www.billofsale-form.com Open in urlscan Pro
2606:4700:3035::ac43:bf24 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://cdn-3.billofsale-form.com/
Effective URL:
https://www.billofsale-form.com/
Submission: On June 11 via automatic, source certstream-suspicious (June 11th 2021, 7:04:28 pm UTC)

Summary HTTP 206 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 58 IPs in 8 countries across 51 domains to perform 206 HTTP transactions. The main IP is 2606:4700:3035::ac43:bf24, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.billofsale-form.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 11th 2020. Valid for: a year.

This is the only time www.billofsale-form.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3031::6815:443f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
41	2606:4700:303... 2606:4700:3035::ac43:bf24	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3035::6815:4c02	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
13	2.18.235.93 2.18.235.93	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:9000:211... 2600:9000:211a:7600:2:cb38:840:93a1	16509 (AMAZON-02) (AMAZON-02)
11	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
3	18.159.80.129 18.159.80.129	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
1 2	2a02:2638::1c 2a02:2638::1c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	178.250.0.157 178.250.0.157	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	18.192.15.110 18.192.15.110	16509 (AMAZON-02) (AMAZON-02)
1	72.251.249.14 72.251.249.14	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
1	198.148.27.133 198.148.27.133	19189 (PULSEPOINT) (PULSEPOINT)
2	213.19.147.42 213.19.147.42	26120 (RHYTHMONE) (RHYTHMONE)
1	136.144.59.88 136.144.59.88	54825 (PACKET) (PACKET)
1	13.32.2.39 13.32.2.39	16509 (AMAZON-02) (AMAZON-02)
1 3	2620:116:800d... 2620:116:800d:21:f916:5049:f87f:108e	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:211... 2600:9000:211a:9200:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
14	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:811::2001	15169 (GOOGLE) (GOOGLE)
3	2.16.186.89 2.16.186.89	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	34.102.149.62 34.102.149.62	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:809::2001	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:813::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
1	54.36.109.22 54.36.109.22	16276 (OVH) (OVH)
1 2	198.148.27.139 198.148.27.139	19189 (PULSEPOINT) (PULSEPOINT)
1	2600:9000:21f... 2600:9000:21f3:a600:1f:2473:9080:93a1	16509 (AMAZON-02) (AMAZON-02)
3	13.224.192.221 13.224.192.221	16509 (AMAZON-02) (AMAZON-02)
2 2	2.19.35.65 2.19.35.65	16625 (AKAMAI-AS) (AKAMAI-AS)
4	104.109.78.125 104.109.78.125	16625 (AKAMAI-AS) (AKAMAI-AS)
1 3	185.33.221.13 185.33.221.13	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
5	54.84.143.226 54.84.143.226	14618 (AMAZON-AES) (AMAZON-AES)
2 2	18.197.47.23 18.197.47.23	16509 (AMAZON-02) (AMAZON-02)
2 3	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
4 5	76.223.111.131 76.223.111.131	16509 (AMAZON-02) (AMAZON-02)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1 1	88.214.206.142 88.214.206.142	46636 (NATCOWEB) (NATCOWEB)
3 3	185.64.190.79 185.64.190.79	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 2	37.157.3.30 37.157.3.30	198622 (ADFORM) (ADFORM)
1 1	185.64.189.110 185.64.189.110	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	185.64.189.114 185.64.189.114	62713 (AS-PUBMATIC) (AS-PUBMATIC)
27 29	213.19.147.45 213.19.147.45	26120 (RHYTHMONE) (RHYTHMONE)
2	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
3 4	52.29.176.117 52.29.176.117	16509 (AMAZON-02) (AMAZON-02)
2 2	34.240.2.137 34.240.2.137	16509 (AMAZON-02) (AMAZON-02)
12	213.19.147.44 213.19.147.44	26120 (RHYTHMONE) (RHYTHMONE)
1 1	162.55.6.212 162.55.6.212	24940 (HETZNER-AS) (HETZNER-AS)
1 1	35.186.193.173 35.186.193.173	15169 (GOOGLE) (GOOGLE)
2 2	37.252.173.22 37.252.173.22	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	185.29.133.199 185.29.133.199	30419 (MEDIAMATH...) (MEDIAMATH-INC)
2 2	151.101.14.49 151.101.14.49	54113 (FASTLY) (FASTLY)
1 1	54.81.207.173 54.81.207.173	14618 (AMAZON-AES) (AMAZON-AES)
2 3	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
3 9	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	52.49.183.138 52.49.183.138	16509 (AMAZON-02) (AMAZON-02)
8 15	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
1 2	72.21.206.140 72.21.206.140	16509 (AMAZON-02) (AMAZON-02)
2 2	51.178.20.139 51.178.20.139	16276 (OVH) (OVH)
2	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:803::2006	15169 (GOOGLE) (GOOGLE)
2	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
1 2	2001:678:cb4:... 2001:678:cb4:bbbb::11	56396 (TURN) (TURN)
1 1	2620:119:50e1... 2620:119:50e1:101::6cae:b25	14413 (LINKEDIN) (LINKEDIN)
2 2	193.232.148.157 193.232.148.157	48061 (UMA-TECH-AS) (UMA-TECH-AS)
1 1	13.32.2.95 13.32.2.95	16509 (AMAZON-02) (AMAZON-02)
1	52.48.144.237 52.48.144.237	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
206	58

1 2606:4700:3031::6815:443f (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cdn-3.billofsale-form.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

41 2606:4700:3035::ac43:bf24 (United States)

ASN13335 (CLOUDFLARENET, US)

www.billofsale-form.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::6815:4c02 (United States)

ASN13335 (CLOUDFLARENET, US)

go.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2.18.235.93 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-93.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
lg3.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:211a:7600:2:cb38:840:93a1 (United States)

ASN16509 (AMAZON-02, US)

go.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.159.80.129 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com

g.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638::1c (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.0.157 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.192.15.110 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-192-15-110.eu-central-1.compute.amazonaws.com

ads.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.251.249.14 (Amsterdam, Netherlands)

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.148.27.133 (New York, United States)

ASN19189 (PULSEPOINT, US)

bid.contextweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.19.147.42 (United Kingdom)

ASN26120 (RHYTHMONE, US)

targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tag.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 136.144.59.88 (Secaucus, United States)

ASN54825 (PACKET, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.2.39 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-2-39.vie50.r.cloudfront.net

hb.undertone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:116:800d:21:f916:5049:f87f:108e (United States) 1 redirects

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:211a:9200:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.16.186.89 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-89.deploy.static.akamaitechnologies.com

res-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.102.149.62 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 62.149.102.34.bc.googleusercontent.com

navvy.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:809::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.36.109.22 (France)

ASN16276 (OVH, FR)

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 198.148.27.139 (New York, United States) 1 redirects

ASN19189 (PULSEPOINT, US)

bh.contextweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:a600:1f:2473:9080:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.undertone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.224.192.221 (United States)

ASN16509 (AMAZON-02, US)

video.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.19.35.65 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-19-35-65.deploy.static.akamaitechnologies.com

secure-assets.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.109.78.125 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-109-78-125.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.33.221.13 (Amsterdam, Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 54.84.143.226 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

usr.undertone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.197.47.23 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-47-23.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.126.56.137 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 76.223.111.131 (United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: a97adde81b00f2ca4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 88.214.206.142 (United Kingdom) 1 redirects

ASN46636 (NATCOWEB, US)

cs.admanmedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.64.190.79 (United Kingdom) 3 redirects

ASN62713 (AS-PUBMATIC, US)

image8.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.3.30 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.110 (United Kingdom) 1 redirects

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.114 (United Kingdom) 1 redirects

ASN62713 (AS-PUBMATIC, US)

image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 213.19.147.45 (United Kingdom) 27 redirects

ASN26120 (RHYTHMONE, US)

usermatch.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.29.176.117 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-29-176-117.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.240.2.137 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)

ads.avct.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 213.19.147.44 (United Kingdom)

ASN26120 (RHYTHMONE, US)

sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.55.6.212 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.212.6.55.162.clients.your-server.de

csync.loopme.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.193.173 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)

cm.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.252.173.22 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.29.133.199 (United Kingdom) 2 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.14.49 (Frankfurt am Main, Germany) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.81.207.173 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1288:110:c305::8000 (United Kingdom) 2 redirects

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2.18.234.21 (Frankfurt am Main, Germany) 3 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.49.183.138 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 216.58.212.162 (Mountain View, United States) 8 redirects

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 72.21.206.140 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: 206-140.amazon.com

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.178.20.139 (France) 2 redirects

ASN16276 (OVH, FR)

gu.dyntrk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:803::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:678:cb4:bbbb::11 (United Kingdom) 1 redirects

ASN56396 (TURN, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:119:50e1:101::6cae:b25 (United States) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.232.148.157 (Russian Federation) 2 redirects

ASN48061 (UMA-TECH-AS, RU)

px.adhigh.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.2.95 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-32-2-95.vie50.r.cloudfront.net

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.48.144.237 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

ads.yieldmo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
42	billofsale-form.com 1 redirects cdn-3.billofsale-form.com www.billofsale-form.com	416 KB
30	doubleclick.net 8 redirects securepubads.g.doubleclick.net cm.g.doubleclick.net googleads.g.doubleclick.net googleads4.g.doubleclick.net	245 KB
29	unrulymedia.com 12 redirects targeting.unrulymedia.com video.unrulymedia.com usermatch.targeting.unrulymedia.com sync.targeting.unrulymedia.com	14 KB
22	googlesyndication.com 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	92 KB
17	1rx.io 15 redirects tag.1rx.io sync.1rx.io	4 KB
15	media.net contextual.media.net lg3.media.net navvy.media.net	165 KB
11	2mdn.net s0.2mdn.net	170 KB
9	casalemedia.com 3 redirects ssum-sec.casalemedia.com dsum-sec.casalemedia.com	9 KB
9	rubiconproject.com 2 redirects secure-assets.rubiconproject.com eus.rubiconproject.com pixel.rubiconproject.com token.rubiconproject.com	22 KB
7	undertone.com hb.undertone.com cdn.undertone.com usr.undertone.com	4 KB
6	yahoo.com 4 redirects ups.analytics.yahoo.com pr-bh.ybp.yahoo.com	3 KB
6	google.com adservice.google.com www.google.com	1 KB
5	pubmatic.com 5 redirects image8.pubmatic.com simage2.pubmatic.com image4.pubmatic.com	2 KB
5	adsrvr.org 4 redirects match.adsrvr.org	2 KB
5	adnxs.com 3 redirects ib.adnxs.com secure.adnxs.com	4 KB
5	gstatic.com fonts.gstatic.com csi.gstatic.com	43 KB
4	bidswitch.net 3 redirects x.bidswitch.net	1 KB
4	google.de adservice.google.de	574 B
4	advertising.com 2 redirects ads.adaptv.advertising.com pixel.advertising.com	1 KB
4	criteo.com 1 redirects gum.criteo.com mug.criteo.com	1 KB
4	ezoic.net go.ezoic.net g.ezoic.net	2 KB
3	akamaihd.net res-a.akamaihd.net	53 KB
3	quantserve.com 1 redirects secure.quantserve.com pixel.quantserve.com cms.quantserve.com	10 KB
3	contextweb.com 1 redirects bid.contextweb.com bh.contextweb.com	1 KB
2	cloudflare.com cdnjs.cloudflare.com	22 KB
2	adhigh.net 2 redirects px.adhigh.net	962 B
2	turn.com 1 redirects ad.turn.com r.turn.com	857 B
2	googletagservices.com www.googletagservices.com	65 KB
2	dyntrk.com 2 redirects gu.dyntrk.com	850 B
2	amazon-adsystem.com 1 redirects s.amazon-adsystem.com	961 B
2	bidr.io 1 redirects match.prod.bidr.io	966 B
2	everesttech.net 2 redirects sync-tm.everesttech.net	623 B
2	mathtag.com 2 redirects sync.mathtag.com	1 KB
2	avct.cloud 2 redirects ads.avct.cloud	892 B
2	adform.net 2 redirects c1.adform.net	1 KB
2	openx.net 2 redirects us-u.openx.net	535 B
2	google-analytics.com www.google-analytics.com	19 KB
1	yieldmo.com ads.yieldmo.com	35 B
1	smaato.net 1 redirects s.ad.smaato.net	429 B
1	linkedin.com 1 redirects px.ads.linkedin.com	650 B
1	stackadapt.com 1 redirects sync.srv.stackadapt.com	607 B
1	ctnsnet.com 1 redirects cm.ctnsnet.com	391 B
1	loopme.me 1 redirects csync.loopme.me	211 B
1	admanmedia.com 1 redirects cs.admanmedia.com	413 B
1	id5-sync.com id5-sync.com	541 B
1	quantcount.com rules.quantcount.com	430 B
1	a-mo.net prebid.a-mo.net	789 B
1	lijit.com ap.lijit.com	767 B
1	googleapis.com fonts.googleapis.com	427 B
1	ezodn.com go.ezodn.com	60 KB
0	Failed function sub() { [native code] }. Failed
206	51

	Domain	Requested by
41	www.billofsale-form.com	www.billofsale-form.com
16	sync.1rx.io	15 redirects video.unrulymedia.com
15	cm.g.doubleclick.net	8 redirects googleads.g.doubleclick.net 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
13	usermatch.targeting.unrulymedia.com	12 redirects video.unrulymedia.com
13	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com googleads.g.doubleclick.net s0.2mdn.net www.googletagservices.com
12	sync.targeting.unrulymedia.com	video.unrulymedia.com ssum-sec.casalemedia.com
11	s0.2mdn.net	www.billofsale-form.com s0.2mdn.net
11	securepubads.g.doubleclick.net	www.billofsale-form.com securepubads.g.doubleclick.net 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com s0.2mdn.net
7	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com s0.2mdn.net
7	contextual.media.net	www.billofsale-form.com contextual.media.net
6	dsum-sec.casalemedia.com	2 redirects ssum-sec.casalemedia.com googleads.g.doubleclick.net
6	lg3.media.net	www.billofsale-form.com contextual.media.net
5	match.adsrvr.org	4 redirects ssum-sec.casalemedia.com
5	usr.undertone.com	cdn.undertone.com
5	adservice.google.com	www.billofsale-form.com securepubads.g.doubleclick.net
4	x.bidswitch.net	3 redirects ssum-sec.casalemedia.com
4	eus.rubiconproject.com	cdn.undertone.com eus.rubiconproject.com video.unrulymedia.com
4	adservice.google.de	securepubads.g.doubleclick.net
3	ssum-sec.casalemedia.com	1 redirects video.unrulymedia.com ssum-sec.casalemedia.com
3	pr-bh.ybp.yahoo.com	2 redirects ssum-sec.casalemedia.com
3	image8.pubmatic.com	3 redirects
3	ups.analytics.yahoo.com	2 redirects ssum-sec.casalemedia.com
3	ib.adnxs.com	1 redirects cdn.undertone.com googleads.g.doubleclick.net
3	video.unrulymedia.com	go.ezodn.com video.unrulymedia.com
3	csi.gstatic.com	securepubads.g.doubleclick.net
3	res-a.akamaihd.net	www.billofsale-form.com
3	g.ezoic.net	www.billofsale-form.com
2	cdnjs.cloudflare.com	s0.2mdn.net
2	px.adhigh.net	2 redirects
2	googleads4.g.doubleclick.net	www.billofsale-form.com
2	googleads.g.doubleclick.net	9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com www.billofsale-form.com
2	www.googletagservices.com	securepubads.g.doubleclick.net 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
2	gu.dyntrk.com	2 redirects
2	s.amazon-adsystem.com	1 redirects ssum-sec.casalemedia.com
2	match.prod.bidr.io	1 redirects video.unrulymedia.com
2	sync-tm.everesttech.net	2 redirects
2	sync.mathtag.com	2 redirects
2	secure.adnxs.com	2 redirects
2	ads.avct.cloud	2 redirects
2	token.rubiconproject.com	eus.rubiconproject.com
2	c1.adform.net	2 redirects
2	pixel.advertising.com	2 redirects
2	us-u.openx.net	2 redirects
2	secure-assets.rubiconproject.com	2 redirects
2	bh.contextweb.com	1 redirects go.ezodn.com
2	navvy.media.net	contextual.media.net
2	9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	ads.adaptv.advertising.com	go.ezodn.com
2	mug.criteo.com	www.billofsale-form.com
2	gum.criteo.com	1 redirects
2	www.google-analytics.com	www.billofsale-form.com www.google-analytics.com
2	fonts.gstatic.com	fonts.googleapis.com
1	ads.yieldmo.com	9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
1	s.ad.smaato.net	1 redirects
1	px.ads.linkedin.com	1 redirects
1	r.turn.com	9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
1	ad.turn.com	1 redirects
1	cms.quantserve.com	1 redirects
1	sync.srv.stackadapt.com	1 redirects
1	cm.ctnsnet.com	1 redirects
1	csync.loopme.me	1 redirects
1	image4.pubmatic.com	1 redirects
1	simage2.pubmatic.com	1 redirects
1	cs.admanmedia.com	1 redirects
1	pixel.rubiconproject.com	cdn.undertone.com
1	cdn.undertone.com	go.ezodn.com
1	id5-sync.com	go.ezodn.com
1	www.google.com	tpc.googlesyndication.com
1	pixel.quantserve.com	www.billofsale-form.com
1	rules.quantcount.com	secure.quantserve.com
1	secure.quantserve.com	www.billofsale-form.com
1	hb.undertone.com	go.ezodn.com
1	prebid.a-mo.net	go.ezodn.com
1	tag.1rx.io	go.ezodn.com
1	targeting.unrulymedia.com	go.ezodn.com
1	bid.contextweb.com	go.ezodn.com
1	ap.lijit.com	go.ezodn.com
1	go.ezoic.net	www.billofsale-form.com
1	fonts.googleapis.com	www.billofsale-form.com
1	go.ezodn.com	www.billofsale-form.com
1	cdn-3.billofsale-form.com	1 redirects
0	blank Failed	www.billofsale-form.com
206	82

This site contains links to these domains. Also see Links.

Domain
silktide.com
www.facebook.com
twitter.com
plusone.google.com
pinterest.com
www.ezoic.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-11` - `2021-07-11`	a year	crt.sh
*.google.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.media.net DigiCert SHA2 Secure Server CA	`2021-04-12` - `2022-04-20`	a year	crt.sh
*.ezoic.net Amazon	`2021-02-15` - `2022-03-16`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
ezoic.net R3	`2021-05-23` - `2021-08-21`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-04-14` - `2021-07-12`	3 months	crt.sh
*.v.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-05-24` - `2021-11-17`	6 months	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2021-03-11` - `2022-04-12`	a year	crt.sh
*.contextweb.com DigiCert SHA2 Secure Server CA	`2020-05-07` - `2022-05-12`	2 years	crt.sh
*.targeting.unrulymedia.com DigiCert SHA2 Secure Server CA	`2020-05-04` - `2022-05-09`	2 years	crt.sh
*.1rx.io Sectigo RSA Domain Validation Secure Server CA	`2021-06-01` - `2022-07-02`	a year	crt.sh
*.a-mo.net R3	`2021-05-11` - `2021-08-09`	3 months	crt.sh
*.undertone.com Amazon	`2020-11-03` - `2021-12-02`	a year	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.google.de GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2020-07-15` - `2021-09-13`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.id5-sync.com R3	`2021-06-01` - `2021-08-30`	3 months	crt.sh
*.unrulymedia.com Sectigo RSA Domain Validation Secure Server CA	`2020-10-16` - `2021-11-16`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-04-01` - `2022-04-04`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.k8s-cluster-p-us-east-1.ramp-ut.io Amazon	`2020-11-18` - `2021-12-18`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.match.prod.bidr.io Amazon	`2021-02-26` - `2022-03-27`	a year	crt.sh
s.amazon-adsystem.com Amazon	`2020-08-28` - `2021-08-20`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2021-03-18` - `2022-04-19`	a year	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-23` - `2022-05-04`	2 years	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-03-22` - `2021-09-15`	6 months	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-03-29` - `2021-09-22`	6 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
*.turn.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2021-03-31` - `2022-03-31`	a year	crt.sh
*.yieldmo.com Amazon	`2021-05-25` - `2022-06-23`	a year	crt.sh

This page contains 30 frames:

Primary Page: https://www.billofsale-form.com/
Frame ID: 0CB4978EEC4643C6B5C414A5A6F3E16D
Requests: 98 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU4593V4&https=1&itype=CM
Frame ID: C18F6AB716DAF2CD83C1C0377136859E
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU4593V4&https=1&itype=CM
Frame ID: 29C49DBF40368B6E7F7923CCB1ED8DDF
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/4a/nrrV12042.js
Frame ID: 7D38F4258772BA130861CC9603368A45
Requests: 6 HTTP requests in this frame

Frame: https://contextual.media.net/4a/nrrV12042.js
Frame ID: B5217D2758B768AF79D0AF3D0E1B104E
Requests: 6 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html
Frame ID: 7B1EB36C8AC2E5B617E22BDEF906C51C
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: DF1DC38B0628F32FBCC867751B686897
Requests: 1 HTTP requests in this frame

Frame: https://bh.contextweb.com/visitormatch
Frame ID: 35106D69AF53E8E6226E77705D1CB87E
Requests: 1 HTTP requests in this frame

Frame: https://cdn.undertone.com/js/usersync.html
Frame ID: 874F8286FCA47B333F59C279EB276BF1
Requests: 8 HTTP requests in this frame

Frame: https://video.unrulymedia.com/iframes/third-party-iframes.html
Frame ID: C627C0FE72BA0A8EA5135175F2E7D83B
Requests: 6 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=12776
Frame ID: 77A9C09F074CF0890521A95E930E1493
Requests: 3 HTTP requests in this frame

Frame: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Frame ID: 92F55489B720A151BBFC84B5EAE851A3
Requests: 1 HTTP requests in this frame

Frame: https://sync.targeting.unrulymedia.com/csync/RX-5a2700a5-3640-400a-847c-ef0e2f66e962-003
Frame ID: A3DB006B1289F626527005DCB5B8A13C
Requests: 1 HTTP requests in this frame

Frame: https://sync.targeting.unrulymedia.com/csync/RX-5a2700a5-3640-400a-847c-ef0e2f66e962-003
Frame ID: 391D89791A1E04648DAD9797C36191FA
Requests: 1 HTTP requests in this frame

Frame: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Frame ID: A880990FED7D290F75CAB2EBACB1828A
Requests: 1 HTTP requests in this frame

Frame: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Frame ID: 7A4A1ADB7D5058397513A366E274F5DD
Requests: 1 HTTP requests in this frame

Frame: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Frame ID: 700FD3455781A97851B4A46FA6E69F2B
Requests: 1 HTTP requests in this frame

Frame: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Frame ID: 9641D27E886E94C5907D9D2D3586D411
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=unruly&endpoint=us-east
Frame ID: 61C0B735299B6D7DF56D1FB7AB245512
Requests: 3 HTTP requests in this frame

Frame: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Frame ID: 606755465C2D5B4854EBC26F23B55561
Requests: 1 HTTP requests in this frame

Frame: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Frame ID: 2BA1FDDEC88DF677BA42632F0F7E5E11
Requests: 1 HTTP requests in this frame

Frame: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Frame ID: CA5DE7ACB9F934FDA37285DD6764D1A6
Requests: 1 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcasale%2F&s=182257&C=1
Frame ID: FA19AE70EE2D7CFD16357BE29E67BE93
Requests: 10 HTTP requests in this frame

Frame: https://match.prod.bidr.io/cookie-sync/unr?_bee_ppp=1
Frame ID: 084361E65B1926FE3FE24B7AB2B22F9F
Requests: 1 HTTP requests in this frame

Frame: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: ABBB8C58E85C5F1AC937C42E2A494B8D
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeX3QEQoJjlARjk9t6sATAB&v=APEucNWUG6GfSsEH1iZ13hhilYA-gwb5SLsiGzbh0A1C05iT-MO2gJ7qDk0i_5V407Fd335ltvLMET_1qEJdcPEu2lGMV80HxXk19VZZE9feBRKVvKKNA06X2AeBS4mLCA4hbg2vK2tX37MUPA7ATDz3dndGj11EEWDfkF49A09LaF539gWSm3s8we2UxbfVbhWX9a3NWhemX20B6Px66TZVWPnh6wafaw
Frame ID: 6E6A5B80A78F86EA05937F2C77FE5F09
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: B593582C8DAC0DC49720DEEB580B9125
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: F171B2036CBD211E19E0368BF9A54CD9
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2
Frame ID: 81C71FB51F3887CC87A2BC1CDF58754E
Requests: 16 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js
Frame ID: 6FB51D5E45F757C9D17D028C13F4ACCA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://cdn-3.billofsale-form.com/ HTTP 301
https://www.billofsale-form.com/ Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

Page Statistics

206
Requests

99 %
HTTPS

36 %
IPv6

51
Domains

82
Subdomains

58
IPs

8
Countries

1414 kB
Transfer

3420 kB
Size

4
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: http://silktide.com/cookieconsent
Title: Cookie Consent plugin for the EU cookie law

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https://www.billofsale-form.com/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/home?status=Bill%20of%20Sale%20Form%20https://www.billofsale-form.com/
Title: Twitter

Search URL Search Domain Scan URL

URL: https://plusone.google.com/_/+1/confirm?hl=en&url=https://www.billofsale-form.com/&name=Bill%20of%20Sale%20Form
Title: Google +

Search URL Search Domain Scan URL

URL: https://pinterest.com/pin/create/button/?url=https://www.billofsale-form.com/&description=Bill%20of%20Sale%20Form&media=
Title: Pinterest

Search URL Search Domain Scan URL

URL: https://www.ezoic.com/what-is-ezoic/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://cdn-3.billofsale-form.com/ HTTP 301
https://www.billofsale-form.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 36

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.billofsale-form.com%2F&domain=www.billofsale-form.com&cw=1 HTTP 302
https://mug.criteo.com/sid?cpp=jb8VJXxhMEpCVjRla2FHakJINGM4aWxIRHVVSS9tRG9CYzN3QThsZkZXWldkQkZQa2FQRXJvenJKeDhwejdaMndsVzA4OTBHajI0V2YveFU0QW1vY0MrMW9GM0FWWS9GQjRLbEVDbmlWdUdTcURsNXRtZlhXMDE1Q1IwMFBOWmhGM2pZL2tpOXR1bnYrMGFDd3FPN1RGSGFzZy9hNmprMkVXM3VXbDgxZlJaK29NOUhPUVhBQnlLQlRvV0ZWWG85amMveFVWSXVOazFqUVJYWXlhZXM2ZHBJMG1BMXZ0dE5CazlZWWJaV2xPQXk0SVA3bHlSKzdSMlNWOGRPTWJJQmhUM2pCfA&cppv=2

Request Chain 96

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776 HTTP 301
https://eus.rubiconproject.com/usync.html?p=12776

Request Chain 98

https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid= HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid= HTTP 302
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=b6f164a9-416d-42f0-a4b7-af9b02b4aaa0

Request Chain 99

https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true HTTP 302
https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&apid=UPcf099639-cae7-11eb-8b64-028c3a1b4c64 HTTP 302
https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&apid=UPcf099639-cae7-11eb-8b64-028c3a1b4c64&verify=true HTTP 302
https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-euI1t8tE2uGMnZa8wHPUx.glbdA5fGbQ~A~UPcf099639-cae7-11eb-8b64-028c3a1b4c64

Request Chain 100

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://usr.undertone.com/userPixel/sync?partner=ttd&uid=41eaa05d-649d-4fb0-92c6-a7b0dc246c97&ttl=1626030252

Request Chain 102

https://cs.admanmedia.com/sync/undertone?url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3Fpartner%3Dacuityads%26uid%3D%24UID HTTP 302
https://usr.undertone.com/userPixel/sync?partner=acuityads&uid=e36be904e693c934fa5116d824d06c91ba9678e1

Request Chain 103

https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone.com%252FuserPixel%252Fsync%253FpartnerId%253D53%2526uid%253D%2523PMUID&rdf=1 HTTP 302
https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=2470380978946745063 HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?p=160318&pmc=1&pr=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D53%26uid%3D9D28E62D-A9A3-4CB6-8F9C-A9DE2FEA81BD HTTP 302
https://usr.undertone.com/userPixel/sync?partnerId=53&uid=9D28E62D-A9A3-4CB6-8F9C-A9DE2FEA81BD

Request Chain 109

https://x.bidswitch.net/sync?ssp=unrulyx HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=unrulyx HTTP 302
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dunrulyx HTTP 302
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dunrulyx HTTP 302
https://x.bidswitch.net/sync?dsp_id=59&user_id=85bb2fa8-99e1-4ec4-9c1d-8bcf594733a1&ssp=unrulyx HTTP 302
https://usermatch.targeting.unrulymedia.com/usermatch/iponweb/f9fbac6f-a60c-4d6d-b7e1-684ee2e6d7ce?gdpr=&gdpr_consent= HTTP 302
https://sync.1rx.io/usersync/bidswitch/f9fbac6f-a60c-4d6d-b7e1-684ee2e6d7ce?gdpr=&gdpr_consent= HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

Request Chain 110

https://csync.loopme.me/?redirect=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Floopme%2F%7Bdevice_id%7D HTTP 307
https://usermatch.targeting.unrulymedia.com/usermatch/loopme/4c0adc94-6e3b-4c6b-93d7-8bc7d5582a27 HTTP 302
https://sync.1rx.io/usersync/loopme/4c0adc94-6e3b-4c6b-93d7-8bc7d5582a27 HTTP 302
https://sync.1rx.io/usersync/loopme/4c0adc94-6e3b-4c6b-93d7-8bc7d5582a27?zcc=1&dspret=0&cb=1623438252570 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-5a2700a5-3640-400a-847c-ef0e2f66e962-003

Request Chain 111

https://cm.ctnsnet.com/int/cm?exc=23&redir=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcrimtan%2F%5Buser_id%5D HTTP 302
https://usermatch.targeting.unrulymedia.com/usermatch/crimtan/2d3beb493ad84232b2bba6509d5d1986 HTTP 302
https://sync.1rx.io/usersync/crimtan/2d3beb493ad84232b2bba6509d5d1986 HTTP 302
https://sync.1rx.io/usersync/crimtan/2d3beb493ad84232b2bba6509d5d1986?zcc=1&dspret=0&cb=1623438252570 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-5a2700a5-3640-400a-847c-ef0e2f66e962-003

Request Chain 112

https://secure.adnxs.com/getuid?https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fappnexus%2F%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fusermatch.targeting.unrulymedia.com%252Fusermatch%252Fappnexus%252F%2524UID HTTP 302
https://usermatch.targeting.unrulymedia.com/usermatch/appnexus/8632359127879155850 HTTP 302
https://sync.1rx.io/usersync/appnexus/8632359127879155850 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

Request Chain 113

https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fmediamath%2F%5BMM_UUID%5D HTTP 302
https://usermatch.targeting.unrulymedia.com/usermatch/mediamath/290460c3-b3ac-4a00-abf3-d5900e5999c7 HTTP 302
https://sync.1rx.io/usersync/mediamathtest/290460c3-b3ac-4a00-abf3-d5900e5999c7 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

Request Chain 114

https://sync-tm.everesttech.net/upi/pid/1cMuUcwh?redir=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fadobe%2F%24%7BTM_USER_ID%7D%3F HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/1cMuUcwh?redir=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fadobe%2F%24%7BTM_USER_ID%7D%3F&_test=YMOzrAABuGDxBQA4 HTTP 302
https://usermatch.targeting.unrulymedia.com/usermatch/adobe/YMOzrAABuGDxBQA4?&_test=YMOzrAABuGDxBQA4 HTTP 302
https://sync.1rx.io/usersync/adobe/YMOzrAABuGDxBQA4?&_test=YMOzrAABuGDxBQA4 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

Request Chain 115

https://match.adsrvr.org/track/cmf/generic?ttd_pid=unruly&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=unruly&ttd_tpi=1 HTTP 302
https://usermatch.targeting.unrulymedia.com/usermatch/tradedesk/07a0a9b4-68a9-4b7a-a363-1289796554cf HTTP 302
https://sync.1rx.io/usersync/tradedesk/07a0a9b4-68a9-4b7a-a363-1289796554cf HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

Request Chain 116

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=unruly&endpoint=us-east HTTP 301
https://eus.rubiconproject.com/usync.html?p=unruly&endpoint=us-east

Request Chain 117

https://sync.srv.stackadapt.com/sync?nid=41 HTTP 302
https://usermatch.targeting.unrulymedia.com/usermatch/stackadapt/hXG71nWxSwBm-IKq_Ncc4Fn5QNM HTTP 302
https://sync.1rx.io/usersync/stackadapt/hXG71nWxSwBm-IKq_Ncc4Fn5QNM HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

Request Chain 118

https://pr-bh.ybp.yahoo.com/sync/unruly/ HTTP 302
https://usermatch.targeting.unrulymedia.com/usermatch/oath/y-QHcNiC9E2oWRGjFvXjcXEeEnNiZPekTqQM1T~A HTTP 302
https://sync.1rx.io/usersync/verizon/y-QHcNiC9E2oWRGjFvXjcXEeEnNiZPekTqQM1T~A HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

Request Chain 119

https://bh.contextweb.com/bh/rtset?pid=560138&ev=1&daaqp=1&rurl=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fpulsepoint%2F%25%25VGUID%25%25 HTTP 302
https://usermatch.targeting.unrulymedia.com/usermatch/pulsepoint/rCas3EotCD55 HTTP 302
https://sync.1rx.io/usersync/pulse/rCas3EotCD55 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

Request Chain 120

https://ssum-sec.casalemedia.com/usermatch?s=182257&cb=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcasale%2F HTTP 302
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcasale%2F&s=182257&C=1

Request Chain 121

https://match.prod.bidr.io/cookie-sync/unr HTTP 303
https://match.prod.bidr.io/cookie-sync/unr?_bee_ppp=1

