCZnzc_UI4N--oKKUXlecCkHBijtvWp_J7xcRFuN5ItLUCZe8WNAl8cPAoQFP1Skxyyc0yDKR9EaLRnUVSPsATqomnWaHLvh9lINBSBWsXvp1zqTJmfzyyh_UEOVOD5NWC2IABkBGLUj1h5RSgNCrO_RWMzrQwDBlpcxhiVdrbWBQJ4UZTO0-XEd2hvbDrZXDMxeEdgy41L3jh7UPqvKjnaqrGmnwAfN88izUg6t2ctl1-4i4rlVAo1obj4nsiqaNB3xodxmntEh1dc89eLlVlRLTuBjLqXHQqM3LGeNGq0BnQBOeNAJcSMwPEyx5OqMF4kWJw3j0eSgvINVBe2TE2p94khtusiDAyDLHfo_iWAI9c1TIkPjt7hydFONZwUEPzPN7TusCcd7rm3EyC3BDtDRFWMZuvFMl-l-GvPhn6QwYhY7n2c3jPF0lC7Zazku7CnvEWu9qxm5glC6liEAwt90OQ0CMn42XvC45Q7laCsmLUr1he6RMhbKOrEQMI2eQinjNoY8EWiNu3YRqv_UdBCJfgcy_TLN6NkifYyV0BT-nuEZ0JG6HKqebO5KI8vltlxFcx5Ztpc03GSJasPsqS-2O5vhaJ1XBZU9ZhGMCaQumlpcKbolAs5Wdu83IMAKLwKIo6Dsrfr0yBevypJcrLPWhi2OnGBxxPvlLTXrywAaaJMkgv69ZKsoVKZRdsL4Dj4GoClK2phxtgM6L8hLA2HH1mkCPwITSqO-yGWfwbH1kXwN8_eYvL_gQu19esVtZ_29pmHXafwwq6u-E-HrQ9-49uyh5MsmJ-sg7MBJ7kFb-sPREufRdOXuSCje17DotrBrDfLB4L2DCR9lax_eDiLK8fxexaIMEkUgsHt_1Xo6I-R3DhVG1b_2KLP7PTDB32nJXoW6keI5jm6puJrbIaMmKjZ0BFh_zNukijMR1Yhz2cPmiaT-NPEKr4jd66SLl95AkmDt2-lJgBBOW9tSTAPS_pbYqsqmP1Vvn4JU53Dn2bUf3XlbjwDQVu2n6Du0WNtqRKb51fHG1qAAMApbMUCDqgBtknK-6ymeyMvBhSOSf_8HFVD2qdxsgCDuqiSkQyqH-XGH3n-4ROFC7xhHpjlZcdiNtOWdcNauO6PRElmrIcKEFRlmiwG-wR3LRl0lxohBQTKrdV2ieQpqZUNkCQ11rj1PK58hwsrS6l5D2iMh_nN3eyeJMIFl8hIxRAmSxy5qHikwLTduuYS4G6rJcaV9YEtMd_l6a15DZFfZxUmEdKgDSh752Zc0V3k1nikkgoaV-K9U6BaVfrVHUQFTChvLPJIsFkedgbXzQbag6YoZZPPmL75PWoUpUoduQxObrRN3bR7j6jHzClVrMxuih8z9RAXT1G0h_irrTmna_V5GgDJIWcRMlZdQ835XeLOFrq0IrGavaiBQZuT-hiYdTVqqappVDwqqbKqlbrokcNgOkkKMUfuv-Bn7GCMk1XAtFey_P2naXUxKuIHN8LVFHqsl8kAGhhfVVUVzqYtrrrUuCkDVW680mJHbeD7JZMGIgA6Bm6H2ZXw3b78iK8WaJuSHykKNN1wLiToiMV7sqdDszZ5T-lKYcPqPWRRR6z6WIXljiVsOgiLEqk_TidrHDhCoJNo8DeuEIDj1JRiRScoVpGM2hBR188QRUoYcGfmw_VOM_NaUz4SC2IZ7XVJKOpzjt6mTStz86QkpVJWCL_Q7KvzdzwU7f9TI5X8zka8IUWwrplAeOYwx4yEGlgSsKARXjokEADx5UaFRWEv88kwzVXnKEIDgjrr2SIsk1KzPyqDn0SLWl7GsTB4NU8237FNkTq3JmQrNRvMQcR760wOJ8MYv_wdN9F7TLA9uwrayhyY6Cx5dEk_Yw1hK0AISG1YHIVLQofEeQhWBumUPSFOdTfqnlxyZOso_SWsO2wVB7KXt_zXJWvVYEavuf7cbFJ5heKElOpfdtSzw&cid=CAASEuRoE9fPPb__pGFw_ejhEc_Wfw&rfl=1%2Chttps%253A%252F%252Fwww.bonne-promo.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:02:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 329
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Aug 2021 18:02:02 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210720/r20110914/ Frame A56D 23 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210720/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1130c26caface5cfa7b2d0cdbbb70cdb3004c582e74969d580216f65596c47c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 17:56:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 678
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9349
x-xss-protection: 0
server: cafe
etag: 11779355884012761328
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Aug 2021 17:56:13 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 14BD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEES9CCq4xXgH_jcoyT7oiK4&google_cver=1

43 B
1012 B

115ms
46ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEES9CCq4xXgH_jcoyT7oiK4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL3J7wIQ9bTT8wEYn52RrwEwAQ&v=APEucNUnUsVwAl1OFBRPRK3XBABJAF2PmWgBTdTz0AqaAYa8XE61S4clIltr2PxlXb9Lu-P9p6oh1AIydLJNfgt2DDIF3XGM7HKkUbittU_AZTyEJRX0_I_LD4Le7jmsm-rURourllV1uR2KBB4Nku-UzdYSP8fbDK1cBgLRXfqsUWE2poRCkiqwyg7RCooYPHJ0v0S2YSAI3kyB7vfps87kTU2uA505WA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 24 Jul 2021 18:07:31 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 24 Jul 2021 18:07:31 GMT

Redirect headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEES9CCq4xXgH_jcoyT7oiK4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 14BD
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YPxW4CNvB0dZtdxZdLAQvgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEES9CCq4xXgH_jcoyT7oiK4&google_cver=1

