pastelink.net Open in urlscan Pro
178.79.155.87 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pastelink.net/53fgu29a
Submission: On October 03 via manual (October 3rd 2022, 2:57:13 am UTC) from CA — Scanned from AU

Summary HTTP 292 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 47 IPs in 7 countries across 37 domains to perform 292 HTTP transactions. The main IP is 178.79.155.87, located in London, United Kingdom and belongs to LINODE-AP Linode, LLC, US. The main domain is pastelink.net. The Cisco Umbrella rank of the primary domain is 327062.
TLS certificate: Issued by R3 on September 21st 2022. Valid for: 3 months.

This is the only time pastelink.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
12	178.79.155.87 178.79.155.87	63949 (LINODE-AP...) (LINODE-AP Linode)
2	172.217.194.95 172.217.194.95	15169 (GOOGLE) (GOOGLE)
1	69.16.175.42 69.16.175.42	20446 (STACKPATH...) (STACKPATH-CDN)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	172.67.202.177 172.67.202.177	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	142.251.12.105 142.251.12.105	15169 (GOOGLE) (GOOGLE)
2	74.125.200.97 74.125.200.97	15169 (GOOGLE) (GOOGLE)
1	142.251.10.94 142.251.10.94	15169 (GOOGLE) (GOOGLE)
4	74.125.24.94 74.125.24.94	15169 (GOOGLE) (GOOGLE)
22 34	142.251.10.155 142.251.10.155	15169 (GOOGLE) (GOOGLE)
3	13.33.79.24 13.33.79.24	16509 (AMAZON-02) (AMAZON-02)
4	142.251.12.139 142.251.12.139	15169 (GOOGLE) (GOOGLE)
1	13.33.30.231 13.33.30.231	16509 (AMAZON-02) (AMAZON-02)
1	142.251.12.154 142.251.12.154	15169 (GOOGLE) (GOOGLE)
1	74.125.200.155 74.125.200.155	15169 (GOOGLE) (GOOGLE)
36	74.125.24.155 74.125.24.155	15169 (GOOGLE) (GOOGLE)
7	142.251.12.132 142.251.12.132	15169 (GOOGLE) (GOOGLE)
1	13.33.88.90 13.33.88.90	16509 (AMAZON-02) (AMAZON-02)
1	104.22.53.86 104.22.53.86	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	141.95.98.70 141.95.98.70	16276 (OVH) (OVH)
2 12	52.46.130.91 52.46.130.91	16509 (AMAZON-02) (AMAZON-02)
27	172.217.194.132 172.217.194.132	15169 (GOOGLE) (GOOGLE)
1	18.139.54.231 18.139.54.231	16509 (AMAZON-02) (AMAZON-02)
1	141.95.98.65 141.95.98.65	16276 (OVH) (OVH)
12	142.251.12.156 142.251.12.156	15169 (GOOGLE) (GOOGLE)
6	142.250.4.155 142.250.4.155	15169 (GOOGLE) (GOOGLE)
12	23.36.254.7 23.36.254.7	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	13.33.88.107 13.33.88.107	16509 (AMAZON-02) (AMAZON-02)
2 2	35.213.12.39 35.213.12.39	15169 (GOOGLE) (GOOGLE)
2 2	64.202.112.255 64.202.112.255	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1 1	104.69.148.168 104.69.148.168	16625 (AKAMAI-AS) (AKAMAI-AS)
3 7	52.220.40.119 52.220.40.119	16509 (AMAZON-02) (AMAZON-02)
2	23.72.44.196 23.72.44.196	16625 (AKAMAI-AS) (AKAMAI-AS)
2	23.9.185.218 23.9.185.218	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	199.187.193.202 199.187.193.202	47043 (SMARTADSE...) (SMARTADSERVER)
42	142.250.4.149 142.250.4.149	15169 (GOOGLE) (GOOGLE)
18 30	104.18.19.126 104.18.19.126	13335 (CLOUDFLAR...) (CLOUDFLARENET)
18 24	104.254.150.228 104.254.150.228	29990 (ASN-APPNEX) (ASN-APPNEX)
6 6	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
2 2	104.254.148.252 104.254.148.252	29990 (ASN-APPNEX) (ASN-APPNEX)
1	67.199.150.81 67.199.150.81	62713 (AS-PUBMATIC) (AS-PUBMATIC)
4	34.149.43.113 34.149.43.113	15169 (GOOGLE) (GOOGLE)
5 9	69.173.158.64 69.173.158.64	26667 (RUBICONPR...) (RUBICONPROJECT)
8	172.253.118.156 172.253.118.156	15169 (GOOGLE) (GOOGLE)
1 2	185.84.60.30 185.84.60.30	() ()
1 1	103.229.206.241 103.229.206.241	30419 (MEDIAMATH...) (MEDIAMATH-INC)
2	67.199.150.85 67.199.150.85	() ()
3	103.231.98.194 103.231.98.194	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	18.136.93.127 18.136.93.127	16509 (AMAZON-02) (AMAZON-02)
2	209.197.3.19 209.197.3.19	20446 (STACKPATH...) (STACKPATH-CDN)
1 1	69.173.151.100 69.173.151.100	() ()
1	52.94.222.140 52.94.222.140	() ()
1	13.107.42.14 13.107.42.14	() ()
4	205.185.216.42 205.185.216.42	() ()
2	3.1.212.219 3.1.212.219	() ()
292	47

12 178.79.155.87 (London, United Kingdom)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li274-87.members.linode.com

pastelink.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.194.95 (United States)

ASN15169 (GOOGLE, US)
PTR: si-in-f95.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.16.175.42 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: tlb.hwcdn.net

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.67.202.177 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.adligature.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.251.12.105 (United States)

ASN15169 (GOOGLE, US)
PTR: se-in-f105.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.125.200.97 (United States)

ASN15169 (GOOGLE, US)
PTR: sa-in-f97.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.10.94 (United States)

ASN15169 (GOOGLE, US)
PTR: sd-in-f94.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 74.125.24.94 (United States)

ASN15169 (GOOGLE, US)
PTR: sf-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 142.251.10.155 (United States) 22 redirects

ASN15169 (GOOGLE, US)
PTR: sd-in-f155.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.33.79.24 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-79-24.sin2.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.12.139 (United States)

ASN15169 (GOOGLE, US)
PTR: se-in-f139.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.30.231 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-30-231.sin2.r.cloudfront.net

aax-dtb-cf.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.12.154 (United States)

ASN15169 (GOOGLE, US)
PTR: se-in-f154.1e100.net

adservice.google.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.125.200.155 (United States)

ASN15169 (GOOGLE, US)
PTR: sa-in-f155.1e100.net

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

36 74.125.24.155 (United States)

ASN15169 (GOOGLE, US)
PTR: sf-in-f155.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.251.12.132 (United States)

ASN15169 (GOOGLE, US)
PTR: se-in-f132.1e100.net

fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.88.90 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-88-90.sin2.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.22.53.86 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.95.98.70 (France)

ASN16276 (OVH, FR)
PTR: ns3216620.ip-141-95-98.eu

lb.eu-1-id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 52.46.130.91 (Ashburn, United States) 2 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 172.217.194.132 (United States)

ASN15169 (GOOGLE, US)
PTR: si-in-f132.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.139.54.231 (Singapore, Singapore)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-139-54-231.ap-southeast-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.95.98.65 (France)

ASN16276 (OVH, FR)
PTR: ns3216659.ip-141-95-98.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 142.251.12.156 (United States)

ASN15169 (GOOGLE, US)
PTR: se-in-f156.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.4.155 (United States)

ASN15169 (GOOGLE, US)
PTR: sm-in-f155.1e100.net

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 23.36.254.7 (Singapore, Singapore)

ASN16625 (AKAMAI-AS, US)
PTR: a23-36-254-7.deploy.static.akamaitechnologies.com

cdn.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.88.107 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-33-88-107.sin2.r.cloudfront.net

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.213.12.39 (Tokyo, Japan) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 39.12.213.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.202.112.255 (Lovettsville, United States) 2 redirects

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.69.148.168 (Singapore, Singapore) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-69-148-168.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 52.220.40.119 (Singapore, Singapore) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-220-40-119.ap-southeast-1.compute.amazonaws.com

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.72.44.196 (Singapore, Singapore)

ASN16625 (AKAMAI-AS, US)
PTR: a23-72-44-196.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.9.185.218 (Singapore, Singapore)

ASN16625 (AKAMAI-AS, US)
PTR: a23-9-185-218.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.187.193.202 (Canada) 1 redirects

ASN47043 (SMARTADSERVER, CA)

ssbsync-us.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

42 142.250.4.149 (United States)

ASN15169 (GOOGLE, US)
PTR: sm-in-f149.1e100.net

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

30 104.18.19.126 (Shahr, Iran, Islamic Republic Of) 18 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 104.254.150.228 (Los Angeles, United States) 18 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 15.197.193.217 (United States) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.254.148.252 (Los Angeles, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.199.150.81 (Los Angeles, United States)

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.149.43.113 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 113.43.149.34.bc.googleusercontent.com

rtb0.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rtbc-ae1.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 69.173.158.64 (Singapore, Singapore) 5 redirects

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.253.118.156 (United States)

ASN15169 (GOOGLE, US)
PTR: sl-in-f156.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.84.60.30 (None, ) 1 redirects

ASN- ()

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.229.206.241 (Singapore) 1 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 67.199.150.85 (None, )

ASN- ()

image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
simage4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 103.231.98.194 (Japan)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.136.93.127 (Singapore, Singapore) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-136-93-127.ap-southeast-1.compute.amazonaws.com

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.197.3.19 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: vip0x013.map2.ssl.hwcdn.net

servedby.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.151.100 (None, ) 1 redirects

ASN- ()

pixel-us-east.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.94.222.140 (None, )

ASN- ()

aax-eu.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (None, )

ASN- ()

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 205.185.216.42 (None, )

ASN- ()

cdn.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.1.212.219 (None, )

ASN- ()

d9.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
70	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 102 fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 143	428 KB
54	doubleclick.net 22 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 180 googleads.g.doubleclick.net — Cisco Umbrella Rank: 42 cm.g.doubleclick.net — Cisco Umbrella Rank: 212 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 299	364 KB
42	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 268	2 MB
30	casalemedia.com 18 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 528	23 KB
26	adnxs.com 20 redirects ib.adnxs.com — Cisco Umbrella Rank: 229 secure.adnxs.com — Cisco Umbrella Rank: 428	25 KB
17	amazon-adsystem.com 2 redirects c.amazon-adsystem.com — Cisco Umbrella Rank: 297 aax-dtb-cf.amazon-adsystem.com — Cisco Umbrella Rank: 494 s.amazon-adsystem.com — Cisco Umbrella Rank: 287 aax-eu.amazon-adsystem.com	57 KB
16	doubleverify.com cdn.doubleverify.com — Cisco Umbrella Rank: 468 rtb0.doubleverify.com — Cisco Umbrella Rank: 676 rtbc-ae1.doubleverify.com — Cisco Umbrella Rank: 19922 tps.doubleverify.com Failed	484 KB
12	rubiconproject.com 6 redirects eus.rubiconproject.com — Cisco Umbrella Rank: 557 token.rubiconproject.com — Cisco Umbrella Rank: 667 pixel-us-east.rubiconproject.com pixel.rubiconproject.com	17 KB
12	pastelink.net pastelink.net — Cisco Umbrella Rank: 327062	218 KB
9	google.com www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 76	2 KB
8	flashtalking.com servedby.flashtalking.com — Cisco Umbrella Rank: 827 cdn.flashtalking.com d9.flashtalking.com secure.flashtalking.com Failed adstudio-asset-lib.flashtalking.com Failed	87 KB
8	pubmatic.com ads.pubmatic.com — Cisco Umbrella Rank: 457 image6.pubmatic.com — Cisco Umbrella Rank: 647 image4.pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 904 simage2.pubmatic.com — Cisco Umbrella Rank: 686 simage4.pubmatic.com	25 KB
7	sharethrough.com 3 redirects match.sharethrough.com — Cisco Umbrella Rank: 538	2 KB
6	adsrvr.org 6 redirects match.adsrvr.org — Cisco Umbrella Rank: 344	3 KB
6	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 191	262 KB
5	gstatic.com www.gstatic.com fonts.gstatic.com	212 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 28	20 KB
4	adligature.com cdn.adligature.com — Cisco Umbrella Rank: 76221	185 KB
2	yahoo.com 1 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 439	1 KB
2	adform.net 1 redirects c1.adform.net	950 B
2	zemanta.com 2 redirects b1sync.zemanta.com — Cisco Umbrella Rank: 532	1 KB
2	bidswitch.net 2 redirects x.bidswitch.net — Cisco Umbrella Rank: 288	1 KB
2	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 1159 id5-sync.com — Cisco Umbrella Rank: 456	17 KB
2	crwdcntrl.net tags.crwdcntrl.net — Cisco Umbrella Rank: 1205 bcp.crwdcntrl.net — Cisco Umbrella Rank: 818	10 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 64	137 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 41	2 KB
1	linkedin.com px.ads.linkedin.com	572 B
1	mathtag.com 1 redirects sync.mathtag.com — Cisco Umbrella Rank: 441	661 B
1	smartadserver.com 1 redirects ssbsync-us.smartadserver.com — Cisco Umbrella Rank: 5534	329 B
1	bluekai.com 1 redirects stags.bluekai.com — Cisco Umbrella Rank: 480	722 B
1	smaato.net 1 redirects s.ad.smaato.net — Cisco Umbrella Rank: 712	530 B
1	eu-1-id5-sync.com lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 1356 lbs.eu-1-id5-sync.com Failed	327 B
1	google.com.au adservice.google.com.au — Cisco Umbrella Rank: 103730	792 B
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 208	1 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 663	30 KB
0	pippio.com Failed pippio.com Failed
0	ip-api.com Failed pro.ip-api.com Failed
292	37

	Domain	Requested by
42	s0.2mdn.net	pastelink.net fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com s0.2mdn.net
36	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
30	dsum-sec.casalemedia.com	18 redirects googleads.g.doubleclick.net
30	cm.g.doubleclick.net	22 redirects googleads.g.doubleclick.net eus.rubiconproject.com
27	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com googleads.g.doubleclick.net
24	ib.adnxs.com	18 redirects googleads.g.doubleclick.net
12	cdn.doubleverify.com	fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com cdn.doubleverify.com pastelink.net cdn.flashtalking.com
12	googleads.g.doubleclick.net	fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com pastelink.net
12	s.amazon-adsystem.com	2 redirects c.amazon-adsystem.com s.amazon-adsystem.com match.sharethrough.com ads.pubmatic.com eus.rubiconproject.com
12	pastelink.net	pastelink.net
8	googleads4.g.doubleclick.net	pastelink.net
8	www.google.com	pastelink.net tpc.googlesyndication.com fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
7	match.sharethrough.com	3 redirects s.amazon-adsystem.com match.sharethrough.com ads.pubmatic.com
7	fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
6	match.adsrvr.org	6 redirects
6	www.googletagservices.com	fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
5	token.rubiconproject.com	4 redirects eus.rubiconproject.com
4	cdn.flashtalking.com	servedby.flashtalking.com cdn.flashtalking.com
4	pixel.rubiconproject.com	1 redirects eus.rubiconproject.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
4	securepubads.g.doubleclick.net	cdn.adligature.com securepubads.g.doubleclick.net
4	fonts.gstatic.com	fonts.googleapis.com
4	cdn.adligature.com	pastelink.net cdn.adligature.com
3	c.amazon-adsystem.com	cdn.adligature.com c.amazon-adsystem.com
2	d9.flashtalking.com	cdn.flashtalking.com d9.flashtalking.com
2	servedby.flashtalking.com	fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
2	rtbc-ae1.doubleverify.com	cdn.doubleverify.com
2	pr-bh.ybp.yahoo.com	1 redirects ads.pubmatic.com
2	image2.pubmatic.com	ads.pubmatic.com
2	c1.adform.net	1 redirects ads.pubmatic.com
2	rtb0.doubleverify.com	cdn.doubleverify.com
2	secure.adnxs.com	2 redirects
2	eus.rubiconproject.com	s.amazon-adsystem.com eus.rubiconproject.com
2	ads.pubmatic.com	s.amazon-adsystem.com ads.pubmatic.com
2	b1sync.zemanta.com	2 redirects
2	x.bidswitch.net	2 redirects
2	www.googletagmanager.com	pastelink.net www.googletagmanager.com
2	fonts.googleapis.com	pastelink.net
1	simage4.pubmatic.com	ads.pubmatic.com
1	px.ads.linkedin.com	eus.rubiconproject.com
1	aax-eu.amazon-adsystem.com	eus.rubiconproject.com
1	pixel-us-east.rubiconproject.com	1 redirects
1	simage2.pubmatic.com	ads.pubmatic.com
1	image4.pubmatic.com	ads.pubmatic.com
1	sync.mathtag.com	1 redirects
1	image6.pubmatic.com	ads.pubmatic.com
1	ssbsync-us.smartadserver.com	1 redirects
1	stags.bluekai.com	1 redirects
1	s.ad.smaato.net	1 redirects
1	id5-sync.com	cdn.id5-sync.com
1	bcp.crwdcntrl.net	tags.crwdcntrl.net
1	lb.eu-1-id5-sync.com	cdn.id5-sync.com
1	cdn.id5-sync.com	pastelink.net
1	tags.crwdcntrl.net	pastelink.net
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.com.au	securepubads.g.doubleclick.net
1	aax-dtb-cf.amazon-adsystem.com	c.amazon-adsystem.com
1	www.gstatic.com	www.google.com
1	cdnjs.cloudflare.com	pastelink.net
1	code.jquery.com	pastelink.net
0	adstudio-asset-lib.flashtalking.com Failed	cdn.flashtalking.com
0	secure.flashtalking.com Failed	fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com cdn.flashtalking.com
0	tps.doubleverify.com Failed	cdn.doubleverify.com
0	pippio.com Failed	ads.pubmatic.com
0	lbs.eu-1-id5-sync.com Failed	cdn.id5-sync.com
0	pro.ip-api.com Failed	cdn.adligature.com
292	66

This site contains links to these domains. Also see Links.

Domain
www.proteckd.com
www.facebook.com
twitter.com
t.me
api.whatsapp.com
www.reddit.com
www.pinterest.com
www.tumblr.com
www.blogger.com
profitquery.com
www.linkedin.com
share.flipboard.com
social-plugins.line.me
www.meneame.net
diasp.org

Subject Issuer	Validity	Valid
pastelink.net R3	`2022-09-21` - `2022-12-20`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2022-05-09` - `2023-04-18`	a year	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon	`2022-06-15` - `2023-06-15`	a year	crt.sh
*.google.com.au GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.crwdcntrl.net Go Daddy Secure Certificate Authority - G2	`2022-05-01` - `2023-06-02`	a year	crt.sh
*.eu-1-id5-sync.com R3	`2022-08-18` - `2022-11-16`	3 months	crt.sh
s.amazon-adsystem.com Amazon	`2022-05-09` - `2023-04-21`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.id5-sync.com R3	`2022-08-18` - `2022-11-16`	3 months	crt.sh
*.doubleverify.com DigiCert SHA2 Secure Server CA	`2021-12-23` - `2022-12-23`	a year	crt.sh
*.sharethrough.com Amazon	`2021-11-25` - `2022-12-22`	a year	crt.sh
*.pubmatic.com DigiCert SHA2 Secure Server CA	`2022-02-04` - `2023-02-03`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-17` - `2023-04-04`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
track.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2022-09-20` - `2023-09-20`	a year	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-06-14` - `2022-12-07`	6 months	crt.sh
servedby.flashtalking.com DigiCert TLS RSA SHA256 2020 CA1	`2022-01-27` - `2023-02-24`	a year	crt.sh
aax-eu.amazon-adsystem.com Amazon	`2022-07-20` - `2023-07-19`	a year	crt.sh
cdn.flashtalking.com DigiCert TLS RSA SHA256 2020 CA1	`2022-01-27` - `2023-02-25`	a year	crt.sh
tag.device9.com Go Daddy Secure Certificate Authority - G2	`2022-07-25` - `2023-08-26`	a year	crt.sh

This page contains 41 frames:

Primary Page: https://pastelink.net/53fgu29a
Frame ID: 072B23C13EAAA7AAF345E9AB758CB4D1
Requests: 54 HTTP requests in this frame

Frame: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: B9467306DF7CD83E721B9F9421E74413
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain&dcc=t
Frame ID: AC05ECFB9A9FB784060241600CB4C610
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 42F92A4B59A5EF8EB2F6EC4D6F0712C7
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 381ED83C009F139526A7DA445394278C
Requests: 2 HTTP requests in this frame

Frame: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 40C221D52C474F30FDB496943F6C3344
Requests: 16 HTTP requests in this frame

Frame: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: A04763408B744410C9F875B357B50D8C
Requests: 16 HTTP requests in this frame

Frame: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 48049776BF42960B25916A05EF80F297
Requests: 23 HTTP requests in this frame

Frame: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: BB73196CCF124710B5D5846715C4D768
Requests: 15 HTTP requests in this frame

Frame: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 06AB61DCAC2F5180265E7A528F1A27EF
Requests: 15 HTTP requests in this frame