Request Chain 122

https://cms.quantserve.com/pixel/p-QcHdy7VcGLKJK.gif?idmatch=0 HTTP 302
https://sync.1rx.io/usersync/quantcast/etWf-C7Wnahh0pr8L9PR83iHzfJhhsX_eoY9PTkl?gdpr=1

Request Chain 123

https://cm.g.doubleclick.net/pixel?google_nid=unruly_dbm&google_cm&google_sc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=unruly_dbm&google_cm=&google_sc=&google_tc= HTTP 302
https://usermatch.targeting.unrulymedia.com/usermatch/google/CAESELHSRL0oWVyvcrIoRLIVfqc?google_cver=1 HTTP 302
https://sync.1rx.io/usersync/google/CAESELHSRL0oWVyvcrIoRLIVfqc?google_cver=1 HTTP 302
https://sync.1rx.io/usersync/google/CAESELHSRL0oWVyvcrIoRLIVfqc?zcc=1&dspret=0&cb=1623438252572 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

Request Chain 126

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YMOzrKHbpLreqAQQB4Ns4wAABHUAAAIB&gdpr_consent=&us_privacy=&gdpr=1 HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEMZR8nhDy_hziVtNiKPuU6Q&google_cver=1

Request Chain 127

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YMOzrKHbpLreqAQQB4Ns4wAABHUAAAIB HTTP 302
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YMOzrKHbpLreqAQQB4Ns4wAABHUAAAIB&dcc=t

Request Chain 129

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1 HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YMOzrKHbpLreqAQQB4Ns4wAA HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENo0yr7aicoXuEhSdvDiw8A&google_cver=1&gdpr=1

Request Chain 131

https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1 HTTP 302
https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1&prevuid=&knw=0 HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=

Request Chain 134

https://usermatch.targeting.unrulymedia.com/usermatch/casale/YMOzrKHbpLreqAQQB4Ns4wAA%261141 HTTP 302
https://sync.1rx.io/usersync/index/YMOzrKHbpLreqAQQB4Ns4wAA&1141 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

Request Chain 162

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENo0yr7aicoXuEhSdvDiw8A&google_cver=1

Request Chain 163

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMOzrKHbpLreqAQQB4Ns4wAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENo0yr7aicoXuEhSdvDiw8A&google_cver=1

Request Chain 164

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEFDI09SId3ZiyV8qJgv-Gdw&google_cver=1

Request Chain 165

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODYzMjM1OTEyNzg3OTE1NTg1MA%3D%3D

Request Chain 175

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEO4E_3xxPpSteLK8ArOmpFs&google_cver=1&google_push=AYg5qPLC7VTfAS6iWmc1OlvzN9C2NNkYC9Ba3m2vkMnks2Gxr6R_W37g5t4cpBzNjgkAxaL0e51VIcC39g7fbJlXZBqHPD6t7fM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzUxMDU3ODc3OTIzMDc5NzE3MA== HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEO4E_3xxPpSteLK8ArOmpFs&google_cver=1

Request Chain 176

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEC2tmPwHgpaCTVbdcavNuCg&google_cver=1&google_push=AYg5qPIvK0PX-tf8vq3gBK0MV5pbgDc8HyM2lBDnjfI8cj5ZMPTgMgnbdc3KBjicFSnXQI7SBz6735gpjRcw1aDDOyJmsJ7RI6Q HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=KQRgw7OsSgCr89WQDlmZxw&google_push=AYg5qPIvK0PX-tf8vq3gBK0MV5pbgDc8HyM2lBDnjfI8cj5ZMPTgMgnbdc3KBjicFSnXQI7SBz6735gpjRcw1aDDOyJmsJ7RI6Q

Request Chain 177

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESECxx3mgyXXVnK9NbkrN1W04&google_cver=1&google_push=AYg5qPK7WY_uoNfWGZuEU-i1wXQOXgzZEtwL0YKEg1sTUz19Yw-tl3vsdJbq5TBGc7f6hkFIzTpEwYnwLAcW2lChJBWtBeH90Fw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AYg5qPK7WY_uoNfWGZuEU-i1wXQOXgzZEtwL0YKEg1sTUz19Yw-tl3vsdJbq5TBGc7f6hkFIzTpEwYnwLAcW2lChJBWtBeH90Fw

Request Chain 178

https://px.adhigh.net/p/gm/rub?google_gid=CAESEPxdd34N83mThwthz1YY1Po&google_cver=1&google_push=AYg5qPLlpnDlL_tI-_5_PnHJCkOM4bQE4ZoTP-f9EnMR8I5aLbtqgQh3YSYZv0xIrQ-03z9nSKjUqONZruAVedQJeYcvmVUMEOc HTTP 302
https://px.adhigh.net/p/gm/rub?google_gid=CAESEPxdd34N83mThwthz1YY1Po&google_cver=1&google_push=AYg5qPLlpnDlL_tI-_5_PnHJCkOM4bQE4ZoTP-f9EnMR8I5aLbtqgQh3YSYZv0xIrQ-03z9nSKjUqONZruAVedQJeYcvmVUMEOc&bounced=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=gint&google_push=AYg5qPLlpnDlL_tI-_5_PnHJCkOM4bQE4ZoTP-f9EnMR8I5aLbtqgQh3YSYZv0xIrQ-03z9nSKjUqONZruAVedQJeYcvmVUMEOc&google_hm=bO64fe3PoHsAAikABlF5_HXmGg%3D%3D

Request Chain 179

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEIxWNdV3vW3jncf6UzLwu9k&google_cver=1&google_push=AYg5qPKlI5mGjrtn6rGXig3G1phjcwa5m4W5pvc2vjaNfqztMg_iFHctVII9OSX0cg6cHnRfXLI672g3J8e88ZHtO4f75kwVsA4 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPKlI5mGjrtn6rGXig3G1phjcwa5m4W5pvc2vjaNfqztMg_iFHctVII9OSX0cg6cHnRfXLI672g3J8e88ZHtO4f75kwVsA4&google_hm=NTgxMTc1OTEzMTgwNjUyNzc5NA%3D%3D

Request Chain 180

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEKYmpYnGYDosxl4sbwR2vHQ&google_cver=1&google_push=AYg5qPIpwGsN3jVTSsmETUC7uQEBMBoDu9t4K5GncW0o53CIlyJVeuKQSFSh-BGIL4k_ZBF128anCIBBD2Uo2z7o7_Da-TGBG0Q HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPIpwGsN3jVTSsmETUC7uQEBMBoDu9t4K5GncW0o53CIlyJVeuKQSFSh-BGIL4k_ZBF128anCIBBD2Uo2z7o7_Da-TGBG0Q

206 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.billofsale-form.com/
Redirect Chain

https://cdn-3.billofsale-form.com/
https://www.billofsale-form.com/

78 KB
20 KB

857ms
818ms

Document
text/html

2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab916a26cfa433b01d5e19e95418ed9d8d477638bc5d54c5cbf83808740b97e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: www.billofsale-form.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
content-type: text/html; charset=UTF-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
display: pub_site_sol
expires: Thu, 10 Jun 2021 19:04:08 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
pagespeed: off
response: 200
set-cookie: ezoadgid_26431=-1; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 19:34:08 UTC ezoref_26431=; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 21:04:08 UTC ezoab_26431=mod12-c; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 21:04:08 UTC active_template::26431=pub_site.1623438248; Path=/; Domain=billofsale-form.com; Expires=Sun, 13 Jun 2021 19:04:08 UTC ezopvc_26431=1; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 19:34:08 UTC ezepvv=0; Path=/; Domain=billofsale-form.com; Expires=Sat, 12 Jun 2021 19:04:08 UTC ezovid_26431=549026828; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 19:34:08 UTC lp_26431=https://www.billofsale-form.com/; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 19:34:08 UTC ezovuuidtime_26431=1623438248; Path=/; Domain=billofsale-form.com; Expires=Sun, 13 Jun 2021 19:04:08 UTC ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; Path=/; Domain=billofsale-form.com; Expires=Fri, 11 Jun 2021 19:34:08 UTC ezCMPCCS=true; Path=/; Domain=billofsale-form.com; Expires=Sat, 11 Jun 2022 19:04:08 GMT
strict-transport-security: max-age=31536000
vary: Accept-Encoding Cookie,Accept-Encoding
x-endurance-cache-level: 2
x-middleton-display: pub_site_sol
x-middleton-response: 200
x-sol: pub_site
cf-cache-status: DYNAMIC
cf-request-id: 0a9e0ee03e00004e920a145000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ZL%2BRwVaRlVNKuZq5WJLB5qBKa9YAwjNJljxcrepEQJWJyC6GXR9voW%2FC%2FZYjMAdTde61Y9rvqzDtShSGmjzINUH058SXyuOpbu%2B4rj%2BKmW1YXctam858xe%2BBtUtCzWgFLdfQ3UPlIytyEWIu6PLn10E%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 65dd1a79f8d34e92-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

date: Fri, 11 Jun 2021 19:04:07 GMT
content-type: text/plain; charset=utf-8
content-length: 0
cache-control: max-age=300, private
location: https://www.billofsale-form.com/
vary: Accept-Encoding Accept-Encoding
x-middleton-display: redirect
cf-cache-status: DYNAMIC
cf-request-id: 0a9e0edd3800004de84f224000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2FAHtif0BP1N9fmHSnrrF1g8g3o4MEGR5ibYtcxcecoFJtQOQbchhjGsU1u%2FaOzcH4OucN2RfVJU7L82KM%2F9ynyS69Z5QKn3JAogIV3axQIVP8gfHGAd7oMIcvOxKhRIURm2jHDInOohtT55bgfBTfpu9og%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 65dd1a752cd04de8-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 15ms
13ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 19:04:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 dall.js Show response
go.ezodn.com/hb/ 207 KB
60 KB 61ms
41ms Script
application/javascript 2606:4700:3035::6815:4c02
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/hb/dall.js?b=amx,oneVideo,pulsepoint,rhythmone,sovrn,undertone,unruly&cb=194-2-22
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:4c02 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bae8dfa26244bc5e96b7918f79c30a3c3f624dd4505bee6cf531fa633607a199

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 527387
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=dDBwnUkuUFeBgBm70J7x7FcUIn46AOzpW%2BmsF2EMECfRftSitr5LmbUludWtN9MCRs%2BGDDt%2FH3uvhL%2FoqQA1nPItvbSbIIgrNbAmtYCnLlwp17hyViiho8%2FZSbDqKbTp0oMx6jKH"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 65dd1a7f4e29e003-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee3890000e003970ca000000001

GET
H3-29 200 autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
www.billofsale-form.com/wp-content/cache/autoptimize/css/ 219 KB
38 KB 40ms
27ms Stylesheet
text/css 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2641613956457a058550707409ced955499e181d4756077e11a0fb1952fbf23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,Origin
cf-cache-status: HIT
x-sol: orig
age: 708033
cf-polished: origSize=225258
x-middleton-display: staticcontent_sol, orig_site_sol
strict-transport-security: max-age=31536000
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee38100004ebc7ebce000000001
response: 200
last-modified: Thu, 03 Jun 2021 13:37:14 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
x-endurance-cache-level: 2
content-type: text/css
x-middleton-response: 200
expires: Tue, 24 May 2022 14:23:35 GMT
cache-control: public, max-age=30672000, immutable
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=gkuQSWrXZWCslCr%2FwaGzneGxKURr7uPDExNEdkLqW4yU%2BCetjk%2BTmHD8rz%2F0p03Z25eTGqei%2Br9aQXVWte4Aypp2RQtsn9HH89QXOP9LkkeVQT2Klj89SJieGUiBVcyL7tA4XKPzrBcngEwpzZDL3Gs%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a7f3a1a4ebc-FRA
display: staticcontent_sol, orig_site_sol
cf-bgj: minify

GET
H3-29 200 autoptimize_42d98f84ce36d173334b58ae09fe2290.css
www.billofsale-form.com/wp-content/cache/autoptimize/css/ 3 KB
2 KB 52ms
40ms Stylesheet
text/css 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_42d98f84ce36d173334b58ae09fe2290.css

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

00a7f30cba5ffdca996801a316a2dd4d9a484c22240e32e4e302a2bfc16e1551

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/cache/autoptimize/css/autoptimize_42d98f84ce36d173334b58ae09fe2290.css
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,Origin
cf-cache-status: HIT
x-sol: orig
age: 708033
cf-polished: origSize=3226
x-middleton-display: staticcontent_sol, orig_site_sol
strict-transport-security: max-age=31536000
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee38700004ebc3bb3a000000001
response: 200
last-modified: Thu, 03 Jun 2021 10:11:16 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
x-endurance-cache-level: 2
content-type: text/css
x-middleton-response: 200
expires: Tue, 24 May 2022 14:23:35 GMT
cache-control: public, max-age=30672000, immutable
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=47drnayqlTyAsASt4yTS6sNFt6W%2BQ%2FrF6OvepNhJ3GaWKdUDVlgKhwCLnoLJ9fluTSB2qUaZ9LHJ3SLC4gkQh4Phl3uPCNoQgamvKXL2TBiZOkpucwKd3z5AQfvdr7SpYl2r3vECLy1zHCYvnkXPap4%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a7f3a204ebc-FRA
display: staticcontent_sol, orig_site_sol
cf-bgj: minify

GET
H2 200 css
fonts.googleapis.com/ 754 B
427 B 17ms
17ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Droid+Sans%3Aregular%2C700

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0665f5f3dfc038e410e2f0004a1a5ff6d2d91f392dd32208606eb8ff51195172

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 11 Jun 2021 17:19:00 GMT
server: ESF
date: Fri, 11 Jun 2021 19:04:08 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 11 Jun 2021 19:04:08 GMT

GET
H2 200 dmedianet.js Show response
contextual.media.net/ 155 KB
53 KB 110ms
66ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/dmedianet.js?cid=8CU4593V4

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

603da704faeac456353f4b9118e4a9f751f2cc770915e90eae69924c965eae70

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-mnt-h: 8-11
content-encoding: gzip
server: Apache
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
etag: "cd1206cb4ec8e00c8c84c9f539756370"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
date: Fri, 11 Jun 2021 19:04:08 GMT
strict-transport-security: max-age=604800
x-mnt-w: 8-7
expires: Fri, 11 Jun 2021 19:09:08 GMT

GET
H3-29 200 cookieconsent.min.js Show response
www.billofsale-form.com/ezoic/ 4 KB
2 KB 29ms
21ms Script
application/javascript 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/ezoic/cookieconsent.min.js
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10d4b728888654e0b85c706a9310b551087d3321fb8ebfff147d07b13fa73bf0

Request headers

:path: /ezoic/cookieconsent.min.js
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 269413
cf-ray: 65dd1a7f3a1d4ebc-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee38100004ebc5d030000000001
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
etag: W/"11a4-5c3cf8fc12640-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=OM2Ysahq6SVFeWC9Kdg3L9HwKLFEtVOrxRQVESq6mPtJ3slhH0EwzrVapRs0C%2BR1MARQZpvytz4308vOWXWrb8hkfkQOB6ECwoxXcIrClgxjDrt1jTUu%2BhvT3uIsGe4Z76EYrodF8%2Fk2YjZyEV3Mm9g%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex
expires: Wed, 08 Jun 2022 16:13:55 GMT

GET
H3-29 200 newlogo2.png
www.billofsale-form.com/wp-content/uploads/2015/08/ 3 KB
3 KB 35ms
32ms Image
image/png 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2015/08/newlogo2.png

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

385010b2baf8e0770b72bda5e96434d98bb716cfe29968e27a8eb51ee4ffde68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2015/08/newlogo2.png
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 269412
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee3d400004ebc39135000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/png
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=CCkUDsl4Z2WHGtFbnn6Ueo6qKTYBe9cqVzMONOQ8ZvIMdTY5j1fxfud5E1ZKQAyT%2B7vNDYtBaVG8OLVbStA7TiVopENyz2ZoxaGr1wg9AwXHcRox6V2Xo27k1ILmy5HOV4ArxMXeD8L4kCMCycCKCBU%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a7fbb9a4ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Thu, 08 Jul 2021 16:13:56 GMT

GET
H2 200 ezoic.png
go.ezoic.net/utilcave_com/img/ 1 KB
2 KB 73ms
20ms Image
image/png 2600:9000:211a:7600:2:cb38:840:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://go.ezoic.net/utilcave_com/img/ezoic.png
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211a:7600:2:cb38:840:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 02:36:22 GMT
via: 1.1 e77ae8cfd42b65dd9027fa08596c6f2a.cloudfront.net (CloudFront)
x-sol: middleton
age: 491266
x-cache: Hit from cloudfront
x-middleton-display: staticcontent_sol
content-length: 1181
x-amz-cf-id: VX664gq9oqMi8o3zRYrmoxPjcXXkWYak2k_lu_7XIfeMAXQzS3XQBg==
last-modified: Sun, 06 Jun 2021 01:06:26 GMT
server: nginx/1.16.0
etag: "49d-5bd497273b080-gzip-gzip"
vary: Accept-Encoding,Accept-Encoding
content-type: image/png
cache-control: max-age=604800
x-amz-cf-pop: VIE50-C2
display: staticcontent_sol
expires: Sun, 13 Jun 2021 02:36:22 GMT

GET
H3-29 200 autoptimize_f5ddbee1756ef961868f5222da593f8e.js Show response
www.billofsale-form.com/wp-content/cache/autoptimize/js/ 254 KB
84 KB 42ms
39ms Script
application/javascript 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.billofsale-form.com/wp-content/cache/autoptimize/js/autoptimize_f5ddbee1756ef961868f5222da593f8e.js

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

01d4dd3082ee2fa86ca800af378341f54e4980badbe1448ffd39d0e3bc98a7f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/cache/autoptimize/js/autoptimize_f5ddbee1756ef961868f5222da593f8e.js
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,Origin
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 708031
cf-polished: origSize=260429
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee3d400004ebc59013000000001
response: 200
last-modified: Thu, 03 Jun 2021 06:12:20 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: application/javascript
expires: Tue, 24 May 2022 14:23:36 GMT
cache-control: public, max-age=30672000, immutable
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=mmw7OPazKwd8hUAgAA34R3l1VC08aNuO0bbNYPMYmsyjNfY3ITp3L9lkHeZgL3Rk%2FfXmOrtVX9LE3SvhBwlPr2QmkGZ8Vhc4UOgTR%2BecbAcYYI8nA0gjS6ROKCIXru3x9s6NL%2Fml1SZiVcSD3gQ4sh8%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a7fbb9e4ebc-FRA
display: staticcontent_sol, staticcontent_sol
cf-bgj: minify

GET
H3-29 200 houston.js Show response
www.billofsale-form.com/detroitchicago/ 3 KB
2 KB 28ms
26ms Script
application/javascript 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/detroitchicago/houston.js?gcb=2&cb=36
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d6f7818a09adfc9c11ff7110eb866179ef9d36a3625cd1c02e23292d315daaa

Request headers

:path: /detroitchicago/houston.js?gcb=2&cb=36
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 703903
cf-ray: 65dd1a7fbba14ebc-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee3d500004ebc7c1d2000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=UbHuXbMmTPC0tyjK9pggTTu4uvndEVP6YIwXWTLncXdaCWJuuFFxaeoxDrmp8HKIIkI7eETWe%2BPBSxf6wyw0%2FRjYhtuPj4D%2By9svTxdrlUXbXEQXjki1H%2BlVHBTdgG9mp8QaU9eh2rCrtrGvR393UYU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 62 KB
22 KB 41ms
16ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

sffe /

Resource Hash

e5b7284af41e6241765d69c3925ee518e4182b73bc45adebb68d8e8f76e9d9ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "900 / 731 of 1000 / last-modified: 1623429367"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21612
x-xss-protection: 0
expires: Fri, 11 Jun 2021 19:04:08 GMT

GET
H3-29 200 banger.js Show response
www.billofsale-form.com/porpoiseant/ 43 KB
10 KB 28ms
26ms Script
application/javascript 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/banger.js?cb=194-2&bv=19&v=51&PageSpeed=off
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7aa8f89d9629c52abf1948b041e78560978a7f601876aa634852f0b2e58cbcf9

Request headers

:path: /porpoiseant/banger.js?cb=194-2&bv=19&v=51&PageSpeed=off
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 703903
cf-polished: origSize=44006
cf-ray: 65dd1a7fbba74ebc-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee3d500004ebc5d03b000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=vuBXa5WZUYuUwj7ZX7HVILnZo7xmBWhkWP8nDa6GI4orc1q7GHkbIasmFfESEbT%2BhlxDwhaV5kpilI429bdO16lA3i%2BNlltUd4xrThmnaVMCVv1msPjvlSMbM%2BqH2thod9URSmyG2TM60qLDVKo9zGE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex

GET
H3-29 200 wp-emoji-release.min.js Show response
www.billofsale-form.com/wp-includes/js/ 14 KB
5 KB 36ms
34ms Script
application/javascript 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.billofsale-form.com/wp-includes/js/wp-emoji-release.min.js

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-includes/js/wp-emoji-release.min.js
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,Origin
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 584711
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee3d700004ebc43386000000001
response: 200
last-modified: Fri, 04 Jun 2021 17:12:32 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: application/javascript
cache-control: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=H3NZVg1ZV3qI5L6pxEvkXORnTjO7LMCcHekYUwTBrPHuPI3MKK8t6krOJkXa12ZCFGjrT7DrhBe%2BYSNI7YnRSwqPwAR3lJ%2FvXQ6jcMVsT9UyL5dP2Ag%2B0HvCl2nteT%2FTQgp%2BhXYMzYYCZr2EJlxEGgA%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a7fbbab4ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 05 Jun 2022 00:38:57 GMT

GET
H2 200 ezosuigeneris.js Show response
g.ezoic.net/ 555 B
563 B 64ms
18ms Script
text/javascript 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/ezosuigeneris.js
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 4356da845489a8803ba9dae2128665643d3027ab424d43a0d07a3fc85f052132

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
content-encoding: br
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: nginx/1.16.0
etag: e617863740bc49da806b5df757fbe225
vary: Accept-Encoding, Accept-Encoding
content-type: text/javascript
cache-control: max-age=999999, private
content-length: 276
expires: Mon, 29 Apr 2020 21:44:55 GMT

GET
H3-29 200 cmbv2.js Show response
www.billofsale-form.com/detroitchicago/ 85 KB
21 KB 47ms
45ms Script
application/javascript 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c16267b73be934e47fa59b248a66488479092eef5d06d02977630f01b6015d6

Request headers

:path: /detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 246609
cf-polished: origSize=87117
cf-ray: 65dd1a7fbbae4ebc-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee3d800004ebc81bf0000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=0A%2BHKYoyBvP7bJg4oIEKnwyOvBcxg7pxY0vwFeo1otE%2BXjcjd0Sy31Rs8E%2BJI3wGIjh%2Fjj8j9WUax12BS7UNtcp4we0W9biWQ%2F%2FRviPdhfVGv8xZ1eNGHj8kUoMRc58tswHvoDn%2BPrIPIF8m%2FxqUf%2Fk%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex

GET
H3-29 200 body-bg7.png
www.billofsale-form.com/wp-content/themes/sahifa/images/patterns/ 21 KB
21 KB 28ms
26ms Image
image/png 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/themes/sahifa/images/patterns/body-bg7.png

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_42d98f84ce36d173334b58ae09fe2290.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a6ac6e588a725241e6f43feaad46fb36de9682576f5f29c570edc3ec5247477

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/themes/sahifa/images/patterns/body-bg7.png
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_42d98f84ce36d173334b58ae09fe2290.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_42d98f84ce36d173334b58ae09fe2290.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 269412
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee3d800004ebc2cb4b000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/png
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=GPuAEFT9xob3iMf0T6RahUBS2%2F2SJwDLLQ%2FPM3epiKcjlTNDVi1WDbzKaFx2eVtZX%2BqqpGenHsTHumzbhl7fOQNW%2BGmmGRDqcRV1bmDRaVe0qzaPgrJbejuV34HXclwqIrCRUtgixcKcwq4%2Bbh6ffc8%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a7fbbb14ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Thu, 08 Jul 2021 16:13:56 GMT

GET
H3-29 200 home.png
www.billofsale-form.com/wp-content/themes/sahifa/images/ 1022 B
2 KB 31ms
31ms Image
image/png 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/themes/sahifa/images/home.png

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6039cdb2c8028b73ddb9d711e7eb22834a8e11ba865283a7ed2fd2c75a401040

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/themes/sahifa/images/home.png
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 269412
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1022
cf-request-id: 0a9e0ee3db00004ebc583ee000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/png
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=EnQMjYehimS4ntpiRx4%2BA9RPsdcHG0Bs7TwZuVpqjBqIL%2FbiQrkYugvmYwz66yOee1Ba7iPrRuVnGriUi0mHksebYVcR1j5f4lqNABsDrwrAUejyBPOLydHcoqXD0%2Bfp8MxSdIm9kcYC1umDXirmgg4%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 65dd1a7fbbb34ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Thu, 08 Jul 2021 16:13:56 GMT

GET
H3-29 200 fontawesome-webfont.woff2
www.billofsale-form.com/wp-content/themes/sahifa/fonts/fontawesome/ 55 KB
56 KB 31ms
31ms Font
font/woff2 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.billofsale-form.com/wp-content/themes/sahifa/fonts/fontawesome/fontawesome-webfont.woff2?v=4.3.0

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-fetch-mode: cors
origin: https://www.billofsale-form.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true
:path: /wp-content/themes/sahifa/fonts/fontawesome/fontawesome-webfont.woff2?v=4.3.0
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://www.billofsale-form.com
Referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
strict-transport-security: max-age=31536000
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 269412
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee3d900004ebc73ace000000001
x-endurance-cache-level: 2
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: font/woff2
access-control-allow-origin: https://www.billofsale-form.com
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=R%2Foi%2BH9t47On5a9e5t8eCQXetFguubn0AmDB3c5Xdc2Q1lyoOM%2FIeKX1e6gkOjUM5jQ0RJMCElVQaPYFaHE74LuSmwmOzQwEldJsQkZLqrxs3VXqdTAT2S5ZfcHsfIdTHYkVinel4cY%2FDc%2BZf8o2vcU%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a7fbbb54ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Thu, 08 Jul 2021 16:13:56 GMT

GET
H2 200 SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2
fonts.gstatic.com/s/droidsans/v12/ 21 KB
21 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/droidsans/v12/SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3Aregular%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a615849237c0ce94e73fc69d86e5f9c58bdaca8d9756a5ff4c88fa86b14e6177

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.billofsale-form.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 15:28:30 GMT
x-content-type-options: nosniff
age: 272138
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21232
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 01:56:42 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 15:28:30 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 4214
date: Fri, 11 Jun 2021 17:53:54 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Fri, 11 Jun 2021 19:53:54 GMT

GET
H3-29 200 stripe.png
www.billofsale-form.com/wp-content/themes/sahifa/images/ 93 B
886 B 21ms
21ms Image
image/png 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/themes/sahifa/images/stripe.png

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

23c79bb552706be2ca97bdb259921e3269a5263326b147676c2f7909a45b58c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/themes/sahifa/images/stripe.png
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 269412
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 93
cf-request-id: 0a9e0ee40200004ebc3913a000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/png
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=zpicf4hPBGm%2BPpLh%2Fp7z%2BtZwioTDtepIjzjw7t9quJsBCRRcFE05aKD5kdG76fJYhJrThKW8QUlog9mTDXV%2B4iTcN05DMju9L9C10krrVuCYYhB5VWLK%2BFpMbgSxugXDMFkTwd%2FrktfQ5KfuGwza0AU%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 65dd1a800c604ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Thu, 08 Jul 2021 16:13:56 GMT

GET
H3-29 200 BebasNeue-webfont.woff
www.billofsale-form.com/wp-content/themes/sahifa/fonts/BebasNeue/ 20 KB
20 KB 15ms
14ms Font
font/woff 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.billofsale-form.com/wp-content/themes/sahifa/fonts/BebasNeue/BebasNeue-webfont.woff

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e8c2e4d6ab0ad2f055a6cc3c777d31531e665758db5ca815f2613afad72f7088

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-fetch-mode: cors
origin: https://www.billofsale-form.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
:path: /wp-content/themes/sahifa/fonts/BebasNeue/BebasNeue-webfont.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://www.billofsale-form.com
Referer: https://www.billofsale-form.com/wp-content/cache/autoptimize/css/autoptimize_a934aaa6f8f555c3987f7bb9a8ce95e8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:08 GMT
strict-transport-security: max-age=31536000
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 703902
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee40300004ebc5fbcb000000001
x-endurance-cache-level: 2
response: 200
last-modified: Thu, 03 Jun 2021 02:12:46 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: font/woff
access-control-allow-origin: https://www.billofsale-form.com
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=D48BKu849G7ipmH6RY5HmpHPhb7%2F0%2FP8nHpL3UwwMK4zuhV9aoVRHO8xjCI7L20Sx%2Bv%2FQOvf2QKYbeT1wd7IMugCBmvNp%2F5lXF8m8sI3Hm3IH8zyVJk2hZV%2BxBBjXgvbYRfYctdNevuINQG9aa9MVGs%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a800c674ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sat, 03 Jul 2021 15:32:25 GMT

GET
H3-29 200 SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2
fonts.gstatic.com/s/droidsans/v12/ 22 KB
22 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/droidsans/v12/SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3Aregular%2C700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

06c572e99c878362d40d1f358efdfe400ae1310f35cf22174dcdd5db022dd810

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.billofsale-form.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 23:06:08 GMT
x-content-type-options: nosniff
age: 244680
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22340
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 02:52:18 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 23:06:08 GMT

GET
H3-29 200 feature_homepage2.jpg
www.billofsale-form.com/wp-content/uploads/2012/06/ 8 KB
8 KB 31ms
29ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/06/feature_homepage2.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9d391cff26c4263fb63bd1ec57cb0cbd9c9693a4e7f6c8451d073438f2a6bd6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/06/feature_homepage2.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 450463
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee43100004ebc7ebde000000001
response: 200
last-modified: Sun, 06 Jun 2021 09:11:29 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=BGAVfGSuaLc9SgiuYKqIpq9YCqS4oRkv0qHB6Gjd2w9i1Snesh4CbLaPjhmBvdLshlSpVkqHT55%2Bb3x262KUN8eb0zBpluvRQiw5UULUES1ifHyYjYhkBb21cH4flUwFb8Mhc4FcP%2FhOSEzBHSQ3NyI%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a804d244ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Tue, 06 Jul 2021 13:56:26 GMT

GET
H3-29 200 billofsaleform.jpg
www.billofsale-form.com/wp-content/uploads/2012/06/ 6 KB
7 KB 18ms
15ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/06/billofsaleform.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2bf593112504d6cf7ef713e8648777ba85e0cf0fe4930933960d83ce041b19dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/06/billofsaleform.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 18075
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee43200004ebc52b51000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=QCnWrhbfk9gP24AXW8SNXGZjffdD%2FQlO2VrfWXVuM8%2Bf1EYxA54cjZq%2BevPVbyEMUz%2FYkH0TrnrAquxuZBRSlqfSr7HeeJRhovECt9s53BKKyMMzNSV9HXNow%2FcYaALRabWDH%2FzTUkI27K%2BLMl%2BiSro%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a804d294ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 14:02:54 GMT

GET
H3-29 200 auto-bill-of-sale-form-thumb-310x190.jpg
www.billofsale-form.com/wp-content/uploads/2012/06/ 10 KB
11 KB 19ms
17ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/06/auto-bill-of-sale-form-thumb-310x190.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f563769bc10d7f4f9daad8c0992d4749482a80ad5bafd4fda3024655a108aa9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/06/auto-bill-of-sale-form-thumb-310x190.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 18075
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee43200004ebc73ad7000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=HhWfa%2B%2FZIvVZfOAwZi5s7HuJq9RgvxhJ0pyllcAOpDaET08jf9VLodEeCnTTAmUmkclfYYCObF2bwDi392pHgFCPi0kJZpX3y2sbx%2BygURwULYLMmDcji7nD4AkVmYIDRD79Dq%2BStL2Ais4D7505nGk%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a804d2d4ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 14:02:54 GMT

GET
H3-29 200 used-car-bill-of-sale-form-thumb-310x190.jpg
www.billofsale-form.com/wp-content/uploads/2012/06/ 9 KB
10 KB 22ms
20ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/06/used-car-bill-of-sale-form-thumb-310x190.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5d4535cc978de1c946554320f48b5b816ebe04e7de3408c9affccb277625138

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/06/used-car-bill-of-sale-form-thumb-310x190.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 18075
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee43300004ebc533e5000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=sMUoU1Xxu6u60RnwjqwrwzhLPUcbCmTEXe5XAh50mFmry7eCgmbb8fzseDHA4IQ7SDPReMJO0nZeY%2BU4hVh8BJXS9F6ybbGQAiftiasCWoY9cQKIxezPYbXXX2B3Mb78s7dyHESATKD81bb7bJDdfqs%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a804d304ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 14:02:54 GMT

GET
H3-29 200 motor-vehicle-bill-of-sale-form-thumb-310x191.jpg
www.billofsale-form.com/wp-content/uploads/2012/06/ 13 KB
13 KB 23ms
21ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/06/motor-vehicle-bill-of-sale-form-thumb-310x191.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

661cbae1050193b339c2f4753348eee3b11a0fe3c8c6b3954426b7cf347cabd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/06/motor-vehicle-bill-of-sale-form-thumb-310x191.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 450463
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee43400004ebc6c815000000001
response: 200
last-modified: Sun, 06 Jun 2021 13:12:22 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=QRctEWxZgHdSQIV6kiqxEu4%2FORHAV0zEUFNEUW3eKuqtvXz5qsCjM562Ok4vY%2FjX4wDQl0XWIedE%2F%2Fgeih9LIigTXyoAQvTeHmNuWCsg1A6EB%2BWDUEeLDVUnLW4cWhnTCwwemnCswGl%2BbsYAZ5F9jBg%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a804d344ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Tue, 06 Jul 2021 13:56:26 GMT