43 B
892 B

47ms
47ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEES9CCq4xXgH_jcoyT7oiK4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL3J7wIQ9bTT8wEYn52RrwEwAQ&v=APEucNUnUsVwAl1OFBRPRK3XBABJAF2PmWgBTdTz0AqaAYa8XE61S4clIltr2PxlXb9Lu-P9p6oh1AIydLJNfgt2DDIF3XGM7HKkUbittU_AZTyEJRX0_I_LD4Le7jmsm-rURourllV1uR2KBB4Nku-UzdYSP8fbDK1cBgLRXfqsUWE2poRCkiqwyg7RCooYPHJ0v0S2YSAI3kyB7vfps87kTU2uA505WA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 24 Jul 2021 18:07:32 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 24 Jul 2021 18:07:32 GMT

Redirect headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEES9CCq4xXgH_jcoyT7oiK4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 14BD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEATVLPm9ExnF2SKcj_QymVs&google_cver=1

43 B
1004 B

67ms
67ms

Image
image/gif

185.33.220.240
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEATVLPm9ExnF2SKcj_QymVs&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL3J7wIQ9bTT8wEYn52RrwEwAQ&v=APEucNUnUsVwAl1OFBRPRK3XBABJAF2PmWgBTdTz0AqaAYa8XE61S4clIltr2PxlXb9Lu-P9p6oh1AIydLJNfgt2DDIF3XGM7HKkUbittU_AZTyEJRX0_I_LD4Le7jmsm-rURourllV1uR2KBB4Nku-UzdYSP8fbDK1cBgLRXfqsUWE2poRCkiqwyg7RCooYPHJ0v0S2YSAI3kyB7vfps87kTU2uA505WA

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.240 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 24 Jul 2021 18:07:31 GMT
X-Proxy-Origin: 82.102.20.219; 82.102.20.219; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: ad8bfa86-0f35-4a67-b676-5fab2f88af35
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEATVLPm9ExnF2SKcj_QymVs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 14BD
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk0MDMzMTc2ODY2MDMwNDcyNg%3D%3D

170 B
188 B

45ms
45ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk0MDMzMTc2ODY2MDMwNDcyNg%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 24 Jul 2021 18:07:31 GMT
X-Proxy-Origin: 82.102.20.219; 82.102.20.219; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 96a7029e-f7ca-4d30-9fcc-35de7a9456c2
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk0MDMzMTc2ODY2MDMwNDcyNg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A56D 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Jul 2021 00:44:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 235402
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Jul 2022 00:44:09 GMT

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9CD3 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 24 Jul 2021 03:09:05 GMT
expires: Sun, 25 Jul 2021 03:09:05 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 53906
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame A56D 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4f25f90be172b62853e0b5bc0d76bcf5d4dda80a961747808ef676819187459c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame CBB7 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Fri, 23 Jul 2021 05:56:59 GMT
expires: Sat, 23 Jul 2022 05:56:59 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 130232
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 index.html Show response
s0.2mdn.net/sadbundle/1798194350119714816/ Frame 62F1 306 KB
32 KB 20ms
7ms Document
text/html 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1798194350119714816/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

227af992e2f7e8eb08a8d376e4cd3d98f619449dbf3960bb3a769f07748f7a85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /sadbundle/1798194350119714816/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Mon, 19 Jul 2021 22:02:11 GMT
expires: Tue, 19 Jul 2022 22:02:11 GMT
last-modified: Mon, 05 Jul 2021 07:06:30 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 33176
age: 417920
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A56D 0
592 B 129ms
51ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstMN5LRu6qWy8AAo8Iha3d1cs-7dwecV5wol1R9ddS4iWiIhiDsT1EXP-u0byXR9G_-NA6A0uijDqC4pofWz_LWtj1ng1p98sCzsvjX6v15wvMmbCgqf1X_Qmj5-o-aHDum3YEhRT_o0AQP5vnH0xP78NxWRYD2eDUKwJYth7NQ_foHNmSkG6GXxHevFJYClAIkHZC2UpRnBwfxJ5Kq7lJ8ReLS93FwTbboc7AZzQa3lw_TgzfmeCdPlZ8U-KYKlZ_3rSikKY7pYbdLM-YdO1u4XTQXs3fnHmKyLmgLgIcezmXrbt06bOH3hXC6wb8fNvIkboJW4HlUwAY8d7VigDI06y-_u16nVamKMHUQ6fHLvaNYvjQoKLFBpW31ia7zCzbuWvJyPlPpAzN5j0c6vQxsc2JIXcc6kRro8RuQL_IBwOMnUsNdRxGEOZbUKukL7pcDaByTRW-M434OSGS6GRoTIj4pwHx7saDzJcgnIlcav_FfobPJquLm9zuQu8SY0gsfnHwDz5If7pYOvKdZ8nJ5UvFcA8rHR6Wf-jitWcd-RM6QEDWHJWpfRt4bu_-_M_f7SYX7kXfmQ4rLGtSZhQSKBe72y794MfJa0GVB-Lb1ZXSgHmkyMN78B-oJn3rIkYOOIPH9c63vHEIpBiLQmW5fA_LspBmEV330fHaXvmb9fYBMnwYx8WuK3NNX6hn1FGgwIUAwww5blnDP8g2tyh5RV_DRDftTbmh3QLNFPfDQeTnoMdeRp-6xEubZTD-6MjN9gVBhH10q_ZlWd8DBmwZuqiwzUUV49BFZ9OAU8OLq5mx5FxjDmw4JgrzYISlHS-q9cBuVeksFcyJ-PUcIsjcjBJq2f1Vlk88uK2XEf8K5aLwjuppjc1VzzS7TTaHNSQELdKUKpwtsvTeLEw-9kyA0kk2hdop-Gfd2hi9bmgfdobs-1eRJko00Jp_HEX0FCsx31ZqhHVeUbNWi5tm-57XVt5Jzq-CXPJoUHEqdECZXx5gR6GSui4uVs4_w5BvflVjLpyYbXWeUAkOp6a3DDrO0SOQKF6evk5bBffp666iugw3fMLVBVtAcTGbomqMXNuqSa8NNZMo9LLL7fEXaUWig6uIy0v9kXG-mcw8WkgahrSWVPmT4dMsKA_T_eGZwH5cDeCRzfhZ9MGv8qn5s74ABNbXBQLJfUXp_IB0x3_TZINbwSWtuehrRA-7L&sai=AMfl-YRN8ufhANRM8SJb_0aZY1VR5NwIU_jfRKD8dnMtSXlXpeRvSjY-q8G9lE6CO6fkTTjBK5SZ35TDpPLFiXZ86l2DMz98X_KVr54wiFkojiRaG2-x9fxfxrXJSu3r6lxkUAdVOv1DYJtgHM5JFEik8ziXycZ7bg&sig=Cg0ArKJSzH7AF8KEc0ucEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=85&cbvp=1&cstd=83&cisv=r20210720.02204&adurl=

Requested by

Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sat, 24 Jul 2021 18:07:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 9CD3
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEDBsw279AEyrWRg8JmGXL3c&google_cver=1&google_push=AYg5qPJrFDXtrs-FiI9bIuAHgt0io5wYuKA9uum3Ig85XrJxfay6t67-__...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJrFDXtrs-FiI9bIuAHgt0io5wYuKA9uum3Ig85XrJxfay6t67-__9p_smbW3H8Hqpj2DqNbTuDy4DtEsMbdq-J8TktPzo&google_hm=bpIekCn...