Frame: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: A4779EE72836FCF8B80F7D279791621D
Requests: 23 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sY5PHd0wEwAQ&v=APEucNW3MkI34zrLXIGZ5SxWErJg1XbEtDLhKzgcFW_7-arFagrm3pR_WV8OBTzSKR1gYBEgx24pUQGtRU7ziCi98u7LFMcYCQ
Frame ID: 5F16C01205DA8AB38A1FB778F5D2C2B2
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sY2-fd0wEwAQ&v=APEucNWET0IDM519V3i_LXUQNX5EWf2QeGo1dNOgbdyaNExuT7MiWhhAAcBKsKhxNgvwLwgKIp9oSxv2ydowghf3HXW9a6JVPw
Frame ID: 89EDEB21A0014868DAA516A3DE3B00CA
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARiA-ITRATAB&v=APEucNXOZqQRWmFQrH35ltv-HhYbPoR8-lCW-_Rba8gi1Bmx5GhhLBSx7zq5LAfeWn1cG9-W_VxX4B-14Oc-k7ioUNaKWCqt5g
Frame ID: AB190C12A4DEA190C1B74DF39C5FEBEC
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sYvrqy0gEwAQ&v=APEucNUTUzMHDvS1X1_wkKPBlSEvznY-a2tgebatKOoGp9eReX38XrpQAyQJYenf6R8gMcMIAN5N0JKBtg2Dvh1TnKTt4wnJ0Q
Frame ID: F91FFBD981BF45E2E4C8C0B1AA28A8CF
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sYvrqy0gEwAQ&v=APEucNWxjazYEZUxYIJJePJJcPFYtbDXreTPO-2n5UzMan42KLt3cAROdGIPX6Qox1ANLMhhtiWJXTe2OS7nU5a8_QGV58rrLg
Frame ID: E240E9F1E3D93C2E2746010DBE2E710C
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARiijIXRATAB&v=APEucNXAw5Uv9fXkH6Sbl414FzmDLUWFpe6URRBLFvr3-6XxlytM0tvCSKa-gYJOwEs2cOKnThOLOuJOCT154zQLtk8iJyH6Vw
Frame ID: 267E53B7D54A755AB8C466A5DE368245
Requests: 5 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Frame ID: E5E04ED716A2EDCAD285932B83EA1C56
Requests: 4 HTTP requests in this frame

Frame: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Frame ID: C619F95E1979A805DF54B268ADD393D4
Requests: 6 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Frame ID: AF6A317F344D7F08E8611DDE2C087FB7
Requests: 11 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Frame ID: 2C0C3F59A77292FF5276D532B04F1825
Requests: 12 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=2570014997578740130&gdpr=0&gdpr_consent=
Frame ID: 2CB945227B06C81E4CFBA3028DEF298C
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 9EB92C0769FF6B5EFF7D0D587F19B742
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 36A0E0290FAB39C1224D8E3F08E08061
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 1FE504BC1739AC5A06A6FB84B3BD8A57
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 045F6F3840DAA99887653DF99AF44928
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 083169BBA8743F9A98102726552914AA
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: C5CFCD1BD2535D60BE18F54936E64D4F
Requests: 3 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=B5D3048E-F57D-4798-BCC1-50AFE1835279
Frame ID: 25D84AE0BBA3C5E09397C34196939F41
Requests: 1 HTTP requests in this frame

Frame: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=B5D3048E-F57D-4798-BCC1-50AFE1835279
Frame ID: CDC302CBF5BEF69D64901D319A4F52FA
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UIDB5D3048E-F57D-4798-BCC1-50AFE1835279
Frame ID: 2D2F81A58E65BAA6FF41DE47A021ED3D
Requests: 1 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements3094.js
Frame ID: 2B930958CA9FC4F98A141F68363066D5
Requests: 2 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements3094.js
Frame ID: 0FA617B16789AB377AF47F99DE2C6250
Requests: 2 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/11801784320751736007/index.html
Frame ID: 9E7C3062B57371EF6968CF70FE0B1836
Requests: 7 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/16303439989154602609/index.html
Frame ID: 8676EAB212D5FF90908F2C4E4AF7F5B6
Requests: 7 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
Frame ID: 32A76FF79842C9257973D32108714A14
Requests: 10 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
Frame ID: 783F516D63373A10ACC883878641BFF5
Requests: 10 HTTP requests in this frame

Frame: https://cdn.flashtalking.com/155165/3854153/main.html
Frame ID: AB7C3F5C221F9B1CBEEA30E98A857A14
Requests: 2 HTTP requests in this frame

Frame: https://cdn.flashtalking.com/155165/3893991/main.html
Frame ID: 2CD43B0ACA28C620C379D6E0DE5262DF
Requests: 2 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements3094.js
Frame ID: C6443F60F4F8071556B50929C8530782
Requests: 2 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements3094.js
Frame ID: C37FD17E62F262E8DED43A097B735E81
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Different Types Of EMF Protection Hats - Pastelink.net

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

292
Requests

79 %
HTTPS

0 %
IPv6

37
Domains

66
Subdomains

47
IPs

7
Countries

4533 kB
Transfer

11656 kB
Size

56
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://www.proteckd.com/
Title: https://www.proteckd.com

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://pastelink.net/53fgu29a

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=Different%20Types%20Of%20EMF%20Protection%20Hats%20https://pastelink.net/53fgu29a

Search URL Search Domain Scan URL

URL: https://t.me/share/url?url=Different%20Types%20Of%20EMF%20Protection%20Hats%20%0Ahttps://pastelink.net/53fgu29a

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=Different%20Types%20Of%20EMF%20Protection%20Hats%20https://pastelink.net/53fgu29a

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https://https://pastelink.net/53fgu29a&title=Different%20Types%20Of%20EMF%20Protection%20Hats%20

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/pin/create/button/?url=https://pastelink.net/53fgu29a&description=Different%20Types%20Of%20EMF%20Protection%20Hats%20&media=https://pastelink.net/assets/images/pastelink-logo-square.png

Search URL Search Domain Scan URL

URL: http://www.tumblr.com/share?v=3&u=https://pastelink.net/53fgu29a&t=Different%20Types%20Of%20EMF%20Protection%20Hats%20&posttype=link

Search URL Search Domain Scan URL

URL: https://www.blogger.com/blog-this.g?u=https://pastelink.net/53fgu29a&n=Different%20Types%20Of%20EMF%20Protection%20Hats%20

Search URL Search Domain Scan URL

URL: https://profitquery.com/add-to/livejournal/?url=https://pastelink.net/53fgu29a&title=Different%20Types%20Of%20EMF%20Protection%20Hats%20

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https://pastelink.net/53fgu29a

Search URL Search Domain Scan URL

URL: https://share.flipboard.com/bookmarklet/popout?v=2&title=Different%20Types%20Of%20EMF%20Protection%20Hats%20&url=https://pastelink.net/53fgu29a

Search URL Search Domain Scan URL

URL: https://social-plugins.line.me/lineit/share?url=https://pastelink.net/53fgu29a&text=Different%20Types%20Of%20EMF%20Protection%20Hats%20

Search URL Search Domain Scan URL

URL: https://www.meneame.net/submit?url=https://pastelink.net/53fgu29a

Search URL Search Domain Scan URL

URL: https://diasp.org/bookmarklet?url=https://pastelink.net/53fgu29a&title=Different%20Types%20Of%20EMF%20Protection%20Hats%20&jump=doclose

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 50

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain HTTP 302
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain&dcc=t

Request Chain 112

https://s.ad.smaato.net/c/?adExInit=aps&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsmaato.com%26id%3D%24UID HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=3b716c22

Request Chain 113

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24%7BBSW_UUID%7D HTTP 302
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24%7BBSW_UUID%7D HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=e62429d9-e11f-4445-a2b3-e4c4aa4dceea

Request Chain 114

https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__ HTTP 302
https://stags.bluekai.com/site/23178?id=_HrWR-X0tNcHrruwK45A&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZSXQY3IMFXGOZJ5MFWWC6TPNZPXIYLNEZUWIPK7JBZFOURNLAYHITTDJBZHE5LXJM2DKQI HTTP 302
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZSXQY3IMFXGOZJ5MFWWC6TPNZPXIYLNEZUWIPK7JBZFOURNLAYHITTDJBZHE5LXJM2DKQI HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=_HrWR-X0tNcHrruwK45A

Request Chain 118

https://ssbsync-us.smartadserver.com/api/sync?callerId=2 HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=2570014997578740130&gdpr=0&gdpr_consent=

Request Chain 125

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1

Request Chain 126

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YzpPhacHtwARAFazCVifyQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1

Request Chain 127

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEFjMZI6JWtvUK4QgSVPEQ2g&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFjMZI6JWtvUK4QgSVPEQ2g%26google_cver%3D1

Request Chain 128

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjgxODIyNTMwODMwNzY4OTA4Mg%3D%3D

Request Chain 129

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1

Request Chain 130

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YzpPhacHtwARAFazCVifyQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1

Request Chain 131

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEI6qopysGvGGccnz0w3fvy4&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1

Request Chain 132

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzY1MzI5MjcxNTQyMTM3MzMyNA%3D%3D

Request Chain 133

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1

Request Chain 134

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YzpPhacHtwARAFazCVifyQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1

Request Chain 135

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEI6qopysGvGGccnz0w3fvy4&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1

Request Chain 136

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDUzNjIyNjU0ODM1MTYwNzU3Nw%3D%3D

Request Chain 137

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1

Request Chain 138

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YzpPhacHtwARAFazCVifyQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1

Request Chain 139

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEI6qopysGvGGccnz0w3fvy4&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1

Request Chain 140

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk0MTg2MTUxMTc2Njg3ODkzMw%3D%3D

Request Chain 141

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1

Request Chain 142

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YzpPhacHtwARAFazCVifyQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1

Request Chain 143

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEI6qopysGvGGccnz0w3fvy4&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1

Request Chain 144

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk1NjI2MDU0MDczMjU1MTE1OQ%3D%3D

Request Chain 145

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1

Request Chain 146

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YzpPhR7LVpAdryH5ww5bLQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1

Request Chain 147

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEI6qopysGvGGccnz0w3fvy4&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1

Request Chain 148

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk0MTg2MTUxMTc2Njg3ODkzMw%3D%3D

Request Chain 154

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=a7820e1a-7af3-4c11-ba6f-97b933883918&gdpr=0&gdpr_consent=

Request Chain 155

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=a7820e1a-7af3-4c11-ba6f-97b933883918&gdpr=0&gdpr_consent=

Request Chain 156

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3 HTTP 302
https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=$UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D0e8893f90b606c9c5d33f1be%26gdpr%3D0%26gdpr_consent%3D%26source_user_id%3D%24UID HTTP 302
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=7969831712906881363

Request Chain 157

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4 HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?p=156557&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156557%26pr%3Dhttps%253A%252F%252Fmatch.sharethrough.com%252Fsync%252Fv1%253Fsource_id%253DuFFr5RFBYgoUJbWMAWGEZKS3%2526source_user_id%253D%2523PMUID HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?p=156557&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156557%26pr%3Dhttps%253A%252F%252Fmatch.sharethrough.com%252Fsync%252Fv1%253Fsource_id%253DuFFr5RFBYgoUJbWMAWGEZKS3%2526source_user_id%253D%2523PMUID&rdf=1 HTTP 302
https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6543021577934406525&gdpr=0&gdpr_consent= HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=fTYnwn9jLJtmNHfGfGM5wXk2cZRmNyeXfjzigpVo HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3DB5D3048E-F57D-4798-BCC1-50AFE1835279 HTTP 302
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=B5D3048E-F57D-4798-BCC1-50AFE1835279

Request Chain 195

https://c1.adform.net/serving/cookie/match?party=14&cid=B5D3048E-F57D-4798-BCC1-50AFE1835279 HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=B5D3048E-F57D-4798-BCC1-50AFE1835279

Request Chain 196

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:edb9633a-4f87-4000-a28c-f20b447855b0&gdpr=0&gdpr_consent= HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=ruQIIKyxA3m15lglquEWcqmzWXK1tQ5x_bQHsnJt HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3DB5D3048E-F57D-4798-BCC1-50AFE1835279 HTTP 302
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=B5D3048E-F57D-4798-BCC1-50AFE1835279

Request Chain 198

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tdMEjvV9R5i8wVCv4YNSeQ%3D%3D HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

Request Chain 199

https://idsync.rlcdn.com/420486.gif?partner_uid=B5D3048E-F57D-4798-BCC1-50AFE1835279 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJEI1RDMwNDhFLUY1N0QtNDc5OC1CQ0MxLTUwQUZFMTgzNTI3ORAAGg0Ihp_pmQYSBQjoBxAAQgBKAA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=8a0f4ca1ac2de6cdffa91e63cce7f02c0b92f55be097db322ec0d07454515fbd791426b5417dce21&_=2 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA4YTBmNGNhMWFjMmRlNmNkZmZhOTFlNjNjY2U3ZjAyYzBiOTJmNTViZTA5N2RiMzIyZWMwZDA3NDU0NTE1ZmJkNzkxNDI2YjU0MTdkY2UyMRAAGgwIiJ_pmQYSBAgCEABCAEoA HTTP 302
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA4YTBmNGNhMWFjMmRlNmNkZmZhOTFlNjNjY2U3ZjAyYzBiOTJmNTViZTA5N2RiMzIyZWMwZDA3NDU0NTE1ZmJkNzkxNDI2YjU0MTdkY2UyMRAAGgwIiJ_pmQYSBAgCEABCAEoA&google_gid=CAESEHvAUMQFTkbQlhpdJumUd90&google_cver=1

Request Chain 200

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=b253633a-4f87-4d00-816b-5d13c9985a2d

Request Chain 201

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QjVEMzA0OEUtRjU3RC00Nzk4LUJDQzEtNTBBRkUxODM1Mjc5&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 202

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEB4JU7Mlh29X_VORjwq8K88&google_cver=1

Request Chain 203

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:CBF888B986A14940B2B742F09F217922 HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=eQg4rXtdM_RiCmipdlkm9Hdabf1iCGr9Ll7YIHYa HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3DB5D3048E-F57D-4798-BCC1-50AFE1835279 HTTP 302
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=B5D3048E-F57D-4798-BCC1-50AFE1835279

Request Chain 205

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=a7820e1a-7af3-4c11-ba6f-97b933883918

Request Chain 227

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=L8S6LC8B-1P-58LZ HTTP 302
https://s.amazon-adsystem.com/ecm3?id=L8S6LC8B-1P-58LZ&ex=d-rubiconproject.com&status=ok

Request Chain 228

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id= HTTP 302
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=5yDGlGYYSLq5XoyQpYn8Ow&rk=usync-na HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=5yDGlGYYSLq5XoyQpYn8Ow

Request Chain 230

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
https://pr-bh.ybp.yahoo.com/sync/rubicon/--TspjIWK93R85JyxJZEDsn5EUdSAgOZEtemQ7w0kco?csrc= HTTP 302
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5569503473443212140

Request Chain 231

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEJ3vv760ARVnEYp_ddMOsUk&google_cver=1

Request Chain 232

https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NGY1ZmQ5YmQwZGM2Y2NhNjVjYzMzN2E3ODRmMmU0NWQ4ZWZjMDhjZQ

Request Chain 233

https://token.rubiconproject.com/token?pid=36584 HTTP 302
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L8S6LC8B-1P-58LZ

Request Chain 234

https://match.adsrvr.org/track/cmf/rubicon HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=a7820e1a-7af3-4c11-ba6f-97b933883918&gdpr=0&gdpr_consent=&expires=30

Request Chain 235

https://token.rubiconproject.com/token?pid=25470 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDhTNkxDOEItMVAtNThMWg==

292 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 53fgu29a Show response
pastelink.net/ 26 KB
7 KB 1151ms
417ms Document
text/html 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

35029063e2a5ce56cba3fec0420418d5e7e12800b9a77d4c5f71ba1eda308f9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 03 Oct 2022 02:57:03 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
x-frame-options: SAMEORIGIN

GET
H2 200 css2
fonts.googleapis.com/ 5 KB
1 KB 586ms
196ms Stylesheet
text/css 172.217.194.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f95.1e100.net

Software

ESF /

Resource Hash

ebfd96030683611d9ed054682f1ddf8b9098bc7d10105602b338605b0ae82a9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 03 Oct 2022 02:57:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 03 Oct 2022 02:57:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 03 Oct 2022 02:57:03 GMT

GET
H2 200 styles.css
pastelink.net/assets/css/ 120 KB
121 KB 366ms
365ms Stylesheet
text/css 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://pastelink.net/assets/css/styles.css?q=35

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

752ff8324271233c2135a95dde8adf84e507296eacd17db421c623b0c5e5af85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/53fgu29a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Sat, 18 Jun 2022 18:14:09 GMT
server: nginx
etag: "62ae15f1-1e1ae"
content-type: text/css
accept-ranges: bytes
content-length: 123310

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 732ms
240ms Script
application/javascript 69.16.175.42
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: pastelink.net
URL: https://pastelink.net/53fgu29a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.42 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: tlb.hwcdn.net
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer: https://pastelink.net/
Origin: https://pastelink.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:04 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-15d9d"
vary: Accept-Encoding
x-hw: 1664765824.dop217.la3.t,1664765824.cds264.la3.hn,1664765824.cds267.la3.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30875

GET
H2 200 script.min.js Show response
pastelink.net/assets/js/ 41 KB
41 KB 365ms
365ms Script
application/javascript 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://pastelink.net/assets/js/script.min.js?q=35

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

612ac93fa7a4f369ab6549ed35e681c03fb942081d36944edeec8b9ea3a0c1e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/53fgu29a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 08 Jun 2022 13:39:30 GMT
server: nginx
etag: "62a0a692-a20d"
content-type: application/javascript
accept-ranges: bytes
content-length: 41485

GET
H2 200 js.cookie.min.js Show response
cdnjs.cloudflare.com/ajax/libs/js-cookie/latest/ 2 KB
1 KB 312ms
107ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/js-cookie/latest/js.cookie.min.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.25.14 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b6d244a569a8befc0b901e3dca8e82f19b188e2d3e76f7c62fce96935ed6311

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:03 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 13666909
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 772
last-modified: Mon, 04 May 2020 16:11:49 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec5-6d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iEXgdMZ5rpx2I2ZKhA8wW1NRRVXi%2BKyYXKJTyXQpBMxboTonObuBiiSCCz0cjYOjrKLy2lD4qU6fGJwX0YaavE1ZdjH9nFoPa6eDCKq7x2eSdu1%2B1UScwPgAh0oH9Aimp5cyXkvD"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7542687e39f554fd-SYD
expires: Sat, 23 Sep 2023 02:57:03 GMT

GET
H2 200 rules.js Show response
cdn.adligature.com/pl/prod/ 16 KB
5 KB 328ms
115ms Script
application/javascript 172.67.202.177
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adligature.com/pl/prod/rules.js
Requested by: Host: pastelink.net
URL: https://pastelink.net/53fgu29a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.202.177 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5740ea039fa2894da5942c74ebbd622c42f128d2777881b5c654c85fe07cb66f

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:03 GMT
content-encoding: br
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=27720
x-guploader-uploadid: ADPycduqWu5iebWjZhDjnBtbD_-U-xNfAu2bVJMEs6wljWfxMp64NpWbUb9t78beIJiWzvF41L8p6ssdaYuRk8pB9KrK6g
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 19 Sep 2022 18:15:17 GMT
server: cloudflare
etag: W/"22235b4c92371407f3f9e461c36a0fcd"
vary: Accept-Encoding
x-goog-generation: 1663611317639170
content-type: application/javascript
x-goog-hash: crc32c=udYfmg==, md5=IiNbTJI3FAfz+eRhw2oPzQ==
cache-control: public, max-age=1800, s-maxage=600, must-revalidate
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5B4JwI%2BRPlDt4Aw%2Bcx7vGNWlx7g9T8EsN%2F1cNW8mXjs6j8kDSFzOqJWSxJfYXGJJKAf0a%2FhjHFk%2Fj9mbj1wZuzobTQ6VnY%2BXMMmsjMKwy51gkq3yxeHwoBMFh%2BKF8EA%2FRFa0CXI%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 27720
cf-ray: 7542687e4c9ba8d0-SYD
expires: Mon, 03 Oct 2022 02:58:47 GMT

GET
H2 200 css2
fonts.googleapis.com/ 1 KB
483 B 586ms
197ms Stylesheet
text/css 172.217.194.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Modak:wght@400&display=swap

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f95.1e100.net

Software

ESF /

Resource Hash

2e732d9584917f154bc9cf99d21a81ff38d3b509128ab9212c823d912ae63aa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 03 Oct 2022 02:57:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 03 Oct 2022 02:57:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 03 Oct 2022 02:57:03 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 906 B
985 B 586ms
199ms Script
text/javascript 142.251.12.105
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=captchaLoaded

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f105.1e100.net

Software

GSE /

Resource Hash

ea911e1f073a044fa417f444f003343e78f4e59097988b08014724db5d515084

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 572
x-xss-protection: 1; mode=block
expires: Mon, 03 Oct 2022 02:57:03 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 173 KB
62 KB 586ms
195ms Script
application/javascript 74.125.200.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sa-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

5ff2e306c2cc23ba10e3035c75bb94c95c3af84614e37b126fa894ab14f2be37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63431
x-xss-protection: 0
last-modified: Mon, 03 Oct 2022 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 03 Oct 2022 02:57:05 GMT

GET
H2 200 advally-4.29.0.js Show response
cdn.adligature.com/rules.js/ 111 KB
31 KB 114ms
113ms Script
application/javascript 172.67.202.177
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adligature.com/rules.js/advally-4.29.0.js
Requested by: Host: cdn.adligature.com
URL: https://cdn.adligature.com/pl/prod/rules.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.202.177 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ca180607fd93a9e1b6b1d03e5ac2c4d9f661f7ce867be2b9b91ba3c3e9da926