GET
H3-29 200 motorcycle-bill-of-sale-form-thumb1-310x190.jpg
www.billofsale-form.com/wp-content/uploads/2012/06/ 10 KB
11 KB 18ms
16ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/06/motorcycle-bill-of-sale-form-thumb1-310x190.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

202bd56541955467d5f146d2327d07cf24d15c1a4cec190b4422e0b05e6aa521

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/06/motorcycle-bill-of-sale-form-thumb1-310x190.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 18075
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee43400004ebc5fbd1000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=aKKAZG7rgD1I%2BPzNZlknONP4Qqrhwx5sY8fMgAkJ2CHJEvkiK8YFBhohoHZFP49voodWXEpvhB0oeCJz6EiA45xePq9gKwvld1TyGO1jt0SNobQ%2BWJOWUFHsuks0UMoq3h9YWfEM96kqSZ%2Bv98mzuRk%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a804d384ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 14:02:54 GMT

GET
H3-29 200 general-bill-of-sale-form-thumb-310x190.jpg
www.billofsale-form.com/wp-content/uploads/2012/07/ 8 KB
9 KB 23ms
21ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/07/general-bill-of-sale-form-thumb-310x190.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1a93848c085efc9f585f788e97acaccd8e4b19ea4b81e1b82c72900a53d233a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/07/general-bill-of-sale-form-thumb-310x190.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 18075
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee43700004ebc4a83e000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=5m0UU0zx8MfYhUR07Z9GihLUHpUuQe0PXP0fl49CwlLebjaSboIuMO1WwIDt%2Fy7ZRnCybByZnmgrc7dfm29xckhiUvTqJ1YJBVtIrl14vwCOmUSQqlyGc%2FjdDgG0OJ%2BI3YlTAKJL9B7gc3CI39xnXLM%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a804d3f4ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 14:02:54 GMT

GET
H3-29 200 blank-bill-of-sale-form-thumb-310x190.jpg
www.billofsale-form.com/wp-content/uploads/2012/06/ 6 KB
6 KB 24ms
22ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/06/blank-bill-of-sale-form-thumb-310x190.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9fdb19a71e00bb21dfedda32adce5776cf86de33a1b4b2aebafdbd6f94cebc88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/06/blank-bill-of-sale-form-thumb-310x190.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 18075
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee43700004ebc4fb1b000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ZEBuF67u2OYY1Nbsb1yXPRIeQpDMUaX5VruLHMXVr9lMihwgpMHxxbll4HOoFsrlc8Dyq0oE0tJhgl04rx2gpUdwJVsg2insFc11XA2HsNXvo9ZezSTHoYuOBVGrKhAXzg30e6iKI%2FblR%2F64RuHWgN4%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a804d444ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 14:02:54 GMT

GET
H3-29 200 equine-bill-of-sale-form-thumb-310x191.jpg
www.billofsale-form.com/wp-content/uploads/2012/07/ 16 KB
17 KB 25ms
23ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/07/equine-bill-of-sale-form-thumb-310x191.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6f57fd658644f23df86a2b6859fb3a01831bc41d99c9cb6a38ecf0641d89a722

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/07/equine-bill-of-sale-form-thumb-310x191.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 18075
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee43700004ebc3bb49000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=cof4LuP5gSc%2BzjgCe%2FlH8J5qxtrXXkAXsernGOWUc40wtDkcvJKSLtFPIh21a0hUaLNdLRvVE9Yozf4v%2FddzQgfi8QS8pFfuRiBjcW9eIwFcM4K5IGHFfkD%2FpgqFZKuq7VKun2MsxFkfoBy%2FZMYI%2FQg%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a804d4a4ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 14:02:54 GMT

GET
H3-29 200 gun-bill-of-sale-form-thumb-310x190.jpg
www.billofsale-form.com/wp-content/uploads/2012/07/ 9 KB
10 KB 24ms
23ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/07/gun-bill-of-sale-form-thumb-310x190.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b113cf7d5e8230f2c635ef644ee8ab1533228b80b42d953bc6ca10ec2d2a8cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/07/gun-bill-of-sale-form-thumb-310x190.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 18075
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee43800004ebc5d048000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=nU1FfQfGjUVpc3eHBRQ5nATeCIgr1q8WQVluDsvjsefVfDB6IEzfZz2XSQYFuRwxpBudg92jW90m%2BW3yeKnQhVPP4i%2BpJ7dps0e9LeILP1KYx8B7kn%2Fclp6e%2FuikC8qvy0f2BzWFyqQpDtxF4EE58uM%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a804d504ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 14:02:54 GMT

GET
H3-29 200 trailer-bill-of-sale-thumb-310x190.jpg
www.billofsale-form.com/wp-content/uploads/2012/06/ 7 KB
7 KB 30ms
28ms Image
image/jpeg 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.billofsale-form.com/wp-content/uploads/2012/06/trailer-bill-of-sale-thumb-310x190.jpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4763390e1fc67cffdd08fc8b11ab860e91725eb864db4df971d878f1d570fe04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2012/06/trailer-bill-of-sale-thumb-310x190.jpg
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
vary: Accept-Encoding Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 10292
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee43800004ebc7ebdf000000001
response: 200
last-modified: Wed, 02 Jun 2021 21:58:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
x-endurance-cache-level: 2
content-type: image/jpeg
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=osxOh%2BoxiOgbwt%2BRKHEQa6yv6irGq2iSEb%2FVJF0u9G6qYM%2FFTXQYsLmPGZ%2Bjh0m02FXTFHdCZatwkIGNN1AEZF4lYNFFuqyl6oUExBV3ywfT4o2VJL3sS5XXkYtzAgngEZPSuDn7yz4LZAyJ6pqTMkI%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 65dd1a804d544ebc-FRA
display: staticcontent_sol, staticcontent_sol
expires: Sun, 11 Jul 2021 16:12:37 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 69ms
23ms Preflight
application/json 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.billofsale-form.com%2F&domain=www.billofsale-form.com&cw=1

Protocol

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://www.billofsale-form.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: https://www.billofsale-form.com
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1923
date: Fri, 11 Jun 2021 19:04:08 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.billofsale-form.com%2F&domain=www.billofsale-form.com&cw=1
https://mug.criteo.com/sid?cpp=jb8VJXxhMEpCVjRla2FHakJINGM4aWxIRHVVSS9tRG9CYzN3QThsZkZXWldkQkZQa2FQRXJvenJKeDhwejdaMndsVzA4OTBHajI0V2YveFU0QW1vY0MrMW9GM0FWWS9GQjRLbEVDbmlWdUdTcURsNXRtZlhXMDE1Q1IwMF...

350 B
632 B

65ms
22ms

XHR
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=jb8VJXxhMEpCVjRla2FHakJINGM4aWxIRHVVSS9tRG9CYzN3QThsZkZXWldkQkZQa2FQRXJvenJKeDhwejdaMndsVzA4OTBHajI0V2YveFU0QW1vY0MrMW9GM0FWWS9GQjRLbEVDbmlWdUdTcURsNXRtZlhXMDE1Q1IwMFBOWmhGM2pZL2tpOXR1bnYrMGFDd3FPN1RGSGFzZy9hNmprMkVXM3VXbDgxZlJaK29NOUhPUVhBQnlLQlRvV0ZWWG85amMveFVWSXVOazFqUVJYWXlhZXM2ZHBJMG1BMXZ0dE5CazlZWWJaV2xPQXk0SVA3bHlSKzdSMlNWOGRPTWJJQmhUM2pCfA&cppv=2

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

ec5c4259535bfa76fa1049a4a8a06f3232d13bee8af0c3575e8b2cdd70be3f7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Fri, 11 Jun 2021 19:04:08 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2502
expires: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Fri, 11 Jun 2021 19:04:09 GMT
location: https://mug.criteo.com/sid?cpp=jb8VJXxhMEpCVjRla2FHakJINGM4aWxIRHVVSS9tRG9CYzN3QThsZkZXWldkQkZQa2FQRXJvenJKeDhwejdaMndsVzA4OTBHajI0V2YveFU0QW1vY0MrMW9GM0FWWS9GQjRLbEVDbmlWdUdTcURsNXRtZlhXMDE1Q1IwMFBOWmhGM2pZL2tpOXR1bnYrMGFDd3FPN1RGSGFzZy9hNmprMkVXM3VXbDgxZlJaK29NOUhPUVhBQnlLQlRvV0ZWWG85amMveFVWSXVOazFqUVJYWXlhZXM2ZHBJMG1BMXZ0dE5CazlZWWJaV2xPQXk0SVA3bHlSKzdSMlNWOGRPTWJJQmhUM2pCfA&cppv=2
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1597
content-length: 509
expires: 0

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ 0
224 B 73ms
23ms XHR
application/json 18.192.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oneVideo,pulsepoint,rhythmone,sovrn,undertone,unruly&cb=194-2-22
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.192.15.110 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-192-15-110.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.billofsale-form.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ 0
224 B 280ms
228ms XHR
application/json 18.192.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oneVideo,pulsepoint,rhythmone,sovrn,undertone,unruly&cb=194-2-22
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.192.15.110 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-192-15-110.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.billofsale-form.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
767 B 55ms
23ms XHR
application/json 72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.27.0
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oneVideo,pulsepoint,rhythmone,sovrn,undertone,unruly&cb=194-2-22
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx /
Resource Hash: 8984590d4b780e7b0071ff24d23cc54ecc2d15f738524d943812b220b0f9a9e8

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 11 Jun 2021 19:04:09 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding, Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://www.billofsale-form.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

POST
H2 204 ortb Show response
bid.contextweb.com/header/ 0
513 B 291ms
96ms XHR
text/plain 198.148.27.133
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL: https://bid.contextweb.com/header/ortb?src=prebid
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oneVideo,pulsepoint,rhythmone,sovrn,undertone,unruly&cb=194-2-22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.148.27.133 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
server: envoy
cwdl: 22/148,22/148
access-control-allow-origin: https://www.billofsale-form.com
access-control-expose-headers: Access-Control-Allow-Origin
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
cw-server: bid-deployment-5fcfb8b64b-66bls

POST
H2 204 prebid Show response
targeting.unrulymedia.com/ 0
179 B 51ms
20ms XHR
text/plain 213.19.147.42
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/prebid
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oneVideo,pulsepoint,rhythmone,sovrn,undertone,unruly&cb=194-2-22
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.42 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.billofsale-form.com
pragma: no-cache
date: Fri, 11 Jun 2021 19:04:09 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
server: Tengine

POST
H2 204 mvo Show response
tag.1rx.io/rmp/215626/0/ 0
179 B 257ms
226ms XHR
text/plain 213.19.147.42
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.1rx.io/rmp/215626/0/mvo?z=1r&hbv=4.27,2.1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oneVideo,pulsepoint,rhythmone,sovrn,undertone,unruly&cb=194-2-22
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.42 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.billofsale-form.com
pragma: no-cache
date: Fri, 11 Jun 2021 19:04:09 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
server: Tengine

POST
H2 200 c Show response
prebid.a-mo.net/a/ 861 B
789 B 306ms
117ms XHR
application/json 136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oneVideo,pulsepoint,rhythmone,sovrn,undertone,unruly&cb=194-2-22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 Secaucus, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 890e0090ae6817e59c39a34765662ad440b9067f9b02c74db24bb70fd9eb29d2

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 24
content-length: 354

POST
H2 204 hb Show response
hb.undertone.com/ 0
454 B 207ms
140ms XHR
text/plain 13.32.2.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.undertone.com/hb?pid=4009&domain=billofsale-form.com
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oneVideo,pulsepoint,rhythmone,sovrn,undertone,unruly&cb=194-2-22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.2.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-2-39.vie50.r.cloudfront.net
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:08 GMT
via: 1.1 39103e0eac16074bdce5f23fa11c3dcc.cloudfront.net (CloudFront)
server: istio-envoy
x-amz-cf-pop: VIE50-C2
x-cache: Miss from cloudfront
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV"
access-control-allow-origin: https://www.billofsale-form.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
x-envoy-upstream-service-time: 4
x-amz-cf-id: WqXQpG4QKOCJr1sqC3_PbK2aS4FFy5Q0yvbK495jY8qpwgynm6A2Dw==
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 13ms
13ms XHR
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=566070678&t=pageview&_s=1&dl=https%3A%2F%2Fwww.billofsale-form.com%2F&ul=en-us&de=UTF-8&dt=Bill%20of%20Sale%20Form&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1145679264&gjid=2042465592&cid=1441411795.1623438249&tid=UA-978532-51&_gid=1063163387.1623438249&_r=1&_slc=1&z=1426182450

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:09 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 nmash.js
www.billofsale-form.com/porpoiseant/ 33 KB
9 KB 19ms
19ms Other
application/javascript 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/nmash.js?v=19
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9ceb55dc61f4a59d76a175754dd840f84a3d4e5e3b4797690ecea8fa8bf89cf

Request headers

:path: /porpoiseant/nmash.js?v=19
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; ezouspvv=0; ezouspva=0; _pbjs_userid_consent_data=3524755945110770; _ga=GA1.2.1441411795.1623438249; _gid=GA1.2.1063163387.1623438249; _gat=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: same-origin
accept: */*
cache-control: no-cache
sec-fetch-dest: worker
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 703904
cf-polished: origSize=34125
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee48f00004ebc2cb62000000001
x-robots-tag: noindex
last-modified: Fri, 28 May 2021 04:19:14 GMT
server: cloudflare
etag: W/"854d-5c35c2da8d480;5c3d8f5e745e1-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=1TGRJ%2B9WP8oSDG1GNHczndKiGJ381KEzVYVnGqL9lElehcZhVupRKEZvkNRynop1%2BBiaZ1wNAuh77DsFxn8bVycM34%2BShEqQqj9N6PQc2m3uUQYIIGUE85OmowPVvnCNC6wbwOPblPWYoRxUoR1JmiA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 65dd1a80ef374ebc-FRA
cf-bgj: minify

GET
H3-29 200 pubads_impl_2021061001.js Show response
securepubads.g.doubleclick.net/gpt/ 326 KB
114 KB 24ms
23ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

sffe /

Resource Hash

1ce69465fa2284194ab3ec822ee452307e2f4b4ab202499e24a06f8215b1ead1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 10 Jun 2021 08:39:38 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 116947
x-xss-protection: 0
expires: Fri, 11 Jun 2021 19:04:09 GMT

GET
H3-29 200 imp.gif Show response
www.billofsale-form.com/detroitchicago/ 43 B
685 B 36ms
36ms XHR
image/gif 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A0%2C%22ad_count_adjustment%22%3A1%2C%22ad_lazyload_version%22%3A5%2C%22ad_load_version%22%3A0%2C%22ad_location_ids%22%3A%221%2C4%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A2%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A2%2C%22city%22%3A%22%22%2C%22country%22%3A%22DE%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A2%2C%22domain_id%22%3A26431%2C%22domain_test_group%22%3A20210309%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A0%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22iab_category_0%22%3A%223000%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A0%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A3%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%221101%2C1112%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%225001f171-1244-4ebf-6abd-66ffbeebb533%22%2C%22position_selection_id%22%3A39%2C%22postal_code%22%3A%22%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A36124%2C%22response_time_orig%22%3A625%2C%22serverid%22%3A%2235.180.46.71%3A7471%22%2C%22state%22%3A%22%22%2C%22sub_page_ad_positions%22%3A%221101%2C1112%22%2C%22t_epoch%22%3A1623438248%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Fwww.billofsale-form.com%2F%22%2C%22user_id%22%3A0%2C%22weather_precipitation%22%3A0%2C%22weather_summary%22%3A%22%22%2C%22weather_temperature%22%3A0%2C%22word_count%22%3A1111%2C%22worst_bad_word_level%22%3A0%7D
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:path: /detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A0%2C%22ad_count_adjustment%22%3A1%2C%22ad_lazyload_version%22%3A5%2C%22ad_load_version%22%3A0%2C%22ad_location_ids%22%3A%221%2C4%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A2%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A2%2C%22city%22%3A%22%22%2C%22country%22%3A%22DE%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A2%2C%22domain_id%22%3A26431%2C%22domain_test_group%22%3A20210309%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A0%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22iab_category_0%22%3A%223000%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A0%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A3%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%221101%2C1112%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%225001f171-1244-4ebf-6abd-66ffbeebb533%22%2C%22position_selection_id%22%3A39%2C%22postal_code%22%3A%22%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A36124%2C%22response_time_orig%22%3A625%2C%22serverid%22%3A%2235.180.46.71%3A7471%22%2C%22state%22%3A%22%22%2C%22sub_page_ad_positions%22%3A%221101%2C1112%22%2C%22t_epoch%22%3A1623438248%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Fwww.billofsale-form.com%2F%22%2C%22user_id%22%3A0%2C%22weather_precipitation%22%3A0%2C%22weather_summary%22%3A%22%22%2C%22weather_temperature%22%3A0%2C%22word_count%22%3A1111%2C%22worst_bad_word_level%22%3A0%7D
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; ezouspvv=0; ezouspva=0; _pbjs_userid_consent_data=3524755945110770; _ga=GA1.2.1441411795.1623438249; _gid=GA1.2.1063163387.1623438249; _gat=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=TV48PdLbgFekQ7d46tDVju4%2FyZmfGI%2BBWNmvMuzlhuJ2hdwFnyQsyzNy0ZQ1up8ALccf4TlNLLJHPDZLQb40wNo7bZLFDQd5Mrp2GjMXEP4bqshf8Cn%2B8VK4YEkoC36iBCR3Nxrvo8kMJtf1vvSzJWQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-middleton-display: imp_sol
cache-control: no-cache, no-store, must-revalidate, max-age=0
accept-ranges: bytes
cf-ray: 65dd1a80ff914ebc-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 43
cf-request-id: 0a9e0ee4a000004ebc7c1f0000000001

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
9 KB 28ms
10ms Script
application/javascript 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
content-encoding: gzip
etag: "WhyxmPkT7L77qVDcrjxwGw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Fri, 18 Jun 2021 19:04:09 GMT

GET
H3-29 200 greenoaks.gif Show response
www.billofsale-form.com/detroitchicago/ 0
673 B 52ms
50ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MzgyNDgsImRhdGEiOlt7Im5hbWUiOiJkZXZpY2Vfd2lkdGgiLCJ2YWwiOiIxNjAwIn0seyJuYW1lIjoiZGV2aWNlX2hlaWdodCIsInZhbCI6IjEyMDAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MzgyNDgsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA2LTExIn0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMjEifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiNSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDM4MjQ4LCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MzgyNDgsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV9wcmltYXJ5X3N1YnRhZyIsInZhbCI6ImVuIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDM4MjQ4LCJkYXRhIjpbeyJuYW1lIjoidW5pdmVyc2FsX3VzZXJfaWQiLCJ2YWwiOiJlNjE3ODYzNzQwYmM0OWRhODA2YjVkZjc1N2ZiZTIyNSJ9XX1d
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MzgyNDgsImRhdGEiOlt7Im5hbWUiOiJkZXZpY2Vfd2lkdGgiLCJ2YWwiOiIxNjAwIn0seyJuYW1lIjoiZGV2aWNlX2hlaWdodCIsInZhbCI6IjEyMDAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MzgyNDgsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA2LTExIn0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMjEifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiNSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDM4MjQ4LCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MzgyNDgsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV9wcmltYXJ5X3N1YnRhZyIsInZhbCI6ImVuIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDM4MjQ4LCJkYXRhIjpbeyJuYW1lIjoidW5pdmVyc2FsX3VzZXJfaWQiLCJ2YWwiOiJlNjE3ODYzNzQwYmM0OWRhODA2YjVkZjc1N2ZiZTIyNSJ9XX1d
pragma: no-cache
cookie: ezoadgid_26431=-1; ezoref_26431=; ezoab_26431=mod12-c; active_template::26431=pub_site.1623438248; ezopvc_26431=1; ezepvv=0; ezovid_26431=549026828; lp_26431=https://www.billofsale-form.com/; ezovuuidtime_26431=1623438248; ezovuuid_26431=fea3fe1c-a8c4-4ec4-43ef-3836833daa8a; ezCMPCCS=true; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; ezouspvv=0; ezouspva=0; _pbjs_userid_consent_data=3524755945110770; _ga=GA1.2.1441411795.1623438249; _gid=GA1.2.1063163387.1623438249; _gat=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9e0ee4a000004ebc508fe000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=8NPXFxWTVIzougFVEY8K2clflHUI3RrU7CVMmtEeJu%2Fd0UXP%2FdIeux%2FRT0XioLB4Q89Dx5dYYfLAWfgF56%2BRMmykgMsZ59%2Bo6%2FdD5JobuFoqRZ6xJ6wMeTsDIx2Knt6YiBn5QZqeNAmQVb03E3RERlY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dd1a80ffa04ebc-FRA
expires: Thu, 10 Jun 2021 19:04:10 UTC

GET
H2 200 ezosuigenerisc.js Show response
g.ezoic.net/ 0
77 B 20ms
19ms Script
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/ezosuigenerisc.js?nogen=1
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
cache-control: max-age=300, private
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8

GET
H2 200 fcmain.js Show response
contextual.media.net/1017354394/ 87 KB
26 KB 453ms
451ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/1017354394/fcmain.js?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU4593V4&cpcd=pW0W2n1qzJZYY8yxiQBiyA%3D%3D&crid=661154765&size=600x250&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fwww.billofsale-form.com%2F&nse=5&vi=1623438248517474502&lw=1&ugd=4&nb=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU4593V4

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

000aa718fa3c1c7ae3fcd7884c2ac7606583e6c351626df7156b162ead404a61

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
x-mnt-hl2: 8-9
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=0, no-cache, no-store
date: Fri, 11 Jun 2021 19:04:09 GMT
x-mnt-w: 10-16
content-length: 26780
expires: Fri, 11 Jun 2021 19:04:09 GMT

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame C18F 14 KB
6 KB 55ms
55ms Document
text/html 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU4593V4&https=1&itype=CM

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

561cf1c701ba868c42bf72c8c58e6e35fe934798737dbd50f22bbca5072c751d

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

:method: GET
:authority: contextual.media.net
:scheme: https
:path: /checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU4593V4&https=1&itype=CM
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: gdpr_status=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

server: Apache
content-type: text/html; charset=UTF-8
set-cookie: gdpr_status=1; Expires=Mon, 13 Dec 2021 19:04:09 GMT; domain=.media.net; Path=/; sameSite=none; secure=true
x-mnet-hl2: E
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=172800
expires: Sun, 13 Jun 2021 19:04:09 GMT
date: Fri, 11 Jun 2021 19:04:09 GMT
content-length: 5607

GET
H2 200 fcmain.js Show response
contextual.media.net/1017354394/ 53 KB
13 KB 93ms
92ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/1017354394/fcmain.js?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU4593V4&cpcd=pW0W2n1qzJZYY8yxiQBiyA%3D%3D&crid=889045848&size=300x250&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fwww.billofsale-form.com%2F&nse=5&vi=1623438248367080728&lw=1&ugd=4&nb=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU4593V4

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

8a78dae412fd5399523846db8f14f9be73225a0558acbf605227bd858a963205

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
x-mnt-hl2: 8-9
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=0, no-cache, no-store
date: Fri, 11 Jun 2021 19:04:09 GMT
x-mnt-w: 8-11
content-length: 12793
expires: Fri, 11 Jun 2021 19:04:09 GMT

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 29C4 14 KB
6 KB 52ms
50ms Document
text/html 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU4593V4&https=1&itype=CM

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

561cf1c701ba868c42bf72c8c58e6e35fe934798737dbd50f22bbca5072c751d

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

:method: GET
:authority: contextual.media.net
:scheme: https
:path: /checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU4593V4&https=1&itype=CM
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: gdpr_status=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

server: Apache
content-type: text/html; charset=UTF-8
set-cookie: gdpr_status=1; Expires=Mon, 13 Dec 2021 19:04:09 GMT; domain=.media.net; Path=/; sameSite=none; secure=true
x-mnet-hl2: E
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=172800
expires: Sun, 13 Jun 2021 19:04:09 GMT
date: Fri, 11 Jun 2021 19:04:09 GMT
content-length: 5607

GET
H2 200 bping.php
lg3.media.net/ 35 B
189 B 44ms
36ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU4593V4&crid=661154765&vi=1623438248517474502&ugd=4&lf=6&cc=DE&sc=HE&lper=100&wsip=2886781032&r=1623438249143&requrl=https%3A%2F%2Fwww.billofsale-form.com%2F&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_rakh=1623438248139253920&vgd_rpth=%2Fdmedianet.js&vgd_pgid=p0229282536t202106111904&vgd_pgids=1&vgd_uspa=0&hvsid=00001623438249139015095070725520&gdpr=1&vgd_end=1

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 11 Jun 2021 19:04:09 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 11 Jun 2021 19:04:09 GMT

GET
H2 200 bping.php
lg3.media.net/ 35 B
189 B 45ms
38ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU4593V4&crid=889045848&vi=1623438248367080728&ugd=4&lf=6&cc=DE&sc=HE&lper=100&wsip=2886781032&r=1623438249157&requrl=https%3A%2F%2Fwww.billofsale-form.com%2F&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_rakh=1623438248139253920&vgd_rpth=%2Fdmedianet.js&vgd_pgid=p0229282536t202106111904&vgd_pgids=2&vgd_uspa=0&hvsid=00001623438249155015095070728377&gdpr=1&vgd_end=1

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 11 Jun 2021 19:04:09 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 11 Jun 2021 19:04:09 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 78ms
22ms Preflight
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: null
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1241
date: Fri, 11 Jun 2021 19:04:08 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H2 200 rules-p-31iz6hfFutd16.js Show response
rules.quantcount.com/ 3 B
430 B 65ms
20ms Script
application/javascript 2600:9000:211a:9200:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-31iz6hfFutd16.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211a:9200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 18:24:17 GMT
via: 1.1 c855d201fddbb6ef22989607fe8f5d1f.cloudfront.net (CloudFront)
age: 14019
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 19:50:24 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: VIE50-C2
accept-ranges: bytes
x-amz-cf-id: 7TpFG5qZTNJiuxLaJH86rqOsN-K0J_KkMf84WaYHLG5bK6Z1cYOeQQ==

GET
H3-29 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ 55 KB
21 KB 8ms
8ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

7929ef5b848609d4d5ef695261ede98df014607a3cc0d1eabacb2f503d838842

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 18:17:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2792
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21114
x-xss-protection: 0
server: cafe
etag: 11617696749572877616
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Fri, 11 Jun 2021 19:17:37 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 15ms
14ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 19:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 25ms
23ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 19:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 465 B
280 B 904ms
903ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3107597125158511&correlator=2016583659978830&output=ldjh&impl=fif&eid=31060784%2C31061161%2C31061279%2C31061429%2C31061200%2C21066613%2C21066615&vrg=2021061001&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&prev_scp=iid12%3D1169663%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C252%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dbillofsale_form_com-box-2-1169663%26eb_br%3D26dfa00588543c52511429ade391f561%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D550%26br2%3D260%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%252C117%252C120%252C67%252C51%252C116%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C815%2C817%2C899%2C903%2C919%2C782&cookie_enabled=1&bc=31&abxe=1&lmt=1622671121&dt=1623438249238&dlt=1623438248817&idt=387&frm=20&biw=1600&bih=1200&oid=3&adxs=308&adys=183&adks=3053355510&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&rumc=3107597125158511&rume=1&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90&msz=728x90&ga_vid=1441411795.1623438249&ga_sid=1623438249&ga_hid=566070678&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

680e69eec93ab478a82adc7021fca9f7588e9ead4285d6ae1c0c24907b49e308

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:10 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 250
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/ 0
0 48ms
14ms Other
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 475 B
289 B 1363ms
1362ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3107597125158511&correlator=2016583659978830&output=ldjh&impl=fif&eid=31060784%2C31061161%2C31061279%2C31061429%2C31061200%2C21066613%2C21066615&vrg=2021061001&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&prev_scp=iid13%3D1239263%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26a%3D%257C5%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dbillofsale_form_com-medrectangle-1-1239263%26eb_br%3D8b07bae800b215e481d05a271b3e723b%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D700%26br2%3D350%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%252C0%252C28%252C67%252C45%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C782&cookie_enabled=1&bc=31&abxe=1&lmt=1622671121&dt=1623438249244&dlt=1623438248817&idt=387&frm=20&biw=1600&bih=1200&oid=3&adxs=482&adys=5025&adks=3853710753&ucis=2&ifi=2&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&rumc=3107597125158511&rume=1&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x266&msz=300x250&ga_vid=1441411795.1623438249&ga_sid=1623438249&ga_hid=566070678&ga_fc=false&fws=0&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

1598f80d363db82c28ae8385d03f79fa08a5a830c5ce103b08c1d1bcd8267877

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:10 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 259
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 nrrV12042.js Show response
contextual.media.net/4a/ Frame 7D38 90 KB
29 KB 52ms
51ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/4a/nrrV12042.js

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU4593V4

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

98d453d14213adc82358775170098980cfdeab09e53543d0273924ad13cf77ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: max-age=2592000
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
etag: "8585939e10dc0d11d37aa63cdeaecdf8"
vary: Accept-Encoding
x-mnet-h: 8-11
content-type: text/javascript; charset=utf-8
cache-control: max-age=1209600
date: Fri, 11 Jun 2021 19:04:09 GMT
content-length: 29733
expires: Fri, 25 Jun 2021 19:04:09 GMT

GET
H/1.1 200
OK 10124_505bb4db55aaa1165fa3b242bf39701b.png
res-a.akamaihd.net/__media__/images/800000006/ Frame 7D38 4 KB
4 KB 95ms
30ms Image
image/png 2.16.186.89
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://res-a.akamaihd.net/__media__/images/800000006/10124_505bb4db55aaa1165fa3b242bf39701b.png
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.89 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-89.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 19:04:09 GMT
Last-Modified: Tue, 03 Oct 2017 12:52:51 GMT
Server: nginx
ETag: "59d38823-1001"
Content-Type: image/png
Cache-Control: public, max-age=1195726
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4097
Expires: Fri, 25 Jun 2021 15:12:55 GMT

GET
H/1.1 200
OK Oswald_Demibold.woff
res-a.akamaihd.net/__media__/fonts/Oswald_Demibold/ Frame 7D38 27 KB
27 KB 130ms
66ms Font
application/font-woff 2.16.186.89
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/Oswald_Demibold/Oswald_Demibold.woff
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.89 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-89.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: d5b724b7fcc373e0d4b583817d46310f7c5d92c59209d183d24f0b27ae119cf8

Request headers

Origin: https://www.billofsale-form.com
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 19:04:09 GMT
Last-Modified: Mon, 16 May 2016 10:39:41 GMT
Server: nginx
ETag: "5739a36d-6b78"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 27512

GET
H2 200 pixel;r=1033534631;labels=Domain.billofsale_form_com%2CDomainId.26431;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fwww.billofsale-form.com%2F;uht=2;fpan=1;fpa=P0-1812266074-1623438249278;pbcn=u;pbc=;ns...
pixel.quantserve.com/ 35 B
372 B 12ms
11ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1033534631;labels=Domain.billofsale_form_com%2CDomainId.26431;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fwww.billofsale-form.com%2F;uht=2;fpan=1;fpa=P0-1812266074-1623438249278;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=82efd7d8-20210517233434;cm=;gdpr=0;ref=;d=billofsale-form.com;je=0;sr=1600x1200x24;dst=1;et=1623438249278;tzo=-120;ogl=title.Bill%20of%20Sale%20Form%2Ctype.website%2Cdescription.Free%20Bill%20of%20Sale%20Form%20at%20Your%20Fingertips%20%252E%252E%252E%2Curl.https%3A%2F%2Fwww%252Ebillofsale-form%252Ecom%2F%2Csite_name.Bill%20of%20Sale%20Form%2Clocale.en_US%2Ctype.website%2Ctitle.Bill%20of%20Sale%20Form%2Cdescription.Are%20you%20looking%20for%20bill%20of%20sale%20form%20to%20complete%20paper%20work%20of%20your%20sales%20trans%2Curl.https%3A%2F%2Fwww%252Ebillofsale-form%252Ecom%2F%2Csite_name.Bill%20of%20Sale%20Form%2Cimage.https%3A%2F%2Fwww%252Ebillofsale-form%252Ecom%2Fwp-content%2Fuploads%2F2012%2F06%2Ffeature_homepage2%252Ejpg

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:09 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1 200
OK OpenSans_Semibold.woff
res-a.akamaihd.net/__media__/fonts/OpenSans_Semibold/ Frame 7D38 21 KB
21 KB 92ms
30ms Font
application/font-woff 2.16.186.89
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://res-a.akamaihd.net/__media__/fonts/OpenSans_Semibold/OpenSans_Semibold.woff
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.89 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-89.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 2a354649f57a81405daccfd6b5785da5f73ba638f2db591992cb7b739dac3135

Request headers

Origin: https://www.billofsale-form.com
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 19:04:09 GMT
Last-Modified: Mon, 16 May 2016 10:39:41 GMT
Server: nginx
ETag: "5739a36d-54c8"
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21704