170 B
188 B

44ms
44ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJrFDXtrs-FiI9bIuAHgt0io5wYuKA9uum3Ig85XrJxfay6t67-__9p_smbW3H8Hqpj2DqNbTuDy4DtEsMbdq-J8TktPzo&google_hm=bpIekCnMuYWmDFX8vaAEEw

Requested by

Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:31 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJrFDXtrs-FiI9bIuAHgt0io5wYuKA9uum3Ig85XrJxfay6t67-__9p_smbW3H8Hqpj2DqNbTuDy4DtEsMbdq-J8TktPzo&google_hm=bpIekCnMuYWmDFX8vaAEEw
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 9CD3
Redirect Chain

https://sync3.sniperlog.ru/?src=ggl_nga&google_gid=CAESEP1653HEYRoKnH_MJIAtgYA&google_cver=1&google_push=AYg5qPIkS0rNcStAA7drrlYD4P9gzO265rJRkLA5bN_2yQQn5-Toe2uRlSXVBH1gVrjh-bSeMkspBovBaa3gyyibLFPG...
https://sync.bumlam.com/?src=ggl_nga&google_gid=CAESEP1653HEYRoKnH_MJIAtgYA&google_cver=1&google_push=AYg5qPIkS0rNcStAA7drrlYD4P9gzO265rJRkLA5bN_2yQQn5-Toe2uRlSXVBH1gVrjh-bSeMkspBovBaa3gyyibLFPGWUa...
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AYg5qPIkS0rNcStAA7drrlYD4P9gzO265rJRkLA5bN_2yQQn5-Toe2uRlSXVBH1gVrjh-bSeMkspBovBaa3gyyibLFPGWUaNWtY

170 B
188 B

45ms
44ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AYg5qPIkS0rNcStAA7drrlYD4P9gzO265rJRkLA5bN_2yQQn5-Toe2uRlSXVBH1gVrjh-bSeMkspBovBaa3gyyibLFPGWUaNWtY

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sat, 24 Jul 2021 18:07:32 GMT
Server: nginx
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AYg5qPIkS0rNcStAA7drrlYD4P9gzO265rJRkLA5bN_2yQQn5-Toe2uRlSXVBH1gVrjh-bSeMkspBovBaa3gyyibLFPGWUaNWtY
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate, s-maxage=0
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 9CD3
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEHCkNnUynnPiAPuQJ-FCjO0&google_cver=1&google_push=AYg5qPJJXjOyU8ytWQoZTfnYl7Rag6OOQMQvlQxJVj4qmuMHI4_GRP5CMgBSg68OwWP6Aw1ZQlhqchbZ4Xpe2Jj7mkIX2k-1BxcN
https://rtb.openx.net/sync/dds?google_gid=CAESEHCkNnUynnPiAPuQJ-FCjO0&google_cver=1&google_push=AYg5qPJJXjOyU8ytWQoZTfnYl7Rag6OOQMQvlQxJVj4qmuMHI4_GRP5CMgBSg68OwWP6Aw1ZQlhqchbZ4Xpe2Jj7mkIX2k-1BxcN&...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJJXjOyU8ytWQoZTfnYl7Rag6OOQMQvlQxJVj4qmuMHI4_GRP5CMgBSg68OwWP6Aw1ZQlhqchbZ4Xpe2Jj7mkIX2k-1BxcN&google_hm=zybn6gb-z7c_VlptTdrTcQ==

170 B
188 B

45ms
44ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJJXjOyU8ytWQoZTfnYl7Rag6OOQMQvlQxJVj4qmuMHI4_GRP5CMgBSg68OwWP6Aw1ZQlhqchbZ4Xpe2Jj7mkIX2k-1BxcN&google_hm=zybn6gb-z7c_VlptTdrTcQ==

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:31 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJJXjOyU8ytWQoZTfnYl7Rag6OOQMQvlQxJVj4qmuMHI4_GRP5CMgBSg68OwWP6Aw1ZQlhqchbZ4Xpe2Jj7mkIX2k-1BxcN&google_hm=zybn6gb-z7c_VlptTdrTcQ==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: kc3diaq65oork8tla5ncduvhe11tvq03

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 9CD3
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEBjrNZJe_7c7Eb_pMp6Eins&google_cver=1&google_push=AYg5qPJNqCYAdjQb-kADvHacWf5UZuOUMS9l2coNKTGJIR6s0OdowgZjJoE5z2t_tBvaFMwrcz8V37QRaYfPyXmIBbR35q6RC8lC
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPJNqCYAdjQb-kADvHacWf5UZuOUMS9l2coNKTGJIR6s0OdowgZjJoE5z2t_tBvaFMwrcz8V37QRaYfPyXmIBbR35q6RC8lC&goog...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTE1Nzk0MDIyNTY4Njc2NzA4NzI%3D&google_push=AYg5qPJNqCYAdjQb-kADvHacWf5UZuOUMS9l2coNKTGJIR6s0OdowgZjJoE5z2...

170 B
188 B

46ms
46ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTE1Nzk0MDIyNTY4Njc2NzA4NzI%3D&google_push=AYg5qPJNqCYAdjQb-kADvHacWf5UZuOUMS9l2coNKTGJIR6s0OdowgZjJoE5z2t_tBvaFMwrcz8V37QRaYfPyXmIBbR35q6RC8lC

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTE1Nzk0MDIyNTY4Njc2NzA4NzI%3D&google_push=AYg5qPJNqCYAdjQb-kADvHacWf5UZuOUMS9l2coNKTGJIR6s0OdowgZjJoE5z2t_tBvaFMwrcz8V37QRaYfPyXmIBbR35q6RC8lC
date: Sat, 24 Jul 2021 18:07:32 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 9CD3
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEHAF9iSbRaP78GUPkN4L38M&google_cver=1&google_push=AYg5qPJA2X6iHtKoJAthT6JsVYOPQCBqVt1_5CfvAVwWeZPKOhDrNmSPY0Di72kMF7KfpKFZYob9V3...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPJA2X6iHtKoJAthT6JsVYOPQCBqVt1_5CfvAVwWeZPKOhDrNmSPY0Di72kMF7KfpKFZYob9V3x3ahBDoBGM5pcnnK4xh08&google_hm=NjY2ODQyOTc...