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:04 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1323
cf-polished: origSize=183079
x-guploader-uploadid: ADPycdvoEUZw78_VcfyTWS9e1QNL0GpmTF7huyns-063Lj_Cb3nQJVj7qFSMxpWg55Ya7O9JxuZhiNh7BzPj0psOwYGT2A
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Tue, 30 Aug 2022 13:22:29 GMT
server: cloudflare
etag: W/"c42683032b2dde64f4e339d2ab3f977c"
vary: Accept-Encoding
x-goog-generation: 1661865749561003
content-type: application/javascript
x-goog-hash: crc32c=/WFfgQ==, md5=xCaDAyst3mT04znSqz+XfA==
cache-control: public, max-age=7200, s-maxage=7200, must-revalidate
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4X%2FQbsiRCdcaPbaGehWPzwk06aKbMtKopOBk8H3EfVxs2AD%2By%2FsJTXL86XXTNVM9%2FQATAqC9INe3DGFhMncnsTHfZOKAjzTRpXVgnc6mwPCEq67kJAr3AlpilGFz2vxtwXDPE8c%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 183079
cf-ray: 75426883e87ca8d0-SYD
expires: Mon, 03 Oct 2022 04:16:17 GMT

GET
H2 200 rules.css
cdn.adligature.com/pl/prod/ 294 B
728 B 109ms
107ms Stylesheet
text/css 172.67.202.177
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adligature.com/pl/prod/rules.css
Requested by: Host: cdn.adligature.com
URL: https://cdn.adligature.com/pl/prod/rules.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.202.177 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 328f7808cfa82581e66b87932fd28a928ce58f69a388aabe667e5154c3a9a437

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:04 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 235
x-guploader-uploadid: ADPycdtzBQZdMXBbyqlsxfePMqiucszIAov1zE0-UYOY4Htmt7_1EzJkQa0HeCPU85Z5tsK894NWXlZ_r-1fpmvmpf42rw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 19 Sep 2022 18:15:19 GMT
server: cloudflare
etag: W/"3e2d744323302df67c7f61ecc16cd570"
vary: Accept-Encoding
x-goog-hash: crc32c=6jmLUw==, md5=Pi10QyMwLfZ8f2HswWzVcA==
x-goog-generation: 1663611319473177
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OtYIWGZqcPINczidlhlDUMaEfhCKTigsVCKj%2FMImv4aFnofHvO1crSGKi7iHgZwpJ1L2PF87cB3Pa%2B8O1PpAP5nY5kKeFhvcIWy6Zcn7pp5KReVR%2BqLePjp%2FzjbdP1X8OEiBLOw%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=1800, s-maxage=600, must-revalidate
x-goog-stored-content-length: 294
cf-ray: 75426883e87ba8d0-SYD
expires: Mon, 03 Oct 2022 02:57:10 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/a9s0j4pCVT6gaTEkLiFbtZPH/ 389 KB
156 KB 583ms
194ms Script
text/javascript 142.251.10.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/a9s0j4pCVT6gaTEkLiFbtZPH/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=captchaLoaded

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f94.1e100.net

Software

sffe /

Resource Hash

bec7e5a49219ef10544321dbd44f27849644f20623c16f05baeeeaa73e3b9332

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Origin: https://pastelink.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Sep 2022 16:31:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 555909
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 158844
x-xss-protection: 0
last-modified: Mon, 26 Sep 2022 04:02:34 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 26 Sep 2023 16:31:56 GMT

GET
H2 200 debut_light.png
pastelink.net/assets/images/ 4 KB
4 KB 367ms
366ms Image
image/png 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/debut_light.png

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

c24ccee9a35eef9e74411eac871935bdff6bcb895cce80b754b66d3e4292a3ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 27 May 2021 10:51:09 GMT
server: nginx
etag: "60af799d-10c8"
content-type: image/png
accept-ranges: bytes
content-length: 4296

GET
H2 200 pastelink-logo.svg
pastelink.net/assets/images/logo/ 3 KB
3 KB 367ms
367ms Image
image/svg+xml 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/logo/pastelink-logo.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

01408f8061623faa6d2c0f015cd23483c3aa363c095e152f613ed94c87a5803d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 06 Oct 2021 13:37:31 GMT
server: nginx
etag: "615da69b-d3d"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 3389

GET
DATA 200
OK truncated
/ 16 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 13100cd3879e5c1385581d7c88153e60cd7c3e4b0578fe2838daa56da689769b

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 arrow-down-blue.svg
pastelink.net/assets/images/ 239 B
409 B 369ms
367ms Image
image/svg+xml 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/arrow-down-blue.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

50a60e5e5f2e8f10a2f8685031ec9849ba8faff613139f3a402e89f25ccbbabc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 29 Sep 2021 15:26:32 GMT
server: nginx
etag: "615485a8-ef"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 239

GET
H2 200 moon.svg
pastelink.net/assets/images/ 2 KB
2 KB 369ms
367ms Image
image/svg+xml 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/moon.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

ed6cd01c384db70bedbe24986aa85b0745f994ad71b7e5712f8a60e1ff457d7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Mon, 18 Apr 2022 15:53:05 GMT
server: nginx
etag: "625d8961-62e"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 1582

GET
H2 200 public-black.svg
pastelink.net/assets/images/ 578 B
748 B 370ms
368ms Image
image/svg+xml 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/public-black.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

57226adbc32c91a8cd4ec9ee08e4f155f3450e79256731c04f81709a58c4c1fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Mon, 18 Apr 2022 15:53:05 GMT
server: nginx
etag: "625d8961-242"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 578

GET
H2 200 social-spritesheet.png
pastelink.net/assets/images/ 28 KB
28 KB 370ms
368ms Image
image/png 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/social-spritesheet.png

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

8af24d7350dbdc8eea22e4737deaa35a795b19b0560d7173113bec7e8a3effb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Fri, 05 Nov 2021 18:20:14 GMT
server: nginx
etag: "618575de-70de"
content-type: image/png
accept-ranges: bytes
content-length: 28894

GET
H2 200 pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 585ms
194ms Font
font/woff2 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f94.1e100.net

Software

sffe /

Resource Hash

7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pastelink.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 09:31:37 GMT
x-content-type-options: nosniff
age: 149128
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7884
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 17:03:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 01 Oct 2023 09:31:37 GMT

GET
H2 200 EJRYQgs1XtIEskMA-hQ.woff2
fonts.gstatic.com/s/modak/v18/ 33 KB
33 KB 609ms
219ms Font
font/woff2 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/modak/v18/EJRYQgs1XtIEskMA-hQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Modak:wght@400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f94.1e100.net

Software

sffe /

Resource Hash

044310f45a5f75b5c510d535acdb78b42734c88cf31696b05c58be67e7c2219d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pastelink.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 28 Sep 2022 00:03:58 GMT
x-content-type-options: nosniff
age: 442387
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33560
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 15:07:23 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 28 Sep 2023 00:03:58 GMT

GET
H2 200 pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 878ms
487ms Font
font/woff2 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f94.1e100.net

Software

sffe /

Resource Hash

cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pastelink.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 14:32:17 GMT
x-content-type-options: nosniff
age: 217488
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7748
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:21:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Sep 2023 14:32:17 GMT

GET
H2 200 logo-bg-90-tl.svg
pastelink.net/assets/images/ 2 KB
2 KB 584ms
583ms Image
image/svg+xml 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/logo-bg-90-tl.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

1c9e4c65f9d921b1c0829958cc7b2f307a3e22ac7a23e8315b6db4c0954e1107

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 25 Nov 2021 11:28:22 GMT
server: nginx
etag: "619f7356-933"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 2355

GET
H2 200 pastelink-logo-contrast.svg
pastelink.net/assets/images/logo/ 4 KB
4 KB 585ms
584ms Image
image/svg+xml 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/logo/pastelink-logo-contrast.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

3a73b36061944ebbb33696553917d393280f796e212afcd09057b441c1168606

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Mon, 18 Apr 2022 15:53:05 GMT
server: nginx
etag: "625d8961-e31"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 3633

GET
H2 200 logo-symbol-non-white-bg.svg
pastelink.net/assets/images/ 4 KB
5 KB 585ms
584ms Image
image/svg+xml 178.79.155.87
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pastelink.net/assets/images/logo-symbol-non-white-bg.svg

Requested by

Host: pastelink.net
URL: https://pastelink.net/assets/css/styles.css?q=35

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li274-87.members.linode.com

Software

nginx /

Resource Hash

15f20e02ef301e62ed325d633f971c506dcf1be3458c2371b849b505bb8673dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/assets/css/styles.css?q=35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 25 Nov 2021 11:28:22 GMT
server: nginx
etag: "619f7356-11c0"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 4544

GET
H2 200 pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 830ms
459ms Font
font/woff2 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f94.1e100.net

Software

sffe /

Resource Hash

9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pastelink.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 12:07:53 GMT
x-content-type-options: nosniff
age: 53352
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7816
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:11:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 02 Oct 2023 12:07:53 GMT

GET /
pro.ip-api.com/json/ 0
0

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 80 KB
28 KB 596ms
195ms Script
text/javascript 142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.adligature.com
URL: https://cdn.adligature.com/rules.js/advally-4.29.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f155.1e100.net

Software

sffe /

Resource Hash

88455c9e51c8fdd216db8cfa62f5179eaac2c25076b277ca98fc5a18f59493c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27689
x-xss-protection: 0
server: sffe
etag: "1352 / 842 of 1000 / last-modified: 1664575501"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 03 Oct 2022 02:57:05 GMT

GET
H3 200 prebid-6.29.1.js Show response
cdn.adligature.com/prebid/ 522 KB
149 KB 119ms
118ms Script
application/javascript 172.67.202.177
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adligature.com/prebid/prebid-6.29.1.js
Requested by: Host: cdn.adligature.com
URL: https://cdn.adligature.com/rules.js/advally-4.29.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.177 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c436c070b4846bddc3edcd9b1a64b2847af21d3725bf4e9e297c978db85259b6

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:04 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 243
cf-polished: origSize=534394
x-guploader-uploadid: ADPycdu0XQ4uc9EhPkW8yryAhCgeiJqza05O74frpAUYpuYdy7CturvnNr1ek-kL3Dtdr3_LVTl8mr43ZmjSZK98CYxU_1x1PPTT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Thu, 30 Jun 2022 20:59:21 GMT
server: cloudflare
etag: W/"bbf0e18125fdc89f04edf74b2cd920ed"
vary: Accept-Encoding
x-goog-generation: 1656622761936025
content-language: en
content-type: application/javascript
x-goog-hash: crc32c=n4q/cA==, md5=u/DhgSX9yJ8E7fdLLNkg7Q==
cache-control: public, max-age=1800, s-maxage=600, must-revalidate
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ueuNGJCYUfY%2F8YjKcVxZ3YBB7TPN%2F7cHR54U%2B85J4x30MOQI6ebFSZIAqXtNHznKIHZCevCJI7YEd%2BG%2BTgJybCe3YmA11j6hf2JVZoa3WPuNvFOVNPetXJ1SXSXPrP129rowPmA%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 534394
cf-ray: 75426884afb8aacc-SYD
expires: Mon, 03 Oct 2022 03:03:01 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 167 KB
43 KB 638ms
230ms Script
application/javascript 13.33.79.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.adligature.com
URL: https://cdn.adligature.com/rules.js/advally-4.29.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.79.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-79-24.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 45877403f3c1932bbdbf87c7f02f250b9ddd3d5ed4dc59b30ac9c4f876d83d4b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:16:58 GMT
content-encoding: gzip
via: 1.1 73a569eafe77b39b17f3e8ef76c14c7c.cloudfront.net (CloudFront), 1.1 d349739893df3b59b8ea4953ff21a5e8.cloudfront.net (CloudFront)
last-modified: Fri, 30 Sep 2022 18:36:22 GMT
server: AmazonS3
x-amz-cf-pop: SIN2-P2, SIN2-P2
age: 2408
x-amz-server-side-encryption: AES256
etag: W/"0b4d277527066dd35dd7c0288cb596b4"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: LOFVXLU1hqT_iHHsS6Y6GK33jN3R9qDqXvWxeIncbAxitvSwOXTGZw==

GET
H2 200 pubads_impl_2022092701.js Show response
securepubads.g.doubleclick.net/gpt/ 378 KB
128 KB 498ms
197ms Script
text/javascript 142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092701.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f155.1e100.net

Software

sffe /

Resource Hash

34c9ee51c2dd7fafb4df5f5e0bbb0a2a3508db0692f97b90b44ab89a50a545ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 10:41:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 490527
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131011
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 08:38:39 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 27 Sep 2023 10:41:38 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 84 B
106 B 587ms
200ms XHR
application/json 142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=pastelink.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f155.1e100.net

Software

cafe /

Resource Hash

49bbad20ccb27a96fdfc238056a6756c0b6db09a489764ae4c9a04a1b0549211

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 81
x-xss-protection: 0
expires: Mon, 03 Oct 2022 02:57:06 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 583ms
195ms Script
text/javascript 142.251.12.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f139.1e100.net

Software

Golfe2 /

Resource Hash

9e25469f734732205f33dd80ff8ca12080406c18d2fa99a1f368103e51f7999f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 03 Oct 2022 01:15:02 GMT
last-modified: Sun, 11 Sep 2022 13:50:09 GMT
server: Golfe2
age: 6124
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19826
expires: Mon, 03 Oct 2022 03:15:02 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 215 KB
75 KB 496ms
196ms Script
application/javascript 74.125.200.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S3DKHVPF03&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sa-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

a6b239f8cdad5923fe554248842662056e33a278b280b9b9dffb5e632e3e0994

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 76537
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 03 Oct 2022 02:57:05 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 598ms
202ms XHR
application/javascript 13.33.79.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.79.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-79-24.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: I95TjGhhrR3O7F99m0mjPLrSrnJRj9o4
content-encoding: gzip
via: 1.1 09c63a510feb1b96fe87d2cfe41d34ae.cloudfront.net (CloudFront)
date: Sun, 02 Oct 2022 16:45:55 GMT
x-amz-cf-pop: SIN2-P2
age: 36672
x-cache: Hit from cloudfront
last-modified: Mon, 19 Sep 2022 09:37:07 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: A1kV0ogTDcmNfG81MRAIxV1SWY9dAFmp27fkZTM1yeRDd49EU3neHg==

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
204 B 495ms
193ms XHR
text/plain 142.251.12.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j97&a=1043771906&t=pageview&_s=1&dl=https%3A%2F%2Fpastelink.net%2F53fgu29a&ul=en-us&de=UTF-8&dt=Different%20Types%20Of%20EMF%20Protection%20Hats%20-%20Pastelink.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1633065144&gjid=821494239&cid=877371335.1664765826&tid=UA-55088947-2&_gid=184655491.1664765826&_r=1&gtm=2wg9s055WHPWQ&z=1796473947

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f139.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pastelink.net/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:06 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
47 B 495ms
194ms Ping
text/plain 142.251.12.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-S3DKHVPF03&gtm=2oe9s0&_p=1043771906&cid=877371335.1664765826&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_z=ccd.v9B&_s=1&sid=1664765826&sct=1&seg=0&dl=https%3A%2F%2Fpastelink.net%2F53fgu29a&dt=Different%20Types%20Of%20EMF%20Protection%20Hats%20-%20Pastelink.net&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S3DKHVPF03&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.12.139 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f139.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 376ms
194ms XHR
text/plain 142.251.12.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j97&aip=1&a=1043771906&t=pageview&_s=1&dl=https%3A%2F%2Fpastelink.net%2F53fgu29a&ul=en-us&de=UTF-8&dt=Different%20Types%20Of%20EMF%20Protection%20Hats%20-%20Pastelink.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAEABAAAAAC~&jid=1293524119&gjid=208459787&cid=877371335.1664765826&tid=UA-197326395-9&_gid=184655491.1664765826&_r=1&_slc=1&z=1981317443

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f139.1e100.net

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pastelink.net/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:06 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 1 KB
1 KB 200ms
200ms XHR
application/json 13.33.79.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpastelink.net&pubid=7e29cf92-dbd2-479a-865a-9cb3658a40f8
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.79.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-79-24.sin2.r.cloudfront.net
Software: Server /
Resource Hash: 59b0485c1fec4f53ce71bbf2805f19215f6651cc406e6ff66548444594eebc7b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:51:54 GMT
via: 1.1 d349739893df3b59b8ea4953ff21a5e8.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN2-P2
age: 312
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://pastelink.net
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 1071
x-amz-cf-id: MBeRCXgvdfnF3V0OP85aIn_dpuul9bXpUHoBisXxuMX38YRVk1799A==

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aa68e17fb13028f96c0d5b38fcf7006182894eb694625f9dedf5824d5066a5f0

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bid Show response
aax-dtb-cf.amazon-adsystem.com/e/dtb/ 157 B
530 B 622ms
218ms XHR
text/javascript 13.33.30.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax-dtb-cf.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpastelink.net%2F53fgu29a&pid=DlxTcjTxeA1FB&cb=0&ws=1600x1200&v=22.9.81452&t=1500&slots=%5B%7B%22sd%22%3A%22advally-adhesion-slot%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FBottom_adhesion_banner%22%7D%2C%7B%22sd%22%3A%22Top_leaderboard%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FTop_leaderboard%22%7D%2C%7B%22sd%22%3A%22AdvallyTag-pl-728x90-1%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FInline_banner%22%7D%2C%7B%22sd%22%3A%22AdvallyTag-pl-728x90-2%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FInline_banner%22%7D%2C%7B%22sd%22%3A%22AdvallyTag-pl-728x90-3%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FInline_banner%22%7D%2C%7B%22sd%22%3A%22Sidebar_MPU%22%2C%22s%22%3A%5B%22160x600%22%5D%2C%22sn%22%3A%22%2F22405481091%2Fpastelink.net%2FSidebar_MPU%22%7D%5D&schain=1.0%2C1!advally.com%2CP58S175%2C1%2C%2C%2C&pubid=7e29cf92-dbd2-479a-865a-9cb3658a40f8&gdprl=%7B%22status%22%3A%22no-cmp%22%2C%22cmpTimeout%22%3A2000%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.30.231 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-30-231.sin2.r.cloudfront.net
Software: Server /
Resource Hash: a7f18b9dd88458ff488af1bf4edb96c9d6d6134f72673b20066c54e3c58e80bc

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:06 GMT
content-encoding: gzip
via: 1.1 d1a7553a1d5e7893c2e3eb99d2820c18.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: SIN2-P1
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://pastelink.net
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 154
x-amz-cf-id: IQqPQ4bmwpIFrRjwXqyxmdtNub-NTz7Pa3xiMO-QHmwppHNeCiCQ5g==

GET
H2 200 integrator.js Show response
adservice.google.com.au/adsid/ 107 B
792 B 593ms
199ms Script
application/javascript 142.251.12.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com.au/adsid/integrator.js?domain=pastelink.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f154.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 586ms
196ms Script
application/javascript 74.125.200.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=pastelink.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sa-in-f155.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 105 KB
31 KB 1539ms
1538ms XHR
text/plain 142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3253086112556029&correlator=976970139010721&eid=31069555%2C44775020%2C44772496%2C31067826%2C31062931&output=ldjh&gdfp_req=1&vrg=2022092701&ptt=17&impl=fifs&iu_parts=22405481091%2Cpastelink.net%2CBottom_adhesion_banner%2CTop_leaderboard%2CInline_banner%2CSidebar_MPU&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F5&prev_iu_szs=728x90%2C320x50%7C300x250%2C300x250%2C300x250%2C300x250%2C160x600&fluid=0%2Cheight%2C0%2C0%2C0%2C0&ifi=1&adks=3402602959%2C1666686559%2C2365527928%2C2365527929%2C2365527910%2C2108190548&sfv=1-0-38&fsapi=false&eri=1&cust_params=refid%3D2%26amznbid%3D0%26amznp%3D0&sc=1&cookie_enabled=1&abxe=1&dt=1664765826455&lmt=1664765826&dlt=1664765823455&idt=2924&adxs=436%2C310%2C513%2C513%2C513%2C1071&adys=1105%2C325%2C865%2C1499%2C2109%2C521&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C1%7C2%7C0&ucis=1%7C2%7C3%7C4%7C5%7C6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fpastelink.net%2F53fgu29a&frm=20&vis=1&psz=728x-1%7C705x414%7C665x250%7C665x250%7C665x250%7C168x607&msz=728x-1%7C705x250%7C300x-1%7C300x-1%7C300x-1%7C160x-1&fws=516%2C4%2C4%2C4%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600&ga_vid=877371335.1664765826&ga_sid=1664765826&ga_hid=1043771906&ga_fc=true&ga_cid=184655491.1664765826

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f155.1e100.net

Software

cafe /

Resource Hash

c5a3d7fc1ccaaeed6f62298f0816f423d6b3f806a82f53b4affc015da457d0f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:07 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32074
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 588ms
199ms XHR
application/json 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022092701&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

ae7f9c300dc88b20419cc040be2f89038803ad45cf02c55512d6836eacfc91ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11179
x-xss-protection: 0

GET
H2 200 container.html Show response
fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame B946 6 KB
4 KB 588ms
194ms Document
text/html 142.251.12.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 02:57:06 GMT
expires: Tue, 03 Oct 2023 02:57:06 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 29 KB
9 KB 621ms
219ms Script
text/javascript 13.33.88.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: pastelink.net
URL: https://pastelink.net/53fgu29a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.88.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-88-90.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1ca7d45c26841657f394d905623d5e5c9c7f32aecc66d66ff8401388ffc43097