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 7D38 15 B
216 B 35ms
34ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?&vgd_l2type=setting&v=1&gdpr=1&hvsid=00001623438249155015095070728377&geo=50.12|8.68&dlper=25&lper=100&fp=oaU99tdnOWcz3R0ojHLEWON9KauzDunj2k6NcTTI-nm1kLvPtD1H87QYu3455LdPU7bapwQRtYyJ0XhLAzdQfskemhSxARFiXgc9dM5nBtlxtVxKlnXpf0eiH6MFIkFC&lpid=&tsid=1&q=&prv=&type=&ps=&cme=wKMzE5aEf1ApuFl23hQaxmA8JcP2NGpDBmayTeacTKMLhSDHC6YLRCihFeP1JEhB2uzhAxwYdYTQ82u3KsYb6XVI2mUmOYzBCY9__PiQXiAgG3IhIu5q6d_n9fqmqCdnQU9afMLOFSw-T1legm9PMfNd5AqU-OjnM5QCRgJsrLheHa71cCn4VxpeDDX6icJvfw1nBoiZeKY%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CsRBSg3CPSiQ%3D%7CYdjFvixrVaF8p8bRV2-VqgKNNqcmZ61nOSKd24xYWWiPBaBzzAZG6w%3D%3D%7CN7fu2vKt8_s%3D%7CuCwEv227vsAefnMtWo7CxKD6O4K1ea0y-ddYKR2GG239xhqq5-fO1-eOKQq61zKaxlTBqEUJbq4rV1X5b-LqhUPzhBR-QdUYiulkSSxWFszUpOYpkzmPRmrN6W7T_lqJdjfFeYU67ygxagcBbebjPjvjQ1BF052-VoINzpTWHnADzrLiFGsVVK0J6Sc0IdMEA8AApbeIWEw6RxupKTP9IK2nxFgGJFGa1F4UeX_KIBo%3D%7C&hint=&td=&cc=DE&wsip=2886781042&bca=0&ugd=4&vgd_chost=contextual.media.net&vgd_fcic=0&vgde_kbbh=WoNWNY&vgde_setid=NW&&rc=0&ksu=207&fdkt=341&kwd[]=Simple%20Used%20Car%20Bill%20of%20Sale&kwt[]=341&kbc[]=im3650188&kwp[]=1&kid[]=329935849&kbc2[]=sale%7C%7Cps%3D0.692%7C%7Crpc%3D0.44%7C%7Clvl%3D1.00&ktd[]=1126174801723648&kwd[]=RV%20Bill%20of%20Sale&kwt[]=307&kbc[]=31598&kwp[]=2&kid[]=152332466&kbc2[]=0%7C%7Cps%3D0.718%7C%7Crpc%3D0.38%7C%7Clvl%3D1.00&ktd[]=1128373841756416&kwd[]=Printable%20Bill%20of%20Sale%20Form&kwt[]=201&kbc[]=6d24202f90ae8fde103385c3c874ad2c.d2s&kwp[]=3&kid[]=23154062&kbc2[]=rps%3D0.03%7C%7Cr_c%3D0.28%7C%7Cp_r%3D0.09%7C%7Cc%3D703%7C%7Crpc%3D0.11%7C%7Clvl%3D1.00&ktd[]=1126174818304512&kwd[]=Download%20Bill%20of%20Sale&kwt[]=201&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=4&kid[]=8830116&kbc2[]=rps%3D0.03%7C%7Cr_c%3D0.11%7C%7Cp_r%3D0.24%7C%7Cc%3D-1198%7C%7Crpc%3D0.14%7C%7Clvl%3D1.00&ktd[]=1126174801527296&kwd[]=Printable%20Blank%20Bill%20of%20Sale%20Template&kwt[]=307&kbc[]=155596&kwp[]=5&kid[]=329967127&kbc2[]=0%7C%7Crps%3D0.03%7C%7Cr_c%3D0.28%7C%7Cp_r%3D0.09%7C%7Cc%3D604%7C%7Cps%3D0.718%7C%7Crpc%3D0.09%7C%7Clvl%3D1.00&ktd[]=2473918137088&rand=1623438249341&cid=8CU4593V4&vwid=1623438248367080728&vi=1623438248367080728&l3ch=1&slnkp=no&tdAdd[]=ib=0&vgd_uspa=0&vgd_sc=HE&vgd_l1rakh=1623438248139253920&vgd_lhl=743&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&sttm=1623438249155&upk=1623438249.24605&hvsid=00001623438249155015095070728377&verid=3121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&vgd_isiolc=1&npgv=1&pid=8POU88YO6&vgd_pgid=p0229282536t202106111904&matm=1623438249347&vgd_ltime=285&vgd_ltimesrc=2&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l3_sc=HE&vgd_l2ch=1&vgd_l1ch=1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_sbSup=1&vgd_l2wsip=2886781042&vgd_nrrsf=nrr&vgd_nrrv=12042&vgd_nrrs=12042&vgd_nrrmf=4a&vgd_cntrdt=AS%7CDIV-889045848%7CDIV&vgd_x_pos=999&vgd_y_pos=391&vgd_ren_page_h=5693&vgd_cty=FRANKFURT&vgd_l1hcsd=A11%7C3853&vgd_sethcsd=A9%7C3864&vgd_cfud=180403&vgd_is_amp=0&vgd_optout=0&vgd_ect=4g&vgd_rensize=290_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_mbr=1&vgd_l1rpth=%2Fdmedianet.js&vgd_pgids=2&requrl=https%3A%2F%2Fwww.billofsale-form.com&oRurl=http%3A%2F%2Fcdng%2Ffcmain.js%3F%26esi%3D1%26%26fvips%3D0%26vpf%3D000%26chost%3Dcontextual.media.net%26cb%3Dwindow._mNDetails.initAd%26%26gdpr%3D1%26cid%3D8CU4593V4%26cpcd%3DpW0W2n1qzJZYY8yxiQBiyA%253D%253D%26crid%3D889045848%26size%3D300x250%26cc%3DDE%26https%3D1%26vif%3D1%26requrl%3Dhttps%253A%252F%252Fwww.billofsale-form.com%252F%26nse%3D5%26vi%3D1623438248374576052%26lw%3D1%26ugd%3D4%26nb%3D1%26blacpfl%3D1%26baeFlag%3D0%26blapd%3D0%26isOffice%3D0&tdAdd[]=uiparams%3D%3Brend_w%3A290%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A5&vgd_end=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV12042.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 11 Jun 2021 19:04:09 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Fri, 11 Jun 2021 19:04:09 GMT

POST
H2 200 log
navvy.media.net/ Frame 7D38 807 B
980 B 178ms
154ms Ping
image/gif 34.102.149.62
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://navvy.media.net/log
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV12042.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.149.62 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 62.149.102.34.bc.googleusercontent.com
Software: Jetty(9.4.7.v20170914) /
Resource Hash: 0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:09 GMT
via: 1.1 google
server: Jetty(9.4.7.v20170914)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache,no-store
alt-svc: clear
content-length: 807
expires: Fri, 11 Jun 2021 19:04:09 GMT

GET
H2 200 nrrV12042.js Show response
contextual.media.net/4a/ Frame B521 90 KB
29 KB 38ms
37ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/4a/nrrV12042.js

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU4593V4

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

98d453d14213adc82358775170098980cfdeab09e53543d0273924ad13cf77ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: max-age=2592000
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
etag: "8585939e10dc0d11d37aa63cdeaecdf8"
vary: Accept-Encoding
x-mnet-h: 8-11
content-type: text/javascript; charset=utf-8
cache-control: max-age=1209600
date: Fri, 11 Jun 2021 19:04:09 GMT
content-length: 29733
expires: Fri, 25 Jun 2021 19:04:09 GMT

GET blank
/ Frame B521 0
0

GET
DATA 200
OK truncated
/ Frame B521 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame B521 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bql.php Show response
lg3.media.net/ Frame B521 15 B
216 B 32ms
31ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?&vgd_l2type=setting&v=1&gdpr=1&hvsid=00001623438249139015095070725520&geo=50.12|8.68&dlper=25&lper=100&fp=oaU99tdnOWcz3R0ojHLEWON9KauzDunj2k6NcTTI-nm1kLvPtD1H87QYu3455LdPSa89jDuAplbT6VikjH7kp9o7pKkWLydyGRs8pEAP1c8Q2t8nx2DpCDSCUwoCEMiOnIIdLagcslI%3D&lpid=&tsid=112&q=&prv=&type=&ps=&cme=Codd7iN8JH91xJ6zKDMNX6PXeDTM8xKpwfsi6w0KZWYXeCssISuEXbx4lHznm5m3JGCJIW94fO4PQpFzZL6qXlEWiwzXDyfuZtEDXwWK1pDktBZxe7GxBybx2YcKgjcyF8olLeZgzgrpfhSeEhfVU0QKkOv0Qrp5_d5gBFRizF9DpCVDt8dj1Au8PH7G2i61NurMaay2FQd59VM5VUEwfw%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CsRBSg3CPSiQ%3D%7CYdjFvixrVaF8p8bRV2-VqgKNNqcmZ61nOSKd24xYWWiPBaBzzAZG6w%3D%3D%7CN7fu2vKt8_s%3D%7CZCOy_GrKeFssavcKeCKBQRHqiI5mtz8l2O-3ZCqZHcaq39Uh-nLc9-5nqbnhhtfvcj9aP3Tp6qWWFdnF9v677YfqVhGnw5_JwV1jM_C9LIhKUOB7LcAbYWe-PSWlHPvIMYSh3h3Pe-MkxZ3fY_1bFTI82aDtRNamGSxUKAnJbjxoxfGoZMhR6XRJnIS-L9ki-M1PZWbCnSMEEGPcu4VBlvs24wJF5ZdUk0RBDejlQaE%3D%7C&hint=&td=&cc=DE&wsip=2887305298&bca=0&ugd=4&vgd_chost=contextual.media.net&vgd_fcic=0&vgde_kbbh=u9oNu9&vgde_setid=Nu9&&rc=0&ksu=207&fdkt=201&kwd[]=Printable%20Blank%20Bill%20of%20Sale%20Template&kwt[]=201&kbc[]=&kwp[]=1&kid[]=329967127&kbc2[]=o_r%3D0.39%7C%7Cp_r%3D0.42%7C%7Cl_r%3D138%7C%7Cc%3D1969%7C%7Crpc%3D0.09%7C%7Clvl%3D1.00&ktd[]=274894684672&kwd[]=Printable%20Bill%20of%20Sale%20Form&kwt[]=201&kbc[]=6d24202f90ae8fde103385c3c874ad2c.d2s&kwp[]=2&kid[]=23154062&kbc2[]=o_r%3D0.67%7C%7Cp_r%3D0.50%7C%7Cl_r%3D138%7C%7Cc%3D1370%7C%7Crpc%3D0.11%7C%7Clvl%3D1.00&ktd[]=1126174818304512&kwd[]=Free%20Trailer%20Bill%20Sale&kwt[]=232&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=3&kid[]=324692488&kbc2[]=0%7C%7Co_r%3D0.00%7C%7Cp_r%3D0.44%7C%7Cl_r%3D138%7C%7Cc%3D-1261%7C%7Cps%3D0.996%7C%7Crpc%3D0.09%7C%7Clvl%3D1.00&ktd[]=1126174818697984&kwd[]=Free%20General%20Bill%20of%20Sale&kwt[]=201&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=4&kid[]=208325539&kbc2[]=o_r%3D0.33%7C%7Cp_r%3D0.10%7C%7Cl_r%3D42%7C%7Cc%3D-1607%7C%7Crpc%3D0.12%7C%7Clvl%3D1.00&ktd[]=1126174801527296&kwd[]=Basic%20Blank%20Bill%20of%20Sale&kwt[]=232&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=5&kid[]=329967124&kbc2[]=0%7C%7Co_r%3DNaN%7C%7Cp_r%3D0.44%7C%7Cl_r%3D138%7C%7Cc%3D-2312%7C%7Cps%3D0.996%7C%7Crpc%3D0.09%7C%7Clvl%3D1.00&ktd[]=1126174801920768&kwd[]=Free%20Boat%20Bill%20of%20Sale%20Form&kwt[]=232&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=6&kid[]=208276042&kbc2[]=0%7C%7Co_r%3DNaN%7C%7Cp_r%3D0.44%7C%7Cl_r%3D138%7C%7Cc%3D-2312%7C%7Cps%3D0.996%7C%7Crpc%3D0.14%7C%7Clvl%3D1.00&ktd[]=1126174801920768&kwd[]=Download%20Boat%20Bill%20of%20Sale&kwt[]=232&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=7&kid[]=329935866&kbc2[]=0%7C%7Co_r%3DNaN%7C%7Cp_r%3D0.44%7C%7Cl_r%3D138%7C%7Cc%3D-2312%7C%7Cps%3D0.996%7C%7Crpc%3D0.09%7C%7Clvl%3D1.00&ktd[]=1126174801920768&kwd[]=Free%20Vehicle%20Bill%20of%20Sale&kwt[]=232&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=8&kid[]=11678867&kbc2[]=0%7C%7Co_r%3DNaN%7C%7Cp_r%3D0.44%7C%7Cl_r%3D138%7C%7Cc%3D-2312%7C%7Cps%3D0.996%7C%7Crpc%3D0.13%7C%7Clvl%3D1.00&ktd[]=1126174818697984&kwd[]=Free%20Blank%20Bill%20of%20Sale&kwt[]=232&kbc[]=55dd0c7ca698fe5b760b9fb8acee8faf.d2s&kwp[]=9&kid[]=11523120&kbc2[]=0%7C%7Co_r%3D0.00%7C%7Cp_r%3D0.44%7C%7Cl_r%3D138%7C%7Cc%3D-2312%7C%7Cps%3D0.996%7C%7Crpc%3D0.07%7C%7Clvl%3D1.00&ktd[]=1126174818697984&kwd[]=Ranches%20for%20Sale&kwt[]=266&kbc[]=45697&kwp[]=10&kid[]=23789749&kbc2[]=2%7C%7Cps%3D0.677%7C%7Crpc%3D0.04%7C%7Clvl%3D1.00&ktd[]=565423888269568&rand=1623438249663&cid=8CU4593V4&vwid=1623438248517474502&vi=1623438248517474502&l3ch=0&slnkp=no&tdAdd[]=ib=0&vgd_uspa=0&vgd_sc=HE&vgd_l1rakh=1623438248139253920&vgd_lhl=736&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&sttm=1623438249139&upk=1623438249.24605&hvsid=00001623438249139015095070725520&verid=3121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&vgd_isiolc=1&pid=8POU88YO6&vgd_pgid=p0229282536t202106111904&matm=1623438249668&vgd_ltime=538&vgd_ltimesrc=2&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l3_sc=HE&vgd_l2ch=0&vgd_l1ch=1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_sbSup=1&vgd_l2wsip=2887305298&vgd_nrrsf=nrr&vgd_nrrv=12042&vgd_nrrs=12042&vgd_nrrmf=4a&vgd_cntrdt=AS%7CDIV-661154765%7CDIV&vgd_x_pos=322&vgd_y_pos=2947&vgd_ren_page_h=5975&vgd_cty=FRANKFURT&vgd_l1hcsd=A11%7C3853&vgd_sethcsd=A9%7C3864&vgd_cfud=191218&vgd_is_amp=0&vgd_optout=0&vgd_ect=4g&vgd_rensize=620_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_mbr=1&vgd_l1rpth=%2Fdmedianet.js&vgd_pgids=1&requrl=https%3A%2F%2Fwww.billofsale-form.com&oRurl=http%3A%2F%2Fcdng%2Ffcmain.js%3F%26esi%3D1%26%26fvips%3D0%26vpf%3D000%26chost%3Dcontextual.media.net%26cb%3Dwindow._mNDetails.initAd%26%26gdpr%3D1%26cid%3D8CU4593V4%26cpcd%3DpW0W2n1qzJZYY8yxiQBiyA%253D%253D%26crid%3D661154765%26size%3D600x250%26cc%3DDE%26https%3D1%26vif%3D1%26requrl%3Dhttps%253A%252F%252Fwww.billofsale-form.com%252F%26nse%3D5%26vi%3D1623438248517474502%26lw%3D1%26ugd%3D4%26nb%3D1%26blacpfl%3D1%26baeFlag%3D0%26blapd%3D0%26isOffice%3D0&tdAdd[]=uiparams%3D%3Brend_w%3A620%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A10&vgd_end=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV12042.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 11 Jun 2021 19:04:09 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Fri, 11 Jun 2021 19:04:09 GMT

POST
H2 200 log
navvy.media.net/ Frame B521 807 B
869 B 152ms
152ms Ping
image/gif 34.102.149.62
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://navvy.media.net/log
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV12042.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.149.62 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 62.149.102.34.bc.googleusercontent.com
Software: Jetty(9.4.7.v20170914) /
Resource Hash: 0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:09 GMT
via: 1.1 google
server: Jetty(9.4.7.v20170914)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache,no-store
alt-svc: clear
content-length: 807
expires: Fri, 11 Jun 2021 19:04:09 GMT

GET
H2 200 dark-bottom.css
www.billofsale-form.com/ezoic/styles/ 3 KB
1 KB 27ms
27ms Stylesheet
text/css 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/ezoic/styles/dark-bottom.css
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/ezoic/cookieconsent.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ac054159a85ddee2e265bc0a517304e773e8c8db653af949bab52dec5e2a1ed9

Request headers

:path: /ezoic/styles/dark-bottom.css
pragma: no-cache
cookie: __qca=P0-1812266074-1623438249278; cto_bidid=rdP1nl9FS3ROJTJGM04wZmJpZkpPJTJGR3Y4MVhCTmtJR1dib25Fa1VVQjUxdyUyRmxpOVhQNCUyRnFWRGUzOFIxMU9iUXhwMFRoOGN0NnNueHlsekg1NzZnbSUyQk5sVTk1T2clM0QlM0Q; cto_bundle=OWhOnF9KTXUyTVlGRkNPejlSTDg5NklMenNadFF1Q3YwSnRnamZvS3k0WE1iRUN3YktKWUc0dDkxTlVqUTcwcmxuQ1J1VHJsV0l1VURDYjZHMHVYSGN0RFVTMldJa3FxdiUyRmY5JTJCbjAwaTQ4bWhhR0hrZ3ZoVGd5ak9YMW0xMk5xZVZ5dWw
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 703901
cf-polished: origSize=3031
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a9e0ee6ca00004e923eb48000000001
x-robots-tag: noindex
last-modified: Fri, 28 May 2021 04:19:14 GMT
server: cloudflare
etag: W/"bd7-5c35c2da8d480-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=HA%2FDbvm2l14WeA1Iz42XMNiuVTLuAk4AGQjQKPWebOX7DaI6yFuXEFgQAXDwyXtbWW1OqG8oADe4bNm39%2FU7uEt8ZlW3%2BRCSfRBzlox7OpnrzrCwDn0zFyT%2BRFQ6jPyavsmYLeSxWnRaHxF41tWhwBw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=31536000
cf-ray: 65dd1a84785f4e92-FRA
cf-bgj: minify

GET
H2 200 log
lg3.media.net/ 35 B
206 B 28ms
27ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/log?&logid=kfk&evtid=adPrvLog&otherprov=0&cid=8CU4593V4&crid=661154765&cc=DE&ugd=4&timeTaken=1&vi=1623438248517474502&r=1623438249674

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Jetty(9.4.35.v20201120) /

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:09 GMT
server: Jetty(9.4.35.v20201120)
strict-transport-security: max-age=21600
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 11 Jun 2021 19:04:09 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
121 B 14ms
14ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_stats&su=www.billofsale-form.com&doc=complete&pg_h=5975&pg_w=1600&pg_hs=5975&c=2&aa_c=0&av_h=170&av_w=514&av_a=70260&s=5034.250&all_s=5034.250&b=417.750&all_b=417.750&d=0.057&all_d=0.057&ard=0.015&all_ard=0.015&dt=d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 greenoaks.gif Show response
www.billofsale-form.com/detroitchicago/ 0
672 B 29ms
28ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MzgyNDgsImRhdGEiOlt7Im5hbWUiOiJuYXZpZ2F0aW9uX3R5cGUiLCJ2YWwiOiIwIn0seyJuYW1lIjoicmVkaXJlY3RfY291bnQiLCJ2YWwiOiIwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDM4MjQ4LCJkYXRhIjpbeyJuYW1lIjoicGVyZl9pc190cmFja2VkIiwidmFsIjoiMSJ9LHsibmFtZSI6InBlcmZfbmF2X3RvX2Nvbm5lY3QiLCJ2YWwiOiI4MDIifSx7Im5hbWUiOiJwZXJmX2Nvbm5lY3RfdG9fcmVzcF9zdGFydCIsInZhbCI6IjE2MTgifSx7Im5hbWUiOiJwZXJmX3Jlc3BfdGltZSIsInZhbCI6IjkifSx7Im5hbWUiOiJwZXJmX2ludGVyYWN0aXZlIiwidmFsIjoiMTEyIn0seyJuYW1lIjoicGVyZl9jb250ZW50bG9hZGVkIiwidmFsIjoiMjc1In0seyJuYW1lIjoicGVyZl9jb21wbGV0ZSIsInZhbCI6Ijg1MSJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjUwMDFmMTcxLTEyNDQtNGViZi02YWJkLTY2ZmZiZWViYjUzMyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiZGF0YSI6W3sibmFtZSI6ImZpcnN0X3BhaW50IiwidmFsIjoiMTczMyJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjUwMDFmMTcxLTEyNDQtNGViZi02YWJkLTY2ZmZiZWViYjUzMyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiZGF0YSI6W3sibmFtZSI6ImZpcnN0X2NvbnRlbnRmdWxfcGFpbnQiLCJ2YWwiOiIxNzMzIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDM4MjQ4LCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9lZmZlY3RpdmVfdHlwZSIsInZhbCI6IjRnIn1dfV0=
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MzgyNDgsImRhdGEiOlt7Im5hbWUiOiJuYXZpZ2F0aW9uX3R5cGUiLCJ2YWwiOiIwIn0seyJuYW1lIjoicmVkaXJlY3RfY291bnQiLCJ2YWwiOiIwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDM4MjQ4LCJkYXRhIjpbeyJuYW1lIjoicGVyZl9pc190cmFja2VkIiwidmFsIjoiMSJ9LHsibmFtZSI6InBlcmZfbmF2X3RvX2Nvbm5lY3QiLCJ2YWwiOiI4MDIifSx7Im5hbWUiOiJwZXJmX2Nvbm5lY3RfdG9fcmVzcF9zdGFydCIsInZhbCI6IjE2MTgifSx7Im5hbWUiOiJwZXJmX3Jlc3BfdGltZSIsInZhbCI6IjkifSx7Im5hbWUiOiJwZXJmX2ludGVyYWN0aXZlIiwidmFsIjoiMTEyIn0seyJuYW1lIjoicGVyZl9jb250ZW50bG9hZGVkIiwidmFsIjoiMjc1In0seyJuYW1lIjoicGVyZl9jb21wbGV0ZSIsInZhbCI6Ijg1MSJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjUwMDFmMTcxLTEyNDQtNGViZi02YWJkLTY2ZmZiZWViYjUzMyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiZGF0YSI6W3sibmFtZSI6ImZpcnN0X3BhaW50IiwidmFsIjoiMTczMyJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjUwMDFmMTcxLTEyNDQtNGViZi02YWJkLTY2ZmZiZWViYjUzMyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiZGF0YSI6W3sibmFtZSI6ImZpcnN0X2NvbnRlbnRmdWxfcGFpbnQiLCJ2YWwiOiIxNzMzIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDM4MjQ4LCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9lZmZlY3RpdmVfdHlwZSIsInZhbCI6IjRnIn1dfV0=
pragma: no-cache
cookie: __qca=P0-1812266074-1623438249278; cto_bidid=rdP1nl9FS3ROJTJGM04wZmJpZkpPJTJGR3Y4MVhCTmtJR1dib25Fa1VVQjUxdyUyRmxpOVhQNCUyRnFWRGUzOFIxMU9iUXhwMFRoOGN0NnNueHlsekg1NzZnbSUyQk5sVTk1T2clM0QlM0Q; cto_bundle=OWhOnF9KTXUyTVlGRkNPejlSTDg5NklMenNadFF1Q3YwSnRnamZvS3k0WE1iRUN3YktKWUc0dDkxTlVqUTcwcmxuQ1J1VHJsV0l1VURDYjZHMHVYSGN0RFVTMldJa3FxdiUyRmY5JTJCbjAwaTQ4bWhhR0hrZ3ZoVGd5ak9YMW0xMk5xZVZ5dWw; ezux_lpl_26431=1623438249673|5001f171-1244-4ebf-6abd-66ffbeebb533|false; __gads=ID=2e5f578fb3c3ed15-22acbf935dc800d4:T=1623438249:S=ALNI_MacupuFWNQYiQezrwhkKc7U7a7NRA
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:10 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9e0ee8ae00004ebc2f08d000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=2hZ78IgnvZ%2BvX5s79KmrjQBC0ibQf7cz1hRfEMFEhmeeQG%2F2TgM5EwgKCfIxUBER%2Bz1ifZT1L5FsxqsBkNmQBQe6IwgF%2F9HayGJR%2F1bvlorszfpaiwtyQt9cE8nC%2FO9lxlNZMunZXKi2YJYtFR4favw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dd1a877bc84ebc-FRA
expires: Thu, 10 Jun 2021 19:04:09 UTC

GET
H3-29 200 greenoaks.gif Show response
www.billofsale-form.com/detroitchicago/ 0
670 B 38ms
37ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MzgyNDgsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX2Rvd25saW5rIiwidmFsIjoiOS41In1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDM4MjQ4LCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9ydHQiLCJ2YWwiOiIwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDM4MjQ4LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfcmVxdWVzdCIsInZhbCI6IjEzMzQifV19XQ==
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MzgyNDgsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX2Rvd25saW5rIiwidmFsIjoiOS41In1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDM4MjQ4LCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9ydHQiLCJ2YWwiOiIwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ0X2Vwb2NoIjoxNjIzNDM4MjQ4LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfcmVxdWVzdCIsInZhbCI6IjEzMzQifV19XQ==
pragma: no-cache
cookie: __qca=P0-1812266074-1623438249278; cto_bidid=rdP1nl9FS3ROJTJGM04wZmJpZkpPJTJGR3Y4MVhCTmtJR1dib25Fa1VVQjUxdyUyRmxpOVhQNCUyRnFWRGUzOFIxMU9iUXhwMFRoOGN0NnNueHlsekg1NzZnbSUyQk5sVTk1T2clM0QlM0Q; cto_bundle=OWhOnF9KTXUyTVlGRkNPejlSTDg5NklMenNadFF1Q3YwSnRnamZvS3k0WE1iRUN3YktKWUc0dDkxTlVqUTcwcmxuQ1J1VHJsV0l1VURDYjZHMHVYSGN0RFVTMldJa3FxdiUyRmY5JTJCbjAwaTQ4bWhhR0hrZ3ZoVGd5ak9YMW0xMk5xZVZ5dWw; ezux_lpl_26431=1623438249673|5001f171-1244-4ebf-6abd-66ffbeebb533|false; __gads=ID=2e5f578fb3c3ed15-22acbf935dc800d4:T=1623438249:S=ALNI_MacupuFWNQYiQezrwhkKc7U7a7NRA
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:10 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9e0ee8af00004ebc8b973000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=D6LnlkCgq7ZNenscfZyXX%2BeQg3j2DB6IpPYhM9eFxWiLsQjpAo4C%2BkzsEB1SdDpdyATH%2FA%2FeYREYP7pSiC4VYdMZikrE5rpcIFvuBV5uscK9Ra1qu5VevVIeMWxtdyeXuD41kSN0NGSjSracCWxes1A%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dd1a877bca4ebc-FRA
expires: Thu, 10 Jun 2021 19:04:10 UTC

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 10 KB
8 KB 28ms
26ms XHR
application/json 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021061001&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d2555967c12febd8161d68c6e94516b6a36ef337ecfdf1503baacbe55f8576e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 19:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7989
x-xss-protection: 0

GET
H2 200 bqi.php
lg3.media.net/ 15 B
15 B 34ms
34ms Image
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bqi.php?lf=3&&vgd_l2type=setting&pid=8POU88YO6&cme=wKMzE5aEf1ApuFl23hQaxmA8JcP2NGpDBmayTeacTKMLhSDHC6YLRCihFeP1JEhB2uzhAxwYdYTQ82u3KsYb6XVI2mUmOYzBCY9__PiQXiAgG3IhIu5q6d_n9fqmqCdnQU9afMLOFSw-T1legm9PMfNd5AqU-OjnM5QCRgJsrLheHa71cCn4VxpeDDX6icJvfw1nBoiZeKY=||NDHRnZ9Gz3KXlI-i9OnZqQ==|5gDUJdTGiJzedmq9hanWYg==|sRBSg3CPSiQ=|YdjFvixrVaF8p8bRV2-VqgKNNqcmZ61nOSKd24xYWWiPBaBzzAZG6w==|N7fu2vKt8_s=|uCwEv227vsAefnMtWo7CxKD6O4K1ea0y-ddYKR2GG239xhqq5-fO1-eOKQq61zKaxlTBqEUJbq4rV1X5b-LqhUPzhBR-QdUYiulkSSxWFszUpOYpkzmPRmrN6W7T_lqJdjfFeYU67ygxagcBbebjPjvjQ1BF052-VoINzpTWHnADzrLiFGsVVK0J6Sc0IdMEA8AApbeIWEw6RxupKTP9IK2nxFgGJFGa1F4UeX_KIBo=|&gdpr=1&prid=8PRHGG6T9&cid=8CU4593V4&crid=889045848&requrl=https%3A%2F%2Fwww.billofsale-form.com%2F&vi=1623438248367080728&ugd=4&cc=DE&sc=HE&startTime=1623438249154&l2type=setting&vgd_l1rakh=1623438248139253920&l1ch=1&sttm=1623438249155&upk=1623438249.24605&hvsid=00001623438249155015095070728377&verid=3121199&vgd_sc=HE&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&l1hcsd=l1!A11|3853&vgd_uspa=0&vgd_isiolc=1&npgv=1&clp=%7B%7D&cl=%7B%7D&l2ch=1&l2wsip=2886781042&sethcsd=set!A9%7C3864&vgd_pgid=p0229282536t202106111904&vgd_pgids=2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Fri, 11 Jun 2021 19:04:10 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Fri, 11 Jun 2021 19:04:10 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e684839cbcef6b16753dae73e92a49b7115f55e83662ead12d5e05bf7b9915fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622653785071769"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Fri, 11 Jun 2021 19:04:10 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/223/ Frame 7B1E 12 KB
5 KB 15ms
13ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de7dd7e8a5f2257d16c23c395b9262c6fa04689c81b0e2b8bf7f5bae9f4177dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/223/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Fri, 11 Jun 2021 17:28:24 GMT
expires: Sat, 11 Jun 2022 17:28:24 GMT
last-modified: Wed, 17 Mar 2021 18:24:30 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 5746
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame DF1D 783 B
530 B 16ms
16ms Document
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

6f5414a00d9de40f036c84608713a628419189bb8f829a28577ee1fc2bda9236

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-UcL+dtX+qu534RCpNqUpsw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

expires: Fri, 11 Jun 2021 19:04:10 GMT
date: Fri, 11 Jun 2021 19:04:10 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-UcL+dtX+qu534RCpNqUpsw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 511
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame 7B1E 14 KB
6 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 17:54:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4176
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 11 Jun 2022 17:54:34 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 15ms
15ms Image
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=223&t=2&li=gpt_2021061001&jk=3107597125158511&bg=!CAulC0_NAAY6sG-_OrA7ACkAdvg8Wr0qYalogNk7iwxKBS81-dlXHwUzzFd9qMTGLvcprG_lV7rgCgIAAABkUgAAAAxoAQeZAoN6sQ0Sw8wqQCOqQXkYEW4YfyoiGotR-3tfWVGsLvoU9fvKIClv029NKKidNUS6bvATUy8k7eASMYB2h1k9aj6gvzRMiSnPjR40q10HgRK1aL1qTqKi8TBhCloUt6Ua6SrgFBtuzsQIHIB3J90eubbeIGIlX30QidZn3aPHpkN4M3o3MFekKCktYKF1Z6OsT08D_FFhVv1AYxEA6K2ZJfnuh60fNyoAFEmTNP9Xsm4ZIHWWdNLRHpdkrvxuoGkU8KIDs3Bckgh2EMFbHI5_J1yEA6pZ4MCKyQfBx0cKKJ4UvKeFAsK7LTdny7w3Lcq5CGzfVOrGFlWD5tMxgIhpbhDDUzAMnPdfcDy9OsIWisVa-ZuqSDD5CCsjGcI4vcxjp9eXgyo8lZEvN9fP7KNXdrVEVVC2UUepTumsPctrg5yMpLVIPtN7LDeg4TTGKpkx2eRYRbl5cZnQI9zNESCFsS6MiVFbaBF07qQf5993vSHOdSnbxRtr2KhOrW6y3yY6lcLWvp2qmcObq4P3N2ZQrANum2Sxhaq9zvE4mhXmbRyZ3Yu_UdSM-4G17hFE3jQKJA4vyfzS9_EJF7Cb_oFSSojSlewJc__-WY8qTcc3koM8H7rlvh3Ktx3LmDoIhBEiTEud_2pXxBYIEsW3YoG4iw-SjD9QysUmLwddY3ioVRj3rvpgyeKqnqwE5wmpLAw9Pl8JM_Co1pA8eP_4BEcWlxO12Jy9z3zOUvCEeR18aAs-v1u6BY0xrc0-cklPYRxc9u4uL4i8Rp2rHystWtnBQogMbuFa-o1iRFoLaTQRlaiwUGOyZ36dhUodjVV0liJMX734LX2UTEyqpX0pl3b9P1EHHahJ