170 B
188 B

47ms
46ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPJA2X6iHtKoJAthT6JsVYOPQCBqVt1_5CfvAVwWeZPKOhDrNmSPY0Di72kMF7KfpKFZYob9V3x3ahBDoBGM5pcnnK4xh08&google_hm=NjY2ODQyOTc4NTIwMTAxNjYzMA%3D%3D

Requested by

Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPJA2X6iHtKoJAthT6JsVYOPQCBqVt1_5CfvAVwWeZPKOhDrNmSPY0Di72kMF7KfpKFZYob9V3x3ahBDoBGM5pcnnK4xh08&google_hm=NjY2ODQyOTc4NTIwMTAxNjYzMA%3D%3D
date: Sat, 24 Jul 2021 18:07:31 GMT
content-length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 9CD3
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEMemrSIxH9CSbugJ5mVybu4&google_cver=1&google_push=AYg5qPL4Hb0wAb8QCbBu52-CdAe3LjoIykkSDGUj9FUYy4kOekOIn9fB6VCV96JQkb30_U148eWZ94406lH0Rp7Fi...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ODIxODZkMDAtMDNiYy00N2U5LWE4OTEtYjI5NmE1MTRhMjQ1&google_push=AYg5qPL4Hb0wAb8QCbBu52-CdAe3LjoIykkSDGUj9FUYy4kOekOIn9fB6VCV96JQ...

170 B
188 B

44ms
44ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ODIxODZkMDAtMDNiYy00N2U5LWE4OTEtYjI5NmE1MTRhMjQ1&google_push=AYg5qPL4Hb0wAb8QCbBu52-CdAe3LjoIykkSDGUj9FUYy4kOekOIn9fB6VCV96JQkb30_U148eWZ94406lH0Rp7FiLlhkh9gLnSiog

Requested by

Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ODIxODZkMDAtMDNiYy00N2U5LWE4OTEtYjI5NmE1MTRhMjQ1&google_push=AYg5qPL4Hb0wAb8QCbBu52-CdAe3LjoIykkSDGUj9FUYy4kOekOIn9fB6VCV96JQkb30_U148eWZ94406lH0Rp7FiLlhkh9gLnSiog
date: Sat, 24 Jul 2021 18:07:31 GMT
content-length: 0

GET

pixel
cm.g.doubleclick.net/ Frame 9CD3
Redirect Chain

https://ads.avads.net/sync/ggl?google_gid=CAESEFwUuHEOBvpC1nL5YTprC-4&google_cver=1&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA
https://ads.avads.net/sync/ggl?google_gid=CAESEFwUuHEOBvpC1nL5YTprC-4&google_cver=1&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA&...
https://ads.avads.net/sync/ggl?google_gid=CAESEFwUuHEOBvpC1nL5YTprC-4&google_cver=1&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhP...

0
0

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 9CD3 0
12 B 43ms
42ms Image
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K_vWdNYlIx-wrj7ad8dflT7-bya3-8RaA7LnQrT0iWzLAKjvmNX3bueZyJEbuPGwIITvvsqU4

Requested by

Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:31 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 K69jH8UFrOCkOTHHl3NJFfCa68pF8Bp7Mwjsnyploxc.js Show response
pagead2.googlesyndication.com/bg/ Frame CBB7 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/K69jH8UFrOCkOTHHl3NJFfCa68pF8Bp7Mwjsnyploxc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2baf631fc505ace0a43931c797734915f09aebca45f01a7b3308ec9f2a65a317

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Jul 2021 16:12:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 179681
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13214
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 07:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 22 Jul 2022 16:12:50 GMT

GET
H3-29 200 DcmEnabler_01_246.js Show response
s0.2mdn.net/879366/ Frame 62F1 28 KB
10 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_246.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1798194350119714816/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44e04e4776c58b34580006ef8e8a1e1ae336f3e9c429ae242fe9a8f090889b79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1798194350119714816/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 07:15:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39105
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10121
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 25 Jul 2021 07:15:46 GMT

GET
H3-29 200 FSAlbert-Regular.ttf
s0.2mdn.net/sadbundle/1798194350119714816/ Frame 62F1 215 KB
215 KB 8ms
7ms Font
application/octet-stream 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1798194350119714816/FSAlbert-Regular.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1798194350119714816/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

70bfcd700f5b1c87104fc59c6696414e06387a716d0790794eef74d6a0742025

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/sadbundle/1798194350119714816/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 22:02:12 GMT
x-content-type-options: nosniff
age: 417919
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 220424
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 07:06:30 GMT
server: sffe
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 22:02:12 GMT

GET
H3-29 200 CycloneLayers-Background.woff
s0.2mdn.net/sadbundle/1798194350119714816/ Frame 62F1 17 KB
17 KB 7ms
6ms Font
application/octet-stream 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1798194350119714816/CycloneLayers-Background.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1798194350119714816/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d429e200327dd5abb1e646ccd94c6b0c997d51afe107377fccab49f01a130628

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/sadbundle/1798194350119714816/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 22:02:12 GMT
x-content-type-options: nosniff
age: 417919
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17240
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 07:06:30 GMT
server: sffe
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 22:02:12 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A56D 0
60 B 45ms
45ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:07:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 splash.png
s0.2mdn.net/sadbundle/1798194350119714816/ Frame 62F1 6 KB
6 KB 7ms
7ms Image
image/png 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1798194350119714816/splash.png

Requested by

Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c230ca75ae3fea7db90ce820f3224549a4462771a8ce7ea393e285a056b8d614

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1798194350119714816/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 22:02:13 GMT
x-content-type-options: nosniff
age: 417918
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6479
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 07:06:30 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 22:02:13 GMT

GET
H3-29 200 front.png
s0.2mdn.net/sadbundle/1798194350119714816/ Frame 62F1 223 KB
223 KB 9ms
9ms Image
image/png 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1798194350119714816/front.png

Requested by

Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f658220289ec582879507b787a56183fc66f9f95a98a975d9b4cff4283827d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1798194350119714816/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 22:02:13 GMT
x-content-type-options: nosniff
age: 417918
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 227940
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 07:06:30 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 22:02:13 GMT