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 07:21:52 GMT
content-encoding: gzip
via: 1.1 fbb0eee872ada24336cf35814e95a30c.cloudfront.net (CloudFront)
last-modified: Tue, 19 Jul 2022 18:12:22 GMT
server: AmazonS3
x-amz-cf-pop: SIN2-P2
age: 70516
x-amz-server-side-encryption: AES256
etag: W/"979a52ecf913f8004d0123a9b7ba2a05"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age: 86400
x-amz-cf-id: VbypJmT5P-3F_LIPF5yE-hzk7lsNAdXEAY7N978CJ0j-5VbnQ55ioQ==

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 56 KB
16 KB 323ms
110ms Script
text/javascript 104.22.53.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.53.86 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6f0507591c49aa88fab2433451c6c3154c5d4450636b43b749afa1ae2521fe2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:06 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 22 Sep 2022 13:13:44 GMT
server: cloudflare
x-amz-request-id: KMNH2R1FNY39D036
age: 753
etag: W/"68154020ef14b5881614607902c7c21b"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 75426891f916a813-SYD
x-amz-id-2: UZ4gE5B2wjX1oiJ4zPRUE3XQVXlj58PYd2YS6f9J9oiaIHjCX4/p10UhlugFFzJEZJ41cBl9e4Y=

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
327 B 1153ms
381ms XHR
application/json 141.95.98.70
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://lb.eu-1-id5-sync.com/lb/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 141.95.98.70 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3216620.ip-141-95-98.eu
Software: /
Resource Hash: 84e7581561fd3acff11f06fa5a730a5957eb852153324a75dff118bcb0b59d2b

Request headers

Referer: https://pastelink.net/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pastelink.net
date: Mon, 03 Oct 2022 02:57:07 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET v1
lbs.eu-1-id5-sync.com/lbs/ 0
0

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame AC05
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain&dcc=t

327 B
1 KB

323ms
323ms

Document
text/html

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain&dcc=t

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

71a8fa712da17bc9d8ecce5391498e6cf29b9834e61406c59ea0a25d0b2f2a69

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 327
Content-Type: text/html;charset=ISO-8859-1
Date: Mon, 03 Oct 2022 02:57:08 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 5KCGW24TMN6VH9FDAGFV

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Mon, 03 Oct 2022 02:57:08 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 1AAZ5TTTGQ0R71YVAXCY

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 584ms
196ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 03 Oct 2022 02:57:07 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
613 B 646ms
209ms XHR
application/json 18.139.54.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.139.54.231 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-139-54-231.ap-southeast-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: f66dc585e78bf41ae910db3ccb4cde465cb30787c3060ad83d271c2c606aa1f1

Request headers

Referer: https://pastelink.net/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:07 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://pastelink.net
cache-control: no-cache
x-server: 10.42.15.189
access-control-allow-credentials: true
content-length: 156
expires: 0

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 42F9 13 KB
5 KB 495ms
193ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 420174
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 Sep 2022 06:14:14 GMT
expires: Thu, 28 Sep 2023 06:14:14 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 381E 783 B
918 B 503ms
201ms Document
text/html 142.251.12.105
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f105.1e100.net

Software

GSE /

Resource Hash

4676e7602647baaf46b374fe06866f0d1d6993386531ad5152302d19267e5e3d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-tupLgW_IQj3RSSz-7z8ngQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-tupLgW_IQj3RSSz-7z8ngQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 02:57:08 GMT
expires: Mon, 03 Oct 2022 02:57:08 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 container.html Show response
fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 40C2 6 KB
3 KB 495ms
193ms Document
text/html 142.251.12.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 02:57:06 GMT
expires: Tue, 03 Oct 2023 02:57:06 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A047 6 KB
3 KB 504ms
203ms Document
text/html 142.251.12.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 02:57:06 GMT
expires: Tue, 03 Oct 2023 02:57:06 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 4804 6 KB
3 KB 494ms
193ms Document
text/html 142.251.12.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 02:57:06 GMT
expires: Tue, 03 Oct 2023 02:57:06 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame BB73 6 KB
3 KB 503ms
203ms Document
text/html 142.251.12.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 02:57:06 GMT
expires: Tue, 03 Oct 2023 02:57:06 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 06AB 6 KB
3 KB 510ms
208ms Document
text/html 142.251.12.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 02:57:06 GMT
expires: Tue, 03 Oct 2023 02:57:06 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A477 6 KB
3 KB 513ms
211ms Document
text/html 142.251.12.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 02:57:06 GMT
expires: Tue, 03 Oct 2023 02:57:06 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H/1.1 200 1102.json Show response
id5-sync.com/g/v2/ 457 B
1 KB 1166ms
387ms XHR
application/json 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/1102.json

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

3051295be310aee32fae99246e1198471a0782aa125206c010f3da3bf0fc3065

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://pastelink.net/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 03 Oct 2022 02:57:08 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://pastelink.net
p3p: CP="CAO PSA OUR"
access-control-allow-credentials: true

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 381E 0
0 590ms
201ms Image
text/html 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022092701&jk=3253086112556029&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.24.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 b4aq_x9zMiku-4ayY0gQrcEuJNMSghrM2Nuaea2nyAg.js Show response
pagead2.googlesyndication.com/bg/ Frame 42F9 36 KB
16 KB 581ms
194ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/b4aq_x9zMiku-4ayY0gQrcEuJNMSghrM2Nuaea2nyAg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

sffe /

Resource Hash

6f86aaff1f7332292efb86b2634810adc12e24d312821accd8db9a79ada7c808

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 28 Sep 2022 18:34:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 375777
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15966
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Sep 2023 18:34:11 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 5F16 624 B
560 B 903ms
509ms Document
text/html 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sY5PHd0wEwAQ&v=APEucNW3MkI34zrLXIGZ5SxWErJg1XbEtDLhKzgcFW_7-arFagrm3pR_WV8OBTzSKR1gYBEgx24pUQGtRU7ziCi98u7LFMcYCQ

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f156.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 02:57:09 GMT
expires: Mon, 03 Oct 2022 02:57:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 40C2 80 KB
34 KB 968ms
577ms Script
text/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BksKfDi68Wlx9w1nKqd230d4XK1zfe5kdfho1bnOwyGw7u4BRTjCH5bPEi9WjSa2AO4fvMbftsv5TRfWa8Lk5cFY4QKsUCLj4X_A4Of6G0PuJBO6SVre1bJGVBkjaJx_IMiAft4jqSBEeg9JQFrv6YISIro0B5ZDfRgFFFhed_8ybiB0g&cry=1&dbm_d=AKAmf-DBhExiI5wKwxh6e5sUEmx_IyNjxCVgL2myjmHuXKM_4m082Kw_4fbKyteAdO9x5ynsUVMOnaX6wYbi2-Z9HmSSqOSt_Bl1nNBIbS50pUJbAJA8fwY5WQQutQcao4i4FYMvjSmSrBJjwR2uKZLvqjwmVCzU5YJmeyE33kTP1xUWmpG6_i7XkxIDjTnnVlkmjTuo5hFuoabjZOVymKqQQVC9S4GcpxKB-FPQxVHoQT-TcBnYwsaNbaBBHPj9XnszPiUhRiD_04BuvXtRcQ9qZjc9Hvnm8pemFpPxUHKcsYpCccPbGzMgm7agpRp3KjS499dP2XO2nsE-JSmTCyKCgfCbo_LMaTrio-VR05XCkpQ1hi47vcuXgXPquKyYYQh6HzdEyKGDffkyesivgzyUVila-HMk4PYbWBUDyXmbCOIZIFYp6GqpWwnqdAELllQJE006ZyMSReh4U6CU29D78MUx6xa46r7KOfHFvbaje1YamKf3L8KDm-vVe3pu7BK0xxJcIB5J7N18B9yJdNpZWBoVvSoj4bGvDp6kLL4SHfahOnqFHCGPJp4isPdkoQy1BbKlbuI7FGqerZzDUR09wPbil_COfi7UxZtpzr0kX1vIxm_SeW7HrPntR2wcDphk6IjbaaidqxmPrNwCH5qyQS46Z4L3dWmlkBDFQbBjcCrFUPIxI4TSrIzS8FhHOl8h0anfw3_DsCbToJ1Fg2z5B00fwyCP2Q-fl5QkbIKWbbBtHYbMqclGlnsS2IVPd7D59ONBQ1RsJmZrY5VdTe1xSSI6Hp-JR9WgBvi8z8zP128KluEgBbKUeiOthHX77jhQassf1uy0I2EwEzVNR-1f05gjAENFJYxCbM_DdRskfRXrg_HXMLVPGhvZDhlzSUyVIM_X2Z9p8yxL_ZQkao4gM9uZoEHcWBuV5MB0cGW-kFnt0evAiHmq2bOFJb5hitmlJPpdaVy9tljT78Gsmk9ZFwz-PLfr3qa4vz2F_gjKkl6EDS6QKIiX2DFmnC8nhSoxPXyIRRgH4K-nyskp7ef0a2e88iJ--VfJO5-JM-karYwJDIjL34IvL6LLEsmKUwUXOPGw_U528C4k_3r20b-GEMbHVlq-92XW6iemaGk8HOYn_SfZE55QXRZsV70WMpmqsSf1HLGriaYw2jFqT-_tliSn-sQXZ3qCTeXHPEQoweUB5YhUx3lUuOCPIvM3xoP-_DECWEfHPvQSlF4jxG7fL_X-n4h1BDvURFv2iVCS_isbXEv91hbRTZ6c_v5rW93W88xJ_2LV5Mp9sa-d8imZhpYEak7JOuOtHkKvjtn2WCS9quqeBSm4ncapiWAlZhTAlj5ts6-kP4hrG4qqjKAblI2cb96sMTzweI2m8Dvxu7He49PpVQfXjKKFoTd7HzXcbpIHABfz_2K2bvfSkrbHUkFqbxPGOd-wEnSKe5nzCx1p9FF9sUJxzijuvUtYbT6DL3kx4uzRV6RJFP515rc-vWsnqZP-QqlWYvlJOIT9Cwdw4RTIxE_ielRjQvz1ATPI0PmB0RAjJCVX_UpkAV-iGFcBBcoNSBUKms63-KQOhfstH1cUzpr3rwPsuB0sRAKd-efbd3ZrMrn_g-ksHXxYXKAc7TX_LCoF6CdvZlAyMHCkzWhyiHRJtmbtk6Q6yaVy947VXipbIfVXa80nxNUTcCVXEQRE6FdfuNGm6YC97ooI5M06Oto0PrL-lfagtFAIIh-M2LX09LpY2zprylWaDSvJJZIxEz06F154p8yExlkQLR-NWIvXGXCBcWc6aX6HHXoDmw4sr_mNIPHWOms8Ly0WuwA9voL85BSMAoTBvfkXUzBbXJSosgt49E1_MQ64sOZpRDAYUz4qsldJPK98KTHMXACX2VOjkEa9-vBdvJ-WURBbCPuSyB-hhzK1E-TmkT6zGpOoeHJg-FWQQ0RwUg1MZdE6EMFil-DXByqBdPq72NEn0DhNZxSHZBqVtu8LOwr7KTxVPRdw6BjAoFE2q7Rpr43E6VnbzOUGrrDymkMmoJXK2vYe0fzNPtRQot4wZUVcbjQAjpmoV93JjNyjWdwkQby5W1HPlz9lKyT1L8trVl0vmJTcijNt9bdWb30XknChWcS8HMFLXa9AaAqlfIpeTY7nxSQ26vzzrCsMyPM3thQbbSD8QbPvFkD9JeypB3_BXdg8r8hW9q58OyZfcrmaoJrDS5i4RoIkkkLbK1p8LMKHAAHu8Tx7emKPVmJWIKX9o9m6Q9pHMBcrmMLIZrz_LdmhxfoFrKp9w-8I1WpzRSOlgJzoNhSFaIV5G_gotRmXE6CbHlQSEY-TTVb-6Ek3CG316kZzTso_nJoZwsdwtiLFhFZ10O4-r2ng08Rp-z9X5CmopuQJvFLLC-ul1ZnNeaTvYCnYb0AlUBAqQ5IUYP_1ei6KVdASg7cozs4f3RudoqUtuhQC2mziokYeSeSzp1vMUGEcOWLTQJjv-ezNEa3x1Kq6IuE76BOgX_iHd8v0ybllDOFVsWDJetxCfG9MuOmYJy8u5wQvD6To0L-I13kUHQTUztqePoy6qdf8kmfqL9bZRUpdrHrSK88UU75Kidrxp6o9JRuOHab-l1E-Nd0yHmWE19-wDjYX45JEz8u3nMl1grfAUwK76SJ3Kfl18cPaFNGkS4VRrOzM0VCKeTj5Q4frNRu75x9N_p1sSkf6bXBIy2FfKpI-25WNk-lxGS2Da17yPMTpmsgdnVPmw1QdEBKbpeEcUWWlo1qM1RHZAgStzhOPheFKyvzhNnznoPe75xMRxOto6iLPcZ8q6pB6Zr6glYrm1kepO5AFB9ajF-Eluf25iMYsQI8UQJUYnHGv3VCwYHMb4w3f6H8sEbpGzZSRwMi9kD9nl37VNDBfNweVOwU8pWavfx70C6lz80tzv2h3nvfj-2uKwg82VcAR6SLZ00FqPs9wU1jT__XHqISnVWc4ALoxdgfl8L1fpJOs-nP6HhYSY9OEwdBwrHKvdlhno4TYwdBpYG0kpSIMX7J7Cdel7Z-t6iGcJwTo0mDyoj39kY11ODlWH3BVR4nDZhyoawiyKrOfciadBkibok6j2fFOf3ZvUEMluYkPw1ySmR0_JvkcUoD0xjgcpw-qNgrNGwJ-kSuNa6-trIjZ6HPx1gTnpC2DARI3rAyQutVoY7iydDFXJF3fb6fIhsneg0buMAyAClttw6WjDLx0fVIIzpdJQmqmXL3DqRhejaJRpxh7FN7JsZcXKNBE3Tc_sGyFb0tRcdIVP3mnBY7INs6JsvI46so3kC0k2hbdB13ngM29Nq6Ta37-1Whs_ehbMpg-Gt1XfxeVO7wVqSYGn9oTq2WhC2XBjoJ3FD4S1jsdXv-JEybyUo4GgFwIGknKvz4Z_oPJjiVaDkz3rAWjNZ_IQAKAcCYCv_axfX_aD_ZUxKhj_doWID96Gjpu3R8gF9bnQ5emq950Z_6WDxuqmmnTbJglA9AfrFRYf75YA3aQhV2NaQuOZZ6Lspv65WCbNlu6fMHBHqkdHtSHQsIEKRBx18FiDgi72JT9yFALXB9g_1QP739qu3UykMlSpxrcLAN05jpA3OYvJ2sL9M99avsoY0is-IhjBSQxkoXH1RCD11tTQD6Nk1hp7U4nNxCFn-U&cid=CAASKORoKp5j2YRBsO7p-k5b8PfhmraAuRKXhx27RmmACM2rSm4Ulqs7Xtc&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f156.1e100.net

Software

cafe /

Resource Hash

02fa73100d13c90974291ee6eaf8a759fc421727ee2632a41c61fdcb8689303f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 40C2 42 B
63 B 346ms
265ms Image
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CaAzixbQFm6kes4xtqriN5yVE2jPuMJP4Y8tWF2U5Q0SXnFSGnqTf52yQMuVursY6xR4GRhyCpqP0GIJqi7u0_JU9mDJVnLQxvRa0TqE3PbGbbY4E

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/ Frame 40C2 3 KB
1 KB 195ms
193ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/window_focus_fy2021.js

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:37:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1208
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:37:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/ Frame 40C2 17 KB
7 KB 196ms
194ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

cafe /

Resource Hash

86d8e892ceacd8c8a7e7125c68dd0e1b311f8399871b6d64b8b6795f0235c1d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:41:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 936
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7559
x-xss-protection: 0
server: cafe
etag: 15289875785628835784
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:41:32 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 40C2 0
0 244ms
242ms Image
text/html 142.251.12.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTkzVoYGmFu8uR4fzbnwoRyRtg1YT3qqzGCkLC5Cogw-Q997K-A2m2tWKwecgMtGfd6NMMjHYCZLV6yS7pFBAtbXqSyGQ
Requested by: Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f105.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 40C2 140 KB
44 KB 585ms
195ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f155.1e100.net

Software

sffe /

Resource Hash

da8438b81e390283f6eb8cc9cf49ccde3d00c954b4fbccdf6372c162c4b58ab2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44530
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664365478704152"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 03 Oct 2022 02:57:09 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 89ED 624 B
557 B 882ms
501ms Document
text/html 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sY2-fd0wEwAQ&v=APEucNWET0IDM519V3i_LXUQNX5EWf2QeGo1dNOgbdyaNExuT7MiWhhAAcBKsKhxNgvwLwgKIp9oSxv2ydowghf3HXW9a6JVPw