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ 0
348 B 48ms
28ms Ping
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=1~kpsp7u3w&c=3107597125158511&e=31060784%2C31061161%2C31061279%2C31061429%2C31061200%2C21066613%2C21066615&ctx=1&met.9=1.1h8~2.1jw~3_2.1l1~3_3.1l2~7_2.0~7_3.0~4_2.2a8~5_2.2a9~4_3.2n0~5_3.2n0&met.3=831.1jx~827.1jy~74.1jy_1~43.1k0~49.1k1~49.1k1~49.1k1~49.1k1~49.1k1~49.1k1~49.1k1~49.1k1~49.1k1~49.1k1~49.1k1~49.1k1~49.1k1~49.1k2~49.1k2~49.1k2~49.1k2~49.1k2~49.1k2~49.1k2~49.1k2~49.1k2~49.1k2~49.1k2~49.1k2~49.1k2~49.1k2~49.1k2~49.1k2~49.1k2~49.1k2~49.1k2~49.1k3~53.1k3~49.1k3~49.1k3~49.1k3~49.1k3~49.1k3~49.1k3~49.1k3~74.1k3~43.1k3~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k4~49.1k5~49.1k5~49.1k5~49.1k5~49.1k5~49.1k5~49.1k5~49.1k5~49.1k5~53.1k5~49.1k5~49.1k5~49.1k5~49.1k5~49.1k5~49.1k5~49.1k5~86.1k5~86.1k6~86.1k6~86.1k6~485.1k6~91.1k6~95.1k6_1~51.1k7~572.1k7~95.1k7_1~51.1k8~572.1k8~77.1jy_a~297.1k8~894.1ka~724.1ka~724.1ka~872.1kb~872.1kb~893.1kb~893.1kb~291.1kn~750.1kn_1~750.1ko~831.1l2~808.1l3~598.1l3~705.1l3~808.1l3~598.1l3~705.1l3~808.1l3~751.1l3~808.1l3~751.1l3~112.1lf_1~573.1wv~598.1ww~355.1ww~598.1ww~355.1ww~94.1wx~573.1x0~598.1x0~598.1x0~113.1wz_2~646.2a8_1~800.2a9~801.2a9~825.2a9~800.2a9~801.2a9~355.2a9~825.2a9~800.2a9~708.2a9~800.2aa~51.2aa~598.2aa~583.2aa~54.2aa~581.2aa~355.2ab~709.2aa_2~800.2ac~647.2ad_1~646.2n0_1~800.2n1~801.2n1~825.2n1~800.2n1~801.2n1~355.2n1~825.2n1~800.2n1~708.2n1~800.2n1~51.2n1~598.2n1~583.2n1~54.2n1~581.2n2~355.2n2~709.2n1_1~800.2n2~647.2n2&met.7=CBsQCMAB7v6Ligk~CC8QChgBINkMKNkMMOoMOBBo2gxw6Qx4pQGAAWSIAWuwAQG4AQPAAZv_iccH~CBsQCiDaDDhGwAHnh6qODA~CBsQByDaDDg1wAGj_Li3DA~CBsQByDaDDg2wAH_08GRAg~CBIQBxgBINoMKNoMMO4MOBRo3Axw7Qx4qwOAAbACiAHyBaoBGAoWRHJvaWQrU2FuczpyZWd1bGFyLDcwMLABAbgBA8AB1se7yAo~CBsQCiDaDDjBAcAByo2Gngc~CBsQCiDdDDgfwAGlsa_pDw~CBsQBiDeDDh5wAHiladx~CBsQBiDeDDibAcABvPe2ogk~CBsQCiDeDDiEAcAB67jK0Qc~CBsQCiDtDDhiwAHG_ujqDA~CDsQChgBIO4MKO4MMOANOHJAsw1ItA1QtA1YyQ1guw1oyQ1w2Q14kawBgAHsqAGIAdXwA7ABAbgBA8AB4s3qlgk~CBsQCiDuDDhgwAHVoaXuDQ~CBsQCiCuDTgqwAGInebDBg~CBsQCiCvDThCwAH6yPw_~CBsQCiCvDTgzwAH207HGAQ~CBsQAiCxDTglwAHCiqmqAw~CBsQAiC3DTgiwAHCw4_lDQ~CBsQAiC4DTgrwAHhh6WzDw~CBMQAhgBILgNKLgNMMANOAhouQ1wvw148KYBgAHwpQGIAfClAaoBDwoJZHJvaWRzYW5zEAwYArABAbgBA8AB142s4Ag~CBsQCiDIDTgIwAHZ67DzCg~CBsQAiDnDTgWwAGG0MWeDQ~CBsQAiDoDTgQwAGj8-fQDg~CBMQAhgBIOgNKOgNMPMNOApo6Q1w8A14364BgAHErgGIAcSuAaoBDwoJZHJvaWRzYW5zEAwYArABAbgBA8ABr7qfrA4~CBsQBiCUDjghwAGinL3uDA~CBsQBiCUDjgTwAGv7OmFBg~CBsQBiCUDjgVwAHT-qSPCw~CBsQBiCUDjggwAHo2PqkBw~CBsQBiCUDjgewAHesPL9BQ~CBsQBiCVDjgUwAG_lrPsCg~CBsQBiCVDjgewAHt573RCg~CBsQBiCVDjgewAGf3YHECw~CBsQBiCVDjgfwAGJ1MSeBA~CBsQBiCVDjgfwAHah_PLCA~CBsQBiCVDjggwAGgsKChBA~CBsQDSDGDjhKwAGSwp7DCw~CBsQDSDHDjg5wAHCkqPaAg~CBsQDSDIDjg0wAG5iYSUCg~CBsQDSDXDjgPwAGAkfKHCA~CBsg8g44FMABrvTinAw~CA4QChgBIP0OKP0OMKYPOClQgA9Yjw9ggA9ogQ9wlw94ipIHgAHTkQeIAduvFLABAbgBA8ABks6b-QY~CBsQDSCCDzglwAH47cO6DA~CBsQCiCDDzgcwAHA1M7vCg~CBsQDSCEDzg1wAGgnO6-Cg~CBsQCiCEDzgWwAH955Ex~CBsQBSCpDzg6wAGL-squDg~CBsQCiCsDzhewAHgjaa0CQ~CBsQBSCvDzg2wAGL-squDg~CBsQBiCvDzgtwAGv87zBDw~CBsQBiCvDzgvwAGv87zBDw~CCgQChgBIOoPKOoPMPMPOAlo6g9w8g94lqUBgAH6pAGIAe-0A7ABAbgBA8ABm-H6cA~CC8QBxgBIOwPKOwPMPwPOBBo7Q9w-w94pQGAAWSIAWuwAQG4AQPAAe21srAK~CC8QBxgBIOwPKOwPMIYQOBpA7Q9I7g9Q7g9Y_A9g7g9o7w9whhB4eoABZIgBa7ABAbgBA8ABm_-Jxwc~CBsQDSDNDjjQAcABlIyOpgw~CBsQCiDXDzhBwAHw7tmdAw~CBsQBiCmEDgNwAHbp7SGDA~CBsQBxgBIIYQKIYQMLcQODHAAYD0gMEE~CBsQDSDKDjiBAsAB2v7Hhgg~CBsQDSDGDjiZAsABksKewws~CBsQDSChEDhBwAHh653NBA~CBsQDSDIDjikAsABlo_8lAk~CBsQDSDMDjizAsAB5IOfqA0~CBsQCiCgDzjJA8AB4I2mtAk~CBsQCDixE8AB7v6Ligk~CBwQBhgBILUTKLUTMMQTOA9othNwxBN4ebABAbgBA8ABlITitQ4~CBsQByCuEzgcwAGWzILHAw~CBsQBiCwEzgcwAHhp6agDg~CA8QDRgBIIUQKIUQMI8XOIkHaIgQcI4XeJgCgAH6AYgB0QOwAQG4AQPAAb_emusG~CBsQBiCNGDgkwAHc5Id-~CBsQDSCTFzgewAGgnO6-Cg~CBsQDSCUFzgmwAGgnO6-Cg~CCcQDRgBIJYXKJYXMLIXOB1AlhdIlxdQlxdYpBdglxdolxdwshd4zD6AAbU-iAGDUrABAbgBA8AB8_LLrgs~CCcQChgBIMgYKMgYMNYYOA_AAeLBm9oF~CCcQBRgBINwYKNwYMO4YOBHAAbfBsI0P~CBsQBRgBIO0YKO0YMP8YOBLAAc_G2uIB~CBwQBhgBIIEaKIEaMJEaOBBogRpwkBp4FLABAbgBA8ABlITitQ4~CA8QDRgBIIcQKIcQMNsaONQKaIgQcNoaeKECgAGDAogB2wOwAQG4AQPAAb_emusG&met.1=1.kpsp7sih~6.l7~7.l8~8.la~9.la~10.mb~11.lg~12.mb~13.18z~14.198~15.194~16.1cb~17.1gu~18.1gu~19.1wu~20.1wv~21.1wx~22.1c5~23.1c5&met.2=19.4~17.1fq~18.1nm&qqid.2=CImbpuGikPECFYfEuwgdWKcBXw&qqid.1=CKOxpuGikPECFYrGuwgdyagA8g
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:10 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200 457.json Show response
id5-sync.com/g/v2/ 213 B
541 B 92ms
59ms XHR
application/json 54.36.109.22
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/457.json

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oneVideo,pulsepoint,rhythmone,sovrn,undertone,unruly&cb=194-2-22

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.36.109.22 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

995861010e6169acbac1c0facc441df8955b1bb3cb75383b32328bc4202c39a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.billofsale-form.com
Date: Fri, 11 Jun 2021 19:04:11 GMT
Access-Control-Allow-Credentials: true
Vary: Origin
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Type: application/json;charset=UTF-8

GET
H2 200 visitormatch Show response
bh.contextweb.com/ Frame 3510 27 B
384 B 282ms
96ms Document
text/html 198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL

https://bh.contextweb.com/visitormatch

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oneVideo,pulsepoint,rhythmone,sovrn,undertone,unruly&cb=194-2-22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(9.4.14.v20181114) /

Resource Hash

ec2f44e7dbd2ebb1268ac7e7a0602ec2106bc7fd9da17b9012db81be55cbd485

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

:method: GET
:authority: bh.contextweb.com
:scheme: https
:path: /visitormatch
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cw-server: bh-deployment-8474b759f8-zvtlc
cache-control: private, max-age=0, no-cache, no-store
expires: -1
content-language: en-US
content-type: text/html;charset=iso-8859-1
server: Jetty(9.4.14.v20181114)
strict-transport-security: max-age=15768000
set-cookie: INGRESSCOOKIE=b25dc3b5f21dfcfb; path=/; HttpOnly; Secure; SameSite=None

GET
H2 200 usersync.html Show response
cdn.undertone.com/js/ Frame 874F 8 KB
2 KB 47ms
7ms Document
text/html 2600:9000:21f3:a600:1f:2473:9080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.undertone.com/js/usersync.html
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oneVideo,pulsepoint,rhythmone,sovrn,undertone,unruly&cb=194-2-22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:a600:1f:2473:9080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 867947a4634bf633546e9b9db67e2bb289ff9e031cc05d99c7d4459232998d24

Request headers

:method: GET
:authority: cdn.undertone.com
:scheme: https
:path: /js/usersync.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

content-type: text/html
date: Fri, 11 Jun 2021 16:43:33 GMT
x-amz-replication-status: COMPLETED
last-modified: Fri, 11 Jun 2021 10:14:43 GMT
etag: W/"04865ba3f4af5f0f5bf8f0f416612b46"
x-amz-version-id: 1lZpE_tcv0o.4DJhDC7N.VxcfbYKCyEg
server: AmazonS3
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: o4dS8Hr5Sa1V-E4r_TiQUEDhJca4NlnzYg7YXU6t3QpTvbC57diGZw==
age: 8440

GET
H2 200 third-party-iframes.html Show response
video.unrulymedia.com/iframes/ Frame C627 466 B
872 B 56ms
14ms Document
text/html 13.224.192.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://video.unrulymedia.com/iframes/third-party-iframes.html
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,oneVideo,pulsepoint,rhythmone,sovrn,undertone,unruly&cb=194-2-22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.192.221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ba49e23fe9269a203befcd1ff0182766711afab8a5e9d098e86cb3ed13248be2

Request headers

:method: GET
:authority: video.unrulymedia.com
:scheme: https
:path: /iframes/third-party-iframes.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

content-type: text/html
content-length: 466
last-modified: Mon, 07 Jun 2021 12:33:17 GMT
x-amz-expiration: expiry-date="Tue, 06 Jun 2028 00:00:00 GMT", rule-id="Delete after 7 years"
accept-ranges: bytes
server: AmazonS3
date: Fri, 11 Jun 2021 18:54:30 GMT
cache-control: max-age=600
etag: "99742e48548c92acc64c0fce94ab9b0e"
x-cache: Hit from cloudfront
via: 1.1 e0efba8a72628bfc3dc6d4d637b28302.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: ltMrPivtXdxdxsqX7Y4YpSS1evmv1bG4cCwDDBcJnxi5R7ASxNXNxg==
age: 583

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 77A9
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
https://eus.rubiconproject.com/usync.html?p=12776

281 B
554 B

25ms
8ms

Document
text/html

104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=12776
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://cdn.undertone.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cdn.undertone.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 23 Feb 2021 20:47:52 GMT
ETag: "402b0-119-5bc0708346e00"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 11 Jun 2021 19:04:12 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?p=12776
Date: Fri, 11 Jun 2021 19:04:12 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H/1.1 200
OK getuidnb
ib.adnxs.com/ Frame 874F 43 B
696 B 57ms
26ms Image
image/gif 185.33.221.13
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/getuidnb?https://usr.undertone.com/userPixel/sync?partner=appnexus&uid=$UID

Requested by

Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.13 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 19:04:12 GMT
X-Proxy-Origin: 89.249.64.211; 89.249.64.211; 729.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.181:80
AN-X-Request-Uuid: ba11898c-e2c4-4aa1-bd57-ec8c2324796e
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

sync
usr.undertone.com/userPixel/ Frame 874F
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid=
https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid=
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=b6f164a9-416d-42f0-a4b7-af9b02b4aaa0

0
308 B

437ms
102ms

Image
text/plain

54.84.143.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partnerId=39&uid=b6f164a9-416d-42f0-a4b7-af9b02b4aaa0
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.84.143.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:12 GMT
x-envoy-upstream-service-time: 1
server: istio-envoy
Connection: keep-alive
Content-Length: 0

Redirect headers

date: Fri, 11 Jun 2021 19:04:12 GMT
content-encoding: gzip
server: OXGW/16.208.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://usr.undertone.com/userPixel/sync?partnerId=39&uid=b6f164a9-416d-42f0-a4b7-af9b02b4aaa0
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H/1.1

200
OK

sync
usr.undertone.com/userPixel/ Frame 874F
Redirect Chain

https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true
https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&verify=true
https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&apid=UPcf099639-cae7-11eb-8b64-028c3a1b4c64
https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&apid=UPcf099639-cae7-11eb-8b64-028c3a1b4c64&verify=true
https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-euI1t8tE2uGMnZa8wHPUx.glbdA5fGbQ~A~UPcf099639-cae7-11eb-8b64-028c3a1b4c64

0
154 B

395ms
100ms

Image
text/plain

54.84.143.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-euI1t8tE2uGMnZa8wHPUx.glbdA5fGbQ~A~UPcf099639-cae7-11eb-8b64-028c3a1b4c64
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.84.143.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:12 GMT
x-envoy-upstream-service-time: 1
server: istio-envoy
Connection: keep-alive
Content-Length: 0

Redirect headers

Date: Fri, 11 Jun 2021 19:04:12 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-euI1t8tE2uGMnZa8wHPUx.glbdA5fGbQ~A~UPcf099639-cae7-11eb-8b64-028c3a1b4c64
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

sync
usr.undertone.com/userPixel/ Frame 874F
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=
https://usr.undertone.com/userPixel/sync?partner=ttd&uid=41eaa05d-649d-4fb0-92c6-a7b0dc246c97&ttl=1626030252

0
154 B

396ms
101ms

Image
text/plain

54.84.143.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partner=ttd&uid=41eaa05d-649d-4fb0-92c6-a7b0dc246c97&ttl=1626030252
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.84.143.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:12 GMT
x-envoy-upstream-service-time: 1
server: istio-envoy
Connection: keep-alive
Content-Length: 0

Redirect headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:12 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://usr.undertone.com/userPixel/sync?partner=ttd&uid=41eaa05d-649d-4fb0-92c6-a7b0dc246c97&ttl=1626030252
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 247

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame 874F 0
239 B 25ms
22ms Image
image/gif 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=12776
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Content-Type: image/gif

GET
H/1.1

200
OK

sync
usr.undertone.com/userPixel/ Frame 874F
Redirect Chain

https://cs.admanmedia.com/sync/undertone?url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3Fpartner%3Dacuityads%26uid%3D%24UID
https://usr.undertone.com/userPixel/sync?partner=acuityads&uid=e36be904e693c934fa5116d824d06c91ba9678e1

0
154 B

300ms
99ms

Image
text/plain

54.84.143.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partner=acuityads&uid=e36be904e693c934fa5116d824d06c91ba9678e1
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.84.143.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:12 GMT
x-envoy-upstream-service-time: 1
server: istio-envoy
Connection: keep-alive
Content-Length: 0

Redirect headers

Location: https://usr.undertone.com/userPixel/sync?partner=acuityads&uid=e36be904e693c934fa5116d824d06c91ba9678e1
Date: Fri, 11 Jun 2021 19:04:12 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked

GET
H/1.1

200
OK

sync
usr.undertone.com/userPixel/ Frame 874F
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone...
https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone...
https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=2470380978946745063
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?p=160318&pmc=1&pr=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D53%26uid%3D9D28E62D-A9A3-4CB6-8F9C-A9DE2FEA81BD
https://usr.undertone.com/userPixel/sync?partnerId=53&uid=9D28E62D-A9A3-4CB6-8F9C-A9DE2FEA81BD

0
308 B

100ms
100ms

Image
text/plain

54.84.143.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partnerId=53&uid=9D28E62D-A9A3-4CB6-8F9C-A9DE2FEA81BD
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.84.143.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:12 GMT
x-envoy-upstream-service-time: 1
server: istio-envoy
Connection: keep-alive
Content-Length: 0

Redirect headers

location: https://usr.undertone.com/userPixel/sync?partnerId=53&uid=9D28E62D-A9A3-4CB6-8F9C-A9DE2FEA81BD
date: Fri, 11 Jun 2021 19:04:12 GMT
x-cnection: close
server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6
content-length: 418
content-type: text/html; charset=iso-8859-1

GET
H2 200 et_v1.0.1709-0-g29446e7.js Show response
video.unrulymedia.com/native/ Frame C627 2 KB
2 KB 14ms
14ms Script
application/javascript 13.224.192.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://video.unrulymedia.com/native/et_v1.0.1709-0-g29446e7.js
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/iframes/third-party-iframes.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.192.221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0b05b4fdf98405edace9cb91aa22ca78159629b426c3b9b40e0b117a82d78d8f

Request headers

Origin: https://video.unrulymedia.com
Referer: https://video.unrulymedia.com/iframes/third-party-iframes.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 05 May 2021 08:33:58 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 3234615
x-cache: Hit from cloudfront
access-control-allow-origin: https://video.unrulymedia.com
x-amz-expiration: expiry-date="Thu, 04 May 2028 00:00:00 GMT", rule-id="Delete after 7 years"
last-modified: Wed, 05 May 2021 08:33:47 GMT
server: AmazonS3
etag: W/"0714b29c7ff13f1fff5a9593b8d3bd3b"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET
content-type: application/javascript
via: 1.1 e0efba8a72628bfc3dc6d4d637b28302.cloudfront.net (CloudFront)
cache-control: max-age=63072000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: sZbnHu88XyJQwLVwvtxOuX36HC6NuWwreE164RjF_lgP2pZ1kTMQIQ==

GET
H2 200 third-party-iframes-966d1215afd0444df063.js Show response
video.unrulymedia.com/native/third-party-iframes/ Frame C627 8 KB
4 KB 15ms
14ms Script
application/javascript 13.224.192.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://video.unrulymedia.com/native/third-party-iframes/third-party-iframes-966d1215afd0444df063.js
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/iframes/third-party-iframes.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.192.221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bc1931e9b7250b3492c2efaa8fd009ab86c877d21cadec7ee99db8f9fc4bec2b

Request headers

Origin: https://video.unrulymedia.com
Referer: https://video.unrulymedia.com/iframes/third-party-iframes.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 05 May 2021 08:33:58 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 3234615
x-cache: Hit from cloudfront
access-control-allow-origin: https://video.unrulymedia.com
x-amz-expiration: expiry-date="Thu, 04 May 2028 00:00:00 GMT", rule-id="Delete after 7 years"
last-modified: Wed, 05 May 2021 08:33:56 GMT
server: AmazonS3
etag: W/"8e81dab7c5e6661af730c0d972f4d7b2"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET
content-type: application/javascript
via: 1.1 e0efba8a72628bfc3dc6d4d637b28302.cloudfront.net (CloudFront)
cache-control: max-age=63072000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: S1pDX0ZPBxlbpE1R8uOWxrYSmtygI23NoGOsSi5gT_iE74R_YXKJpw==

GET
H2 200 checkp Show response
usermatch.targeting.unrulymedia.com/usermatch/all/ Frame C627 589 B
679 B 49ms
13ms Script
text/javascript 213.19.147.45
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://usermatch.targeting.unrulymedia.com/usermatch/all/checkp?callback=checkpCallback
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/native/third-party-iframes/third-party-iframes-966d1215afd0444df063.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.45 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: ec6cb1ecb7a1a6b2fc9d46770a569eb42dfbbee2f4e845c7d9436229041e94d3

Request headers

Referer: https://video.unrulymedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:12 GMT
server: Tengine
content-length: 589
content-type: text/javascript

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 77A9 31 KB
10 KB 9ms
8ms Script
text/html 104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 1e0c500c57328bcdd6992db38ed20a78a321a8b62197c1e0659231ed3ab1eb14

Request headers

Referer: https://eus.rubiconproject.com/usync.html?p=12776
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 19:04:12 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Jun 2021 21:11:51 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=43467
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9302
Expires: Sat, 12 Jun 2021 07:08:39 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 77A9 284 B
536 B 100ms
32ms Image
image/jpg 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Content-Type: image/jpg

GET
H2

200

RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003 Show response
sync.targeting.unrulymedia.com/csync/ Frame 92F5
Redirect Chain

https://x.bidswitch.net/sync?ssp=unrulyx
https://x.bidswitch.net/ul_cb/sync?ssp=unrulyx
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dunrulyx
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dunrulyx
https://x.bidswitch.net/sync?dsp_id=59&user_id=85bb2fa8-99e1-4ec4-9c1d-8bcf594733a1&ssp=unrulyx
https://usermatch.targeting.unrulymedia.com/usermatch/iponweb/f9fbac6f-a60c-4d6d-b7e1-684ee2e6d7ce?gdpr=&gdpr_consent=
https://sync.1rx.io/usersync/bidswitch/f9fbac6f-a60c-4d6d-b7e1-684ee2e6d7ce?gdpr=&gdpr_consent=
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

43 B
395 B

13ms
13ms

Document
image/gif

213.19.147.44
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/native/third-party-iframes/third-party-iframes-966d1215afd0444df063.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.44 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:method: GET
:authority: sync.targeting.unrulymedia.com
:scheme: https
:path: /csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://video.unrulymedia.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003%22%7D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://video.unrulymedia.com/

Response headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-length: 43
set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003%22%7D; path=/; expires=Sat, 11 Jun 2022 19:04:12 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-type: text/html
cache-control: no-store, no-cache, must-revalidate
expires: 0
pragma: no-cache
location: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

GET
H2

200

RX-5a2700a5-3640-400a-847c-ef0e2f66e962-003 Show response
sync.targeting.unrulymedia.com/csync/ Frame A3DB
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Floopme%2F%7Bdevice_id%7D
https://usermatch.targeting.unrulymedia.com/usermatch/loopme/4c0adc94-6e3b-4c6b-93d7-8bc7d5582a27
https://sync.1rx.io/usersync/loopme/4c0adc94-6e3b-4c6b-93d7-8bc7d5582a27
https://sync.1rx.io/usersync/loopme/4c0adc94-6e3b-4c6b-93d7-8bc7d5582a27?zcc=1&dspret=0&cb=1623438252570
https://sync.targeting.unrulymedia.com/csync/RX-5a2700a5-3640-400a-847c-ef0e2f66e962-003

43 B
395 B

43ms
16ms

Document
image/gif

213.19.147.44
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-5a2700a5-3640-400a-847c-ef0e2f66e962-003
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/native/third-party-iframes/third-party-iframes-966d1215afd0444df063.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.44 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:method: GET
:authority: sync.targeting.unrulymedia.com
:scheme: https
:path: /csync/RX-5a2700a5-3640-400a-847c-ef0e2f66e962-003
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://video.unrulymedia.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://video.unrulymedia.com/

Response headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-length: 43
set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-5a2700a5-3640-400a-847c-ef0e2f66e962-003%22%7D; path=/; expires=Sat, 11 Jun 2022 19:04:12 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-type: text/html
cache-control: no-store, no-cache, must-revalidate
expires: 0
pragma: no-cache
location: https://sync.targeting.unrulymedia.com/csync/RX-5a2700a5-3640-400a-847c-ef0e2f66e962-003

GET
H2

200

RX-5a2700a5-3640-400a-847c-ef0e2f66e962-003 Show response
sync.targeting.unrulymedia.com/csync/ Frame 391D
Redirect Chain

https://cm.ctnsnet.com/int/cm?exc=23&redir=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcrimtan%2F%5Buser_id%5D
https://usermatch.targeting.unrulymedia.com/usermatch/crimtan/2d3beb493ad84232b2bba6509d5d1986
https://sync.1rx.io/usersync/crimtan/2d3beb493ad84232b2bba6509d5d1986
https://sync.1rx.io/usersync/crimtan/2d3beb493ad84232b2bba6509d5d1986?zcc=1&dspret=0&cb=1623438252570
https://sync.targeting.unrulymedia.com/csync/RX-5a2700a5-3640-400a-847c-ef0e2f66e962-003

43 B
395 B

44ms
15ms

Document
image/gif

213.19.147.44
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-5a2700a5-3640-400a-847c-ef0e2f66e962-003
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/native/third-party-iframes/third-party-iframes-966d1215afd0444df063.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.44 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:method: GET
:authority: sync.targeting.unrulymedia.com
:scheme: https
:path: /csync/RX-5a2700a5-3640-400a-847c-ef0e2f66e962-003
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://video.unrulymedia.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://video.unrulymedia.com/

Response headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-length: 43
set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-5a2700a5-3640-400a-847c-ef0e2f66e962-003%22%7D; path=/; expires=Sat, 11 Jun 2022 19:04:12 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-type: text/html
cache-control: no-store, no-cache, must-revalidate
expires: 0
pragma: no-cache
location: https://sync.targeting.unrulymedia.com/csync/RX-5a2700a5-3640-400a-847c-ef0e2f66e962-003

GET
H2

200

RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003 Show response
sync.targeting.unrulymedia.com/csync/ Frame A880
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fappnexus%2F%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fusermatch.targeting.unrulymedia.com%252Fusermatch%252Fappnexus%252F%2524UID
https://usermatch.targeting.unrulymedia.com/usermatch/appnexus/8632359127879155850
https://sync.1rx.io/usersync/appnexus/8632359127879155850
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

43 B
395 B

35ms
17ms

Document
image/gif

213.19.147.44
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/native/third-party-iframes/third-party-iframes-966d1215afd0444df063.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.44 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:method: GET
:authority: sync.targeting.unrulymedia.com
:scheme: https
:path: /csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://video.unrulymedia.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://video.unrulymedia.com/

Response headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-length: 43
set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003%22%7D; path=/; expires=Sat, 11 Jun 2022 19:04:12 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-type: text/html
cache-control: no-store, no-cache, must-revalidate
expires: 0
pragma: no-cache
location: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

GET
H2

200

RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003 Show response
sync.targeting.unrulymedia.com/csync/ Frame 7A4A
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fmediamath%2F%5BMM_UUID%5D
https://usermatch.targeting.unrulymedia.com/usermatch/mediamath/290460c3-b3ac-4a00-abf3-d5900e5999c7
https://sync.1rx.io/usersync/mediamathtest/290460c3-b3ac-4a00-abf3-d5900e5999c7
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

43 B
395 B

13ms
13ms

Document
image/gif

213.19.147.44
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/native/third-party-iframes/third-party-iframes-966d1215afd0444df063.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.44 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:method: GET
:authority: sync.targeting.unrulymedia.com
:scheme: https
:path: /csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://video.unrulymedia.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003%22%7D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://video.unrulymedia.com/

Response headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-length: 43
set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003%22%7D; path=/; expires=Sat, 11 Jun 2022 19:04:12 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-type: text/html
cache-control: no-store, no-cache, must-revalidate
expires: 0
pragma: no-cache
location: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

GET
H2

200

RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003 Show response
sync.targeting.unrulymedia.com/csync/ Frame 700F
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/1cMuUcwh?redir=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fadobe%2F%24%7BTM_USER_ID%7D%3F
https://sync-tm.everesttech.net/ct/upi/pid/1cMuUcwh?redir=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fadobe%2F%24%7BTM_USER_ID%7D%3F&_test=YMOzrAABuGDxBQA4
https://usermatch.targeting.unrulymedia.com/usermatch/adobe/YMOzrAABuGDxBQA4?&_test=YMOzrAABuGDxBQA4
https://sync.1rx.io/usersync/adobe/YMOzrAABuGDxBQA4?&_test=YMOzrAABuGDxBQA4
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

43 B
395 B

14ms
13ms

Document
image/gif

213.19.147.44
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/native/third-party-iframes/third-party-iframes-966d1215afd0444df063.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.44 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:method: GET
:authority: sync.targeting.unrulymedia.com
:scheme: https
:path: /csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://video.unrulymedia.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003%22%7D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://video.unrulymedia.com/

Response headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-length: 43
set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003%22%7D; path=/; expires=Sat, 11 Jun 2022 19:04:12 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-type: text/html
cache-control: no-store, no-cache, must-revalidate
expires: 0
pragma: no-cache
location: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

GET
H2

200

RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003 Show response
sync.targeting.unrulymedia.com/csync/ Frame 9641
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=unruly&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=unruly&ttd_tpi=1
https://usermatch.targeting.unrulymedia.com/usermatch/tradedesk/07a0a9b4-68a9-4b7a-a363-1289796554cf
https://sync.1rx.io/usersync/tradedesk/07a0a9b4-68a9-4b7a-a363-1289796554cf
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

43 B
395 B

20ms
16ms

Document
image/gif

213.19.147.44
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/native/third-party-iframes/third-party-iframes-966d1215afd0444df063.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.44 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:method: GET
:authority: sync.targeting.unrulymedia.com
:scheme: https
:path: /csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://video.unrulymedia.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://video.unrulymedia.com/

Response headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-length: 43
set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003%22%7D; path=/; expires=Sat, 11 Jun 2022 19:04:12 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-type: text/html
cache-control: no-store, no-cache, must-revalidate
expires: 0
pragma: no-cache
location: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 61C0
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=unruly&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=unruly&endpoint=us-east

281 B
554 B

10ms
10ms

Document
text/html

104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=unruly&endpoint=us-east
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/native/third-party-iframes/third-party-iframes-966d1215afd0444df063.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://video.unrulymedia.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://video.unrulymedia.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 23 Feb 2021 20:47:52 GMT
ETag: "402b0-119-5bc0708346e00"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 11 Jun 2021 19:04:12 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?p=unruly&endpoint=us-east
Date: Fri, 11 Jun 2021 19:04:12 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H2

200

RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003 Show response
sync.targeting.unrulymedia.com/csync/ Frame 6067
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=41
https://usermatch.targeting.unrulymedia.com/usermatch/stackadapt/hXG71nWxSwBm-IKq_Ncc4Fn5QNM
https://sync.1rx.io/usersync/stackadapt/hXG71nWxSwBm-IKq_Ncc4Fn5QNM
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

43 B
395 B

13ms
13ms

Document
image/gif

213.19.147.44
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/native/third-party-iframes/third-party-iframes-966d1215afd0444df063.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.44 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:method: GET
:authority: sync.targeting.unrulymedia.com
:scheme: https
:path: /csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://video.unrulymedia.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003%22%7D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://video.unrulymedia.com/

Response headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-length: 43
set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003%22%7D; path=/; expires=Sat, 11 Jun 2022 19:04:12 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-type: text/html
cache-control: no-store, no-cache, must-revalidate
expires: 0
pragma: no-cache
location: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

GET
H2

200

RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003 Show response
sync.targeting.unrulymedia.com/csync/ Frame 2BA1
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/unruly/
https://usermatch.targeting.unrulymedia.com/usermatch/oath/y-QHcNiC9E2oWRGjFvXjcXEeEnNiZPekTqQM1T~A
https://sync.1rx.io/usersync/verizon/y-QHcNiC9E2oWRGjFvXjcXEeEnNiZPekTqQM1T~A
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

43 B
395 B

13ms
13ms

Document
image/gif

213.19.147.44
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/native/third-party-iframes/third-party-iframes-966d1215afd0444df063.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.44 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:method: GET
:authority: sync.targeting.unrulymedia.com
:scheme: https
:path: /csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://video.unrulymedia.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003%22%7D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://video.unrulymedia.com/

Response headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-length: 43
set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003%22%7D; path=/; expires=Sat, 11 Jun 2022 19:04:12 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-type: text/html
cache-control: no-store, no-cache, must-revalidate
expires: 0
pragma: no-cache
location: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

GET
H2

200

RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003 Show response
sync.targeting.unrulymedia.com/csync/ Frame CA5D
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=560138&ev=1&daaqp=1&rurl=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fpulsepoint%2F%25%25VGUID%25%25
https://usermatch.targeting.unrulymedia.com/usermatch/pulsepoint/rCas3EotCD55
https://sync.1rx.io/usersync/pulse/rCas3EotCD55
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

43 B
395 B

14ms
14ms

Document
image/gif

213.19.147.44
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/native/third-party-iframes/third-party-iframes-966d1215afd0444df063.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.44 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:method: GET
:authority: sync.targeting.unrulymedia.com
:scheme: https
:path: /csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://video.unrulymedia.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003%22%7D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://video.unrulymedia.com/

Response headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-length: 43
set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003%22%7D; path=/; expires=Sat, 11 Jun 2022 19:04:12 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

server: Tengine
date: Fri, 11 Jun 2021 19:04:12 GMT
content-type: text/html
cache-control: no-store, no-cache, must-revalidate
expires: 0
pragma: no-cache
location: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