GET
H3-29 200 rear.png
s0.2mdn.net/sadbundle/1798194350119714816/ Frame 62F1 59 KB
59 KB 8ms
8ms Image
image/png 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1798194350119714816/rear.png

Requested by

Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5594e6327e27c16d87eec2e5b755957241f627791e76566970f9771036fd3c0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1798194350119714816/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 01:13:00 GMT
x-content-type-options: nosniff
age: 406471
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60224
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 07:06:30 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 01:13:00 GMT

GET
H3-29 200 BTN.png
s0.2mdn.net/sadbundle/1798194350119714816/ Frame 62F1 964 B
989 B 8ms
7ms Image
image/png 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1798194350119714816/BTN.png

Requested by

Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

107f9115761f2ee0f1d5a9bb38e82870f9bf735f0219a8b15f5e4245a95b8adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1798194350119714816/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 22:02:13 GMT
x-content-type-options: nosniff
age: 417918
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 964
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 07:06:30 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 22:02:13 GMT

GET
H3-29 200 callme_logo.svg
s0.2mdn.net/sadbundle/1798194350119714816/ Frame 62F1 4 KB
2 KB 9ms
8ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1798194350119714816/callme_logo.svg

Requested by

Host: 13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
URL: https://13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae18c94edfcd1edf2673955e4bf959ce313eede58e45a7abf4c9c6d81913c626

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1798194350119714816/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 01:20:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 406029
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1718
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 07:06:30 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 01:20:22 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CBB7 0
20 B 44ms
43ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B7dXH41b8YL-QKoWS7_UPgJun0AUAAAAAOAHgBAI&bg=!09Cl0JTNAAbnC78O5ws7ACkAdvg8WnqtfJd7_974TbOyyIHHNFi1bmEmAWRwyJd5vCNbU_7mYBOEkgIAAACRUgAAAA9oAQcKAHgMeTNxCVpWxMaJvn2cb6ilqrFHixko-ALQVF87Q3o4_aJxx9wHj0vZVxxOxoL06bSmQT3xU9fZyE2II7tMqETu-w928Wdt9apNfjkxopEotvLkJE5ZEmk26RKKHMKftviGtE4SjGYZBh4s84MOgvdGQV97jnhhiRKZAtRvhivZlzV3tCA7bYmq3nwFmE__Yk2cDZcgevc0CFVQMfzGyKgMNnYUw-q0S-cyfLPceRdUFjEkhrEe9szcTzGV-HxgU5SQIlqxABlhbck3b6FdXHD3RjdgLISjFFzQ-_gpn_D0ECyd1M1ws57msnZ9MQV2R-yYdRmz9mfOEhalyA18EDc3N5CYnowxNhDb4N6gWi9kJTu6hN7lEUSsXoUn2pCGumCVzl7jfYOH7ciWe8bC1S6g2QNQOJnm1qsdDm-d1Qfz_NramWP0LVgeRJKqmHqutT9O8ACIfYSpX4AerdW-HxvxBxA3ddDvjaDpd9Uf9omP791k7mOzE1UztmFPY93G5pjm97g0EzLKJaQhAgi-eBdydwcRKUC1YxhE7XHIB-1Bhbsa3i7wSp8n6C3PN8-RE6x3qL-KRW_L-pS09G2AMzIEjmwXPissx8y5U5Edv52AUKZfhxS8IKyMbwj9p2ude6dshM3jg225BFhRX-dRTY1_KFuy55_l6060BVirkB2w5SylTG3RdJosbmiKbx6X4ZaHj9stojr3Rxuk5iTLkcVukuXYgKlNUE-J0WsdfMTlj5KpLiQLV2CT-C2qdXun2mu855S5FOJS-de1Nw_5N-g8SgxiOFSkRA2xrRZ_2e21D6mid5_fb1CgUHP_dXSStYV2Q51eAOOLKIBjL5y1db0WSlCAdwQRH-YDJ3R3cIb-ZDQODaolDrQgOg4ObLOVjWIOrOA5RRsOPT2l2ZXohQLoF4Iq8c8CmLVTiAblyo14nNqTIx7qQzBjeqU3rxAkVt38G0dXMOHy-hIeBbhL0e0tXH1N9coVrGw058m-hBmbpAYUpROBxx3XEsWTHTqwmFU1OFoKIcqJPlqvf1e1GYlZmHdtiTlyiflk9aBMEhoBHGOhM_KKSoHVIqTbEF-jC8KZo5qVGNaJgt-qKmCkDmp_RSlkaOjgULC1hGjrfu5n

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Jul 2021 18:07:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
www.bonne-promo.com/porpoiseant/ 0
42 B 36ms
36ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bonne-promo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE0NTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgxNCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzMwMCwyNTBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTQ1NzMwIiwiZG9tYWluX2lkIjoiMjU4OTIzIiwidW5pdCI6ImRpdi1ncHQtYWQtYm9ubmVfcHJvbW9fY29tLW1lZHJlY3RhbmdsZS0xLTAiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzODE0LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNDU3MzAiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ1bml0IjoiZGl2LWdwdC1hZC1ib25uZV9wcm9tb19jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjcxNTAwNDMsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImRiY2JkMWZhLTJiYWYtNDRlYS02ODA5LTRmYzYyZmQxMmZjZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MTQsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiNjMifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.bonne-promo.com
URL: https://www.bonne-promo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-14y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE0NTczMCIsImRvbWFpbl9pZCI6IjI1ODkyMyIsInVuaXQiOiJkaXYtZ3B0LWFkLWJvbm5lX3Byb21vX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyNzE1MDA0MywiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZGJjYmQxZmEtMmJhZi00NGVhLTY4MDktNGZjNjJmZDEyZmNkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgxNCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzMwMCwyNTBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTQ1NzMwIiwiZG9tYWluX2lkIjoiMjU4OTIzIiwidW5pdCI6ImRpdi1ncHQtYWQtYm9ubmVfcHJvbW9fY29tLW1lZHJlY3RhbmdsZS0xLTAiLCJ0X2Vwb2NoIjoxNjI3MTUwMDQzLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJkYmNiZDFmYS0yYmFmLTQ0ZWEtNjgwOS00ZmM2MmZkMTJmY2QiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzODE0LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNDU3MzAiLCJkb21haW5faWQiOiIyNTg5MjMiLCJ1bml0IjoiZGl2LWdwdC1hZC1ib25uZV9wcm9tb19jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjcxNTAwNDMsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImRiY2JkMWZhLTJiYWYtNDRlYS02ODA5LTRmYzYyZmQxMmZjZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MTQsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiNjMifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-07-24T18%3A07%3A27.709814Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Sat%2C%2024%20Jul%202021%2018%3A07%3A27%20GMT; __gads=ID=98404ba529addd45:T=1627150047:S=ALNI_MaIqwS5Edwxs655Q_-i0ltxfH7UYg; ezouspvv=34; ezouspvh=34; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.bonne-promo.com
referer: https://www.bonne-promo.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.bonne-promo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:07:33 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Fri, 23 Jul 2021 18:07:31 UTC