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f156.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 02:57:09 GMT
expires: Mon, 03 Oct 2022 02:57:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A047 80 KB
34 KB 655ms
276ms Script
text/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AU-sK8GyV-4TwMAHzXnsDmE1fRqRR4U7A2zEu3zTS7kVL8upWnPGlEf1O3lcMXbMrD-p_4SwPvSMtOl1i9E-BugnNeqabOG8ifIZsBgFiWP-xpHON9WncnZHlSHE0UymvjeP612VzRv0yfu-m2-bcTF8meghAuqnVS9MyHqUwfP9ZZ-EI&cry=1&dbm_d=AKAmf-DdmdznWojxnaCRazmdw6Oz7Orfkryp3y3918s2sL68reObxxsHNdf8wMeDq0GzJg01DAAcfg8rhvQQ2tDKicfbHGdTga4FmAzyBbJCCr6R1e0Goy7pzC0hXwfJit36m_E1VSizQsoI5xgpm2cg_3S8aiGWPNVG7swqiWkI2VP_Yg78K1_LSkp54d75Rcpxv78BX1XiLMYYFU4G5PsH6dbFM8FPHQEvhizrcxwJ9mLuMDwQWWB12fDkeO1ShQhk3WYxWsvQZMwxVvLfg4iQ8kq5aM7VbO8UBQ2cCUypNmUDIfQrqvz1S8fpcWRathLeL7G0ezt4kP8mcCSopqAV3lgdJKxKRW4Z7XxdOBlYXbJfna6TL_O_iwhMgU-7byZuAVfjC-oqLlErXx1hpI1q-sXNdztiiQkCctW7iZuwoYqgLIruWwHnM8NAIOK5LVPT4s1Ph8qpl20xjQO0xR0KXkQv4QxL4ZPuU6dqzTzQpnxcvKpKsDk286a_GWY_h1FNrK3a8D0GqRNrTc5IS8thIdtLBXZHdlvq4Qf6eukl-tdEcMS1X76HynDE8bRLxXgHtbnUOvfUauA0d74JMxqV25rTyqAEHzis32W7gqUuEwuzTi2OEn9XQx_Zb2NvZoOZs2qWKii1iWLXqX5sUs5Sm3WZ5oeC3pjjgdFdF7MqDgpZLrBmc6VLXD5p-TyP6utrg6FLevbrLk_EeiI_4XL1cMb0PnsIMm5UWZzLcOXeLfi4AK9CiG5caFBfWIQcYaw7q7MorkaJ9F-16ZWnf2gc4H2ZnXBVJauwMvWZAWx13MKR6cWVTZe8WDZKo9Yz5ug3aGxYvRfOI9YgPjoOnZmFTZ8MT6ItK_ZxPRgJDDbkHdvZP3V22__9aPFrHR4UzT6CCByu9biInngFL4XVS9A8VQwOm6XcA7_5cgwqcfLMUrjtDcvfJv9XD0TqM71vptXcuYihZ4PASfjdFXzFmai9GOO839Ezlp2uA3QhQBzP24BjYUx9DZtqE4Ogoox-AvhhfC-RM-QwM1sydMbhMHa42d644iJLyKXgvt3jl9HerPGZU2ovRnTDQ4YfV6wIOqcUvE0AkjwFZxkVgXiohTgllJtFYdJBdFTFsxXasucEyW57wKjuKqVCOlP0LqN2NjgB0JifkxjDLAKNpk3Y_S7rYoCbMiURV2478PnMySoL7Ro67fCIG5S4X9Qzyu7pmCwUYBm1U0inZJuwR1MFAd4pMEYdPQzK8SX_N7lSnChLt5AzM8l4WLaS2B8YIY1cXRSNVn4hfFZ4o3IrLDbNQHktsSYO6QCnIiaakHTaxu7AVxjbbLRLm_vu-2PNgInvk-VGM7a2l7fDOnF5udg4y6T7Ra0JVgYT0hMedKSAtez7CMclC5DV7a-ajF-qiQDsh2aSdRhaI8L1V5hiz2CNtXJYuObsxg6-Axlyvl-1iUXpvC-H08eclRTrXyej82XMZSyKVQmhUMBiL5irl2Pj4olC6KyeXn10MMP8nwRCADZrBXV7PIM1lGtvQmY1BXL3nhEnGLgwOGdaALyL81wFQgnk0J-UduvwuUW6ZwVZqVLa8duApK__WYDuTwC-GyYemZOxQlAZh5gIhokodyDbv5icq-1hqaAG6Td2KD2UPHSsm-ZRrNnobrG7QjTT3KCKGBFmTNBQx9fzo8KGGNyyjJnBtO7v9724zClbMzuewlfHc5Up7rdbhBFRbO18_zsrC_eQn_Sv-QTTQXp5AGXmwROcr7ElYIGeZqlFS8IKUgHmw5eOCYJYgH26HydPB5edcGMK24qAkOAXPeVWO_bE3hJyrHmeApnr7ZDE2xtksuFjEgXUijKCrsnjwBaPu4Ml5ug89J8A8m-oniNzIw8hMMwTUR67ZuTHuLHqVw_vuE4bEZe5hUrJ26viIvASjXe9HvVsLDiWBMJ7sROq-pHXyUNDNb4jOcNSvPp_sKvxaMFYHXa0btxf77AgS9eaO4X9dvup7mnG5PDyZiCwYQ-6XST1fRjNxU5kecFTzoxLxPpninuHrmpBG0coIjnu3hGWOqQhY50Mxd-oZ3T5jq1-4-69QgtgCEAP4Itkq7bhCuj_Vnjnq6jyejMmlV6aWTJJ09GXx4xCveg66XcB4JnOmNgRcUo2I4h11Nl0gyitPB6VzIuqijTP0U2Vc_uke8MUc93v5iMAHo3ouf2QdZqYTsJ3lwk4If-X8KYnbkWOyijLuX5JRgQeP_knGPbN17IVdqhj7995GFqJubWBj2ovhXGDkXZT0sQ-g6fZkYR5qLdr5QZFezBt4uZSKvc4z1ShMEQ6f4P0SizqffGwkGZWj8LDG3Pln9rRsPhZU6G6ZLG6kVutK_kCTseM_D1k4fnh6D9ibi7lyBrQJ0V22mVCkLuVyw8gNeuSW4RGw4rUGToGpLcUpnTkD2e79OBIs8SmcCAmAhzDzQgX_F4wP5zLsPWEPv1sov-xd0VyWw5BXl5sF86LTQylCWQYvs1_4m0wQ3LRze1mIDdPhfEZB3WolL3elV2PCSgva_1am84WnVX1X_NBA37BZPmqEbL35VAYYEs9gyVFgAYl7EyGmLHQkIg_byP5N00MJnv6Pu4X84mpgRdZ_V0sMtKuCB6G0qnrNmhWTfb-SEjiYhHzTsj8fUmH-o88A8Con-PIdewTkHQkc6svu-yD2BPUSEaiqkc6-PLqPWbew7nwKSBQHTSkPeM8t2asfLFS2UjMqKOpbFAICbrNbJKhE4sqXOU_WTJVrhs1RmS8sWiSkRe40DWeEA_V2-7hIOXSbCDXziMfMvdCR_GVpoMWdonESrlI4jAnRDsD84u8DybilnZp837PKGGlLWiWlcKvDGPhjpIFXYObUn1dYQYv0rWIOiCc3kleh-s2IXnaEtbpt634KYG0N3XEb0hYaofGzDeiUU-Tb5P8mf4wVrE_ya7Pb_verEYzrghX6s6C7UVm75kI0S-TwZHaJEK4UBqmofqzdTJZtCqGSjqOoa_AIFtI-YtSAyZh-cV_dJSxxaN0eA5yDASIC0nKj1ZNKC2hldoKZESpjXzo5HGZFssaYqivah4gpywbQ9u6BGlNvO3j4J0Xqnh_ZE79I2cxk4zTtiKUvfVUkAl_yPL6IjWiJ9c0_Iu5nES0TuoMymbiTxe3xOWj49b1aBuVU1FtIqbI8CSFFHqZdpsVokhqtxsEqsc4Hu-wnv_rD_YLHYX7xunk6GHLA6sI7UyhQjKYq_u3-p2CADNDv4wBdUueLqTXe2L7ldJnQbiB3aqCFPAZ_AhJE1OnBYqhNByhVF3BMRNj_HzGpZoYd5lGjnf94dEq8Yyewbkf_dSwBFfSzSfbmbSXukDksa2DDvYG21LN4aJQGGWiptOedmlpRqkWHWwMAz5uGH_tI_t94LZgSXzobDvrs_FACKT606X7HIEO3B5rszsKTaQMeuIZFhb0wfdh3itsYSRgLwPf43VbG1HGhMfn5H_z1Ejc3ImeFyXsDAjP7nDHYzbZRimT9GY7aGTYmarSdUrAWBFHvX7aBOdgsSCiuJayGIQX2r5D2LdzUzV7iUJqCfiM49M-UHKdhfSrm2QfYY1vdY2R2-EOMVWRdRWavI6NoQP8OnZ02VOnR-GNkyCslua1bW45HvXJo4ETqsI&cid=CAASKORoYQAqXKudns1cy3_pbTxD2JN5_jmpRs6nHfYcAsrKsoY23h8ON5E&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f156.1e100.net

Software

cafe /

Resource Hash

82476f0bcb8304f958253a8df6336966c1273ff5720089d7b54495306f3a788e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34218
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A047 42 B
63 B 333ms
265ms Image
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Clik7VYCC3IZGIMbViayMn59hcviwJqoqNmXliIqxr39UJfdY70UEnONlDcP89Km56xyf2Mb4khik8tNwz9s97Lf-qxqZqju2IhkkoGGUTWlj98hI

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/ Frame A047 3 KB
1 KB 194ms
193ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/window_focus_fy2021.js

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:37:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1208
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:37:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/ Frame A047 17 KB
7 KB 199ms
198ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

cafe /

Resource Hash

86d8e892ceacd8c8a7e7125c68dd0e1b311f8399871b6d64b8b6795f0235c1d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:41:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 936
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7559
x-xss-protection: 0
server: cafe
etag: 15289875785628835784
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:41:32 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame A047 0
0 243ms
242ms Image
text/html 142.251.12.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ5clN2PRpOGbVw6m3sPXMJYKzW4dowW7yAOfbqDZ2lncZ5ZPkZJz6Yqmmsh2MAR-a1ms7pzWkjslF7SbG9J05qN7vIIA
Requested by: Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f105.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A047 140 KB
44 KB 839ms
460ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f155.1e100.net

Software

sffe /

Resource Hash

da8438b81e390283f6eb8cc9cf49ccde3d00c954b4fbccdf6372c162c4b58ab2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44530
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664365478704152"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 03 Oct 2022 02:57:09 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame AB19 624 B
560 B 840ms
508ms Document
text/html 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARiA-ITRATAB&v=APEucNXOZqQRWmFQrH35ltv-HhYbPoR8-lCW-_Rba8gi1Bmx5GhhLBSx7zq5LAfeWn1cG9-W_VxX4B-14Oc-k7ioUNaKWCqt5g

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f156.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 02:57:09 GMT
expires: Mon, 03 Oct 2022 02:57:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4804 28 KB
17 KB 840ms
512ms Script
text/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DVL5HhntpYXkI91shH0eofIjBeq-JC5d4h7VvpJ8j9SW9RS9l2BwdxN5qTurSP5GfnMTEGixsJKKoEYuaRqOmZuTdf9X7Ht2O6bTMTGQW4QlcjeJrJOpcn3pVijNsd5-fjRUvYBjvMtOO62W_E89KLLvU_9MiCIkxGYoAB9ZcPhdv1WpI&cry=1&dbm_d=AKAmf-CKcZ4b-Ic0oFKmtN-S5A5vvaqmCPgRGS4nDAmrzQBhNP8_7ezMLkK9y1o6q6H5T6fjPUAWx22Z_i4QHgGVJE5QwUm5Vsq3uuysZji0lnABdHEvSRgqL7erw82nqQ_WcDd3_L4SjLeZSAYqOnQKMIyCLxZx-mXUSLFgXSUbfNu5a6xTK7hDBbfSoaZCfl_gK7yRM8Ezt8iD7IZNAhBpUXYqdh9IqtjBdqFPemXR2p9oYBMoTlGzTNdnqiRHoftmcWPrDWLOYQSxedBxei5ul3WxUGpKA47cYoA8oNarsGDBLaGSPejqBd6q54yAix-10UZzCMSUKOLrSJL--Mb_6uXES9HscNeuByrkrdAPNiYgiZV-DalMqtnUS6fnGqEN29wsDfme68gDE7Ds6hXmMwznCtmMc-5d9Z2-YxD0Uc0TY1VyO435MJVOBS5akA3pKCKAzCP5d2G-JcQLyAgvtYkB-56-IvsePu_c7ff0yWurvd7dToK1DUWUyPFUAyr3Q7VuESckt11OqTYycIt016NoxvDu4V3ddgvKqc9JXvnSrcy0eoJ3ja-69pLew9TYdSKmcto4ahqlsOfRpfIvIQFbVz-PHjK4CfXxg0LPC3mLhIsk7Mm9xjz-HOT_6azCAqZHvCet-ikXTbrp4oInoDo3iouq2-6k0LfEgdI76yFhI9fQ9GiWL2UFbL09El4u3ASo6eDEgxyPYxOZacotifLhLr1A3HLxrazUhpgNWOCPqVkWFRhC_GCNWMY4kKHNVmx8KZr0ASuwFAukRLcm0ZU9MuAVT5Z0ogggtloElqMjFZZ_E5fOU9efzBHAxrwI2yRIoswnnE3ZouxWoDZAtXmeBbwPp-gHA-rNBPItCp_2Yz3m1joPv34H9btwcSSqfmx2qm_asNVMWJwXVD-45E1yxspL7PWRy7CVpAHBF2-SYdvUPWwSpr6MGKzOk4Zba8bQQ2BwzC3Pf6tyTCKe7Vuag87FmG2d5L_bbmuV2ShmTT0poDfk-T_NJhKGLFtCty2MYVQpBEM3QMsUfITB1viF7Xo6CqArqCBNBLPlibIUMVKwg8FrzoVn-HPPgvaaWM4QkyavmDQa4yqXY2bGsnav-SK8uD2HIQaR2RtHPgjnV7F9d8FoSE3m1Og2n66DKO-ZJmSSVlGYRn7Pp7DV0gImi98KbiLggtTIxwD0eA4PTBPBZKC0vwUZvvOFFPzoQAHR_yAbalSktn-d5VT7PbNjm2XYA2CPLosJo18pm7UXAteVq-KDZWfrbGhQkxt8XX1rGJYX-rbc7BDMl3ipO2SbmThiQEWUkVnf4piFON8Ew3CkWw_dJiS7IUv97m3fTEblyhUbrNa8on3z6KxC1F2O8Y5UDNyLeBiZF7t5bn9Gy91jXZ1uwF30T_irp8H735q8jtV_sOesu9KW8TrzOj_soSQhoT6P8cZ19O9QEEbdZtq7-1wYGNp19TB3dTCJtIQiyezDcQB4M_Q-j4n0r2BEAZMcSlZ2MFzGVAr173C_na8bIOaPLgiNyIILL_CK2zJjmFr39nbWORtWIubGEV4e6gblg_KcdQ5uivTF2oBYD6Cym_-3S-fUuHWu2cee9nlLZDyHhU5jt5KRx92KyORinF3dL4OWO8m4DR0dRpxkpcBJev8S2pM_uIhcPWEL9Jsa72ZT8tPPfkvG2Q2JtOvRPdt2pPhedFRSKt_IZFi6RB0B0N3ViQaX_GLZmbu_aoKA9lnQdqVk2a6V-_FSYdy6-LEi0ffEASpbesajxV_8X2xN1_cR8xVdf5fYcPyM-uGKRZVY4wAW2bdquZFFBRiizdzYZj0-l-hqaQs90wACxuLeFFtbyJZEIGHfShZwvW_GlBJKeQhlfSQ8xJWGO_Ch2HZI-02ZyzT-4s2OwWoJFTSLjWOeAE4mEWD-8f9ObwXn7OaBXBKCxIWD65HeHxL4DW_d8LzvbKVmTAn7F3p3gjo-xA9qV1qm82vOo0fIU9VgoQyazF9nCl9qgZqdiWCbwayuZt2fVNWXjQL7-9gfdLHBgRLlYRuVOZf9c4Dp0VM7dDEV16X9m-xeOmncZ6-2GvWTdobxCLfLLtVJ0NekD6Be8jIVMeT6Hb-hVLG-Jlar3xIHVgHtAKs5fqx-gWiJ0X2GlR2WceHbtfvBW8jXl_Tn2wavFls7uTXE8gsfSlmlayNSKh7EHmS61dA3K7MCr9uLVgwgUtu6Jk_yVD9FxDDs44PKEw5Qhz29YDtuwir93LzXIcPb0WooG9GTweCaUkrG0gKyBDyN46hMX0kjxyXivgDW5yx1IST2xO1Fvhb3ERKBcrqeb5d8UGWRTRC-4xOyn3Mr7NApr5gFQfVkWZrrOSXc68_OBJ1zAhooxeriWR45ZN7WT25tE2ukk-9IHkf1FHLhRzyOYXUn09IbY-rrSvCsRk-PUBaqOV6sLKgCqYEEKX3gVJSdsFXg3FlEHx5i1w_TE6emYMDspAFVJ0eUkrUfCaUwnJ0nclIzlKbu3LI5G-BVSohHoBqbzmjr2xh-cGNS5AyL2IBQ4ivS0jVBXiV7U4RYlInHUrzlN1gVudLtnEVMnA7EZlfcAm-5jfL26NBMGtIIzgqbmjXl106quxgZDHuJyqJLwruvmPhdSQIb8iavoINPD-kHeyPGNAR0TxBhO0udKA-pv9s2-nfGVUbbNjjapZy1IZ21JKljSiAJiuSItj-2mfXiUELa4x2QWpXuNQtBDKiMFs5FhkRgXqFVW81B2XiSR8LG1etj5rvEXN4xlXfAmBxLLmj2cxIvzvnHakQu5MXoHfivGzy9uy9PCPIU0Y6YgRjnsXJS7uGdX0aJzdbJjx899hnQD2R9UOC46LlPLHddUAwysPuKscnL5t-Qpa3S4CRLknlbgtJMiDFLYMkZnzFegAYjDVRodu3BcuGB4rYqN0YR_MTotTjs3qCpj5Z95_oRFx8uPlB_x6FX5ki7qFuMYv4wK-Zv62pacJqZQczxXiA-dhNB8z7VjaOtI0sauZ7VpT-Rki7DgUG0g-4VYu71Rjv3niOG1viigDxSroYhvGZZLkzTbQz0Ov4Qraplv-34dNeQRG-aVARMnqHEBRwLCU_Q51TF-4YOoOAZRJqDeS9s9OJMsIfBLxa28ODHm7dZlh_p9pk6IzBoqXVsuo__znZ-0Aewy5l5jXXltK085C5eo_TL4atUN5E0t6YE8_ctMDivgKIcifRTsLMKdyjwm6trRnfrBf_UynVpWqT_uZk3KYAZaTCcv3HSwrk_4z4kOkQaNTvI_w5446O5DcRHI64vxq9RnSl6MkzChjWKqYrYE_t07ScDXcKuX-De7u0jSZ4-DAoglSCmihU1gegmv3b15hCkg1aDX5l9KWLaij9uCSruGHfxRpDPH7-712_FuCqD_jPHnUHJjQDg1deF9o2svKpwxS8X6qqAYwrFmtCFJsRoPwwEL-65khOmxSR_T5PT2J86gPUtOuQf7hmz03AZIdoi1SgZnbtTVmHhQoVqT5qZIiuX1RtZwfGSoAOVEl4QYwdGj5sRuZunjoRRS1rX6S7CJgML9w8mq50NwZE-uKRm7cs&cid=CAASKORo3FLLUcGD_SdpTu2_MmKp61LNzdX6cylLm3OUIxM31sTrDwP3fXk&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f156.1e100.net

Software

cafe /

Resource Hash

6ef08d34204cfd31d34b7f4102f7c1735897594da5c7ee9efa071c04d6ddd16e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16691
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4804 42 B
63 B 283ms
265ms Image
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Ao7PX3NkEIPg87ZkiGAtQJFK_sUVQQUPgoSB9nJlwJ7r2Pq9rucUpzN1J0wqqjQzacobGZ6fAUlQOtm3-nfUv3TjTTDHaHrh-dtVZdBgis9jFx7Ew

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame 4804 2 KB
1 KB 805ms
262ms Script
application/javascript 23.36.254.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=189094&plc=6695893&sid=18330&dvregion=0&unit=300x250&autt=1&ppid=103&aufilter1=3060631&prr=1&auevent=ABAjH0iceNDUv6mq3_WT4Jlltz58&c1=3060631&auorder=1008962086&aulitem=18156675739&aucrtv=438385664&auxch=1&pltfrm=1&ausite=201491245482&turl=https://pastelink.net/53fgu29a&aubndl=&audeal=
Requested by: Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.254.7 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-254-7.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: b42f035c593881359488262fdaf928acd4b9e6129051810120cc361c2a9688dd

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:09 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Aug 2022 13:19:47 GMT
Server: Microsoft-IIS/10.0
ETag: "f128ce2aabbd81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 1170

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 4804 8 KB
4 KB 806ms
256ms Script
application/javascript 23.36.254.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&advid=3398311&adsrv=0&btreg=&btadsrv=&tagtype=&dvtagver=6.1.src&autt=1&ppid=103&aufilter1=3060631&auevent=ABAjH0iceNDUv6mq3_WT4Jlltz58&c1=3060631&auorder=1008962086&aulitem=18156675739&aucrtv=438385664&auxch=1&pltfrm=1&ausite=201491245482&turl=https://pastelink.net/53fgu29a&aubndl=&audeal=
Requested by: Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.254.7 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-254-7.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 9dc99a92f9d68c0bb47cf55e03971e0f068090465859bd483c97bf9c6fdd32e3

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:09 GMT
Content-Encoding: gzip
Last-Modified: Mon, 19 Sep 2022 15:59:20 GMT
Server: Microsoft-IIS/10.0
ETag: "0fc3bc740ccd81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3314

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/ Frame 4804 3 KB
1 KB 320ms
317ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/window_focus_fy2021.js

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:37:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1208
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:37:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/ Frame 4804 17 KB
7 KB 196ms
193ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

cafe /

Resource Hash

86d8e892ceacd8c8a7e7125c68dd0e1b311f8399871b6d64b8b6795f0235c1d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:41:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 936
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7559
x-xss-protection: 0
server: cafe
etag: 15289875785628835784
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:41:32 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 4804 0
0 244ms
241ms Image
text/html 142.251.12.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS6OsgjcSvsk1N-IKn63OaanPgBc4LCWLo2u39aDnkerlfyfhgdYJDLJ8GS5RMmo10AgVlyLk4stIDyfhQNf3tSjIEspw
Requested by: Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f105.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4804 140 KB
44 KB 1134ms
806ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f155.1e100.net

Software

sffe /

Resource Hash

da8438b81e390283f6eb8cc9cf49ccde3d00c954b4fbccdf6372c162c4b58ab2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44530
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664365478704152"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 03 Oct 2022 02:57:09 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame F91F 624 B
559 B 816ms
497ms Document
text/html 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sYvrqy0gEwAQ&v=APEucNUTUzMHDvS1X1_wkKPBlSEvznY-a2tgebatKOoGp9eReX38XrpQAyQJYenf6R8gMcMIAN5N0JKBtg2Dvh1TnKTt4wnJ0Q