GET
H/1.1

200
OK

Cookie set usermatch Show response
ssum-sec.casalemedia.com/ Frame FA19
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=182257&cb=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcasale%2F
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcasale%2F&s=182257&C=1

2 KB
3 KB

40ms
39ms

Document
text/html

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcasale%2F&s=182257&C=1
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/native/third-party-iframes/third-party-iframes-966d1215afd0444df063.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 6a4f642665bc8acd34fa8f09893d145e9670dd85627188b8badffbfcabd5fe49

Request headers

Host: ssum-sec.casalemedia.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://video.unrulymedia.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: CMID=YMOzrKHbpLreqAQQB4Ns4wAA; CMPS=3277
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://video.unrulymedia.com/

Response headers

Server: Apache
Content-Type: text/html
Dropped-Udsids: 230|241|39|45|51|196|206|73
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary: Is-Traffic-Usersync
Content-Length: 1778
Expires: Fri, 11 Jun 2021 19:04:12 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 11 Jun 2021 19:04:12 GMT
Connection: keep-alive
Set-Cookie: CMID=YMOzrKHbpLreqAQQB4Ns4wAA;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sat, 11 Jun 2022 19:04:12 GMT CMPS=3277;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Thu, 09 Sep 2021 19:04:12 GMT CMPRO=1141;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Thu, 09 Sep 2021 19:04:12 GMT CMST=YMOzrGDDs6wA;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sat, 12 Jun 2021 19:04:12 GMT CMRUM3=2760c3b3ac0b40&3360c3b3ac05a0&f160c3b3ac05a0&e660c3b3ac2760&c460c3b3ac05a0&4960c3b3ac05a0&2d60c3b3ac05a0&ce60c3b3ac05a0;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sat, 11 Jun 2022 19:04:12 GMT

Redirect headers

Server: Apache
Content-Length: 324
Content-Type: text/html; charset=iso-8859-1
Location: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcasale%2F&s=182257&C=1
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Expires: Fri, 11 Jun 2021 19:04:12 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 11 Jun 2021 19:04:12 GMT
Connection: keep-alive
Set-Cookie: CMID=YMOzrKHbpLreqAQQB4Ns4wAA;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sat, 11 Jun 2022 19:04:12 GMT CMPS=3277;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Thu, 09 Sep 2021 19:04:12 GMT

GET
H/1.1

400
Bad Request

unr Show response
match.prod.bidr.io/cookie-sync/ Frame 0843
Redirect Chain

https://match.prod.bidr.io/cookie-sync/unr
https://match.prod.bidr.io/cookie-sync/unr?_bee_ppp=1

20 B
596 B

31ms
31ms

Document
text/plain

52.49.183.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://match.prod.bidr.io/cookie-sync/unr?_bee_ppp=1

Requested by

Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/native/third-party-iframes/third-party-iframes-966d1215afd0444df063.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.49.183.138 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

64efdf33ff487ad815c53fe5f819454efd9364a0382e5f410972cfaa918fb66a

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Host: match.prod.bidr.io
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://video.unrulymedia.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: checkForPermission=ok
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://video.unrulymedia.com/

Response headers

content-type: text/plain
Date: Fri, 11 Jun 2021 19:04:12 GMT
Server: nginx
set-cookie: bito=AADxwk7Bh2cAADLUrDC5oA; Domain=bidr.io; expires=Mon, 11 Jul 2022 15:04:12 GMT; Path=/; SameSite=None; Secure bitoIsSecure=ok; Domain=bidr.io; expires=Mon, 11 Jul 2022 15:04:12 GMT; Path=/; SameSite=None; Secure checkForPermission=""; Domain=bidr.io; expires=Thu, 01 May 2008 00:00:00 GMT; Path=/; SameSite=None; Secure
strict-transport-security: max-age=2592000; includeSubDomains
Content-Length: 20
Connection: keep-alive

Redirect headers

Date: Fri, 11 Jun 2021 19:04:12 GMT
location: https://match.prod.bidr.io/cookie-sync/unr?_bee_ppp=1
Server: nginx
set-cookie: checkForPermission=ok; Domain=bidr.io; expires=Fri, 11 Jun 2021 19:14:12 GMT; Path=/; SameSite=None; Secure
strict-transport-security: max-age=2592000; includeSubDomains
Content-Length: 0
Connection: keep-alive

GET
H2

204

etWf-C7Wnahh0pr8L9PR83iHzfJhhsX_eoY9PTkl
sync.1rx.io/usersync/quantcast/ Frame C627
Redirect Chain

https://cms.quantserve.com/pixel/p-QcHdy7VcGLKJK.gif?idmatch=0
https://sync.1rx.io/usersync/quantcast/etWf-C7Wnahh0pr8L9PR83iHzfJhhsX_eoY9PTkl?gdpr=1

0
107 B

41ms
13ms

Image
text/plain

213.19.147.45
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.1rx.io/usersync/quantcast/etWf-C7Wnahh0pr8L9PR83iHzfJhhsX_eoY9PTkl?gdpr=1
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/iframes/third-party-iframes.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.45 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://video.unrulymedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:12 GMT
cache-control: no-store, no-cache, must-revalidate
server: Tengine
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:12 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://sync.1rx.io/usersync/quantcast/etWf-C7Wnahh0pr8L9PR83iHzfJhhsX_eoY9PTkl?gdpr=1
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
sync.targeting.unrulymedia.com/csync/ Frame C627
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=unruly_dbm&google_cm&google_sc
https://cm.g.doubleclick.net/pixel?google_nid=unruly_dbm&google_cm=&google_sc=&google_tc=
https://usermatch.targeting.unrulymedia.com/usermatch/google/CAESELHSRL0oWVyvcrIoRLIVfqc?google_cver=1
https://sync.1rx.io/usersync/google/CAESELHSRL0oWVyvcrIoRLIVfqc?google_cver=1
https://sync.1rx.io/usersync/google/CAESELHSRL0oWVyvcrIoRLIVfqc?zcc=1&dspret=0&cb=1623438252572
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

43 B
395 B

44ms
17ms

Image
image/gif

213.19.147.44
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Requested by: Host: video.unrulymedia.com
URL: https://video.unrulymedia.com/iframes/third-party-iframes.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.44 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://video.unrulymedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:12 GMT
server: Tengine
content-length: 43
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

location: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
pragma: no-cache
date: Fri, 11 Jun 2021 19:04:12 GMT
cache-control: no-store, no-cache, must-revalidate
server: Tengine
content-type: text/html
expires: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 61C0 31 KB
10 KB 8ms
8ms Script
text/html 104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=unruly&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 1e0c500c57328bcdd6992db38ed20a78a321a8b62197c1e0659231ed3ab1eb14

Request headers

Referer: https://eus.rubiconproject.com/usync.html?p=unruly&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 19:04:12 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Jun 2021 21:11:51 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=43467
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9302
Expires: Sat, 12 Jun 2021 07:08:39 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 61C0 284 B
536 B 76ms
35ms Image
image/jpg 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Content-Type: image/jpg

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame FA19
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YMOzrKHbpLreqAQQB4Ns4wAABHUAAAIB&gdpr_consent=&us_privacy=&gdpr=1
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEMZR8nhDy_hziVtNiKPuU6Q&google_cver=1

43 B
315 B

27ms
27ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEMZR8nhDy_hziVtNiKPuU6Q&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcasale%2F&s=182257&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 19:04:12 GMT
Server: Apache
Vary: Is-Traffic-Usersync
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 43
Expires: Fri, 11 Jun 2021 19:04:12 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEMZR8nhDy_hziVtNiKPuU6Q&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 343
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame FA19
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YMOzrKHbpLreqAQQB4Ns4wAABHUAAAIB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YMOzrKHbpLreqAQQB4Ns4wAABHUAAAIB&dcc=t

43 B
433 B

105ms
105ms

Image
image/gif

72.21.206.140
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YMOzrKHbpLreqAQQB4Ns4wAABHUAAAIB&dcc=t
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcasale%2F&s=182257&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 72.21.206.140 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: 206-140.amazon.com
Software: Server /
Resource Hash: c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Request headers

Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 19:04:13 GMT
Server: Server
Vary: User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 19:04:13 GMT
Server: Server
Vary: User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YMOzrKHbpLreqAQQB4Ns4wAABHUAAAIB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame FA19 70 B
264 B 37ms
35ms Image
image/gif 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale?cm_callback_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum&cm_dsp_id=70&cm_user_id=YMOzrKHbpLreqAQQB4Ns4wAA&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcasale%2F&s=182257&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:12 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame FA19
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YMOzrKHbpLreqAQQB4Ns4wAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENo0yr7aicoXuEhSdvDiw8A&google_cver=1&gdpr=1

43 B
999 B

32ms
32ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENo0yr7aicoXuEhSdvDiw8A&google_cver=1&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcasale%2F&s=182257&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 19:04:12 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 11 Jun 2021 19:04:12 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENo0yr7aicoXuEhSdvDiw8A&google_cver=1&gdpr=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 325
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sync
x.bidswitch.net/ Frame FA19 43 B
145 B 17ms
15ms Image
image/gif 52.29.176.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=index&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcasale%2F&s=182257&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.176.117 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-29-176-117.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:12 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame FA19
Redirect Chain

https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1
https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1&prevuid=&knw=0
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=

43 B
315 B

29ms
29ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcasale%2F&s=182257&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 19:04:13 GMT
Server: Apache
Vary: Is-Traffic-Usersync
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 43
Expires: Fri, 11 Jun 2021 19:04:13 GMT

Redirect headers

date: Fri, 11 Jun 2021 19:04:13 GMT
server: nginx
access-control-allow-origin: *
transfer-encoding: chunked
access-control-allow-methods: POST, GET, OPTIONS
p3p: CP="NOI DEV OUR BUS UNI"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
cache-control: no-cache
content-type: text/html; charset=UTF-8
access-control-allow-headers: Origin
keep-alive: timeout=10

GET
H/1.1 204
No Content sync
ups.analytics.yahoo.com/ups/55940/ Frame FA19 0
234 B 19ms
18ms Image
text/plain 3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=YMOzrKHbpLreqAQQB4Ns4wAABHUAAAIB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcasale%2F&s=182257&C=1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.128 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 19:04:12 GMT
Server: ATS/7.1.2.128
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 YMOzrKHbpLreqAQQB4Ns4wAABHUAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame FA19 43 B
99 B 34ms
33ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/YMOzrKHbpLreqAQQB4Ns4wAABHUAAAIB?gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcasale%2F&s=182257&C=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:12 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
sync.targeting.unrulymedia.com/csync/ Frame FA19
Redirect Chain

https://usermatch.targeting.unrulymedia.com/usermatch/casale/YMOzrKHbpLreqAQQB4Ns4wAA%261141
https://sync.1rx.io/usersync/index/YMOzrKHbpLreqAQQB4Ns4wAA&1141
https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003

43 B
395 B

13ms
13ms

Image
image/gif

213.19.147.44
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusermatch.targeting.unrulymedia.com%2Fusermatch%2Fcasale%2F&s=182257&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.44 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:12 GMT
server: Tengine
content-length: 43
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

location: https://sync.targeting.unrulymedia.com/csync/RX-78479bb8-8c96-4d22-9598-8e8efb247cfa-003
pragma: no-cache
date: Fri, 11 Jun 2021 19:04:12 GMT
cache-control: no-store, no-cache, must-revalidate
server: Tengine
content-type: text/html
expires: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 18ms
18ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 19:04:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 16ms
15ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 19:04:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 505 B
708 B 475ms
475ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3107597125158511&correlator=483909587649720&output=ldjh&impl=fif&eid=31060784%2C31061161%2C31061279%2C31061429%2C31061200%2C21066613%2C21066615&vrg=2021061001&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=3&rcs=1&prev_scp=iid13%3D1239263%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26a%3D%257C5%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dbillofsale_form_com-medrectangle-1-1239263%26eb_br%3D9e0a1ce5b2455cb9b48d5df4c6bf4053%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D350%26br2%3D350%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%252C0%252C28%252C67%252C45%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C782%26lb%3D700%26reqt%3D1623438252686&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1622671121&dt=1623438252695&dlt=1623438248817&idt=387&frm=20&biw=1600&bih=1200&oid=3&adxs=482&adys=5307&adks=3853710753&ucis=3&ifi=3&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&rumc=3107597125158511&rume=1&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x266&msz=300x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1441411795.1623438249&ga_sid=1623438249&ga_hid=566070678&ga_fc=false&fws=0&ohw=0&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

9ac02f4f4fbb7a170c6cc2c8749a917207f62461f25129680c964a1caf3d7b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 263
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 495 B
322 B 869ms
869ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3107597125158511&correlator=2272434853033581&output=ldjh&impl=fif&eid=31060784%2C31061161%2C31061279%2C31061429%2C31061200%2C21066613%2C21066615&vrg=2021061001&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ris=3&rcs=1&prev_scp=iid12%3D1169663%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C252%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dbillofsale_form_com-box-2-1169663%26eb_br%3Dc16fac08e79a971524b1c6834f5caad3%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D280%26br2%3D260%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%252C117%252C120%252C67%252C51%252C116%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C815%2C817%2C899%2C903%2C919%2C782%2C20%26lb%3D550%26reqt%3D1623438252689&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1622671121&dt=1623438252697&dlt=1623438248817&idt=387&frm=20&biw=1600&bih=1200&oid=3&adxs=308&adys=183&adks=3053355510&ucis=4&ifi=4&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&rumc=3107597125158511&rume=1&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90&msz=728x90&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1441411795.1623438249&ga_sid=1623438249&ga_hid=566070678&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

3724650f68d9864f04dd2b43a0fa74e196e6019c803c75f0fe961af4639043f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 26ms
24ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 19:04:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 19:04:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
10 KB 431ms
431ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3107597125158511&correlator=354626093400007&output=ldjh&impl=fif&eid=31060784%2C31061161%2C31061279%2C31061429%2C31061200%2C21066613%2C21066615&vrg=2021061001&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=2&rcs=2&prev_scp=iid13%3D1239263%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26a%3D%257C5%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dbillofsale_form_com-medrectangle-1-1239263%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D120%26br2%3D350%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%252C0%252C28%252C67%252C45%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C782%2C17%2C20%26lb%3D350%26reqt%3D1623438253201&eri=1&cookie=ID%3D1d441d504f4973f8%3AT%3D1623438252%3AS%3DALNI_Mbn2e16WLvcABU4166KBO8sU3jvxQ&bc=31&abxe=1&lmt=1622671121&dt=1623438254206&dlt=1623438248817&idt=387&frm=20&biw=1600&bih=1200&oid=3&adxs=482&adys=5307&adks=3853710753&ucis=5&ifi=5&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&rumc=3107597125158511&rume=1&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x266&msz=300x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1441411795.1623438249&ga_sid=1623438249&ga_hid=566070678&ga_fc=false&fws=0&ohw=0&btvi=3&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

28eaab762ea585c84f788d0e8608c30a9c879475db106c1ff754299708adcf51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9717
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 17ms
16ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 19:04:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.billofsale-form.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 19:04:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
9 KB 586ms
586ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3107597125158511&correlator=1203646609566595&output=ldjh&impl=fif&eid=31060784%2C31061161%2C31061279%2C31061429%2C31061200%2C21066613%2C21066615&vrg=2021061001&ptt=17&sc=1&sfv=1-0-38&ecs=20210611&iu_parts=1254144%2Cbillofsale_form_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ris=2&rcs=2&prev_scp=iid12%3D1169663%26t%3D134%26d%3D26431%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C252%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dbillofsale_form_com-box-2-1169663%26eb_br%3Da495ce7dbb4cefcd3e0a722048894f41%26eba%3D1%26ebss%3D10017%2C11304%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D100%26br2%3D260%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%252C117%252C120%252C67%252C51%252C116%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C815%2C817%2C899%2C903%2C919%2C782%2C20%2C17%2C20%26lb%3D280%26reqt%3D1623438253573&eri=1&cookie=ID%3D1d441d504f4973f8%3AT%3D1623438252%3AS%3DALNI_Mbn2e16WLvcABU4166KBO8sU3jvxQ&bc=31&abxe=1&lmt=1622671121&dt=1623438254577&dlt=1623438248817&idt=387&frm=20&biw=1600&bih=1200&oid=3&adxs=308&adys=183&adks=3053355510&ucis=6&ifi=6&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.billofsale-form.com%2F&rumc=3107597125158511&rume=1&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90&msz=728x90&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1441411795.1623438249&ga_sid=1623438249&ga_hid=566070678&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

ebe05f4737785920d862f2fffc18cf51f433282098cea15d3f860442bdd815dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:15 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9538
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.billofsale-form.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
BLOB 200
OK 57cc7fe3-f296-425c-bfec-770a1d5c1d44
https://www.billofsale-form.com/ 131 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.billofsale-form.com/57cc7fe3-f296-425c-bfec-770a1d5c1d44
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b58ee3d7b8cf7715cb2efcc2910ced1fbeeac027b23a5f5b600cd8c07c100b1f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length: 131
Content-Type: text/javascript

GET
H2 200 army.gif Show response
www.billofsale-form.com/porpoiseant/ 0
415 B 52ms
52ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTIzOTI2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYWRfcG9zaXRpb24iOjExMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjEwMzUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNjk2NjMiLCJkb21haW5faWQiOiIyNjQzMSIsInVuaXQiOiJkaXYtZ3B0LWFkLWJpbGxvZnNhbGVfZm9ybV9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjM0MzgyNDgsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjUwMDFmMTcxLTEyNDQtNGViZi02YWJkLTY2ZmZiZWViYjUzMyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiIyNiJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTIzOTI2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYWRfcG9zaXRpb24iOjExMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjEwMzUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNjk2NjMiLCJkb21haW5faWQiOiIyNjQzMSIsInVuaXQiOiJkaXYtZ3B0LWFkLWJpbGxvZnNhbGVfZm9ybV9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjM0MzgyNDgsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjUwMDFmMTcxLTEyNDQtNGViZi02YWJkLTY2ZmZiZWViYjUzMyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiIyNiJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-06-11T19%3A04%3A12.458363Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Fri%2C%2011%20Jun%202021%2019%3A04%3A12%20GMT; __gads=ID=1d441d504f4973f8:T=1623438252:S=ALNI_Mbn2e16WLvcABU4166KBO8sU3jvxQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:14 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9e0efa5700004e920d146000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=68O4j7bL9%2BXGPrKTQxlR1cvyJW8MTWmBKHsbRWWg3t5jWdauUjvai%2Fwp0CWuvvnUHczRrsM96%2BRj06cztgmNh3stGsfzjmtL7Lb4O7WvsEZdRIdI5Z56qcruBXUKMftcowWxNzk9jFwCaGZml3Szwl8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dd1aa3bef64e92-FRA
expires: Thu, 10 Jun 2021 19:04:14 UTC

GET
H2 200 army.gif Show response
www.billofsale-form.com/porpoiseant/ 0
299 B 55ms
55ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTIzOTI2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYWRfcG9zaXRpb24iOjExMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiNDgyIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiI1MzA3In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE2OTY2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMzA4In0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIxODMifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTIzOTI2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYWRfcG9zaXRpb24iOjExMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiNDgyIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiI1MzA3In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE2OTY2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMzA4In0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIxODMifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-06-11T19%3A04%3A12.458363Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Fri%2C%2011%20Jun%202021%2019%3A04%3A12%20GMT; __gads=ID=1d441d504f4973f8:T=1623438252:S=ALNI_Mbn2e16WLvcABU4166KBO8sU3jvxQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:14 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9e0efa5800004e92929cc000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=vbL5kPYrw6kj0tOFDLIIjJzbjzhNLFdgDItzQleMcRsWAZXoTCFrr5hv1a69CfuS%2FKkzuWHKYCLqSWT1WrXisf9WBLAKblbeAU%2FDDnU4z4CO%2B%2BzAVb9PYHb1P%2FMGLVZoBv80i71VobtMgk%2BCwFtpehU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dd1aa3bef84e92-FRA
expires: Thu, 10 Jun 2021 19:04:14 UTC

GET
BLOB 200
OK 3ba7ef53-ffd1-469e-8872-402e7e975b9b
https://www.billofsale-form.com/ 131 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.billofsale-form.com/3ba7ef53-ffd1-469e-8872-402e7e975b9b
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b58ee3d7b8cf7715cb2efcc2910ced1fbeeac027b23a5f5b600cd8c07c100b1f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length: 131
Content-Type: text/javascript

GET
H2 200 container.html Show response
9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame ABBB 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.billofsale-form.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.billofsale-form.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Fri, 11 Jun 2021 19:04:09 GMT
expires: Sat, 11 Jun 2022 19:04:09 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 6
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061001.js?31061429

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

34e9a619897b9223115c6588f352612268c90c3d83990829768973759b0d1a6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:15 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623263566164500"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28162
x-xss-protection: 0
expires: Fri, 11 Jun 2021 19:04:15 GMT

GET
H3-29 200 greenoaks.gif Show response
www.billofsale-form.com/detroitchicago/ 0
681 B 42ms
42ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MzgyNDgsImRhdGEiOlt7Im5hbWUiOiJ0aW1lcl9maXJzdF9hZF9sb2FkIiwidmFsIjoiNjU2MiJ9XX1d
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MzgyNDgsImRhdGEiOlt7Im5hbWUiOiJ0aW1lcl9maXJzdF9hZF9sb2FkIiwidmFsIjoiNjU2MiJ9XX1d
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-06-11T19%3A04%3A12.458363Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Fri%2C%2011%20Jun%202021%2019%3A04%3A12%20GMT; __gads=ID=1d441d504f4973f8:T=1623438252:S=ALNI_Mbn2e16WLvcABU4166KBO8sU3jvxQ; ezouspvv=100; ezouspva=1; ezouspvh=100
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:15 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9e0efd1900004ebc3ba4b000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=GNDM18bzq%2BwPGqJ5%2FXAoKSyqsUk%2FKDFtWz%2FFoZCv3yAkAG7Ae47d5uezzU3SATV4I%2F2guT5ZT3vfyf%2FSm%2FNS6%2FOpnOCYxyKGNFkpK7zTL0E53cxof5VcbU%2B600L4gkmPzcJAlMqMDzbLLMrbWKoF%2BNI%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dd1aa82ff14ebc-FRA
expires: Thu, 10 Jun 2021 19:04:15 UTC

GET
H3-29 200 army.gif Show response
www.billofsale-form.com/porpoiseant/ 0
665 B 34ms
33ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE2OTY2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiIzIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTY5NjYzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDM4MjQ4LCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiYTQ5NWNlN2RiYjRjZWZjZDNlMGE3MjIwNDg4OTRmNDEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNjk2NjMiLCJkb21haW5faWQiOiIyNjQzMSIsInVuaXQiOiJkaXYtZ3B0LWFkLWJpbGxvZnNhbGVfZm9ybV9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjM0MzgyNDgsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMSwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMSwiYmlkX2Zsb29yX3ByZXYiOjAuMDAyOCwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNjk2NjMiLCJkb21haW5faWQiOiIyNjQzMSIsInVuaXQiOiJkaXYtZ3B0LWFkLWJpbGxvZnNhbGVfZm9ybV9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjM0MzgyNDgsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjUwMDFmMTcxLTEyNDQtNGViZi02YWJkLTY2ZmZiZWViYjUzMyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1MTYsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDAzNDUxNiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE2OTY2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE2OTY2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiIzIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTY5NjYzIiwiZG9tYWluX2lkIjoiMjY0MzEiLCJ1bml0IjoiZGl2LWdwdC1hZC1iaWxsb2ZzYWxlX2Zvcm1fY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIzNDM4MjQ4LCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiYTQ5NWNlN2RiYjRjZWZjZDNlMGE3MjIwNDg4OTRmNDEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNjk2NjMiLCJkb21haW5faWQiOiIyNjQzMSIsInVuaXQiOiJkaXYtZ3B0LWFkLWJpbGxvZnNhbGVfZm9ybV9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjM0MzgyNDgsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMSwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMSwiYmlkX2Zsb29yX3ByZXYiOjAuMDAyOCwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNjk2NjMiLCJkb21haW5faWQiOiIyNjQzMSIsInVuaXQiOiJkaXYtZ3B0LWFkLWJpbGxvZnNhbGVfZm9ybV9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjM0MzgyNDgsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjUwMDFmMTcxLTEyNDQtNGViZi02YWJkLTY2ZmZiZWViYjUzMyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1MTYsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDAzNDUxNiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE2OTY2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-06-11T19%3A04%3A12.458363Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Fri%2C%2011%20Jun%202021%2019%3A04%3A12%20GMT; __gads=ID=1d441d504f4973f8:T=1623438252:S=ALNI_Mbn2e16WLvcABU4166KBO8sU3jvxQ; ezouspvv=100; ezouspva=1; ezouspvh=100
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:15 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9e0efd1a00004ebc18181000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=DEbEEUXSb5QOhlaq4U8w4i3KVOfCV89QhTsN%2BSAacYKCxdF2W%2BoSvPcKnpm6uq9zk2P14pIt5tt9m34jpcaXdGYgKBz3xPgXA40GIeqN8hcj3RcW0NE5iae4oPz79W7hqsFCGOR29Nkd6tnMoPZpeKE%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dd1aa82ff64ebc-FRA
expires: Thu, 10 Jun 2021 19:04:15 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
93 B 55ms
16ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/porpoiseant/banger.js?cb=194-2&bv=19&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 11 Jun 2021 19:04:15 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H3-29 200 army.gif Show response
www.billofsale-form.com/porpoiseant/ 0
676 B 37ms
37ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE2OTY2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDYtMTEifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMSJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI1In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE2OTY2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDYtMTEifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMSJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI1In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-06-11T19%3A04%3A12.458363Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Fri%2C%2011%20Jun%202021%2019%3A04%3A12%20GMT; __gads=ID=1d441d504f4973f8:T=1623438252:S=ALNI_Mbn2e16WLvcABU4166KBO8sU3jvxQ; ezouspvv=100; ezouspva=1; ezouspvh=100
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:15 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9e0efd1900004ebc532d2000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=JKqCZ3piEAwqu1rZFUYC8EX4S9uQg1TnXZ92Z4ER4XYgJR6ZZSWk3ciRRDDJB%2BoqcWZMY5dTXf%2B%2FNazCOLSYrxqDQrfvnmLRTXQFzYmvJo%2BIfFEotV91NeLMybTw75HYyEIvVQqzTDsjQZxpySjKrXk%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dd1aa82ff84ebc-FRA
expires: Thu, 10 Jun 2021 19:04:15 UTC

GET
H3-29 200 army.gif Show response
www.billofsale-form.com/porpoiseant/ 0
671 B 33ms
33ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTE2OTY2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYXVjdGlvbl9lcG9jaCI6MTYyMzQzODI1NSwiYWRfcG9zaXRpb24iOjExMTIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJiaWRfZmxvb3JfaW5pdGlhbCI6NTUwLCJiaWRfZmxvb3JfcHJldiI6MjgwLCJiaWRfZmxvb3JfZmlsbGVkIjoxMDAsImF1Y3Rpb25fY291bnQiOjMsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjc5OSwibXVsdGlfYWRfdW5pdCI6MCwibXVsdGlfYWRfY291bnQiOjAsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjoyODY4NzI3NH1d
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTE2OTY2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYXVjdGlvbl9lcG9jaCI6MTYyMzQzODI1NSwiYWRfcG9zaXRpb24iOjExMTIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJiaWRfZmxvb3JfaW5pdGlhbCI6NTUwLCJiaWRfZmxvb3JfcHJldiI6MjgwLCJiaWRfZmxvb3JfZmlsbGVkIjoxMDAsImF1Y3Rpb25fY291bnQiOjMsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjc5OSwibXVsdGlfYWRfdW5pdCI6MCwibXVsdGlfYWRfY291bnQiOjAsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjoyODY4NzI3NH1d
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-06-11T19%3A04%3A12.458363Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Fri%2C%2011%20Jun%202021%2019%3A04%3A12%20GMT; __gads=ID=1d441d504f4973f8:T=1623438252:S=ALNI_Mbn2e16WLvcABU4166KBO8sU3jvxQ; ezouspvv=100; ezouspva=1; ezouspvh=100
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:15 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9e0efd1a00004ebc582c5000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=WJ67CCEF6nHpBP8wO4crXLYZS5r53vV8WBkyq2h9L%2FSaaepJdWlpe%2Fwjl0IZgN4xS4VgxEQ1oL2l34%2F2W3gfdQBQA2vSwEcrKTxf%2FD%2F09CvLNKl7TWWM1XSuIKrAM1puZEP9BNUthrN1IVeTeq31chc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dd1aa82ffd4ebc-FRA
expires: Thu, 10 Jun 2021 19:04:15 UTC

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6E6A 624 B
350 B 18ms
18ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeX3QEQoJjlARjk9t6sATAB&v=APEucNWUG6GfSsEH1iZ13hhilYA-gwb5SLsiGzbh0A1C05iT-MO2gJ7qDk0i_5V407Fd335ltvLMET_1qEJdcPEu2lGMV80HxXk19VZZE9feBRKVvKKNA06X2AeBS4mLCA4hbg2vK2tX37MUPA7ATDz3dndGj11EEWDfkF49A09LaF539gWSm3s8we2UxbfVbhWX9a3NWhemX20B6Px66TZVWPnh6wafaw

Requested by

Host: 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
URL: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJeX3QEQoJjlARjk9t6sATAB&v=APEucNWUG6GfSsEH1iZ13hhilYA-gwb5SLsiGzbh0A1C05iT-MO2gJ7qDk0i_5V407Fd335ltvLMET_1qEJdcPEu2lGMV80HxXk19VZZE9feBRKVvKKNA06X2AeBS4mLCA4hbg2vK2tX37MUPA7ATDz3dndGj11EEWDfkF49A09LaF539gWSm3s8we2UxbfVbhWX9a3NWhemX20B6Px66TZVWPnh6wafaw
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUm70a3q_gH8b2n3TgYHMTOrogsv4D6mT_aEDcw8s9Qhu-Gk6qshZfKINOuf738
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Fri, 11 Jun 2021 19:04:15 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame ABBB 60 KB
25 KB 48ms
47ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CUUkMlTWN9aUImtWN8rnigyEq4lWAMuxhF8mGtuMbkUZV4AGcOTemY5qqqwGso4AmQyAxqKh0NRrkBpiwTP8-wsHt1ybHGpQocYbEuzbYBBXA8-v7mYzsmyIsJcSAkv1rkO5pFxQWRSYJIHOr6RCyV7uXT5w&dbm_d=AKAmf-DaL1QpHzumIYzYV31NNS_DilUI7YYY1P9QcyzcMxqU7ClGpBikxdGY8Bm1BmMJfvjIqKrFFJAVIctz_r1GrQetuz9PR2MAo3az_JitaZXBk6trPK6YhMTStbJOQ_nID28n-FP1huL440OLSRw3EAjOkhiVbpMElYsi6LmQ6Ouv1Eq6EfQ-79r2daqBGDCEVLbg7iAJatnMNXNADdUQykyH_KgkLEuqi36tXeZUOl2Lm_XILCwqwvQ6I9bYL35S0PLSIlFaeqKuO2oa8Q8CRWai9MFtUfKzR9bkAmQRU_OYfBWlia4ELJAmKq1NRLxzxLZPR1SgwNKIpnFyn49nnBuCt5D_2ebQK97tnXXosn1OsWeCpuKg3QahqkTgCbXGKIVf6orm-Za7Nbm-vjidSY-JEf2G5CmHt1zauI3Q91YNvODYvu9S54_FmLSQmF7BcqdshiDmsg2Ho_nlFQGdBN6yxjIkW2QavdG2mM7NGmZzQ1SzRuRvaTY2Zz07YDS_b2C8alZQqPs-wfPTVyoPs_qMjix74lxlp0BBQ2MSoMM0lBfD7gK233genCNB3CxMQkhg5jdy0URJRrmvpPQgSpcqB3Q7-me3Oz5ZQridmr5UvcNMz-kMRiRBBoSbtV2INIWz6zSLDff2CFu-zSODJ5BwDWDNsbjaOkRXr5_hgk59FGWRPWf9SGwkCsVywjBVCLq8MNK9r1y79xNz48QHfPuN43WG5L-dGnzI1Y46q6uHiyH6UWhNDrrONU-ADMk2W5DkZwGP5jU3aTUcgrqrvKnEH3lYJSYZc813wAdtxEAcOtDuDbblTL1dNG_o3e9bwopItKYxLYuaiwWWbPK0w8tVmVPsySuZRzeOsvWQ9QwJix1A2OXqwpp8cVisRsOPjEcY4dFttcYJp6vuzGbAWN-I30Q1I9VjaZhFfEz_DAIMiy7xOj5gjhfNXVGv7vIXEHJ0-z6lP90Bjr4BpEAiMkZeRQfFVeHnnmL7MN3z_2wp3T1BsiZ0LE5py6iC1h6Qf6hVKqDJCy5HCqI4BsmGB2tcSjF-wUWB6XvzY1fNb4RQzJZF0PfXJyuXmiH-KDoqf20Qfi2w4Ige1bewRVcETRyy6Hp0fhlEzHsfua4cLb2IJ0SoVAop3dl61J2FtXO74Kh3WulD61b_GDx8xwUd6hzQkGnbLBM0f90LzZut8cm3Z32sIYHPCr6TelnXfRua72NkVthDxWCCLKEbXWD0QTdJPlx8Pdt2aOHQIafWu6iqtkvGdsXhjuv7cLhsD7wbRuhc-AFRGfPOjxhfoYyn7rfB7eA3EBITtxZYPUDXSc866fSssNXcsRQsd4MSbIRikWC9B7Yf4wk_rT2ShpniQ_nc78OtA6Gex0dRVsutfMpoh79wPNxAJhjyfurTy0-ZG-fGsIztFlwyEDhKqdEyjpgdyKQVzCRpHj11t94ZktFRDTq59aDDZX_fdHHhVzVJfhGRTAqzgKHfM7o0GQj1o3wGvxQaxsA_8dAtvbE0u-cFl_YYVVhWqhUB1YFMOjRBcr4kquS9zsgxsUojmk_9z7QXL3UMIE4qkuFbWN3TPthDMAQ2LzflQuuBF-iV_Dvn1nIkateOGYP0zLvF5pqbpjzHrjTeSCBGYxCmger0rBP2UcZF1gbHhTyFBVye93PltC0qtBFkwO2u3sgVVR4E7w_W7QFf0bOHhPMprRxPrqx3Xig1J6X0BVjYELY6TuG6_Y2dnqpThEl9oaEDSmamdw--qEFo_TFGPBTb1ANeb-GML5s9CHU3bQdASFtKWqEecw2TTbSN00_RswCWenaqz6Is4I2nB6rYLA3Qj-SAxGrIF_JmHOcG-FeSwnOcZ4-hmdEIj1fy2HWm_76RuV1lbyA3rD0zO_kw2uajKKTnqSlStaj-v2b1GJrLPYAe0_jUpnNtbHCfDbyy1ANSgcmfWIe8ryWD5AH5MiCOefArIPLlTTEKGuBuGGVNI2TyxLSg-N4sq9jP52GjsR1CjBdjH3BxrBuMOjDBr7Hh3OW1bHv3qvjuPRJEy-avdBCgN20W95TkxOxTuP-MlJjfEvrZPqn0mSU_FYl8MsYQ9-Pr3_WQh-gUlYzQEeBNOyt2NjMkAnrw_5tdkAYMUV-oJvhTKwxmdXic7byJBbAiq8vRAcmnUUK-XWVBt3oFMAWbPT-nttlA8EJAny2UsRafYWDjILDhfGblDijKx8t8PJgPi8om21DXnJB-7G3sf4LuRwAEMmFQo-wisv6-e6EQgpnI6fKNm0lYx6Nh9wjNcC9GYu4tCBi1YPGN1PG5OpOAOidWLNm3LycOiAhr4jXQi48KYikTzQaBxn1xw9S_e92ZCocXZwfHTsv3HXh2ebCTpG54Q1pcFu7gsDu4hioR1X3qwuVswhDYsj7hBI7NSJqoVMhx_CsYBJB13V5rmhjhg_uWFcUyJXDm-Lb8y3nU7rWRMcFAEL46C60iS7o5xLI-vzXUuVZCkSB11D5esanWj4s5FF5EUrVShNGebWfUiryEUEG4IcXiJI4mqGPvC86lnxX-d4ximWurnC1FkpcKfujl46zQoNm8r-1LVDI3qChgl8edZL5EMDSGrXn9jlhLHB8BRUwSTDND3UwhaluDLJKnitdLjCEf_tviNJYXGKniwMb0YoP7NiS1XFVv8Ze2evqF9d7xiNwtDNojJ8qLMS_fpGW9Not8yZncq7pDgICaUlgi86xBYlTo-sQU7rBGSpRbtdY818p1V8JqI5U74PiZfSBBWImkRPKHOlazXnRktGXkSxa4z8dqY8U_g1kw-G47GU25ZCvCGjvc7djg_wpq5E66zCagwuXE-pbpUyv9qOKXOQlSwACdiWTgrLNsSkDMI8qYTXc5ckeXBbnZ-aMBANpD22nLgsumiQXwVgdWDLX_e0xV6izBomfctlNy4WvKk-A_P48kG1wp9sLnQkCOEcd21-4SXs_fFwkNNOtIEZpWu1Mmz7QGE91QOh4J4oJMc4xcc-px1u9BlsZcGb-sGqomh8zxRefRyiAbxZ8oI2CoL0PSol9-mJOJSoo0NOwmn7AStG8e41_KgGQvE3EZz-AGAHj_hqhqHsbAqgOtJebvWi0qp_dpP78dPIesndQYU_aIaqIbxaLo9f4JHAtzOHS9dPSq4BUjqK1UO1JHefRe-tKzEeOpuJTcplvIx-1tJXhnYBA&cid=CAASEuRoa1UTf8EiklvpUswaJNbRFw&rfl=1%2Chttps%253A%252F%252Fwww.billofsale-form.com%252F%240