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NTRiZTI2ZjEtZWE4Zi00NDk0LWE5YTEtMWIxMTlhNGFkMzVi&google_push=AYg5qPJekEIJgDhgyAF8K0LHEl9gpeWcl45j7GsbG1n6-MFIEgS4XU8hpga02C7WSX7MRhPVonuCZD4ODXeE3T-PPh-kQcK2GCkA

Verdicts & Comments Add Verdict or Comment

208 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

21 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.bonne-promo.com/	1970-01-19 20:00:36	Name: _gid Value: GA1.2.1066146526.1627150044
www.bonne-promo.com/	1970-01-19 20:42:22	Name: _pbjs_userid_consent_data Value: 3524755945110770
www.bonne-promo.com/	1969-12-31 23:59:59	Name: ezouspvv Value: 0
www.bonne-promo.com/	1970-01-22 09:18:22	Name: ezds Value: ffid%3D1%2Cw%3D1600%2Ch%3D1200
.bonne-promo.com/	1970-01-19 19:59:11	Name: ezopvc_258923 Value: 1
.bonne-promo.com/	1970-01-19 19:59:11	Name: ezovuuid_258923 Value: 1f5c861d-7aa2-4d86-6910-162e89dd2305
www.bonne-promo.com/	1970-01-22 09:18:22	Name: ezohw Value: w%3D1600%2Ch%3D1200
.bonne-promo.com/	1970-01-19 20:00:36	Name: ezepvv Value: 0
.bonne-promo.com/	1970-01-19 19:59:11	Name: ezovid_258923 Value: 1643568915
.bonne-promo.com/	1970-01-19 19:59:17	Name: ezoab_258923 Value: mod31-c
.bonne-promo.com/	1969-12-31 23:59:59	Name: csvnv9dhq3kqvsq2f0u8i0jtig Value: ufesq9iakjvtfmt52ge1nnau8v
.bonne-promo.com/	1970-01-19 19:59:10	Name: _gat_gtag_UA_506386_12 Value: 1
.bonne-promo.com/	1970-01-19 20:02:02	Name: active_template::258923 Value: pub_site.1627150044
.bonne-promo.com/	1970-01-19 19:59:17	Name: ezoref_258923 Value:
.bonne-promo.com/	1970-01-20 04:44:46	Name: ezCMPCCS Value: false
.bonne-promo.com/	1970-01-19 19:59:11	Name: ezoadgid_258923 Value: -1
www.bonne-promo.com/	1969-12-31 23:59:59	Name: ezouspva Value: 0
.bonne-promo.com/	1970-01-19 20:02:02	Name: ezovuuidtime_258923 Value: 1627150043
.bonne-promo.com/	1970-01-20 13:30:22	Name: _ga Value: GA1.2.1757086823.1627150044
.bonne-promo.com/	1970-01-19 19:59:11	Name: lp_258923 Value: https://www.bonne-promo.com/
.bonne-promo.com/	1970-01-19 20:20:46	Name: PHPSESSID Value: csvnv9dhq3kqvsq2f0u8i0jtig

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://code.jquery.com/jquery-3.6.0.min.js(Line 2) Message: jQuery.Deferred exception: Cannot read property 'getItem' of null TypeError: Cannot read property 'getItem' of null at HTMLDocument.<anonymous> (https://css.bonne-promo.com/js/bonne-promo-20210415.min.js:1:55302) at e (https://code.jquery.com/jquery-3.6.0.min.js:2:30038) at t (https://code.jquery.com/jquery-3.6.0.min.js:2:30340) undefined
console-api	info	URL: https://cdn.ampproject.org/rtv/012107130206000/amp4ads-v0.mjs(Line 6) Message: Powered by AMP ⚡ HTML – Version 2107130206000 https://www.bonne-promo.com/