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f156.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 02:57:09 GMT
expires: Mon, 03 Oct 2022 02:57:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame BB73 82 KB
34 KB 982ms
667ms Script
text/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D-vux09UgTLqghqfiVac_j6hwWWtemqH3-eB0cDdDlm6bN7gWOZulFkxLgw2aH_1F0gyp4XLOaKFwRNx_eGVnAeEfHTYYYcHku3YKXwDlqz2RYc2ti2GzalOnWr3wL7mVQYmXwvvwxxTAYGfk7Tu77fYNgnooFA-u8dA135VSTfioPPYY&cry=1&dbm_d=AKAmf-DQfS0A9iMF4k8B6TDiSHkpnkNjQWHW023HYj3S9IiZTeb9aHbiieE1OPG__afJixufNqlhLaErD2i3EjGQrlrZk1biPHWZ_HiL6wkwVSAOe7r4P-BOe4xiAJjQVl_ozUZbZ_dvQDOmmkf2zV3rK7MJsCfJtdXqVmlZr6O1w4KSGGoeJlfFFmbKRJtccVxooP7XhGt5z1JdnTlIkcH8A4_BzKtYgschN3idO5863Rs1ll-KLQrZ7Rp1GuVXBnfO5kU8h7i-UOUc6xY-HOri0srwN43_IOxk-Nt4VytdgzWakxKR5sXmYzcjHWo4qNz3Ii-ZKnckNFk8glDuxjBODJvIDlEn7WmEyZI9JMC9dSvwi1ho8FlkWyXGI-GDDR0gJ0nB4GUT2iFDs9iYrZCKYXPAMfIZNORGxTAvhyEDRE__WClYkGul699fUZPldkOST7hP58Z0HyW6x02I44VwtIE2-4zRgpdbWdVeZUmIeDUprEXq9fjhSQaWYZExcKu8HnKifwrOKtm5Owh2Y9S6ZojJw3gwaKQHItxrvmh1A1mh6Waxn__8DcPUNGRc01O80isqZkoy_BwAZESYlujc3S45UXWZwZ5Sx78BZmep4Z2hvCZ_BiCZ_cC0zPRvGlKg1uco2roOWnaTovkADIFXq1LyHRGK3cGdpFPt_pWPhIcgaXzPWyqv7m4k_wigouTeNo_91YI7CYxkO3W0sTevAug0u9XZ30I-Y7DPrKqd285DukYbVUwyNAX0MZT2xT-cIH-SiBuHbmEIdKJ4GDzIrjFfZUdBIeyGSBX8ez52NlFB24B6uWrkx29LcVLchCHvaY7yg7fG4EzCm_usDuqC-Mx0xWO9Y5HGGwfi9So1cGMjxIfCqZGQ-WCR8gKcLqfaKsPCAIzePnx-IYcV1oxMSqlSz_IHzDJ0HBoMOGYzT-UWkVyr1V-mTAp2tt-bKCx4kRcQpya71yTcTpJvv8ksBoMvzcsQ2VjKkli7ZDlJV9bgoC7GnzTBJlTf0eWx2L6FXYQ76uEKc0iWh23sFSHR00RcDOCRcy7fG-9Y0ed2Jo5rmRuwuLPj8SPbzqmUo8gk4JUyU0YGintAztkYKnbL_QhGWvDLVyKzX7Kbgapo27kJxMAdumZssTwiIObDp4jZXNeETnKhYxIDp1wrzRY0n_fgYFKr8GaV-6bLOughSoiX350D1DlLZIRvaeaMaW6MQDSCJez0CCMp5yBeormRQjsVL0qBc6JU2M1axdNjfSB5NLnJGc_gKNFbA7ldJ2_klOF-f4Bqa4F3YJn-j2kOxMARZWPhwchTrSNbXGKyfeh_zCsN2tT1bzyvVViBLBF3sv3NpXrSrQZUeR-XeM-c-q4aWSZVbona1hT_KOr5uQOMY51fPv6uKBu3yFGatMmL35kHq6VEda7Kqr3FWahoGtXkCstAdiBSh8C85hEnCw82zjxKVoWHdHxGWaQJ4wbPyjCUPiy_oq6kG-_WNjP4DaOKulhGWPpv-d2seGr9IJ6JXi8z_CGEaIlcf9IjO90537ruW0FvwRryqAXgU01CcLaf5UbIeu-jWsjLAfKCh7wuRWDDbeOfD6spIgnZ2g2AZ_Ed5bCY58l_Eqy_D_PLHLjClegvxzOo7ntbd93Q2VLcdX-LpEfNGlLqsYKD8SjbwSEVC-RxuJLKzAvSm0nOI5Vk1c3l4ZieYwJ_yrsV1FlDk0ergdYyWmzasvIPzwyExCbDbyJz_pZiuMNUrYKgzBN76msizE6Rb2zqvtPJisnAb9eHug-DDn12_KdBBJhIH5muK-gau8jxln5WQG34FvdEozeIdUF1WQ5RRt8shqJF5LlUcMenHFrM68qCj_2sbcftUO5HCPChfRjNcL8ZFV_tQ2Ixm3IZniAL7Fo2CRHQtbtTCi5ezlP8k9CH95gumR1sGABFcjkyFwRWi3vYXqtGb9C4nsuNN-OVhK11XO3rS9tkVTfyC_byPRJFmp6mOckCQXQrWd1KtHZrNSvC_54bGwziYAXfW2V-ehSb4OiZpMXWw-F3LYYijkfX-J_bcGxFDFbqrW5ciY7-g34RNavm6OuRHbfpEAWALtYDipHdIDXWgZcEQA85nEtqgt1J7VJALPYfKuYl0hIHrXyQxvrcubhFRsd3hRueCeRjh9xWFVlEFy30kW-cXxRwLG-5cLmi_eop83Y3iOJaCXJJgeLCqd9gB68xtMHhy4SFkoEs6bt4H_ct8eaC1epoUx-1P-CiEsh6Hjr5fRZhuwnObHwNjkUnyadq9YZ_mIGjuINR6lcCdEghNCeog2jODKFC6Xi44AY-zO5Rw_anRP_quOkdrDWpQSi9mcOkNOw8veeIOPl6xTmKa5o6EvWCjAE98oeqm2sBA6lx_raIOmlbgtgR33HWmp0cKCf2i1gyB_9UVjYuP_E76Onb2hEeEFYieVxoSpkcKqQ1jd2VR5JKbi7KwkNHibR0MRaAnOctBmrvukWZI5sk1fcRWf7zYtwwti1VpbTxzpxSbiPgf9zjpSFPObScDpC4p9sMBH1q_6FMHIc4yT9wpgv2RR4zucs2Fm5pOA7L8nxQwyBjSAW2WVTv9KW1S9-B6gkxcvdoYq0wEQRg7MXFD0VxJbttfpT-kH3W5d7atCRoDwi6vkoSZ7gFB-6b_LhX2r_Qk4VxT4Qc0B-moq1MTPEAeBM_YI96osnPiT2CcOYxAf-jl_mTncp-ykB3N4G65TdAHd2hC2C4wnyB3TgJFI2i_n2sI99q1Jcve01iAEd4EivU94jGj2G49VxmVM-7DW6zKGB2tzevQO0TKYi18UeYGkcT3BcK4CkswKS_1rSG5hAIlkFL2Vy-OU7O_tZFX6ycC58gfptPvbMVOuaYJ6BG-HE8EPcMQnnQKxu5Q9fkO2Q8jAkJCfM6IoniFqa4TVv2sCv1p5lMWOEzjn7WnU9SK0QX0mLIKaD2u4Zs3KBvEtyr2BdQbETSdxac58efliW3N84XbwixmyDQpxUKlZPjMeeuidizAawj4hbNkuEygrREECjizNXTTNHjforEv6bInWX2vzvkqX0tF2b_7BD2mvS5k0EtTQ2ZKP16Li4Kb1BlS3e394xkgH_Bydecj_Sj9LeCOIdMjyy2BKIX5y_nPgK-DQc_8t_6qzXYwa8BF-wZ9FVBTlQoK3hsSYNuVVmbVoNfjMiOrCbEf_z8z0SljRo4ww3OYrZ8sf9q64SMPYTgXhvnPZmCRyV1hqsuVTVzcMZYHnpgA8XFFl1Oq07IUXYjvTJ-cyyT3Z6XwsqqvLt1DewVw_Q8HJ2JXV8rtQus__ZC3r-NtYdsJAQXCT1njLMK35A-g8zfItE4Yg43j_sxO8b6hQeawNkYRAG8C3hltprMCrPUmlCLSk0L3CPN6Rm58W5wropFCE3qP8n_HtlExmbN3bfXYwa6rOer5oaiKo9rH2yNSBWxc2ZULaO0qrL0XK9E0PMIrqSpgPH_vorLHBZV7yXYiPy42n93VkWzt1M3KpXgfzKR5gqWQ5RGCICouDhIhSlp09rvzBje4hEylVP5o5yuQ0IuHri3M7rmYZfBwrBxuheA8npuDBCrcpjqSrTgRw_ycmKjVmvJHM51FUvtkZJ9DUd_uY8n-p8FayV5nLoCl3ytsn1_vucm0n8l1D6hTitubdW3DRsYsHmpqICRq_sKF9eboYJuH1slOuUIvwWv8KgI8_B7k2gqyqn9xHnHeGPMwAOt3iIVLSMLfv20asoctPvVAElQxj3AjO2dA7pRoy9e1Zc&cid=CAASKORoMpHkS1ddtjQFVRWNYPDA_fosIUycONLTIykiA3xZjfRutk4KviM&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f156.1e100.net

Software

cafe /

Resource Hash

2e68abe4eaa63ef8655118e46734567bd0850085352c47eddf019d1c37a7fe84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34577
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame BB73 42 B
63 B 266ms
262ms Image
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BuJVprCO2L0TKSKMntPXqBZXd03jGz71QBKmpV5rOoWppgQeYMZP3GMXepbYG4PHTJH4IV6YzVuRYBrGDe8dElmHLyexr2Xm1is-S8TtKidyxejxQ

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/ Frame BB73 3 KB
1 KB 311ms
307ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/window_focus_fy2021.js

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:37:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1208
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:37:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/ Frame BB73 17 KB
7 KB 213ms
209ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

cafe /

Resource Hash

86d8e892ceacd8c8a7e7125c68dd0e1b311f8399871b6d64b8b6795f0235c1d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:41:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 936
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7559
x-xss-protection: 0
server: cafe
etag: 15289875785628835784
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:41:32 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame BB73 0
0 245ms
242ms Image
text/html 142.251.12.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS00QsW4rF7Clxpxpekr5YCTpkjlF-onpM_eFjDfOVAUVERGwGdd1SRM398fY9pr9c9qkxl3VT7M7ZY9XN5X9R8G0dMvw
Requested by: Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f105.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame BB73 140 KB
44 KB 1009ms
695ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f155.1e100.net

Software

sffe /

Resource Hash

da8438b81e390283f6eb8cc9cf49ccde3d00c954b4fbccdf6372c162c4b58ab2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44530
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664365478704152"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 03 Oct 2022 02:57:09 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame E240 624 B
559 B 803ms
498ms Document
text/html 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sYvrqy0gEwAQ&v=APEucNWxjazYEZUxYIJJePJJcPFYtbDXreTPO-2n5UzMan42KLt3cAROdGIPX6Qox1ANLMhhtiWJXTe2OS7nU5a8_QGV58rrLg

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f156.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 02:57:09 GMT
expires: Mon, 03 Oct 2022 02:57:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 06AB 82 KB
34 KB 1051ms
749ms Script
text/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Df1iPYQvFGrfzeWsNYRMX8Pk6DzZ4bDHPJDVmaP9ONQcGZk6uEwkyMMJ5-YBONTzLKSypjrPEDubPQWeghne28_cWMwaXwDFSPLtS5EViN8KiTCE2yYHMEBSzehBLwBwFv09u5UtLNb8uBYFFitALmxKalqJDGn5CQftesa9T9kz63NPs&cry=1&dbm_d=AKAmf-CpUL5mhpeUkpsGX7eOxgfaRzYkiAyO59c43bWybJLd9gpP11ycMXyUB53fzT2JBD6kh1W2uZeHJ_QrkI5ONLW8VraSJOPvU8f4QcS0XXR0stat8L5JBsyxTu9cuQc-lnPWrWUHedJUVh__H9pW4tiEGmPEek4Zm8gf6YvU4gsunHbvznYwZ9TXClZiV6GX4VB3nYhhiOIeZTn2Qel_9Uem-iBE1A4wd9TOsxSG75FDC5GuArhy6v0hv2jBfvo4iZvP1gOAXrWQIH3obk23xIyPRw06zIHDQC_Rl-El8H8JEkB2Ly_T83d9Oloc8bimgO_p66O9LGPOguaT_263SvLA4NCvf7l285K915NCJoSiTi56tMpJ0SrWiHGFqoa3ZFg-CJ2oHBQsMYAg92gF_N9YlqAmA9L7-dnn1J6VLt3uG4ZsSoqJ-PK0ddmLOP6VkP7JO2-11Maf7E9jxwf56JQSaFM0KQTIWaiXR21NWL9YuDFZy7txnkMcfoyKM4sSxbRfMLE9HeltBxhpSEG6OxlSqMwIuj-gnpWGX6jC_3bs9ENi6s1iFiW4-twdEUKHNeKtMTn8kU1orY6K6h-WQjOwGpuj6eyhV6YWXNg6wMIGEEQTMCt69-DqxeS9dUQtp3S_ffb9brZwQ-8eOSMhfMNl8sMmsfQ2qo4aTlYBqClcEeNlqK72dGjZYSdk43MAdMRS-SURYdG5ktuya2CM1vUQj1d-TiWOIMuncvEsAPlHeJ54vxuu49n4x5xLdhYqgsVnpC0upZz_-34i1ittt7RMusRHwgTAUhzcPY8m1eEh6BL8Iz1hwu2K6l8q8_aBPvAlTuNhVFH6do3Qejuo5oczzSWUIAywyV6Gp8ct71RJxmcHSkCu5T0HLwoV-kZXZeVG6fT_GZkovw4C_Q31SMNqZjc32IbhFk93HvJLyPXHxLoZD5vjiiv-pWRQgg_RSRQSoGdG4N-m8AFk0LgFzZgAFZtonWIzMUQ4uVwC4xsBMQepLtH_WL1UDLmS-2ZnWWTV-8PBT6dkm5reQoxjXcLYMWHxXgStnSfmdDEaKE58ZvwF-rxamhanb-QxxZtv7QefYFe-gdLgIdldsA3qRQlkRviwAUeaqGJzpQmnrHg5x7NWRwMXRerkPaEuvB1EmMZ-ddTL-BgbiJt8BIT_lJiNcTsD9AAyR8g64tzyx31UUALbdLL_TfmcJ3r9T7RT6BkgiWdj4UI2o4T70zM5RXBPvERuPRHUb2gKsPk60i4ciARqPy17cp9RCE9_yY5B2q7peagnHecZhtOZ4J5WqY1vGkd38Q230CqK8pcz4g-vQdhcGH_IdeGV5sLHRCjn6bRxEWTMxDrDTfMOWA707DQSvJKOoPhXFKknQCvCnijZU640QLYLsaKdNio4x1Uit43Vbymd1LYsoKOxXPINenwOiyyAVuT2W8tdSmQafncIYfPXxAUdNZUmkn98tvdhGWi-DMS6i2iu3-2_qBJMoEn2KPJyWOfRyoNXJAkUF-C1G7ysm2ToBmZKyqKBdirqEHQki6KNf9mQyWTxi22TazulqivgsdnhVpOYGUR3C1HRFT5Mzfh8Kg4ZZv6PqaAhKtNdKuwOv8chvrsocmN_OpQZZ_sRA23zyXi2GmNgeV-ob8T-pUvPjo9UnND7XmqMbW0BG4jRqWYDHOMgP47SF2l6aU85ahdmMbvLGWDWrOTphYwyW0c_YzibfuNXO8v8GYo7-OhBtXU7HcASfKAwWUbKVEe4DZy1Lrh8AjNlAvwLFJ7vWH1OkI1rqZyU12MCfdgqIGVqmbDklckHFcTrHKEfhCEMKWehuJOODxhW5IOqBd_C5bFPu9oFiIa6cYqxt-cKZ11zDvatoVpLoxYHf6tD23Mk2lmyoGDlHaJy744HjzBV3bkqXy_Uvzkpu8nmg_F9BdWV0XfaDRQyChHoNOx_0l-Gll1X_Z-wnYiFLDHKXpgbIZWriznXiFjrT7uyf6vJG7FNpL3Frn3Ooih8lt5n2uiYPLGYcjnsnQf_911zg7FYiOeEtG6eSJ5wpyP_aUh6B5pmJe0R_t3FEqTR_euP-gZayCuO3pWWUjRLgLcaGOi9Vb6sZGm92publnI8xPHJ93q0ZjK_ZrH7aWFgc0tHy9oAGialtL4qNFNTrZmflyDe16oshcrsDo6mPfVCltTVhI6q6WxE23x3RPPyA6u5sAfzf1oHEDHY5kih4mHVulNEa9xzv8A0V7sKVFF4oLOilhFLc69Cw7oxOFk7zSKqZSo9aYiWrFyVjNcw0JMRIEp9zqnz5jwFTd2dN1A-KRjMeiRRUYpkghCvgBi_g0bgLN2qCio7i-CbydgEOD4fUtv2amDljwqdfMaoUUokWfKIU2XJyZuMaVMNo3Jm86WsVXMvDfH3UeFxtmU1f_4r3tonAjRsKrpOYcsMO-I4MuoOYLZ1yKU-6UgXKAQI51Z1MNDBffnEBu8GApwY-E9Qr0HYlR9Qf0YX_yNVkG5uNwz6lVzIKiVK_fSdZavT-ZxMitpS3Riw-OnmFWLSzOdNCBVwQzkqz68-TDGFA0iPFyklEVP4k8FMRUbt65wdGfh9Mz74pYvAXg44Yms1c2IEMf5Uo3NdX0lEiLUPmSC4ALOtaGgkhrPj5TaWPKtZ7xqEQ6g0kipYS0n61Ja7REnk7gGQY2vTsGySycYXqfJvPTvtYEvrLaojV7J_nRlooh05fRFn7Hc-ZmWc6tXZ5o6Tz0D9QNe9gFsfm8uqwZqBQLjQN33ks1Qoyp1nf6cVbko_AhKuY2jQBG95huUiQ7CLU1-pAojcV795h1sQe4hY5v4wvQi7eQCJnuIASR2hEZKcTqueBlQuIUlXRO9g7_vyKmwo04Hesk6m8Y3_y9GpSkSIhyAgy9s-AUU0NgBBrjrwF99Pj5LvGXdQxKxG6x5fogaDn-k9hF3Pjf_KeItLvjHFEUTl0IaR1ujjvFN60ZUHFYKe-J3Sr1NPxhSgPFSLOumtqPGqLl7qpeMCfQemuh3353O4AIi2FBINRfxWVxEiYatDkQwz-i7WcMUoCv8VEjbS-vFqj9U8zEATGagNGvaSVk3Zzn3rYte4b_kC0o7wcbQ7EgIy7XqyJ9WXMECCVUGDE63JBsjMbCHnrxmUrjaxxiEfnJ4g2U64UwgWQNyCrlZxLD2LnwdQjWecFScYs3goCPoAwrNunRk-84Tbhxus2wn341YvJ6bvAjUj3I43-VT0kVaiyJ3xD7a6ZCFj7ZdufjUGr06-303SHU5VPTU5iOe5DOYvcqiq9jhwXkDas_YdjDx6z6z6QdmqQpKZVBzE4Bsw0daZ0rLboawVCg3B4xI-uJSoOXlRaZWbGfP1-TJ8n2MMvWAkPZ0ruafQZqUlI6hUP5UUpW7GuNS7pZS2EneIUbs4Go3W39I-LkvhhvvKpxkxlVu8HTXtArJ9V6ReBg9Io5Z9cagVlKGq0REEIC1vj4fl0Yg9vdDbJENHscY7kWcTcCjqZVgCSiC3Gzv9pbpREZKLmP4rtXwyAN-EmpshANOqT3Vblo0jRZ1mOprNV2xPUqCrcyGwmM8OjX5wO__2M4yfdY___e6mSxb9ojuc5nqgYrkKTc_lBKZXNOTu70KCZ2aZGN29oYZi5szFI9V0m0YL2UXoIPGjd7X9alpJM37bUZGTlhgtGHNTTuCr3fOceE8Ra3y8HHHFRu2g-7O8nmSTfyPxQtno3KSHexwV-tJVOZCzYSD_OcJLsO7D25amT-7ocYFQvrcOGlMx8Tw&cid=CAASKORoYDhM9F-yc33YU48gP_6Jg1jt7JAZ5qPLcW6Ps6EgMsreeMzfJuY&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f156.1e100.net

Software

cafe /

Resource Hash

e383ed7917855bf3d2db643cf5b1b2bd2a4ce6f2dd7e44e9c54c8e7533c04dc4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34552
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 06AB 42 B
63 B 257ms
257ms Image
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DYPLMz7DQHd4Au8lGri8b8yDGnFxH2kynInPFYUN3cN0Zv_0FLLEg6wmWIFWLoICGksKhhDSHW26mjo5iQ9RvuEGwVDHYOEvwDJ0N_3YnnVxh1wxw

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/ Frame 06AB 3 KB
1 KB 309ms
307ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/window_focus_fy2021.js

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:37:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1208
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:37:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/ Frame 06AB 17 KB
7 KB 231ms
230ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

cafe /

Resource Hash

86d8e892ceacd8c8a7e7125c68dd0e1b311f8399871b6d64b8b6795f0235c1d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:41:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 936
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7559
x-xss-protection: 0
server: cafe
etag: 15289875785628835784
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:41:32 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 06AB 0
0 242ms
241ms Image
text/html 142.251.12.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQEyFTTkruZbu7Xdij_oaBN5g0miOvmJl9TVZNwTDcdGabUnNPX8Mpdz5x_Z37ICmuVNSQ-3f-Ujjf5lQ5579Fcj3P2rA
Requested by: Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f105.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 06AB 140 KB
44 KB 1161ms
860ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f155.1e100.net

Software

sffe /

Resource Hash

da8438b81e390283f6eb8cc9cf49ccde3d00c954b4fbccdf6372c162c4b58ab2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44530
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664365478704152"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 03 Oct 2022 02:57:09 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 267E 624 B
615 B 783ms
488ms Document
text/html 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARiijIXRATAB&v=APEucNXAw5Uv9fXkH6Sbl414FzmDLUWFpe6URRBLFvr3-6XxlytM0tvCSKa-gYJOwEs2cOKnThOLOuJOCT154zQLtk8iJyH6Vw