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a62d98c587c63d75303477d6ee39d83eb76cf095c40016d3334b79f48e724d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25138
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame ABBB 42 B
110 B 15ms
14ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Bm1cNh_klmwDYCs-DGJ0z-EAlPFDeXZMa61vZojF8F_-SVY5XVGH54BmwWqYjRh90gTPl8rpBhi4Tc2BlmsE8w-AppK9t63cTBgteEuwTR8Mt6jGg

Requested by

Host: 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
URL: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/ Frame ABBB 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/window_focus_fy2019.js

Requested by

Host: 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
URL: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 18:58:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 323
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1316
x-xss-protection: 0
server: cafe
etag: 797314601362473214
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 25 Jun 2021 18:58:52 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame ABBB 122 KB
37 KB 24ms
20ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
URL: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5e762276ffd20732a10037842bac383dc64a7b230ab1f48f2a0ff7406b8b9c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:15 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623263560240521"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37945
x-xss-protection: 0
expires: Fri, 11 Jun 2021 19:04:15 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/ Frame ABBB 13 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
URL: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:03:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5644
x-xss-protection: 0
server: cafe
etag: 16788636151609896382
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 25 Jun 2021 19:03:37 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6E6A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENo0yr7aicoXuEhSdvDiw8A&google_cver=1

43 B
1 KB

50ms
35ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENo0yr7aicoXuEhSdvDiw8A&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeX3QEQoJjlARjk9t6sATAB&v=APEucNWUG6GfSsEH1iZ13hhilYA-gwb5SLsiGzbh0A1C05iT-MO2gJ7qDk0i_5V407Fd335ltvLMET_1qEJdcPEu2lGMV80HxXk19VZZE9feBRKVvKKNA06X2AeBS4mLCA4hbg2vK2tX37MUPA7ATDz3dndGj11EEWDfkF49A09LaF539gWSm3s8we2UxbfVbhWX9a3NWhemX20B6Px66TZVWPnh6wafaw
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 19:04:15 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 11 Jun 2021 19:04:15 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENo0yr7aicoXuEhSdvDiw8A&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6E6A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMOzrKHbpLreqAQQB4Ns4wAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENo0yr7aicoXuEhSdvDiw8A&google_cver=1

43 B
999 B

31ms
31ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENo0yr7aicoXuEhSdvDiw8A&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeX3QEQoJjlARjk9t6sATAB&v=APEucNWUG6GfSsEH1iZ13hhilYA-gwb5SLsiGzbh0A1C05iT-MO2gJ7qDk0i_5V407Fd335ltvLMET_1qEJdcPEu2lGMV80HxXk19VZZE9feBRKVvKKNA06X2AeBS4mLCA4hbg2vK2tX37MUPA7ATDz3dndGj11EEWDfkF49A09LaF539gWSm3s8we2UxbfVbhWX9a3NWhemX20B6Px66TZVWPnh6wafaw
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 19:04:15 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 11 Jun 2021 19:04:15 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENo0yr7aicoXuEhSdvDiw8A&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 6E6A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFDI09SId3ZiyV8qJgv-Gdw&google_cver=1

43 B
1022 B

14ms
14ms

Image
image/gif

185.33.221.13
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFDI09SId3ZiyV8qJgv-Gdw&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeX3QEQoJjlARjk9t6sATAB&v=APEucNWUG6GfSsEH1iZ13hhilYA-gwb5SLsiGzbh0A1C05iT-MO2gJ7qDk0i_5V407Fd335ltvLMET_1qEJdcPEu2lGMV80HxXk19VZZE9feBRKVvKKNA06X2AeBS4mLCA4hbg2vK2tX37MUPA7ATDz3dndGj11EEWDfkF49A09LaF539gWSm3s8we2UxbfVbhWX9a3NWhemX20B6Px66TZVWPnh6wafaw

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.13 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 19:04:15 GMT
X-Proxy-Origin: 89.249.64.211; 89.249.64.211; 729.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.221.48:80
AN-X-Request-Uuid: b7442a63-ecd3-4e55-b895-2512c49dd4bb
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFDI09SId3ZiyV8qJgv-Gdw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6E6A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODYzMjM1OTEyNzg3OTE1NTg1MA%3D%3D

170 B
188 B

16ms
16ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODYzMjM1OTEyNzg3OTE1NTg1MA%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 11 Jun 2021 19:04:15 GMT
X-Proxy-Origin: 89.249.64.211; 89.249.64.211; 729.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.165:80
AN-X-Request-Uuid: 8892cb84-7179-4988-9d8f-056d59ce9a58
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODYzMjM1OTEyNzg3OTE1NTg1MA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame ABBB 176 KB
61 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2f126a8957c32db99e94d1bf7c9ed09fcd38ba99bd632ebd048f01f9c5f9c9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 10:46:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29875
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62241
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:47 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 12 Jun 2021 10:46:20 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/elements/html/ Frame ABBB 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CUUkMlTWN9aUImtWN8rnigyEq4lWAMuxhF8mGtuMbkUZV4AGcOTemY5qqqwGso4AmQyAxqKh0NRrkBpiwTP8-wsHt1ybHGpQocYbEuzbYBBXA8-v7mYzsmyIsJcSAkv1rkO5pFxQWRSYJIHOr6RCyV7uXT5w&dbm_d=AKAmf-DaL1QpHzumIYzYV31NNS_DilUI7YYY1P9QcyzcMxqU7ClGpBikxdGY8Bm1BmMJfvjIqKrFFJAVIctz_r1GrQetuz9PR2MAo3az_JitaZXBk6trPK6YhMTStbJOQ_nID28n-FP1huL440OLSRw3EAjOkhiVbpMElYsi6LmQ6Ouv1Eq6EfQ-79r2daqBGDCEVLbg7iAJatnMNXNADdUQykyH_KgkLEuqi36tXeZUOl2Lm_XILCwqwvQ6I9bYL35S0PLSIlFaeqKuO2oa8Q8CRWai9MFtUfKzR9bkAmQRU_OYfBWlia4ELJAmKq1NRLxzxLZPR1SgwNKIpnFyn49nnBuCt5D_2ebQK97tnXXosn1OsWeCpuKg3QahqkTgCbXGKIVf6orm-Za7Nbm-vjidSY-JEf2G5CmHt1zauI3Q91YNvODYvu9S54_FmLSQmF7BcqdshiDmsg2Ho_nlFQGdBN6yxjIkW2QavdG2mM7NGmZzQ1SzRuRvaTY2Zz07YDS_b2C8alZQqPs-wfPTVyoPs_qMjix74lxlp0BBQ2MSoMM0lBfD7gK233genCNB3CxMQkhg5jdy0URJRrmvpPQgSpcqB3Q7-me3Oz5ZQridmr5UvcNMz-kMRiRBBoSbtV2INIWz6zSLDff2CFu-zSODJ5BwDWDNsbjaOkRXr5_hgk59FGWRPWf9SGwkCsVywjBVCLq8MNK9r1y79xNz48QHfPuN43WG5L-dGnzI1Y46q6uHiyH6UWhNDrrONU-ADMk2W5DkZwGP5jU3aTUcgrqrvKnEH3lYJSYZc813wAdtxEAcOtDuDbblTL1dNG_o3e9bwopItKYxLYuaiwWWbPK0w8tVmVPsySuZRzeOsvWQ9QwJix1A2OXqwpp8cVisRsOPjEcY4dFttcYJp6vuzGbAWN-I30Q1I9VjaZhFfEz_DAIMiy7xOj5gjhfNXVGv7vIXEHJ0-z6lP90Bjr4BpEAiMkZeRQfFVeHnnmL7MN3z_2wp3T1BsiZ0LE5py6iC1h6Qf6hVKqDJCy5HCqI4BsmGB2tcSjF-wUWB6XvzY1fNb4RQzJZF0PfXJyuXmiH-KDoqf20Qfi2w4Ige1bewRVcETRyy6Hp0fhlEzHsfua4cLb2IJ0SoVAop3dl61J2FtXO74Kh3WulD61b_GDx8xwUd6hzQkGnbLBM0f90LzZut8cm3Z32sIYHPCr6TelnXfRua72NkVthDxWCCLKEbXWD0QTdJPlx8Pdt2aOHQIafWu6iqtkvGdsXhjuv7cLhsD7wbRuhc-AFRGfPOjxhfoYyn7rfB7eA3EBITtxZYPUDXSc866fSssNXcsRQsd4MSbIRikWC9B7Yf4wk_rT2ShpniQ_nc78OtA6Gex0dRVsutfMpoh79wPNxAJhjyfurTy0-ZG-fGsIztFlwyEDhKqdEyjpgdyKQVzCRpHj11t94ZktFRDTq59aDDZX_fdHHhVzVJfhGRTAqzgKHfM7o0GQj1o3wGvxQaxsA_8dAtvbE0u-cFl_YYVVhWqhUB1YFMOjRBcr4kquS9zsgxsUojmk_9z7QXL3UMIE4qkuFbWN3TPthDMAQ2LzflQuuBF-iV_Dvn1nIkateOGYP0zLvF5pqbpjzHrjTeSCBGYxCmger0rBP2UcZF1gbHhTyFBVye93PltC0qtBFkwO2u3sgVVR4E7w_W7QFf0bOHhPMprRxPrqx3Xig1J6X0BVjYELY6TuG6_Y2dnqpThEl9oaEDSmamdw--qEFo_TFGPBTb1ANeb-GML5s9CHU3bQdASFtKWqEecw2TTbSN00_RswCWenaqz6Is4I2nB6rYLA3Qj-SAxGrIF_JmHOcG-FeSwnOcZ4-hmdEIj1fy2HWm_76RuV1lbyA3rD0zO_kw2uajKKTnqSlStaj-v2b1GJrLPYAe0_jUpnNtbHCfDbyy1ANSgcmfWIe8ryWD5AH5MiCOefArIPLlTTEKGuBuGGVNI2TyxLSg-N4sq9jP52GjsR1CjBdjH3BxrBuMOjDBr7Hh3OW1bHv3qvjuPRJEy-avdBCgN20W95TkxOxTuP-MlJjfEvrZPqn0mSU_FYl8MsYQ9-Pr3_WQh-gUlYzQEeBNOyt2NjMkAnrw_5tdkAYMUV-oJvhTKwxmdXic7byJBbAiq8vRAcmnUUK-XWVBt3oFMAWbPT-nttlA8EJAny2UsRafYWDjILDhfGblDijKx8t8PJgPi8om21DXnJB-7G3sf4LuRwAEMmFQo-wisv6-e6EQgpnI6fKNm0lYx6Nh9wjNcC9GYu4tCBi1YPGN1PG5OpOAOidWLNm3LycOiAhr4jXQi48KYikTzQaBxn1xw9S_e92ZCocXZwfHTsv3HXh2ebCTpG54Q1pcFu7gsDu4hioR1X3qwuVswhDYsj7hBI7NSJqoVMhx_CsYBJB13V5rmhjhg_uWFcUyJXDm-Lb8y3nU7rWRMcFAEL46C60iS7o5xLI-vzXUuVZCkSB11D5esanWj4s5FF5EUrVShNGebWfUiryEUEG4IcXiJI4mqGPvC86lnxX-d4ximWurnC1FkpcKfujl46zQoNm8r-1LVDI3qChgl8edZL5EMDSGrXn9jlhLHB8BRUwSTDND3UwhaluDLJKnitdLjCEf_tviNJYXGKniwMb0YoP7NiS1XFVv8Ze2evqF9d7xiNwtDNojJ8qLMS_fpGW9Not8yZncq7pDgICaUlgi86xBYlTo-sQU7rBGSpRbtdY818p1V8JqI5U74PiZfSBBWImkRPKHOlazXnRktGXkSxa4z8dqY8U_g1kw-G47GU25ZCvCGjvc7djg_wpq5E66zCagwuXE-pbpUyv9qOKXOQlSwACdiWTgrLNsSkDMI8qYTXc5ckeXBbnZ-aMBANpD22nLgsumiQXwVgdWDLX_e0xV6izBomfctlNy4WvKk-A_P48kG1wp9sLnQkCOEcd21-4SXs_fFwkNNOtIEZpWu1Mmz7QGE91QOh4J4oJMc4xcc-px1u9BlsZcGb-sGqomh8zxRefRyiAbxZ8oI2CoL0PSol9-mJOJSoo0NOwmn7AStG8e41_KgGQvE3EZz-AGAHj_hqhqHsbAqgOtJebvWi0qp_dpP78dPIesndQYU_aIaqIbxaLo9f4JHAtzOHS9dPSq4BUjqK1UO1JHefRe-tKzEeOpuJTcplvIx-1tJXhnYBA&cid=CAASEuRoa1UTf8EiklvpUswaJNbRFw&rfl=1%2Chttps%253A%252F%252Fwww.billofsale-form.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 25 Jun 2021 19:04:09 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/ Frame ABBB 22 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cabbde8502a6598896a3c812c89ecd99ecfb3e9ca68f632c8c9b3f2a7f6e0046

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:03:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8601
x-xss-protection: 0
server: cafe
etag: 18280575870105241958
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 25 Jun 2021 19:03:34 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame ABBB 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
URL: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 12:04:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 25215
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 11 Jun 2022 12:04:00 GMT

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B593 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
URL: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Thu, 10 Jun 2021 19:15:34 GMT
expires: Fri, 11 Jun 2021 19:15:34 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 85721
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame ABBB 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 916c930beb86ef0f20096f08a556055da89dea56be2b32241a4b7ac47db323bc

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame F171 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Fri, 11 Jun 2021 11:11:48 GMT
expires: Sat, 11 Jun 2022 11:11:48 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 28347
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/ Frame 81C7 2 KB
829 B 35ms
22ms Document
text/html 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1881ed5a5ede7751f62ca41ef98423c19b35c0a6be4f2434425f7df01763232e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 804
date: Fri, 11 Jun 2021 19:04:15 GMT
expires: Sat, 12 Jun 2021 19:04:15 GMT
cache-control: public, max-age=86400
last-modified: Tue, 27 Oct 2020 14:24:13 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame ABBB 0
592 B 57ms
29ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstpirLU2-1_-jB4s_ijWrZAIdEKnE1q7tPSJkyKsu6UO-vYUMGCGoMfWHTZm79fpXUnDMcZAamT9YB8PJ-sYZfYzbewufahRggrSftFkTW2AxohDTu45_m2VYBJzoW_rtJ0heRbFlsdz6-Ofw2OY2CAJdKw0G2kRjGgpsZBfaKPyjXBD5ZG73d8zz6swEYX69kZO3vYFlwLEvNL5ifbq5ZJ1dlK6htjEDEXyipmBKCdVK9VtTeIQOKYJN9DtsXGb-c6R5Xm5OzSrHY0Nxst4_CM7WIXmRzaLaKrdpoPONSy6FAyYIbVfFoQYZZvn_OICzNELb1VGvm8n_YZPELVQJw2SgG4ZYmmm_h1OPQZygOzA9Zh-coNppOy7dhgVkb8HCKQyTTQ-C2fLz_GLOpCpEWKvI-mr5cP-nufbiPWeUUyGVwJKLyvZWRCEYZVzdm11fAnG6YciYEzCQN3n6ohg6wDG8fFNm8UH6TuDq8KV8KznWF1JQZbUki5R7b0LCkcnYFnqmtAKJ4XsQrqrpp4HhovKivqmKMhnha-p5ucUw-oMoU-YFy1UJrU5Xk0y0hid2v4CVyUMGiyB1ceKKvKBM0-UApU_biu8vtgNGVjnM6ZIjc6h7qzczkEZK2BYRRMWUUGHq9TnEBxEm53wxxoU0KpermYdDg-CuqGtaMEK77iIw5s_CjNlmLsF9V-GPTPqLOT436rWAdENFuSHpR9h6jnCqD-rpRlN0L9JpfBFr4azkgYUobIIEX2iEUwjnTd1CrCHjXkg69MLvjyNzj2r0gAV9E8dCO96nNcDVkG6GUVr0pzXfAxgG0GT5ABjbu05htQjY76ILBmpgT5lQ2KQYfQaOcewUL699gDgSc71xWBIFA0J3RqzqxVybLT4feph3WP6MI_tB4iELcr5JqZCtkvBXqMqXdtKCLPgrohkmaFbjZQL2NyfHNzwmrj4YTvtdl7A80X1N7Ajjwd57_mSsGfNajnX-sIGakbgVPVM5jSTpB0szpzm_do5kNmkzixGUbnZD4yUb2t-zGVUMe31lUf7TviEaKcWA9RnOv_9bzUwHYu-G97ifg4fiSLwN2CAUoY2M1WE07m1cOiZW9BYXCSTi2_NB6BCberLgAxRh2uVhYdfnyDRVu1ltcm6-Edmn_riayrebfSDKpI19OaxFev1oLhUE0ncPvjU1P4Ab6yGAdChDno1tVrmhSisiKgr7HkebNd7TcQooGCuAmaWdou-HcULFQiFzrPCVKU1yWFTSWDgaFe1cvwThJ-yJYrGA&sai=AMfl-YTs9APvtUthfUy7uZMBdwxezZJmtmKLoUCORsK8XoX_Q2mDFxft3leqAYfFdfIwegknmhBZEFgnjheTT7SX31aMCNyDDa1pn-t1Vw71P2jcAXbLBtZ62tlIyikZ8KBkEA2j-0NGHD6kfKYe64pzO4hx7e25rQ&sig=Cg0ArKJSzIGZ5TwfDO9AEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=79&cbvp=1&cstd=72&cisv=r20210607.61721&adurl=

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Fri, 11 Jun 2021 19:04:15 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame B593
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEO4E_3xxPpSteLK8ArOmpFs&google_cver=1&google_push=AYg5qPLC7VTfAS6iWmc1OlvzN9C2NNkYC9Ba3m2vkMnks2Gxr6R_W37g5t4cpBzNjgkAxaL0e51VIcC39g7fbJlXZBqHPD6t7fM
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzUxMDU3ODc3OTIzMDc5NzE3MA==
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEO4E_3xxPpSteLK8ArOmpFs&google_cver=1

43 B
407 B

15ms
13ms

Image
image/gif

2001:678:cb4:bbbb::11
TURN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEO4E_3xxPpSteLK8ArOmpFs&google_cver=1
Requested by: Host: 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
URL: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (TURN, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEO4E_3xxPpSteLK8ArOmpFs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame B593
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEC2tmPwHgpaCTVbdcavNuCg&google_cver=1&google_push=AYg5qPIvK0PX-tf8vq3gBK0MV5pbgDc8HyM2lBDnjfI8cj5ZMPTgMgnbdc3KBjicFSnXQI7SBz6735gpjRcw1aDD...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=KQRgw7OsSgCr89WQDlmZxw&google_push=AYg5qPIvK0PX-tf8vq3gBK0MV5pbgDc8HyM2lBDnjfI8cj5ZMPTgMgnbdc3KBjicFSnXQI7SBz6735gpjRcw1aDDOyJmsJ7RI6Q

170 B
188 B

19ms
18ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=KQRgw7OsSgCr89WQDlmZxw&google_push=AYg5qPIvK0PX-tf8vq3gBK0MV5pbgDc8HyM2lBDnjfI8cj5ZMPTgMgnbdc3KBjicFSnXQI7SBz6735gpjRcw1aDDOyJmsJ7RI6Q

Requested by

Host: 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
URL: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 11 Jun 2021 19:04:19 GMT
Server: MT3 3759 5f8f15b master zrh-pixel-x1
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=KQRgw7OsSgCr89WQDlmZxw&google_push=AYg5qPIvK0PX-tf8vq3gBK0MV5pbgDc8HyM2lBDnjfI8cj5ZMPTgMgnbdc3KBjicFSnXQI7SBz6735gpjRcw1aDDOyJmsJ7RI6Q
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 11 Jun 2021 19:04:18 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame B593
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESECxx3mgyXXVnK9NbkrN1W04&google_cver=1&google_push=AYg5qPK7WY_uoNfWGZuEU-i1wXQOXgzZEtwL0YKEg1sTUz19Yw-tl3vsdJbq5TBGc7f6hkFIzTpEw...
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AYg5qPK7WY_uoNfWGZuEU-i1wXQOXgzZEtwL0YKEg1sTUz19Yw-tl3vsdJbq5TBGc7f6hkFIzTpEwYnwLAcW2lChJBWtBeH90Fw

170 B
188 B

18ms
17ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AYg5qPK7WY_uoNfWGZuEU-i1wXQOXgzZEtwL0YKEg1sTUz19Yw-tl3vsdJbq5TBGc7f6hkFIzTpEwYnwLAcW2lChJBWtBeH90Fw

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 11 Jun 2021 19:04:15 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-ltx1
location: https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AYg5qPK7WY_uoNfWGZuEU-i1wXQOXgzZEtwL0YKEg1sTUz19Yw-tl3vsdJbq5TBGc7f6hkFIzTpEwYnwLAcW2lChJBWtBeH90Fw
x-li-proto: http/2
x-li-pop: prod-esv5
content-length: 0
x-li-uuid: oRv+/H2chxYAbPcgzCoAAA==

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame B593
Redirect Chain

https://px.adhigh.net/p/gm/rub?google_gid=CAESEPxdd34N83mThwthz1YY1Po&google_cver=1&google_push=AYg5qPLlpnDlL_tI-_5_PnHJCkOM4bQE4ZoTP-f9EnMR8I5aLbtqgQh3YSYZv0xIrQ-03z9nSKjUqONZruAVedQJeYcvmVUMEOc
https://px.adhigh.net/p/gm/rub?google_gid=CAESEPxdd34N83mThwthz1YY1Po&google_cver=1&google_push=AYg5qPLlpnDlL_tI-_5_PnHJCkOM4bQE4ZoTP-f9EnMR8I5aLbtqgQh3YSYZv0xIrQ-03z9nSKjUqONZruAVedQJeYcvmVUMEOc&b...
https://cm.g.doubleclick.net/pixel?google_nid=gint&google_push=AYg5qPLlpnDlL_tI-_5_PnHJCkOM4bQE4ZoTP-f9EnMR8I5aLbtqgQh3YSYZv0xIrQ-03z9nSKjUqONZruAVedQJeYcvmVUMEOc&google_hm=bO64fe3PoHsAAikABlF5_HXm...

170 B
188 B

17ms
17ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gint&google_push=AYg5qPLlpnDlL_tI-_5_PnHJCkOM4bQE4ZoTP-f9EnMR8I5aLbtqgQh3YSYZv0xIrQ-03z9nSKjUqONZruAVedQJeYcvmVUMEOc&google_hm=bO64fe3PoHsAAikABlF5_HXmGg%3D%3D

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
server: nginx
access-control-allow-origin: *
x-backend-id: f18-ru
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=gint&google_push=AYg5qPLlpnDlL_tI-_5_PnHJCkOM4bQE4ZoTP-f9EnMR8I5aLbtqgQh3YSYZv0xIrQ-03z9nSKjUqONZruAVedQJeYcvmVUMEOc&google_hm=bO64fe3PoHsAAikABlF5_HXmGg%3D%3D
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame B593
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEIxWNdV3vW3jncf6UzLwu9k&google_cver=1&google_push=AYg5qPKlI5mGjrtn6rGXig3G1phjcwa5m4W5pvc2vjaNfqztMg_iFHctVII9OSX0cg6cHnRfXLI672g3J8e88ZHtO4f75kw...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPKlI5mGjrtn6rGXig3G1phjcwa5m4W5pvc2vjaNfqztMg_iFHctVII9OSX0cg6cHnRfXLI672g3J8e88ZHtO4f75kwVsA4&google_hm=NTgxMTc1OTEzMTgwNjUyNzc...

170 B
188 B

17ms
16ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPKlI5mGjrtn6rGXig3G1phjcwa5m4W5pvc2vjaNfqztMg_iFHctVII9OSX0cg6cHnRfXLI672g3J8e88ZHtO4f75kwVsA4&google_hm=NTgxMTc1OTEzMTgwNjUyNzc5NA%3D%3D

Requested by

Host: 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
URL: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 11 Jun 2021 19:04:15 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPKlI5mGjrtn6rGXig3G1phjcwa5m4W5pvc2vjaNfqztMg_iFHctVII9OSX0cg6cHnRfXLI672g3J8e88ZHtO4f75kwVsA4&google_hm=NTgxMTc1OTEzMTgwNjUyNzc5NA%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame B593
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEKYmpYnGYDosxl4sbwR2vHQ&google_cver=1&google_push=AYg5qPIpwGsN3jVTSsmETUC7uQEBMBoDu9t4K5GncW0o53CIlyJVeuKQSFSh-BGIL4k_ZBF128anCIBBD2Uo2z7o...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPIpwGsN3jVTSsmETUC7uQEBMBoDu9t4K5GncW0o53CIlyJVeuKQSFSh-BGIL4k_ZBF128anCIBBD2Uo2z7o7_Da-TGBG0Q

170 B
188 B

19ms
19ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPIpwGsN3jVTSsmETUC7uQEBMBoDu9t4K5GncW0o53CIlyJVeuKQSFSh-BGIL4k_ZBF128anCIBBD2Uo2z7o7_Da-TGBG0Q

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 11 Jun 2021 19:04:15 GMT
via: 1.1 639dd5dd68d7e7193120d95480cd44cb.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: VIE50-C2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPIpwGsN3jVTSsmETUC7uQEBMBoDu9t4K5GncW0o53CIlyJVeuKQSFSh-BGIL4k_ZBF128anCIBBD2Uo2z7o7_Da-TGBG0Q
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: Qu5zBhhXErLMFMygUhE60wQ_Vh9MzP9wLsHm9okzqevSqPqzr5QS5A==

GET
H2 204 exptsync
ads.yieldmo.com/ Frame B593 0
35 B 112ms
34ms Image
text/plain 52.48.144.237
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/exptsync?google_gid=CAESEE6fRz82Yq35VLfN_POuuWw&google_cver=1&google_push=AYg5qPL76LZCFEru8dtbn4LFeKcEgFkBS7_rlyMhTiAn8jbVVVNibwqf4pq1rIT744xngttAS4-H7UQ-50z4mrjvwBi6DPPrOjM
Requested by: Host: 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
URL: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.48.144.237 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:15 GMT

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame B593 0
12 B 17ms
15ms Image
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KFVlUByQzohhctO1R0UN9vQw5an1g4oYZi6iQXHdFJgTLETZCyZSeSe2MZAPwTbJBKrUTQ

Requested by

Host: 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
URL: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:15 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame F171 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 17:54:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4181
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 11 Jun 2022 17:54:34 GMT

GET
H3-29 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame 81C7 110 KB
38 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 16:43:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8457
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 12 Jun 2021 16:43:18 GMT

GET
H3-29 200 style.3c89950763bc6c6cf3d8.css
s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/ Frame 81C7 5 KB
1 KB 7ms
7ms Stylesheet
text/css 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/style.3c89950763bc6c6cf3d8.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89041d4a8ff69bb5f9e3eb632ec9eb92ef223511f981465eeabedd97b1ef887d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 15:09:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14093
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1061
x-xss-protection: 0
last-modified: Tue, 27 Oct 2020 14:24:13 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 12 Jun 2021 15:09:22 GMT

GET
H3-29 200 blank_1x1-904a5f9629336d639900be59545ecdd5.png
s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/ Frame 81C7 925 B
949 B 10ms
9ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/blank_1x1-904a5f9629336d639900be59545ecdd5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed936ded7b4b994acb086ad424cb60c602f2638a4b200fa3c18eabc7e8399e03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 15:55:58 GMT
x-content-type-options: nosniff
last-modified: Tue, 27 Oct 2020 14:24:13 GMT
server: sffe
age: 11297
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 925
x-xss-protection: 0
expires: Sat, 12 Jun 2021 15:55:58 GMT

GET
H3-29 200 bottomBar-6c248c91805cb8bbcdeb0174c8b2f3a9.jpg
s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/ Frame 81C7 2 KB
3 KB 9ms
8ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/bottomBar-6c248c91805cb8bbcdeb0174c8b2f3a9.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

32d7096216dc157694c3bcd3f2878eed535d8befb7884c2e71aaf25a6fce5757

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 13:33:09 GMT
x-content-type-options: nosniff
last-modified: Tue, 27 Oct 2020 14:24:13 GMT
server: sffe
age: 19866
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2556
x-xss-protection: 0
expires: Sat, 12 Jun 2021 13:33:09 GMT

GET
H3-29 200 logo-small-261d21047378b4d7b64f3face4bc4495.png
s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/ Frame 81C7 4 KB
4 KB 11ms
10ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/logo-small-261d21047378b4d7b64f3face4bc4495.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3ba6033bcef6eaacedffc9ef085b0f3aaf62b19c7e7bbd818db359a3ee32fd8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 14:15:09 GMT
x-content-type-options: nosniff
last-modified: Tue, 27 Oct 2020 14:24:13 GMT
server: sffe
age: 17346
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4510
x-xss-protection: 0
expires: Sat, 12 Jun 2021 14:15:09 GMT

GET
H3-29 200 logo-large-775fbe272e61a4431e9a64fb53637a2e.png
s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/ Frame 81C7 11 KB
11 KB 10ms
10ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/logo-large-775fbe272e61a4431e9a64fb53637a2e.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

686c5620f8237b773f1c5136ccaee5fad097264a76b016095ba1f222ff255e92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Jun 2021 19:58:25 GMT
x-content-type-options: nosniff
last-modified: Tue, 27 Oct 2020 14:24:13 GMT
server: sffe
age: 83150
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11338
x-xss-protection: 0
expires: Fri, 11 Jun 2021 19:58:25 GMT

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.0.2/ Frame 81C7 55 KB
20 KB 13ms
13ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.0.2/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b27ff4b5540d29ec8590265d0e8fa3bac643ee75c8d453f21b1f57935a9e7380