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

13a2cca271e12890cefc9f187598517d.safeframe.googlesyndication.com
a.tribalfusion.com
a.volvelle.tech
acdn.adnxs.com
ad.turn.com
ads.pubmatic.com
adservice.google.com
adservice.google.dk
bh.contextweb.com
bid.contextweb.com
bon-et-reduction.com
btlr.sharethrough.com
c1.adform.net
cdn.ampproject.org
cm.adgrx.com
cm.g.doubleclick.net
cms.quantserve.com
code.jquery.com
codepromo.bonne-promo.com
css.bonne-promo.com
csync.smilewanted.com
dis.criteo.com
dsum-sec.casalemedia.com
eb2.3lift.com
ezodn.com
fonts.googleapis.com
fonts.gstatic.com
g.ezodn.com
g.ezoic.net
go.ezodn.com
go.ezoic.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gum.criteo.com
hbopenbid.pubmatic.com
ib.adnxs.com
ice.360yield.com
id5-sync.com
idsync.rlcdn.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
img.bonne-promo.com
match.adsrvr.org
match.bnmla.com
match.deepintent.com
match.prod.bidr.io
match.sharethrough.com
match.taboola.com
mug.criteo.com
onetag-sys.com
pagead2.googlesyndication.com
pb-server.ezoic.com
pixel-sync.sitescout.com
pixel.quantserve.com
pixel.rubiconproject.com
pmp.mxptint.net
pr-bh.ybp.yahoo.com
prebid.a-mo.net
prebid.smilewanted.com
pubmatic-match.dotomi.com
px.owneriq.net
rtb.adentifi.com
rtb.gumgum.com
rtb.openx.net
s.tribalfusion.com
s0.2mdn.net
secure.adnxs.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
simage4.pubmatic.com
ssbsync.smartadserver.com
ssum-sec.casalemedia.com
static.smilewanted.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.1rx.io
sync.adotmob.com
sync.bumlam.com
sync.ipredictive.com
sync.mathtag.com
sync.resetdigital.co
sync.search.spotxchange.com
sync.smartadserver.com
sync.srv.stackadapt.com
sync.targeting.unrulymedia.com
sync3.sniperlog.ru
tpc.googlesyndication.com
trc.taboola.com
um.simpli.fi
ups.analytics.yahoo.com
visitor.omnitagjs.com
www.bon-et-reduction.com
www.bonne-promo.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
x.bidswitch.net
cm.g.doubleclick.net
104.111.242.53
142.250.185.226
142.250.186.130
147.75.38.124
151.101.13.44
151.101.14.49
169.50.137.190
172.67.71.185
176.31.224.48
178.250.0.157
178.250.0.163
18.156.0.31
18.159.80.129
18.210.5.212
185.183.112.155
185.255.84.152
185.29.135.233
185.33.220.240
185.33.223.178
185.64.189.112
185.64.189.114
185.64.189.115
185.64.190.80
185.64.190.81
185.86.137.107
185.86.137.132
185.94.180.126
198.148.27.134
198.148.27.140
2.18.232.130
2.18.233.180
2.18.234.21
2001:4de0:ac18::1:a:1b
2001:678:cb4:bbbb::11
204.2.255.233
213.186.33.2
213.19.147.45
216.58.212.162
2600:9000:214f:4800:2:cb38:840:93a1
2606:4700:3036::ac43:a1d1
2606:4700::6812:d05
2620:116:800d:21:5a23:9c4e:e774:96c1
2a00:1288:110:c305::8000
2a00:1450:4001:800::2001
2a00:1450:4001:800::2003
2a00:1450:4001:802::2002
2a00:1450:4001:809::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::200e
2a00:1450:4001:813::2004
2a00:1450:4001:828::2002
2a00:1450:4001:828::2004
2a00:1450:4001:828::200e
2a00:1450:4001:82b::2001
2a00:1450:4001:82b::2008
2a00:1450:4001:830::2002
2a00:1450:4001:830::2006
2a00:1450:4001:831::2001
2a00:1450:4001:831::2002
2a00:1450:4001:831::200a
2a00:1450:400c:c04::9a
2a02:2638:1::13
2a02:fa8:8806:20::2040
2a04:4e42:3::300
3.66.136.156
31.172.81.158
31.172.81.160
35.156.198.184
35.158.176.66
35.158.21.212
35.210.178.101
35.227.252.103
35.244.174.68
37.157.6.245
38.27.122.158
38.91.45.7
45.35.192.162
51.89.7.110
51.89.9.252
52.205.247.225
52.30.222.33
52.45.11.130
52.48.175.241
52.59.128.17
54.226.209.67
63.251.232.170
66.155.71.150
69.173.144.165
76.223.111.131
76.223.111.18
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0d041d67973983cb9838b546ffc38a84c134904487f6fa90a9a218263bff99ed
107f9115761f2ee0f1d5a9bb38e82870f9bf735f0219a8b15f5e4245a95b8adb
1130c26caface5cfa7b2d0cdbbb70cdb3004c582e74969d580216f65596c47c1
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
14375082f18c8501a36b803a80a3489476d037a97867ffa2a1aae1b65df4fa57
16def75cf70ee8dbb1e8b37b3b30e10422cf5e2bf24a60e3d97228fee8e0b089
17d426743c4a5c730530f372e1b869adf7304185b0efd25dc05cd037489fad33
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
18c3abf723851b8b8221b3dc8e54630bbee330a93851642b451538804dccb97c
1a01f5c56a03de3347e9c661a903b8f83de48337a327374f222107b561052b0a
1b16e9c1da7045c9057350282766a114be2070b065e5e8a42ae635d0610ba6d0
1b1a4081a8a32bc714fbb7a2509141683bc3eb707a421c0db556ed856f6d8e99
1c5ad2fd42dffdf04a0f1d757c1cccb4d840218d7ecada79d6cc9db33ca40319
1caacdebd86c67f86ab89cdbd30b056a8c1141638aafdd35ec453c4bae91692b
1d0523ee931603dcc173257b769c87121cca3417cf5fe2af12555d069149ae64
227af992e2f7e8eb08a8d376e4cd3d98f619449dbf3960bb3a769f07748f7a85
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba
238fb35f40ffc6e57fa879d348c2a01defa33a192f7dc7254ac9609625976c9f
2644f44d6c65d45b1e900322bb4ebbbe4e48f1223e442c67e91bf5907f4c6e3a
29d096500cc94cbe347c613cb34199c274da1fe8b5df04fdb49ee75ace5edbec
2baf631fc505ace0a43931c797734915f09aebca45f01a7b3308ec9f2a65a317
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
308bb896f607d1a673aa28a61c8dc7c6e8b6abfe79ac097310b1004b4d9102bb
3166673b6d2cda2fd7e5b54bd95ce529196fa059c6feba829c42fc05031ca4b4
32cd2462f0572cc6d63fba76837141950a47108f0015cee8f116f69002d1019f
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
3ae273c29bd959a91e07ce773731ceab7b47eccba4ab49d17c261c7f0d9f1d22
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3da4bbee65b454ad5e681f82817fdb83faa1beaa26bb309e1aabb15a48933ca8
4409f886851d18b5071cc08d25845e0d959d51fd1e9eec92118d0f12a44e5eeb
440eb2947a8e7d93999e713c828fef42441a0e7e9cfbe5d6611895ae0c79b53a
4412223b83f3dfa829e7f58bec7efc810c2b10432fba5462176874fcda15fedc
44e04e4776c58b34580006ef8e8a1e1ae336f3e9c429ae242fe9a8f090889b79
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e32401487ee2b8c1f2cbdcb9809d778ae684a8087594e83ac572188b7d4797d