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f156.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 02:57:09 GMT
expires: Mon, 03 Oct 2022 02:57:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A477 28 KB
17 KB 509ms
217ms Script
text/javascript 142.251.12.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C-_CkN_tfUY7r5vzKQdoDfLSskW2sdy4sv1hrKC2sMJwSmAu-UbjGAugD50ERaIVsSDUOzbUtX9rK64Zdeqfx_R85W0TvX_xYnoMZwfQWWFZVjaBEEMkz2JEWVz8qo60d2NR4L6ZH1nfDabefz4BIVmV1Is6n2WitqtHWVwGLZxH_RwTU&cry=1&dbm_d=AKAmf-DorA0VrBdtgCLPjpew1pV2oDYhivPmWPmUN60E_9kS5bE5mUuBqLSq1Na67oqUZcZhto9keX55HFEO8rsmLTkroKrykNU9M9QgFgsYZPsCG0IsIPM-uKYTrJlUJiAO069ATZ9SyblmRWFfm_GG_VhKP9N8-4EvOAX_WJFZmx64-MH5ymUO-flKcI8tLuZFkrL9_X-3z4mN4OwBbZ5VaLfDWWHPMfYeYmRy3g36ccYhO_AHiSSkf5xTgOOcieQHWO1aq1V5y4-zipFfxNGHU6gEWTpVH3T415OBON-YOB48i_Y8xRrExTv_x5XcPKb2u34-l1IYLJlv-aXVATcCBQ7F5KFhJyG0ZKc-GyU4aMJWAZijX2qKAQtxoZkwmuPv2x-_WeDJ7M5J99ZerQNbU2J1xpnIT3LAZvpJJVrWIX4arMzxMwCZYbfMfPi1x28Nl4u7MHkzj9OrKbF96p4z9jDoeVpiMI-isrWwNsp7cqzvoS2GQrfTHRlxyCYMcSeHwI8chEuL2I-hsmZCKja6gk5rC20rdObaJkVsSzvmrCQdv-HlB9JrDEdIK3v50X3cR2szZ-V6XxYC5eru0P3F3gKqiYdPUXrnSpSYHTwCFbTngUggCfvdIQAXUS4KcG37hOxQqk8BFkDpWc1Do1HRpd9NoOmeWXevcvbLGZJnJv2DhIRm-1elopw53lq6qB3iZPTvaz_3bmZQWEX8g3f3TcaM9EBG2EWxVv-T1-4fTqp90S4FtctPF20PEvUnfiwIidIbgSi1G2EJ21lNCfRR1olRYlanXk4YTAWkEDQj8H7DZ7XEkVYTgFUby_YXTCdDuLeay4px0UlRMukaP70z2Qr3U0ENXbOxA6CbypTHR4Y-sSalujUlXLSAaz_Bn6xAb08zAHL3w1Ynbx9D05WbJYlrBOti3WeI4gCdSrNl4oo305raNlNDOTypiRWwtr-PGeSQiBL3qK25fmDJ391Teep30YCMEA5qL8Vnk_Y5BxNN0LKMlJMOXZa9u4SiF5NySoyVP2OUzajqH23sapSEnp1boJGpwLsifYuTguZIntvUM4Q_4Pv2j-LuEbHnCeBHqUO7Ow9b1oAeAjvnGi8aN3ajUd6XHyvDRGjS3ojS4S8V0bol5gc5h3dT0SBeyykDj3CHI8YTBk_EyHwynsKgI9Jl8iwXpB8RKN901dYKGkL1OJJijUVrzM_bit0Z3qLnJ-CpkOBLwn8ggJDvBYM-qb-DZGDYJ5phMxKdrdQoce_sEKcwk9RCnCKaBFVtSMQqcu26o3q8dZLJL0s6LXaY2jno_C4e3AKvqTh8k2YsEc7BfL5ey1jRtUAeMdkNegUnr8nkASIFId2yjF79MvyWJIpA-Bstb0IAGzOwFx4RmQ63PsKC3Uwq0XLDyIFNOaHsVDcCPzeRum5HTSSDA_X_mfumX2-v6ErLr88YI1AmzXmVIGrjFN9kpnLEw7wegm3GLPE6BpGxH-Oh4xicdyR_6SDt1K8NYfkZ_N_mEUSEIYbvZNdXIZoVaMZQV1TVJB6NnvILUk4F9DkjYq8znNyNWlw8kXjR5BlJDviCrMxPKzFQOyg1_fso3NgoEC8x2LirczUCBCAQZUGWIOzpevvLYGdEWLTM_4rY9GSX3Y6XfxYfPTjByb-myx_yHfgZ4G4wB0iRr0YVpOVS5hfDjKkPtC-QTxsbXQXH2D6iMZXKyYGPf9HKA4zGkmdAPGgHvNOmq7uOA00fSAorZ3FGbxBnpdY7ecTj7_VFDWpFYIxvATf_ysjowLwwTPDzDhOSfBRqTBPLPmkHjvZl7Ht61Dj1WUYDPnBd4jhK0mFTHtnxfH2v5Pggk1NXamvUOW6evF2psLIJm6NpnsmeIeV7iG749NZMkfBZCXoILi74sCyPUXgaWMvAg8RhAawBMsSJpebw1BFKtJPZsf4PPm0RC53VGIHpCTmCZr81WbDiB_6HviqYI0WdByGSdMMk6b0M0CouqoEJ6naTrv7dU2kzvGRUYiraOZCglHt9UrvWsI-7JZlGijrnfXHEnjU4TsVQ_HeLz3k44kyvhVgcUpXGUrrMys1M1iH4_ZRPqNlDocVl5sK4WXwuL3ga8zmGwJqbn5nJ0-86_Kl0FZdaIUQXPA2D1-B8_Z3Xe04sn5PhGfVhEj06PudBQu4rYqxbJJcg06ESLhgU6klOhCfSG2Iv9wem6HSLjX1I5Z7geGnrQrmsMtFXh00mk5uzMPMMpRnhz1g0D6SLEGTUrQmfbFVs09AGujYtXN5aD93TkKXcxUxKrqlxbQ4dEge-DrDOH7ado4A14Z3o61nsXg7YsUnOEk89oqhO04oUa1eMTLP3qQlUeTnCETu_XhOIzkyxzJTsOuB_LDBY0zwIcFUuh6CynXlQHRBEuEordpx8f5uONjhxUvZQQ0FgpW27u9C04fzCi9nhZe9cTtuTuq5w6SK0zFmlpQnkc7E98U5qvNq8UzKjEeM9rR89Vf1_d_LjyYkuhHShgy9wYsCXWg6A5W6xufTaNnGMwywbc2M7aoqhv_xUek00tK7-8v6aJxy_7hStfme54CUujHdfD66D_Lwcg5WhId-8QKu6Hj_7hsbWrXP4pwXYEN4pQtTQ2bt5-FK9et4pvne0EV_i5Wi4ClMx-IUNNBOhgoglsueqLsGaWED7g3YvtZGw6VBlk9JNrCAdnZVtO4J2sLyG2qMkcchIJ4BZLFOwJy26ohqaPc10_IlpdRP3skKTMCdSDnZAHzOU5jGVJDLP6qOljJdPD54E_TJ3gV0jzCxLx1pijqIpYhwyW1MRCqenRBAX26U4_D8nr53sI-zQVPOAtQu0OAXzvNtcNdnh6mKrCFWP3JQwEf5pG3sbAxDLEGdZOsZeSVF3G0V63lTlQjnxquX4tBa7p4OfJCoS2JM41Bzc8HkZcORWmQmNbtGetP-Nq2t-QRoI_d4-KJ-TOGQ-IsXtdqZutJbG4lVS2l2xP7mtF_oSyHT80Mx36ob_rjz_kMUXBVqZ_aZSAUSWodt_lXvNs0QpitoVwAtTnKULhqQKgkECF2EVL1d2kFQGJ2jgCrGj-YmsrpJhFHR-fzM6t0p73mbAkSkpu0bxrZLRKJNRWg9yhnQNa0Fp20E7ZcciGNHtt8bFn4hJvZS2V1TpwdjofskswNtRPYR26y2MEQkqGANo3z7d9mkUhKCp3xolmIGFaD0Wan_Qo2rdZTMEI0UdMaw6H-WtU9SksTWCeaeNsdoQsoE2_N0rAEAO3yUMb1AKskeVfjGHnRzc6pB5wMVEqrvXhhedZ0ToWlYaxjqjEGhuQVpcUiVebKe0_TTduy3Kw8jaKc_LmyzvEZub2UPg3sjy9ROwQ-9h8X9HQGERH_DSyK5J2ZtC4GU7vsG6XDXK7d_jhwHy6GgifvUNURsJbPa9ihKTpSoNKx7AX8g_Oi7SaYYax3TeCtTo0-7bhFc8ZVCMjItRItNWi1_dYq7KQK1GntWTLep5HUZRumitQ4bHpRgkrKLe6n2T9NTgx7ZHZ9Vh6PGL17Zs1DPMsBNuPbJXo1t8dBBK4W_tEw&cid=CAASKORosT8jYfRoHGvypkaXqZoeVl83tvAqXUee34dC70ZpWF3M7qlcafo&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

se-in-f156.1e100.net

Software

cafe /

Resource Hash

1e7fe399c7403b7595e5407e504692ae4e0fd6ba6261bffc44f80bef676ae618

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16716
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A477 42 B
63 B 247ms
244ms Image
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CT5lcuWgiRFyAPY1-Or4cJMyzs-j7IAuKAl6lLZIjJdG0_lAPpziWc6NSTtajXDQat5W5dnFOKExfju1pxAOtllKeFolRoCij2YSf35SGLjQkaVs4

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame A477 2 KB
1 KB 841ms
287ms Script
application/javascript 23.36.254.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=189094&plc=6695892&sid=18330&dvregion=0&unit=160x600&autt=1&ppid=103&aufilter1=3060631&prr=1&auevent=ABAjH0iAtTr8YdRARxYFyVllg2yQ&c1=3060631&auorder=1008962086&aulitem=18156675739&aucrtv=438388258&auxch=1&pltfrm=1&ausite=201491245482&turl=https://pastelink.net/53fgu29a&aubndl=&audeal=
Requested by: Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.254.7 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-254-7.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: b42f035c593881359488262fdaf928acd4b9e6129051810120cc361c2a9688dd

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:09 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Aug 2022 13:19:47 GMT
Server: Microsoft-IIS/10.0
ETag: "f128ce2aabbd81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 1170

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame A477 8 KB
4 KB 857ms
284ms Script
application/javascript 23.36.254.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&advid=3398311&adsrv=0&btreg=&btadsrv=&tagtype=&dvtagver=6.1.src&autt=1&ppid=103&aufilter1=3060631&auevent=ABAjH0iAtTr8YdRARxYFyVllg2yQ&c1=3060631&auorder=1008962086&aulitem=18156675739&aucrtv=438388258&auxch=1&pltfrm=1&ausite=201491245482&turl=https://pastelink.net/53fgu29a&aubndl=&audeal=
Requested by: Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.254.7 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-254-7.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 9dc99a92f9d68c0bb47cf55e03971e0f068090465859bd483c97bf9c6fdd32e3

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:09 GMT
Content-Encoding: gzip
Last-Modified: Mon, 19 Sep 2022 15:59:20 GMT
Server: Microsoft-IIS/10.0
ETag: "0fc3bc740ccd81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3314

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/ Frame A477 3 KB
1 KB 304ms
301ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/window_focus_fy2021.js

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:37:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1208
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:37:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/ Frame A477 17 KB
7 KB 252ms
249ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220928/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

cafe /

Resource Hash

86d8e892ceacd8c8a7e7125c68dd0e1b311f8399871b6d64b8b6795f0235c1d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:41:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 936
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7559
x-xss-protection: 0
server: cafe
etag: 15289875785628835784
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:41:32 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame A477 0
0 247ms
245ms Image
text/html 142.251.12.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSh5xVjggJcJ20u8Ikinh9sMA7vG2AxYqJC3xUHGU24jMaMlvbTngEWOXsRZ63gFYbEK_pDc7Lv6mvWHBP9Majsnisq_w
Requested by: Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.12.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: se-in-f105.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A477 140 KB
44 KB 906ms
615ms Script
text/javascript 142.250.4.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f155.1e100.net

Software

sffe /

Resource Hash

da8438b81e390283f6eb8cc9cf49ccde3d00c954b4fbccdf6372c162c4b58ab2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44530
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664365478704152"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 03 Oct 2022 02:57:09 GMT

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame E5E0 2 KB
2 KB 309ms
309ms Document
text/html 52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

7c81987e392c2d32084c5f8a1eb4a085b0dcb74f5599544444c0ebbdae18dd4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain&dcc=t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 1624
Content-Type: text/html;charset=ISO-8859-1
Date: Mon, 03 Oct 2022 02:57:08 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 131HTR29VH14KPT307K5

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 42F9 0
10 B 193ms
193ms Image
text/plain 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?Po4B9g
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.194.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: si-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:09 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame E5E0
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=aps&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsmaato.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=3b716c22

43 B
479 B

309ms
309ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=3b716c22

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:09 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: Y4S1BP3KRQA1YYAMXXH2
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Mon, 03 Oct 2022 02:57:09 GMT
via: 1.1 31d603b763553e4238110d07f30c186e.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: SIN2-P2
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=3b716c22
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: hQGw3LqVH-ERzxx5BARglhlIa2QhWmU1oKwi6sSRTUVQ2ugj2M8TfQ==

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame E5E0
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24%7BBSW_UUID%7D
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24%7BBSW_UUID%7D
https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=e62429d9-e11f-4445-a2b3-e4c4aa4dceea

43 B
479 B

314ms
313ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=e62429d9-e11f-4445-a2b3-e4c4aa4dceea

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: G5XJ2FWZS6490S4P6S8Z
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=e62429d9-e11f-4445-a2b3-e4c4aa4dceea
Date: Mon, 03 Oct 2022 02:57:09 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame E5E0
Redirect Chain

https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__
https://stags.bluekai.com/site/23178?id=_HrWR-X0tNcHrruwK45A&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZSXQY3IMFXGOZJ5MFWWC6TPNZPXIYLNEZUWIPK7JBZFOURNLAYHITTDJBZHE...
https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=_HrWR-X0tNcHrruwK45A

43 B
479 B

310ms
310ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=_HrWR-X0tNcHrruwK45A

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:11 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: N1NVNE31KWM5RMM80SM1
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:11 GMT
Content-Type: text/html; charset=utf-8
Location: https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=_HrWR-X0tNcHrruwK45A
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 101
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 / Show response
match.sharethrough.com/jwumXNuB/v1/ Frame C619 427 B
612 B 599ms
196ms Document
text/html 52.220.40.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.220.40.119 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-220-40-119.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 13b3a06a53813881a61adf6cffdde0f7916c3ba7d7117ebc06920103f4c1feaa

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

content-length: 427
date: Mon, 03 Oct 2022 02:57:09 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame AF6A 15 KB
6 KB 796ms
261ms Document
text/html 23.72.44.196
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.72.44.196 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-72-44-196.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=129605
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Mon, 03 Oct 2022 02:57:09 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Tue, 04 Oct 2022 14:57:14 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 2C0C 281 B
554 B 862ms
285ms Document
text/html 23.9.185.218
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.9.185.218 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-9-185-218.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 03 Oct 2022 02:57:09 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 2CB9
Redirect Chain

https://ssbsync-us.smartadserver.com/api/sync?callerId=2
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=2570014997578740130&gdpr=0&gdpr_consent=

43 B
479 B

330ms
309ms

Document
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=2570014997578740130&gdpr=0&gdpr_consent=

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-smaato_n-mediagrid_n-sharethrough_pm-db5_rbd_smrt_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Mon, 03 Oct 2022 02:57:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: TJRRY0KM3K9H4RJD9WY2

Redirect headers

content-length: 0
date: Mon, 03 Oct 2022 02:57:09 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=2570014997578740130&gdpr=0&gdpr_consent=

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/ Frame A477 30 KB
11 KB 193ms
193ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C-_CkN_tfUY7r5vzKQdoDfLSskW2sdy4sv1hrKC2sMJwSmAu-UbjGAugD50ERaIVsSDUOzbUtX9rK64Zdeqfx_R85W0TvX_xYnoMZwfQWWFZVjaBEEMkz2JEWVz8qo60d2NR4L6ZH1nfDabefz4BIVmV1Is6n2WitqtHWVwGLZxH_RwTU&cry=1&dbm_d=AKAmf-DorA0VrBdtgCLPjpew1pV2oDYhivPmWPmUN60E_9kS5bE5mUuBqLSq1Na67oqUZcZhto9keX55HFEO8rsmLTkroKrykNU9M9QgFgsYZPsCG0IsIPM-uKYTrJlUJiAO069ATZ9SyblmRWFfm_GG_VhKP9N8-4EvOAX_WJFZmx64-MH5ymUO-flKcI8tLuZFkrL9_X-3z4mN4OwBbZ5VaLfDWWHPMfYeYmRy3g36ccYhO_AHiSSkf5xTgOOcieQHWO1aq1V5y4-zipFfxNGHU6gEWTpVH3T415OBON-YOB48i_Y8xRrExTv_x5XcPKb2u34-l1IYLJlv-aXVATcCBQ7F5KFhJyG0ZKc-GyU4aMJWAZijX2qKAQtxoZkwmuPv2x-_WeDJ7M5J99ZerQNbU2J1xpnIT3LAZvpJJVrWIX4arMzxMwCZYbfMfPi1x28Nl4u7MHkzj9OrKbF96p4z9jDoeVpiMI-isrWwNsp7cqzvoS2GQrfTHRlxyCYMcSeHwI8chEuL2I-hsmZCKja6gk5rC20rdObaJkVsSzvmrCQdv-HlB9JrDEdIK3v50X3cR2szZ-V6XxYC5eru0P3F3gKqiYdPUXrnSpSYHTwCFbTngUggCfvdIQAXUS4KcG37hOxQqk8BFkDpWc1Do1HRpd9NoOmeWXevcvbLGZJnJv2DhIRm-1elopw53lq6qB3iZPTvaz_3bmZQWEX8g3f3TcaM9EBG2EWxVv-T1-4fTqp90S4FtctPF20PEvUnfiwIidIbgSi1G2EJ21lNCfRR1olRYlanXk4YTAWkEDQj8H7DZ7XEkVYTgFUby_YXTCdDuLeay4px0UlRMukaP70z2Qr3U0ENXbOxA6CbypTHR4Y-sSalujUlXLSAaz_Bn6xAb08zAHL3w1Ynbx9D05WbJYlrBOti3WeI4gCdSrNl4oo305raNlNDOTypiRWwtr-PGeSQiBL3qK25fmDJ391Teep30YCMEA5qL8Vnk_Y5BxNN0LKMlJMOXZa9u4SiF5NySoyVP2OUzajqH23sapSEnp1boJGpwLsifYuTguZIntvUM4Q_4Pv2j-LuEbHnCeBHqUO7Ow9b1oAeAjvnGi8aN3ajUd6XHyvDRGjS3ojS4S8V0bol5gc5h3dT0SBeyykDj3CHI8YTBk_EyHwynsKgI9Jl8iwXpB8RKN901dYKGkL1OJJijUVrzM_bit0Z3qLnJ-CpkOBLwn8ggJDvBYM-qb-DZGDYJ5phMxKdrdQoce_sEKcwk9RCnCKaBFVtSMQqcu26o3q8dZLJL0s6LXaY2jno_C4e3AKvqTh8k2YsEc7BfL5ey1jRtUAeMdkNegUnr8nkASIFId2yjF79MvyWJIpA-Bstb0IAGzOwFx4RmQ63PsKC3Uwq0XLDyIFNOaHsVDcCPzeRum5HTSSDA_X_mfumX2-v6ErLr88YI1AmzXmVIGrjFN9kpnLEw7wegm3GLPE6BpGxH-Oh4xicdyR_6SDt1K8NYfkZ_N_mEUSEIYbvZNdXIZoVaMZQV1TVJB6NnvILUk4F9DkjYq8znNyNWlw8kXjR5BlJDviCrMxPKzFQOyg1_fso3NgoEC8x2LirczUCBCAQZUGWIOzpevvLYGdEWLTM_4rY9GSX3Y6XfxYfPTjByb-myx_yHfgZ4G4wB0iRr0YVpOVS5hfDjKkPtC-QTxsbXQXH2D6iMZXKyYGPf9HKA4zGkmdAPGgHvNOmq7uOA00fSAorZ3FGbxBnpdY7ecTj7_VFDWpFYIxvATf_ysjowLwwTPDzDhOSfBRqTBPLPmkHjvZl7Ht61Dj1WUYDPnBd4jhK0mFTHtnxfH2v5Pggk1NXamvUOW6evF2psLIJm6NpnsmeIeV7iG749NZMkfBZCXoILi74sCyPUXgaWMvAg8RhAawBMsSJpebw1BFKtJPZsf4PPm0RC53VGIHpCTmCZr81WbDiB_6HviqYI0WdByGSdMMk6b0M0CouqoEJ6naTrv7dU2kzvGRUYiraOZCglHt9UrvWsI-7JZlGijrnfXHEnjU4TsVQ_HeLz3k44kyvhVgcUpXGUrrMys1M1iH4_ZRPqNlDocVl5sK4WXwuL3ga8zmGwJqbn5nJ0-86_Kl0FZdaIUQXPA2D1-B8_Z3Xe04sn5PhGfVhEj06PudBQu4rYqxbJJcg06ESLhgU6klOhCfSG2Iv9wem6HSLjX1I5Z7geGnrQrmsMtFXh00mk5uzMPMMpRnhz1g0D6SLEGTUrQmfbFVs09AGujYtXN5aD93TkKXcxUxKrqlxbQ4dEge-DrDOH7ado4A14Z3o61nsXg7YsUnOEk89oqhO04oUa1eMTLP3qQlUeTnCETu_XhOIzkyxzJTsOuB_LDBY0zwIcFUuh6CynXlQHRBEuEordpx8f5uONjhxUvZQQ0FgpW27u9C04fzCi9nhZe9cTtuTuq5w6SK0zFmlpQnkc7E98U5qvNq8UzKjEeM9rR89Vf1_d_LjyYkuhHShgy9wYsCXWg6A5W6xufTaNnGMwywbc2M7aoqhv_xUek00tK7-8v6aJxy_7hStfme54CUujHdfD66D_Lwcg5WhId-8QKu6Hj_7hsbWrXP4pwXYEN4pQtTQ2bt5-FK9et4pvne0EV_i5Wi4ClMx-IUNNBOhgoglsueqLsGaWED7g3YvtZGw6VBlk9JNrCAdnZVtO4J2sLyG2qMkcchIJ4BZLFOwJy26ohqaPc10_IlpdRP3skKTMCdSDnZAHzOU5jGVJDLP6qOljJdPD54E_TJ3gV0jzCxLx1pijqIpYhwyW1MRCqenRBAX26U4_D8nr53sI-zQVPOAtQu0OAXzvNtcNdnh6mKrCFWP3JQwEf5pG3sbAxDLEGdZOsZeSVF3G0V63lTlQjnxquX4tBa7p4OfJCoS2JM41Bzc8HkZcORWmQmNbtGetP-Nq2t-QRoI_d4-KJ-TOGQ-IsXtdqZutJbG4lVS2l2xP7mtF_oSyHT80Mx36ob_rjz_kMUXBVqZ_aZSAUSWodt_lXvNs0QpitoVwAtTnKULhqQKgkECF2EVL1d2kFQGJ2jgCrGj-YmsrpJhFHR-fzM6t0p73mbAkSkpu0bxrZLRKJNRWg9yhnQNa0Fp20E7ZcciGNHtt8bFn4hJvZS2V1TpwdjofskswNtRPYR26y2MEQkqGANo3z7d9mkUhKCp3xolmIGFaD0Wan_Qo2rdZTMEI0UdMaw6H-WtU9SksTWCeaeNsdoQsoE2_N0rAEAO3yUMb1AKskeVfjGHnRzc6pB5wMVEqrvXhhedZ0ToWlYaxjqjEGhuQVpcUiVebKe0_TTduy3Kw8jaKc_LmyzvEZub2UPg3sjy9ROwQ-9h8X9HQGERH_DSyK5J2ZtC4GU7vsG6XDXK7d_jhwHy6GgifvUNURsJbPa9ihKTpSoNKx7AX8g_Oi7SaYYax3TeCtTo0-7bhFc8ZVCMjItRItNWi1_dYq7KQK1GntWTLep5HUZRumitQ4bHpRgkrKLe6n2T9NTgx7ZHZ9Vh6PGL17Zs1DPMsBNuPbJXo1t8dBBK4W_tEw&cid=CAASKORosT8jYfRoHGvypkaXqZoeVl83tvAqXUee34dC70ZpWF3M7qlcafo&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