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 168504
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 20127
cf-request-id: 0a9e0efdea000005c4d81db000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e71-db99"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=HYqU8QbvrDRHSfNSR%2FZXuQQ4n9gYupPA32%2FOMgJAkB0YFW2uMyMLWJnuHcGPXDzxu7yg4fExA9Dq1M%2BgEToDGDk6htYQ%2BTqS2EBsbjmHee%2B%2B33NKBjMspVVigbpvPpN%2BpJL3uqeFdYoWZ1hSYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 65dd1aa978b505c4-FRA
expires: Wed, 01 Jun 2022 19:04:15 GMT

GET
H2 200 fontfaceobserver.standalone.js Show response
cdnjs.cloudflare.com/ajax/libs/fontfaceobserver/2.1.0/ Frame 81C7 4 KB
2 KB 14ms
14ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/fontfaceobserver/2.1.0/fontfaceobserver.standalone.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e1adee22626162c0fb089096a3bd419c5a57d50043e31bf6e7b2ea292f6341f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1979170
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1386
cf-request-id: 0a9e0efdef000005c4fc108000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:08 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e60-111b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=neqdcJGbQd6CoUOoS50DQ%2Fk6I%2FkNhrbCERKgVcN7yOcrZn8n6%2BrGsE%2BD9PA64%2FiCZ6NYxAVGnVyhHPkYvaOwTjkKQKND4seuu%2B38%2FESTf7Eyi63O0eFnaeJmo2G%2FZFtAUAdu0sZNjYsy7xrorw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 65dd1aa978c805c4-FRA
expires: Wed, 01 Jun 2022 19:04:15 GMT

GET
H3-29 200 main_bf014c2821c038766e09.js Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/ Frame 81C7 23 KB
7 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/main_bf014c2821c038766e09.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d190bb644240c0d74123d22677fcabd1c4ea529703e536290857fcf1d5a20e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 07:00:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43428
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7345
x-xss-protection: 0
last-modified: Tue, 27 Oct 2020 14:24:13 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 12 Jun 2021 07:00:27 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame ABBB 0
23 B 39ms
18ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 19:04:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame ABBB 55 KB
21 KB 8ms
7ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: 9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
URL: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

7929ef5b848609d4d5ef695261ede98df014607a3cc0d1eabacb2f503d838842

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 18:17:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2798
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21114
x-xss-protection: 0
server: cafe
etag: 11617696749572877616
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Fri, 11 Jun 2021 19:17:37 GMT

GET
H3-29 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 81C7 55 KB
21 KB 7ms
7ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

7929ef5b848609d4d5ef695261ede98df014607a3cc0d1eabacb2f503d838842

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 18:17:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2798
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21114
x-xss-protection: 0
server: cafe
etag: 11617696749572877616
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Fri, 11 Jun 2021 19:17:37 GMT

GET
H3-29 200 LeasePlan-Bold.woff
s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/ Frame 81C7 33 KB
33 KB 7ms
6ms Font
font/woff 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/LeasePlan-Bold.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/style.3c89950763bc6c6cf3d8.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea18c1af5335fb04e11fdded9c3aec52b377bec0436fce03f52b989631b8da85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/style.3c89950763bc6c6cf3d8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 18:22:34 GMT
x-content-type-options: nosniff
last-modified: Tue, 27 Oct 2020 14:24:13 GMT
server: sffe
age: 2501
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33692
x-xss-protection: 0
expires: Sat, 12 Jun 2021 18:22:34 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 81C7 6 KB
4 KB 17ms
17ms XHR
application/json 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

135420bb8c58a8c18fbffb6ac6e46a6c9d8679fa08befe3c378aaba3b5c64787

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 11 Jun 2021 19:04:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4317
x-xss-protection: 0

GET
H3-29 200 60014130_20201016082543227_US_Finance_PiggyBank_728x90.jpg
s0.2mdn.net/ads/richmedia/studio/60014130/ Frame 81C7 10 KB
10 KB 7ms
6ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60014130/60014130_20201016082543227_US_Finance_PiggyBank_728x90.jpg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb79f5b774d6af18692f105e0def243b835b25ee6286a0b7e394e8758db6cb99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61591664/20201027072413391/index.html?e=69&leftOffset=0&topOffset=0&c=t05LA2AFch&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 07:00:39 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Oct 2020 15:25:43 GMT
server: sffe
age: 43416
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9839
x-xss-protection: 0
expires: Sat, 12 Jun 2021 07:00:39 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 81C7 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e684839cbcef6b16753dae73e92a49b7115f55e83662ead12d5e05bf7b9915fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622653785071769"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Fri, 11 Jun 2021 19:04:15 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 81C7 0
54 B 26ms
25ms Ping
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~kpsp7z2d&c=3107597125158511&ctx=3&qqid=CPGK7eOikPECFRbuuwgdVFkGGg&met.3=113.4g~112.4g
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame ABBB 0
54 B 27ms
26ms Ping
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~kpsp7z2e&chm=1&c=3107597125158511&ctx=2&qqid=CPGK7eOikPECFRbuuwgdVFkGGg&met.4=fb.f~lb.3l~cmrload.4d~ol.74~idt.-bf~dt.-m6&met.3=736.3m~735.3q_1~374.3y~113.8n_3~112.8n_3&met.1=1.kpsp7ytr~6.1~7.1~8.1~9.1~10.1~12.2~13.7~14.8~15.c~16.3l~17.3l~18.3l~19.74~20.74~21.74~22.3o~23.3o&met.7=CBsQCBgBMAg4gAJoAXAHeOEYgAGkGIgBzi-wAQG4AQM~CCgQBRgBIBAoEDAkOBRoEXAjeN4CgAGUAogB8ASwAQG4AQM~CCgQChgBIBEoETBFODRoEnBBeIbFAYABssQBiAHZ4QOwAQG4AQM~CBwQBhgBIBIoEjAiOBBoE3AheG6AASqIASqwAQG4AQM~CBwQChgBIBIoEjAaOAhoE3AZeOUKgAGkCogB4xOwAQG4AQM~CCoQChgBIBIoEjAvOB0~CBwQChgBIBIoEjAaOAhoFHAaeOMsgAGMLIgBqGawAQG4AQM~CCkQChgBIEooSjBuOCVASkhLUEtYXmBQaF5wZHje6QOAAaHmA4gB4PwKsAEBuAED~CBwQChgBIEsoSzBROAdoS3BReM8YgAG0GIgBlT6wAQG4AQM~CAkQChgBIE0oTTBTOAZoTXBTeLRDgAGZQ4gBv64BsAEBuAED~CCcQChgBIFgoWDBfOAdoWXBfeIB3gAHndogBisUCsAEBuAED~CBwQBRgBIFkoWTBiOAloXHBieO0FgAHUBYgBlgmwAQG4AQM~CCcQBRgBIIwBKIwBMJUBOAlojgFwlAF45EGAActBiAHqsgGwAQG4AQM~CCkQBRgBIJYBKJYBMLsBOCVAmAFImAFQmAFYpQFgmAFopQFwuwF4vQaAAaQGiAHrE7ABAbgBAw~CCIQARgBIJsBKJsBMNQBODpAmwFInAFQnAFYtgFgogFotwFw1AF40ASwAQG4AQM~CCIQARgBIP8BKP8BMKcCOChQgAJYlAJggAJolAJwpwJ4F7ABAbgBAw~CCgQChgBII4CKI4CMJcCOAlojgJwlgJ4lqUBgAH6pAGIAe-0A7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F171 0
20 B 16ms
15ms Image
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BKdD5r7PDYKPjGObd7_UPu--k4AsAAAAAOAHgBAI&bg=!wMOlw4fNAAY6sG-_OrA7ACkAdvg8Wjr3StKUguyYnn5PMlTq3QiRjJLpeixtc_WhPNQR7KBZDBhjdQIAAABeUgAAABRoAQeZAtv0lWK-FWngnu4RcxXbA_3wb4XePZmrx70eio8YuO2DNpWadjSyrdYDcW5QO6ucp0WZPETx_bdktE-SASglkImcCzDUpeCt03PPEg9WKxnpDxvbm2wyht7_neBLdFAc1BheGNxIpEStmpVnSzAKZhaYw5mPPfrZf1l1APzlKc6oDJJC0YUvWsLDdJJBb2NPbGTl9VcGFEoomPk_LykPncuScn0iTbyNyP1UNDyWZIxR-mP2T2yfdA86CP9CuzBACK-d8Y6dKjm98dzQGyMATz-PztobnDZqbaQfcx4zgVemFam7Ng31HdyWpl_XHYdZ7tZJLbY70HRJ58cawdnV3bUUtgHVVbMsL_jmoQFeCNCQaqN3-LZ8tQV1cezIY7eQOg5gQUUTYCfCNrkMM99Uol3WYteMkqQIoeHGOnv0-c-B8aqHK3v0xRCD7D54qj-yMEnDOgMA2eaEx0dkUEnjaMJL1YmwHRtmNxiMgGbAxOTjerLV4PWnNKeV-KDMTvKEl3QtaGHHHy4MHfemkjPj6y1I-KzDfVZiviOSwqrpd1StVDOUIDA9fx8uzukEJyNUMGTe1L1d251hIfFSInHwXWZz7kZfGipGNTIyBvQWT0UPc8euq1VkA2mx3EtXlSOFrgkqB9TLKKiN_s48mNOBdE6cMHfto3p-zPdVbctLuTmyQsh5ojBmuuIJDHQpYP094zEHBINcZpeYSzfjzKrLBJYnj2uaA3KRzXeM9AmJ2cAAzKS6lN1It9wAJC7dzZzH8PGq6aPBxDdVAsxQPGaFfMUZoeK6hpQy_EPm-bsqxCW0Ne06KeKXi72s9xMIgUcbnsCiW5aDHhwCz2_OUbYIWMTNxR_W05KZXys9S9mivBp2MqG0WBiE8I18ko2zOGEWpB9F1TsnaZ7LacfzTmTafhRsvyNmlHyHrh26fxYcCD7FZr9F0NkYD0U70D3k7wR7IPh2m5hKErQ_za5yAw

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame 6FB5 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 17:54:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4181
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 11 Jun 2022 17:54:34 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame ABBB 42 B
64 B 20ms
19ms Fetch
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvNaFTe3e55mFxdoaop_mwNVlkYbL6IG69i9IMV5QGH1BOv5nMlu5Xw-O3Dj_6AxA2PJA_1bF-KAMAxIEe5uEhgr8l2Q6-jDI6R_S81H-kql1gbowe-WD2M1Yfm0A&sai=AMfl-YSiAR78J14LfIrRxSDTx7gTJWf6RnGEiblDA6cgEBk7XnHvS4rbY-4YuxdNV1YbaIKAdEKhzzMY8GtZpcKnV8pIfDN3dCdosJacPxk5tuoOmyfgtDnDrEBDC0o&sig=Cg0ArKJSzK7tRBvQkPdlEAE&cid=CAASEuRoa1UTf8EiklvpUswaJNbRFw&id=lidar2&mcvt=1001&p=183,308,273,1036&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20210609&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3053355510&rs=4&met=ce&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ%3D%3D&vs=4&eosm=0&rst=1623438255378&dlt=9&rpt=129&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Jun 2021 19:04:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 army.gif Show response
www.billofsale-form.com/porpoiseant/ 0
672 B 34ms
33ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE2OTY2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE2OTY2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-06-11T19%3A04%3A12.458363Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Fri%2C%2011%20Jun%202021%2019%3A04%3A12%20GMT; __gads=ID=1d441d504f4973f8:T=1623438252:S=ALNI_Mbn2e16WLvcABU4166KBO8sU3jvxQ; ezouspvv=100; ezouspva=1; ezouspvh=100
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:16 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9e0f01b100004ebc2cab6000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=BviM5wiv10L%2BXKaRZ1LRhiCDbpNHwxUTN2UNtFRXsFKudSU2W5YbOwJMDWkSY2DfZ3mMSj1H2uVvjgC3wLbWcjQoIdYdegeBCrYoVOX2kwJCxXG9YymCx6FNVDz%2Bz1iOvOtDljvE%2FjLNSFadYa%2FgyJc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dd1aaf8e274ebc-FRA
expires: Thu, 10 Jun 2021 19:04:16 UTC

GET
H3-29 200 greenoaks.gif Show response
www.billofsale-form.com/detroitchicago/ 0
672 B 32ms
32ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MzgyNDgsImRhdGEiOlt7Im5hbWUiOiJkaXNwbGF5X2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMTM4MDIwIn0seyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9jb3VudCIsInZhbCI6IjIifSx7Im5hbWUiOiJuYXRpdmVfYWRfdmlld3BvcnRfcHgiLCJ2YWwiOiIwIn0seyJuYW1lIjoibmF0aXZlX2FkX3ZpZXdwb3J0X2NvdW50IiwidmFsIjoiMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfZG9jX3B4IiwidmFsIjoiMzY4MDIwIn0seyJuYW1lIjoiZGlzcGxheV9hZF9kb2NfY291bnQiLCJ2YWwiOiI0In0seyJuYW1lIjoibmF0aXZlX2FkX2RvY19weCIsInZhbCI6IjAifSx7Im5hbWUiOiJuYXRpdmVfYWRfZG9jX2NvdW50IiwidmFsIjoiMCJ9LHsibmFtZSI6InZpZXdwb3J0X3NpemUiLCJ2YWwiOiIxNjAweDEyMDAifSx7Im5hbWUiOiJ2aWV3cG9ydF9weCIsInZhbCI6IjE5MjAwMDAifSx7Im5hbWUiOiJkb2NfcHgiLCJ2YWwiOiI5NTYwMDAwIn0seyJuYW1lIjoiZG9jX2hlaWdodCIsInZhbCI6IjU5NzUifV19XQ==
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI1MDAxZjE3MS0xMjQ0LTRlYmYtNmFiZC02NmZmYmVlYmI1MzMiLCJkb21haW5faWQiOiIyNjQzMSIsInRfZXBvY2giOjE2MjM0MzgyNDgsImRhdGEiOlt7Im5hbWUiOiJkaXNwbGF5X2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMTM4MDIwIn0seyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9jb3VudCIsInZhbCI6IjIifSx7Im5hbWUiOiJuYXRpdmVfYWRfdmlld3BvcnRfcHgiLCJ2YWwiOiIwIn0seyJuYW1lIjoibmF0aXZlX2FkX3ZpZXdwb3J0X2NvdW50IiwidmFsIjoiMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfZG9jX3B4IiwidmFsIjoiMzY4MDIwIn0seyJuYW1lIjoiZGlzcGxheV9hZF9kb2NfY291bnQiLCJ2YWwiOiI0In0seyJuYW1lIjoibmF0aXZlX2FkX2RvY19weCIsInZhbCI6IjAifSx7Im5hbWUiOiJuYXRpdmVfYWRfZG9jX2NvdW50IiwidmFsIjoiMCJ9LHsibmFtZSI6InZpZXdwb3J0X3NpemUiLCJ2YWwiOiIxNjAweDEyMDAifSx7Im5hbWUiOiJ2aWV3cG9ydF9weCIsInZhbCI6IjE5MjAwMDAifSx7Im5hbWUiOiJkb2NfcHgiLCJ2YWwiOiI5NTYwMDAwIn0seyJuYW1lIjoiZG9jX2hlaWdodCIsInZhbCI6IjU5NzUifV19XQ==
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-06-11T19%3A04%3A12.458363Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Fri%2C%2011%20Jun%202021%2019%3A04%3A12%20GMT; __gads=ID=1d441d504f4973f8:T=1623438252:S=ALNI_Mbn2e16WLvcABU4166KBO8sU3jvxQ; ezouspvv=100; ezouspva=1; ezouspvh=100
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:16 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9e0f01ec00004ebc7c1b0000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ZJeokZVEpHlUlSxLqXJZAuZr67DdLFysgrkZx%2FAkL8M73tS0PuhVTZrNFwzNv5z%2BhqX9oQT5T6dDWIWNdc7nhEIkgloVVG2NjlgbnKRCqJbdJXd7tYd1Te%2BCCcF07fk2C%2F%2FwrYolqtsPxp2arziRtD0%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dd1aafdf794ebc-FRA
expires: Thu, 10 Jun 2021 19:04:16 UTC

GET
H3-29 200 army.gif Show response
www.billofsale-form.com/porpoiseant/ 0
672 B 37ms
36ms XHR
text/plain 2606:4700:3035::ac43:bf24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.billofsale-form.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE2OTY2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzcyOCw5MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNjk2NjMiLCJkb21haW5faWQiOiIyNjQzMSIsInVuaXQiOiJkaXYtZ3B0LWFkLWJpbGxvZnNhbGVfZm9ybV9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjM0MzgyNDgsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjUwMDFmMTcxLTEyNDQtNGViZi02YWJkLTY2ZmZiZWViYjUzMyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1MTYsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfZmx1aWQiLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE2OTY2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIxMTcifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.billofsale-form.com
URL: https://www.billofsale-form.com/detroitchicago/cmbv2.js?gcb=194-2&cb=04-100-306-1007-109-50a-70d-30f-318-31c-122c-1&cmbcb=17&sj=x04x00x06x07x09x0ax0dx0fx18x1cx2c
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:bf24 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE2OTY2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzcyOCw5MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNjk2NjMiLCJkb21haW5faWQiOiIyNjQzMSIsInVuaXQiOiJkaXYtZ3B0LWFkLWJpbGxvZnNhbGVfZm9ybV9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjM0MzgyNDgsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjUwMDFmMTcxLTEyNDQtNGViZi02YWJkLTY2ZmZiZWViYjUzMyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1MTYsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfZmx1aWQiLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE2OTY2MyIsImRvbWFpbl9pZCI6IjI2NDMxIiwidW5pdCI6ImRpdi1ncHQtYWQtYmlsbG9mc2FsZV9mb3JtX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMzQzODI0OCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNTAwMWYxNzEtMTI0NC00ZWJmLTZhYmQtNjZmZmJlZWJiNTMzIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIxMTcifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: id5id.1st=%7B%22created_at%22%3A%222021-06-11T19%3A04%3A12.458363Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Fri%2C%2011%20Jun%202021%2019%3A04%3A12%20GMT; __gads=ID=1d441d504f4973f8:T=1623438252:S=ALNI_Mbn2e16WLvcABU4166KBO8sU3jvxQ; ezouspvv=100; ezouspva=1; ezouspvh=100
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.billofsale-form.com
referer: https://www.billofsale-form.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.billofsale-form.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 19:04:16 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a9e0f02ef00004ebc390d9000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=asoP%2FkWKbVom4GaHSbecFFmOleSREp6fMV7qhmyEa1NxkVEt8p%2FxNeU1Qj2TkRVkpQvwkMQ8QyTa6sphN%2BuOJsxHl1027wkUFLee%2FBQXZLguEPYseggsZeI1RNW9qZG9IKW5c9yjJnLiBjpYT%2Bq4ieU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 65dd1ab17d254ebc-FRA
expires: Thu, 10 Jun 2021 19:04:16 UTC

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: blank
URL: about:blank

Verdicts & Comments Add Verdict or Comment

234 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.billofsale-form.com/	1970-01-20 04:19:01	Name: cto_bundle Value: OWhOnF9KTXUyTVlGRkNPejlSTDg5NklMenNadFF1Q3YwSnRnamZvS3k0WE1iRUN3YktKWUc0dDkxTlVqUTcwcmxuQ1J1VHJsV0l1VURDYjZHMHVYSGN0RFVTMldJa3FxdiUyRmY5JTJCbjAwaTQ4bWhhR0hrZ3ZoVGd5ak9YMW0xMk5xZVZ5dWw
www.billofsale-form.com/	1970-01-20 03:42:54	Name: ezux_lpl_26431 Value: 1623438249673\|5001f171-1244-4ebf-6abd-66ffbeebb533\|false
www.billofsale-form.com/	1970-01-20 04:19:01	Name: cto_bidid Value: rdP1nl9FS3ROJTJGM04wZmJpZkpPJTJGR3Y4MVhCTmtJR1dib25Fa1VVQjUxdyUyRmxpOVhQNCUyRnFWRGUzOFIxMU9iUXhwMFRoOGN0NnNueHlsekg1NzZnbSUyQk5sVTk1T2clM0QlM0Q
.billofsale-form.com/	1970-01-20 04:21:47	Name: __qca Value: P0-1812266074-1623438249278

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.billofsale-form.com/wp-content/cache/autoptimize/js/autoptimize_f5ddbee1756ef961868f5222da593f8e.js(Line 1) Message: JQMIGRATE: Migrate is installed, version 3.3.2

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9766f0827a8793ec9e16df6376387285.safeframe.googlesyndication.com
ad.turn.com
ads.adaptv.advertising.com
ads.avct.cloud
ads.yieldmo.com
adservice.google.com
adservice.google.de
ap.lijit.com
bh.contextweb.com
bid.contextweb.com
blank
c1.adform.net
cdn-3.billofsale-form.com
cdn.undertone.com
cdnjs.cloudflare.com
cm.ctnsnet.com
cm.g.doubleclick.net
cms.quantserve.com
contextual.media.net
cs.admanmedia.com
csi.gstatic.com
csync.loopme.me
dsum-sec.casalemedia.com
eus.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
g.ezoic.net
go.ezodn.com
go.ezoic.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gu.dyntrk.com
gum.criteo.com
hb.undertone.com
ib.adnxs.com
id5-sync.com
image4.pubmatic.com
image8.pubmatic.com
lg3.media.net
match.adsrvr.org
match.prod.bidr.io
mug.criteo.com
navvy.media.net
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantserve.com
pixel.rubiconproject.com
pr-bh.ybp.yahoo.com
prebid.a-mo.net
px.adhigh.net
px.ads.linkedin.com
r.turn.com
res-a.akamaihd.net
rules.quantcount.com
s.ad.smaato.net
s.amazon-adsystem.com
s0.2mdn.net
secure-assets.rubiconproject.com
secure.adnxs.com
secure.quantserve.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
ssum-sec.casalemedia.com
sync-tm.everesttech.net
sync.1rx.io
sync.mathtag.com
sync.srv.stackadapt.com
sync.targeting.unrulymedia.com
tag.1rx.io
targeting.unrulymedia.com
token.rubiconproject.com
tpc.googlesyndication.com
ups.analytics.yahoo.com
us-u.openx.net
usermatch.targeting.unrulymedia.com
usr.undertone.com
video.unrulymedia.com
www.billofsale-form.com
www.google-analytics.com
www.google.com
www.googletagservices.com
x.bidswitch.net
blank
104.109.78.125
13.224.192.221
13.32.2.39
13.32.2.95
136.144.59.88
142.250.181.226
142.250.186.130
151.101.14.49
162.55.6.212
178.250.0.157
18.159.80.129
18.192.15.110
18.197.47.23
185.29.133.199
185.33.221.13
185.64.189.110
185.64.189.114
185.64.190.79
193.232.148.157
198.148.27.133
198.148.27.139
2.16.186.89
2.18.234.21
2.18.235.93
2.19.35.65
2001:678:cb4:bbbb::11
213.19.147.42
213.19.147.44
213.19.147.45
216.58.212.162
2600:9000:211a:7600:2:cb38:840:93a1
2600:9000:211a:9200:6:44e3:f8c0:93a1
2600:9000:21f3:a600:1f:2473:9080:93a1
2606:4700:3031::6815:443f
2606:4700:3035::6815:4c02
2606:4700:3035::ac43:bf24
2606:4700::6810:135e
2620:116:800d:21:f916:5049:f87f:108e
2620:119:50e1:101::6cae:b25
2a00:1288:110:c305::8000
2a00:1450:4001:802::200a
2a00:1450:4001:803::2002
2a00:1450:4001:803::2006
2a00:1450:4001:809::2001
2a00:1450:4001:809::2004
2a00:1450:4001:80f::2002
2a00:1450:4001:811::2001
2a00:1450:4001:812::2002
2a00:1450:4001:813::2001
2a00:1450:4001:827::2002
2a00:1450:4001:829::2003
2a00:1450:4001:82a::2003
2a00:1450:4001:82f::2002
2a00:1450:4001:830::2002
2a00:1450:4001:831::2002
2a00:1450:4001:831::200e
2a02:2638::1c
3.126.56.137
34.102.149.62
34.240.2.137
34.98.64.218
35.186.193.173
37.157.3.30
37.252.173.22
51.178.20.139
52.29.176.117
52.48.144.237
52.49.183.138
54.36.109.22
54.81.207.173
54.84.143.226
69.173.144.138
69.173.144.139
72.21.206.140
72.251.249.14
76.223.111.131
88.214.206.142
000aa718fa3c1c7ae3fcd7884c2ac7606583e6c351626df7156b162ead404a61
00a7f30cba5ffdca996801a316a2dd4d9a484c22240e32e4e302a2bfc16e1551
01d4dd3082ee2fa86ca800af378341f54e4980badbe1448ffd39d0e3bc98a7f9
0665f5f3dfc038e410e2f0004a1a5ff6d2d91f392dd32208606eb8ff51195172
06c572e99c878362d40d1f358efdfe400ae1310f35cf22174dcdd5db022dd810
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60
0b05b4fdf98405edace9cb91aa22ca78159629b426c3b9b40e0b117a82d78d8f
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
0f563769bc10d7f4f9daad8c0992d4749482a80ad5bafd4fda3024655a108aa9
10d4b728888654e0b85c706a9310b551087d3321fb8ebfff147d07b13fa73bf0
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
135420bb8c58a8c18fbffb6ac6e46a6c9d8679fa08befe3c378aaba3b5c64787
1598f80d363db82c28ae8385d03f79fa08a5a830c5ce103b08c1d1bcd8267877
1881ed5a5ede7751f62ca41ef98423c19b35c0a6be4f2434425f7df01763232e
1a93848c085efc9f585f788e97acaccd8e4b19ea4b81e1b82c72900a53d233a3
1b113cf7d5e8230f2c635ef644ee8ab1533228b80b42d953bc6ca10ec2d2a8cf
1ce69465fa2284194ab3ec822ee452307e2f4b4ab202499e24a06f8215b1ead1
1d190bb644240c0d74123d22677fcabd1c4ea529703e536290857fcf1d5a20e9
1d2555967c12febd8161d68c6e94516b6a36ef337ecfdf1503baacbe55f8576e
1d6f7818a09adfc9c11ff7110eb866179ef9d36a3625cd1c02e23292d315daaa
1e0c500c57328bcdd6992db38ed20a78a321a8b62197c1e0659231ed3ab1eb14
1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f
202bd56541955467d5f146d2327d07cf24d15c1a4cec190b4422e0b05e6aa521
23c79bb552706be2ca97bdb259921e3269a5263326b147676c2f7909a45b58c9
265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6
28eaab762ea585c84f788d0e8608c30a9c879475db106c1ff754299708adcf51
2a354649f57a81405daccfd6b5785da5f73ba638f2db591992cb7b739dac3135
2bf593112504d6cf7ef713e8648777ba85e0cf0fe4930933960d83ce041b19dc
2c16267b73be934e47fa59b248a66488479092eef5d06d02977630f01b6015d6
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347
32d7096216dc157694c3bcd3f2878eed535d8befb7884c2e71aaf25a6fce5757
34e9a619897b9223115c6588f352612268c90c3d83990829768973759b0d1a6e
3724650f68d9864f04dd2b43a0fa74e196e6019c803c75f0fe961af4639043f1
385010b2baf8e0770b72bda5e96434d98bb716cfe29968e27a8eb51ee4ffde68
3a62d98c587c63d75303477d6ee39d83eb76cf095c40016d3334b79f48e724d9
3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820
3ba6033bcef6eaacedffc9ef085b0f3aaf62b19c7e7bbd818db359a3ee32fd8e
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
4356da845489a8803ba9dae2128665643d3027ab424d43a0d07a3fc85f052132
4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b
4763390e1fc67cffdd08fc8b11ab860e91725eb864db4df971d878f1d570fe04
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
561cf1c701ba868c42bf72c8c58e6e35fe934798737dbd50f22bbca5072c751d
6039cdb2c8028b73ddb9d711e7eb22834a8e11ba865283a7ed2fd2c75a401040
603da704faeac456353f4b9118e4a9f751f2cc770915e90eae69924c965eae70
64efdf33ff487ad815c53fe5f819454efd9364a0382e5f410972cfaa918fb66a
661cbae1050193b339c2f4753348eee3b11a0fe3c8c6b3954426b7cf347cabd0
680e69eec93ab478a82adc7021fca9f7588e9ead4285d6ae1c0c24907b49e308
686c5620f8237b773f1c5136ccaee5fad097264a76b016095ba1f222ff255e92
6a4f642665bc8acd34fa8f09893d145e9670dd85627188b8badffbfcabd5fe49
6f5414a00d9de40f036c84608713a628419189bb8f829a28577ee1fc2bda9236
6f57fd658644f23df86a2b6859fb3a01831bc41d99c9cb6a38ecf0641d89a722
7929ef5b848609d4d5ef695261ede98df014607a3cc0d1eabacb2f503d838842
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
7a6ac6e588a725241e6f43feaad46fb36de9682576f5f29c570edc3ec5247477
7aa8f89d9629c52abf1948b041e78560978a7f601876aa634852f0b2e58cbcf9
7e1adee22626162c0fb089096a3bd419c5a57d50043e31bf6e7b2ea292f6341f
867947a4634bf633546e9b9db67e2bb289ff9e031cc05d99c7d4459232998d24
89041d4a8ff69bb5f9e3eb632ec9eb92ef223511f981465eeabedd97b1ef887d
890e0090ae6817e59c39a34765662ad440b9067f9b02c74db24bb70fd9eb29d2
8984590d4b780e7b0071ff24d23cc54ecc2d15f738524d943812b220b0f9a9e8
8a78dae412fd5399523846db8f14f9be73225a0558acbf605227bd858a963205
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
916c930beb86ef0f20096f08a556055da89dea56be2b32241a4b7ac47db323bc
966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38
98d453d14213adc82358775170098980cfdeab09e53543d0273924ad13cf77ec
995861010e6169acbac1c0facc441df8955b1bb3cb75383b32328bc4202c39a6
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9ac02f4f4fbb7a170c6cc2c8749a917207f62461f25129680c964a1caf3d7b8a
9d391cff26c4263fb63bd1ec57cb0cbd9c9693a4e7f6c8451d073438f2a6bd6e
9fdb19a71e00bb21dfedda32adce5776cf86de33a1b4b2aebafdbd6f94cebc88
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5e762276ffd20732a10037842bac383dc64a7b230ab1f48f2a0ff7406b8b9c8
a615849237c0ce94e73fc69d86e5f9c58bdaca8d9756a5ff4c88fa86b14e6177
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c
ab916a26cfa433b01d5e19e95418ed9d8d477638bc5d54c5cbf83808740b97e7
ac054159a85ddee2e265bc0a517304e773e8c8db653af949bab52dec5e2a1ed9
b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b27ff4b5540d29ec8590265d0e8fa3bac643ee75c8d453f21b1f57935a9e7380
b58ee3d7b8cf7715cb2efcc2910ced1fbeeac027b23a5f5b600cd8c07c100b1f
ba49e23fe9269a203befcd1ff0182766711afab8a5e9d098e86cb3ed13248be2
bae8dfa26244bc5e96b7918f79c30a3c3f624dd4505bee6cf531fa633607a199
bb79f5b774d6af18692f105e0def243b835b25ee6286a0b7e394e8758db6cb99
bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012
bc1931e9b7250b3492c2efaa8fd009ab86c877d21cadec7ee99db8f9fc4bec2b
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cabbde8502a6598896a3c812c89ecd99ecfb3e9ca68f632c8c9b3f2a7f6e0046
d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5
d2641613956457a058550707409ced955499e181d4756077e11a0fb1952fbf23
d5b724b7fcc373e0d4b583817d46310f7c5d92c59209d183d24f0b27ae119cf8
d5d4535cc978de1c946554320f48b5b816ebe04e7de3408c9affccb277625138
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de7dd7e8a5f2257d16c23c395b9262c6fa04689c81b0e2b8bf7f5bae9f4177dc
e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234
e2f126a8957c32db99e94d1bf7c9ed09fcd38ba99bd632ebd048f01f9c5f9c9b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5b7284af41e6241765d69c3925ee518e4182b73bc45adebb68d8e8f76e9d9ae
e684839cbcef6b16753dae73e92a49b7115f55e83662ead12d5e05bf7b9915fb
e8c2e4d6ab0ad2f055a6cc3c777d31531e665758db5ca815f2613afad72f7088
ea18c1af5335fb04e11fdded9c3aec52b377bec0436fce03f52b989631b8da85
ebe05f4737785920d862f2fffc18cf51f433282098cea15d3f860442bdd815dd
ec2f44e7dbd2ebb1268ac7e7a0602ec2106bc7fd9da17b9012db81be55cbd485
ec5c4259535bfa76fa1049a4a8a06f3232d13bee8af0c3575e8b2cdd70be3f7f
ec6cb1ecb7a1a6b2fc9d46770a569eb42dfbbee2f4e845c7d9436229041e94d3
ed936ded7b4b994acb086ad424cb60c602f2638a4b200fa3c18eabc7e8399e03
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f9ceb55dc61f4a59d76a175754dd840f84a3d4e5e3b4797690ecea8fa8bf89cf

www.billofsale-form.com Open in urlscan Pro 2606:4700:3035::ac43:bf24 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

206 Requests

99 %HTTPS

36 %IPv6

51 Domains

82 Subdomains

58 IPs

8 Countries

1414 kBTransfer

3420 kBSize

4 Cookies

6 Outgoing links

Page URL History

Redirected requests

206 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.billofsale-form.com Open in urlscan Pro
2606:4700:3035::ac43:bf24 Public Scan

Screenshot
Live screenshot

Full Image

206
Requests

99 %
HTTPS

36 %
IPv6

51
Domains

82
Subdomains

58
IPs

8
Countries

1414 kB
Transfer

3420 kB
Size

4
Cookies

206 HTTP transactions
3 data transactions