4f25f90be172b62853e0b5bc0d76bcf5d4dda80a961747808ef676819187459c
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
5073fab4fddb9f037315ac9c663dce6681b03976250cab681638dfe17475466f
523456a41f734ca688c0cf19f8377da02078680281decf2c4eb1d24ba476b5ef
548b8db8adb3832e6b0397170fc43188877d34c7eae82d91d3b7f6ae908e4234
5594e6327e27c16d87eec2e5b755957241f627791e76566970f9771036fd3c0a
57e9af9d54ab53d00c34fde2ea173f431f7541e1a508cca98f1b9ec7cac5e752
58c072a03fada6cb9a89fa9a8cfec112f0c2fc2a47e09bdeab11e712db28c749
5a8bc86b1ac97d268ad475d3060d59e0597e8f3c1c934d11a127e3f68ad644f0
5e7b4d82f5e920738166b1db6c532065bff57f335bdfae74a8e57085dd4d9f22
63dbc6ec5e1167f88e9e3b205759c7577791b8a9c9e898820b71eeb0e353fefb
65506c87a4e71875a107df7ca37f45ccfd40688cf8e01f65c7e71792dbd6818c
6c4a7041279c1f3b233e93a709698658b8c07c00f4c125f56eb902bd6f76a6f7
6da851b5c9e30b71de10162d65135d679b279d518036f81178092af7f5e9970e
6f658220289ec582879507b787a56183fc66f9f95a98a975d9b4cff4283827d5
70bfcd700f5b1c87104fc59c6696414e06387a716d0790794eef74d6a0742025
72a6f60303973c5ffe153aff6bd00a121f6a81139415236de13a2a1fb41b9d05
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
78613a6e5bab939b078feae691fb0661e2b2671dcce1b1be66517203b2a7b3b1
79d84501e7c458fa0180494d7b63d9c3e56db557c58211c4ec492ca548bd6cb5
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
82261dc337590b649371d49042d244967e604a42306a05be6317d659d42c7781
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
87e096fb76df45c2f8c9b9ac4e01433d4d6c77756d56ebf54e7233f2743fc7fd
880008a768d7c6b45d53344c829cf2a6e0e11315f92034cba73f49a79b1594e5
966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9a3733ce00a3ddcb498211e3c21cc27a31d52beb6fad72caf3e5d177f6f252a8
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9c0848cf18163c7e417b88b1516ca9ef93f175254afdf81a4c36839d76c7a4e3
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5de689da6c35b8fe1b1d52e7e6b83b35cb94167dd574b4593d003cb0e9c03d9
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a9a14735882ec8e6c617f833ad702faf7230ab212e6ee6990a9f69fb97e710db
ab41a2d709eb3721f3f3f353604200c8bd092e2ec8625209192cc83d3ac32e20
ac2ffd30d773ba387806848181aa66fddcaceec404f090c696c6da4011c20965
ae18c94edfcd1edf2673955e4bf959ce313eede58e45a7abf4c9c6d81913c626
afd52daf37ffe311a6399f524f1a32bfcc8d09d9b0b662d9e59c6cfe0c5cdb5c
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b379601c8de553ff9087103812a203b765ce4d520ab9e03e96590cf2f3c99e67
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
ba32310ed9d42f6c8cde2a1d7524e8d336ad0924654164e3d4fea7daaf986376
bab0a173448c8c6cd59fc8df45916dbecc9c72eb3e0ea2af3eea75f73be6b75c
bb10b8a273579cd997035d04ad3d87002aefa416b6ebe91b6c25e4eb0aa6ffcf
c230ca75ae3fea7db90ce820f3224549a4462771a8ce7ea393e285a056b8d614
c6220a44e10ed1a867107ececc722c0eb7a0743c429420218a57a1e2bcd1afc4
c89db6f8636223ca90061f635995fc998724683e73daa2c265ec2e053e9c1d27
c8aa038c4f11b96e214082745ffb8e9955cf0948f3c77063fad29939a759b30d
c9669dc08c346457c8a4d388965bd811020bff7939449368f677267822f23182
cb381469707d9f3d026118f83f65bc46153737a2c690a30d651c716272508f8c
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cdde622f5962fbf1015b9ff944562fb1e4b5c14c8f3be52513f948d0a3f649ff
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
d1cdf840213fc72966930737038dee0d55892000f6cf8d3961a9a85eb93d100e
d216690457c596c62a275eb6351af23fec418a9062912fd6e67abd606425d02a
d398520ac47945ab429cf02b444202f4db1cf7fee5b5335cf98fb009ce56ab8e
d429e200327dd5abb1e646ccd94c6b0c997d51afe107377fccab49f01a130628
d7a681f864fef66e4afaf867943f58cc5d174e12b6a1e002fdb7640a3a86a036
dc48161214298afa70fd306b5a0a247f62c6042238e3dcadbd32015adedcc263
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de5a0fdb3840afdfdf340d32da717392dc7885e85b55c0b1c49c0da810d992dc
e02b3e285daa4c3f6e90f0513f57d3b7cfbe202beca3400f59c358651dd3f831
e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e45818350fb6700935c0dce924d8317b166845c5516bc391a1dbda39203f143a
e895a497e3209104eed037111118b98c1e1de025f3f667d5cef7643a36c96678
e9c818dfb2edfd3add59bb72332cf88e96eb0fa3f55481d23ad9fd1e394de3b5
eb303b5f50e3956196be7170ab56163f2a10a4a721604d7ff2d1dbcad3f52576
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
eba29be11636bc018215eb1dcd43ad549a179196410bd1006e0d65144efb78f4
ebc55986f73d6daa2d1ed97ed198b35d13cfafc3de93f8c4fc5f60c1eadc7027
ec2f44e7dbd2ebb1268ac7e7a0602ec2106bc7fd9da17b9012db81be55cbd485
ed2de1078a718d9e42ae766dc2938802a923b017e955473bfc70cfa069b4c513
ee193a39c085abb2ced804a088d9bc35b9b3afaa9c03d5f44cf5780418bb304c
ee22f683394ec9d609b8c7b90e446dc4fde1cdcf0895322f7004078b5d3ed549
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2b92530616ddbefbed0e825e094cd914f17ae899b42152f17028a0073f5eb62
f37c7332fe7f42bc029bba0a2eb023bbd4aa816868fd8347ce87f02bdf815e03
f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df
f555ff48db1230c650364c7c816b931bcf1367253e5e159de1ea2e116cfcfe45
f77a57f0a6ee94ba897f0b5790d2749ba645d8846b38d3fb3ecf5e84ac4bd5b9
f831b0851e6cbdf68a59095d77d7567b8599f1bd6cb85bc6c751c41839e9f23d
faf5e994ddbada86a873b5d14c1bc0f449a097e61e6fbe0c04e0691b70ec5644
fbd71435e486090a3e634501a0ba4992c005e0753e0dacc4573975527d8d9fd9
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

www.bonne-promo.com Open in urlscan Pro 18.159.80.129 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

227 Requests

100 %HTTPS

31 %IPv6

66 Domains

100 Subdomains

65 IPs

8 Countries

1957 kBTransfer

4427 kBSize

21 Cookies

4 Outgoing links

Page URL History

Redirected requests

227 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.bonne-promo.com Open in urlscan Pro
18.159.80.129 Public Scan

Screenshot
Live screenshot

Full Image

227
Requests

100 %
HTTPS

31 %
IPv6

66
Domains

100
Subdomains

65
IPs

8
Countries

1957 kB
Transfer

4427 kB
Size

21
Cookies

227 HTTP transactions
2 data transactions