f03f34a896200ac3d36794a86a5b23d054f1982d05740b454078c8526a33b631

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:47:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 587
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11727
x-xss-protection: 0
server: cafe
etag: 4188671789125589074
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:47:22 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A477 41 KB
15 KB 194ms
193ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 12:36:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138017
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 01 Oct 2023 12:36:52 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 9EB9 22 KB
8 KB 193ms
193ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 90357
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 01:51:12 GMT
expires: Mon, 02 Oct 2023 01:51:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame A047 106 KB
38 KB 584ms
193ms Script
text/javascript 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Origin: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 09:06:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64217
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Oct 2022 09:06:52 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/elements/html/ Frame A047 8 KB
3 KB 194ms
193ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AU-sK8GyV-4TwMAHzXnsDmE1fRqRR4U7A2zEu3zTS7kVL8upWnPGlEf1O3lcMXbMrD-p_4SwPvSMtOl1i9E-BugnNeqabOG8ifIZsBgFiWP-xpHON9WncnZHlSHE0UymvjeP612VzRv0yfu-m2-bcTF8meghAuqnVS9MyHqUwfP9ZZ-EI&cry=1&dbm_d=AKAmf-DdmdznWojxnaCRazmdw6Oz7Orfkryp3y3918s2sL68reObxxsHNdf8wMeDq0GzJg01DAAcfg8rhvQQ2tDKicfbHGdTga4FmAzyBbJCCr6R1e0Goy7pzC0hXwfJit36m_E1VSizQsoI5xgpm2cg_3S8aiGWPNVG7swqiWkI2VP_Yg78K1_LSkp54d75Rcpxv78BX1XiLMYYFU4G5PsH6dbFM8FPHQEvhizrcxwJ9mLuMDwQWWB12fDkeO1ShQhk3WYxWsvQZMwxVvLfg4iQ8kq5aM7VbO8UBQ2cCUypNmUDIfQrqvz1S8fpcWRathLeL7G0ezt4kP8mcCSopqAV3lgdJKxKRW4Z7XxdOBlYXbJfna6TL_O_iwhMgU-7byZuAVfjC-oqLlErXx1hpI1q-sXNdztiiQkCctW7iZuwoYqgLIruWwHnM8NAIOK5LVPT4s1Ph8qpl20xjQO0xR0KXkQv4QxL4ZPuU6dqzTzQpnxcvKpKsDk286a_GWY_h1FNrK3a8D0GqRNrTc5IS8thIdtLBXZHdlvq4Qf6eukl-tdEcMS1X76HynDE8bRLxXgHtbnUOvfUauA0d74JMxqV25rTyqAEHzis32W7gqUuEwuzTi2OEn9XQx_Zb2NvZoOZs2qWKii1iWLXqX5sUs5Sm3WZ5oeC3pjjgdFdF7MqDgpZLrBmc6VLXD5p-TyP6utrg6FLevbrLk_EeiI_4XL1cMb0PnsIMm5UWZzLcOXeLfi4AK9CiG5caFBfWIQcYaw7q7MorkaJ9F-16ZWnf2gc4H2ZnXBVJauwMvWZAWx13MKR6cWVTZe8WDZKo9Yz5ug3aGxYvRfOI9YgPjoOnZmFTZ8MT6ItK_ZxPRgJDDbkHdvZP3V22__9aPFrHR4UzT6CCByu9biInngFL4XVS9A8VQwOm6XcA7_5cgwqcfLMUrjtDcvfJv9XD0TqM71vptXcuYihZ4PASfjdFXzFmai9GOO839Ezlp2uA3QhQBzP24BjYUx9DZtqE4Ogoox-AvhhfC-RM-QwM1sydMbhMHa42d644iJLyKXgvt3jl9HerPGZU2ovRnTDQ4YfV6wIOqcUvE0AkjwFZxkVgXiohTgllJtFYdJBdFTFsxXasucEyW57wKjuKqVCOlP0LqN2NjgB0JifkxjDLAKNpk3Y_S7rYoCbMiURV2478PnMySoL7Ro67fCIG5S4X9Qzyu7pmCwUYBm1U0inZJuwR1MFAd4pMEYdPQzK8SX_N7lSnChLt5AzM8l4WLaS2B8YIY1cXRSNVn4hfFZ4o3IrLDbNQHktsSYO6QCnIiaakHTaxu7AVxjbbLRLm_vu-2PNgInvk-VGM7a2l7fDOnF5udg4y6T7Ra0JVgYT0hMedKSAtez7CMclC5DV7a-ajF-qiQDsh2aSdRhaI8L1V5hiz2CNtXJYuObsxg6-Axlyvl-1iUXpvC-H08eclRTrXyej82XMZSyKVQmhUMBiL5irl2Pj4olC6KyeXn10MMP8nwRCADZrBXV7PIM1lGtvQmY1BXL3nhEnGLgwOGdaALyL81wFQgnk0J-UduvwuUW6ZwVZqVLa8duApK__WYDuTwC-GyYemZOxQlAZh5gIhokodyDbv5icq-1hqaAG6Td2KD2UPHSsm-ZRrNnobrG7QjTT3KCKGBFmTNBQx9fzo8KGGNyyjJnBtO7v9724zClbMzuewlfHc5Up7rdbhBFRbO18_zsrC_eQn_Sv-QTTQXp5AGXmwROcr7ElYIGeZqlFS8IKUgHmw5eOCYJYgH26HydPB5edcGMK24qAkOAXPeVWO_bE3hJyrHmeApnr7ZDE2xtksuFjEgXUijKCrsnjwBaPu4Ml5ug89J8A8m-oniNzIw8hMMwTUR67ZuTHuLHqVw_vuE4bEZe5hUrJ26viIvASjXe9HvVsLDiWBMJ7sROq-pHXyUNDNb4jOcNSvPp_sKvxaMFYHXa0btxf77AgS9eaO4X9dvup7mnG5PDyZiCwYQ-6XST1fRjNxU5kecFTzoxLxPpninuHrmpBG0coIjnu3hGWOqQhY50Mxd-oZ3T5jq1-4-69QgtgCEAP4Itkq7bhCuj_Vnjnq6jyejMmlV6aWTJJ09GXx4xCveg66XcB4JnOmNgRcUo2I4h11Nl0gyitPB6VzIuqijTP0U2Vc_uke8MUc93v5iMAHo3ouf2QdZqYTsJ3lwk4If-X8KYnbkWOyijLuX5JRgQeP_knGPbN17IVdqhj7995GFqJubWBj2ovhXGDkXZT0sQ-g6fZkYR5qLdr5QZFezBt4uZSKvc4z1ShMEQ6f4P0SizqffGwkGZWj8LDG3Pln9rRsPhZU6G6ZLG6kVutK_kCTseM_D1k4fnh6D9ibi7lyBrQJ0V22mVCkLuVyw8gNeuSW4RGw4rUGToGpLcUpnTkD2e79OBIs8SmcCAmAhzDzQgX_F4wP5zLsPWEPv1sov-xd0VyWw5BXl5sF86LTQylCWQYvs1_4m0wQ3LRze1mIDdPhfEZB3WolL3elV2PCSgva_1am84WnVX1X_NBA37BZPmqEbL35VAYYEs9gyVFgAYl7EyGmLHQkIg_byP5N00MJnv6Pu4X84mpgRdZ_V0sMtKuCB6G0qnrNmhWTfb-SEjiYhHzTsj8fUmH-o88A8Con-PIdewTkHQkc6svu-yD2BPUSEaiqkc6-PLqPWbew7nwKSBQHTSkPeM8t2asfLFS2UjMqKOpbFAICbrNbJKhE4sqXOU_WTJVrhs1RmS8sWiSkRe40DWeEA_V2-7hIOXSbCDXziMfMvdCR_GVpoMWdonESrlI4jAnRDsD84u8DybilnZp837PKGGlLWiWlcKvDGPhjpIFXYObUn1dYQYv0rWIOiCc3kleh-s2IXnaEtbpt634KYG0N3XEb0hYaofGzDeiUU-Tb5P8mf4wVrE_ya7Pb_verEYzrghX6s6C7UVm75kI0S-TwZHaJEK4UBqmofqzdTJZtCqGSjqOoa_AIFtI-YtSAyZh-cV_dJSxxaN0eA5yDASIC0nKj1ZNKC2hldoKZESpjXzo5HGZFssaYqivah4gpywbQ9u6BGlNvO3j4J0Xqnh_ZE79I2cxk4zTtiKUvfVUkAl_yPL6IjWiJ9c0_Iu5nES0TuoMymbiTxe3xOWj49b1aBuVU1FtIqbI8CSFFHqZdpsVokhqtxsEqsc4Hu-wnv_rD_YLHYX7xunk6GHLA6sI7UyhQjKYq_u3-p2CADNDv4wBdUueLqTXe2L7ldJnQbiB3aqCFPAZ_AhJE1OnBYqhNByhVF3BMRNj_HzGpZoYd5lGjnf94dEq8Yyewbkf_dSwBFfSzSfbmbSXukDksa2DDvYG21LN4aJQGGWiptOedmlpRqkWHWwMAz5uGH_tI_t94LZgSXzobDvrs_FACKT606X7HIEO3B5rszsKTaQMeuIZFhb0wfdh3itsYSRgLwPf43VbG1HGhMfn5H_z1Ejc3ImeFyXsDAjP7nDHYzbZRimT9GY7aGTYmarSdUrAWBFHvX7aBOdgsSCiuJayGIQX2r5D2LdzUzV7iUJqCfiM49M-UHKdhfSrm2QfYY1vdY2R2-EOMVWRdRWavI6NoQP8OnZ02VOnR-GNkyCslua1bW45HvXJo4ETqsI&cid=CAASKORoYQAqXKudns1cy3_pbTxD2JN5_jmpRs6nHfYcAsrKsoY23h8ON5E&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:43:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 822
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:43:27 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/ Frame A047 30 KB
11 KB 193ms
193ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

f03f34a896200ac3d36794a86a5b23d054f1982d05740b454078c8526a33b631

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:47:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 587
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11727
x-xss-protection: 0
server: cafe
etag: 4188671789125589074
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:47:22 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 267E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1

43 B
847 B

451ms
345ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARiijIXRATAB&v=APEucNXAw5Uv9fXkH6Sbl414FzmDLUWFpe6URRBLFvr3-6XxlytM0tvCSKa-gYJOwEs2cOKnThOLOuJOCT154zQLtk8iJyH6Vw
Protocol: H3
Server: 104.18.19.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UZx%2FJSdAkeASLHKfL%2BjSff1cDrwnuxuctLSKhTTfoeR86iMOpj9yWL0G71U%2B9cvwo%2Flxm%2FIU0fMb2teWX58PiYPNDKl5kITiQlzIjaRUmVEC1fo9lx%2FDSUuFVDJkPvOZSekZsqPY5IXnDw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 754268a5bca0a93b-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eq45jNZHGe%2BcJYgA8bv0yk94rjEnyxtdIL2Pau3vkh5K8ss8jd4tfIK9kDEGdkHeqafH9sVwrCUtq7wGaugu2wh17XhfVDsxuApv%2B0sV9t7s4rX8PxPxngQKjWG5dpRcuJb3rZHTbiucyg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1
cache-control: no-cache
cf-ray: 754268a39e8caac4-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 267E
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YzpPhacHtwARAFazCVifyQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1

43 B
842 B

221ms
221ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARiijIXRATAB&v=APEucNXAw5Uv9fXkH6Sbl414FzmDLUWFpe6URRBLFvr3-6XxlytM0tvCSKa-gYJOwEs2cOKnThOLOuJOCT154zQLtk8iJyH6Vw
Protocol: H3
Server: 104.18.19.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iV%2FslYN0MFJosis6dL6rmFrsnLLvQDc4KCU6vKlZpdgcnfg8rIINmoG2LRJQdAhm1fhwCkTGPWSxrLtWqNzSrtbXm3VeGnefsRn5By7W%2F1pA%2FIvxsGnS9E%2Bfdd54mAmTK5pR53XXZ9YD7g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 754268a918fca93b-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 267E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFjMZI6JWtvUK4QgSVPEQ2g&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFjMZI6JWtvUK4QgSVPEQ2g%26google_cver%3D1

43 B
1 KB

497ms
241ms

Image
image/gif

104.254.150.228
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFjMZI6JWtvUK4QgSVPEQ2g%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARiijIXRATAB&v=APEucNXAw5Uv9fXkH6Sbl414FzmDLUWFpe6URRBLFvr3-6XxlytM0tvCSKa-gYJOwEs2cOKnThOLOuJOCT154zQLtk8iJyH6Vw

Protocol

HTTP/1.1

Server

104.254.150.228 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: 444c4de2-0144-4362-a50f-045ed3dacecd
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: 0fc92321-f678-4fb2-882e-04594fe12eba
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFjMZI6JWtvUK4QgSVPEQ2g%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 267E
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjgxODIyNTMwODMwNzY4OTA4Mg%3D%3D

170 B
188 B

198ms
198ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjgxODIyNTMwODMwNzY4OTA4Mg%3D%3D

Requested by

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: 42ec003e-84c1-43d9-9f4a-d35532b4f338
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjgxODIyNTMwODMwNzY4OTA4Mg%3D%3D
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame F91F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1

43 B
838 B

276ms
243ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sYvrqy0gEwAQ&v=APEucNUTUzMHDvS1X1_wkKPBlSEvznY-a2tgebatKOoGp9eReX38XrpQAyQJYenf6R8gMcMIAN5N0JKBtg2Dvh1TnKTt4wnJ0Q
Protocol: H3
Server: 104.18.19.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fwEGeQ4DHTDH1b7TYxceuaF4O4ngQ8gVokAClV03qzbWiSzrTXNg6XHFJ%2FGl5FeSn0mvrjaKnukfm4ek3SdgU7Xl68LT0PB75MpeFjQ8YN1743n82x91DIRZF2P7qQ%2BN2tHeC2yb532lqg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 754268a5bca4a93b-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3J5am5bOtXxejaNNvZnIWLYscRxoFPZD6RHLjzRQYycXzCiFF2MPr7cTJUs5DEi0iZuMYnOk%2F4soNHboRFlYhj6SZDg4Bn%2FqgCQiapeFtHYau%2FIwOUkq6fc4ZglE6hE8JStgHgLoi4boWA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1
cache-control: no-cache
cf-ray: 754268a43f9baac4-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame F91F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YzpPhacHtwARAFazCVifyQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1

43 B
849 B

348ms
348ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sYvrqy0gEwAQ&v=APEucNUTUzMHDvS1X1_wkKPBlSEvznY-a2tgebatKOoGp9eReX38XrpQAyQJYenf6R8gMcMIAN5N0JKBtg2Dvh1TnKTt4wnJ0Q
Protocol: H3
Server: 104.18.19.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fqw3GrzTlyJ4%2BaCGMG7WY66XxCG5MqsrHrw79dz04H7V0nb5x8W9YrddZBSugZwFD1Rm57V%2B0FXsHTlMIYOOcAox7AKKLdj%2BapYbIPGBHN%2F1sdgsoK6uu%2BW%2FYFDJykKVqywOezJtPC4jBA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 754268a918fda93b-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame F91F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEI6qopysGvGGccnz0w3fvy4&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1

43 B
1 KB

491ms
241ms

Image
image/gif

104.254.150.228
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sYvrqy0gEwAQ&v=APEucNUTUzMHDvS1X1_wkKPBlSEvznY-a2tgebatKOoGp9eReX38XrpQAyQJYenf6R8gMcMIAN5N0JKBtg2Dvh1TnKTt4wnJ0Q

Protocol

HTTP/1.1

Server

104.254.150.228 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: ebe3e195-5979-4cb5-9059-afa5788085d1
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: 5822a7e3-a45e-462f-94bf-c291a95ce24f
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F91F
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzY1MzI5MjcxNTQyMTM3MzMyNA%3D%3D

170 B
188 B

198ms
197ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzY1MzI5MjcxNTQyMTM3MzMyNA%3D%3D

Requested by

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: 29ddaa12-1f51-45d6-80d5-4697109275da
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzY1MzI5MjcxNTQyMTM3MzMyNA%3D%3D
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame E240
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1

43 B
841 B

333ms
245ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sYvrqy0gEwAQ&v=APEucNWxjazYEZUxYIJJePJJcPFYtbDXreTPO-2n5UzMan42KLt3cAROdGIPX6Qox1ANLMhhtiWJXTe2OS7nU5a8_QGV58rrLg
Protocol: H3
Server: 104.18.19.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Acaz4G21XIaESU2spYjkCxmCAYvty7Zl3soiyev6nmoNuzE%2BauWBqB2mII6DL%2BfnSUdez5ntxpYCPR%2FV1W3hHFgLjAXQb09tHZj8tXAg6E90jEGXb1elPTE1Z4fzmFR0FIHPcp1pWJXyHw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 754268a5bcafa93b-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uD8VAp25PzN70ZhwTKnxPmdAcLcuMqeydRmPSmBTKdGdSXHO7QpkyPB%2BNjCQycnxprjLzZaXx9pZCdGd%2Fu1aCn93tS%2BAi7LmuiQUlagIXKLM1J7Ex6t4W3Zq6VwQCN4Mfk5EsvILsWLaRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1
cache-control: no-cache
cf-ray: 754268a3df03aac4-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame E240
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YzpPhacHtwARAFazCVifyQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1

43 B
843 B

460ms
460ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sYvrqy0gEwAQ&v=APEucNWxjazYEZUxYIJJePJJcPFYtbDXreTPO-2n5UzMan42KLt3cAROdGIPX6Qox1ANLMhhtiWJXTe2OS7nU5a8_QGV58rrLg
Protocol: H3
Server: 104.18.19.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LxqPjLF5qqHQoj75RKLi3V%2B4yutiSdWHmG4ZOGwLdfzFJInqcOosx3hGnJhrOy%2FXyCjPZ2UTpK2mtXrNq4Et56cn3jAsZVgchGTKlhrKx%2BrovZ14zw1G1l%2BdHF4jf2oBdjG0PoW286YlBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 754268a87855a93b-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame E240
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEI6qopysGvGGccnz0w3fvy4&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1

43 B
1 KB

483ms
241ms

Image
image/gif

104.254.150.228
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sYvrqy0gEwAQ&v=APEucNWxjazYEZUxYIJJePJJcPFYtbDXreTPO-2n5UzMan42KLt3cAROdGIPX6Qox1ANLMhhtiWJXTe2OS7nU5a8_QGV58rrLg

Protocol

HTTP/1.1

Server

104.254.150.228 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: 077fb2fa-1a2a-4331-91f5-8d249919fab8
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: 049792bb-bb7c-46fd-988e-352a7486e7b6
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E240
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDUzNjIyNjU0ODM1MTYwNzU3Nw%3D%3D

170 B
188 B

197ms
197ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDUzNjIyNjU0ODM1MTYwNzU3Nw%3D%3D

Requested by

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: 3cb30cc9-5047-4ee4-a8e9-46870c30dce1
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDUzNjIyNjU0ODM1MTYwNzU3Nw%3D%3D
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 89ED
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1

43 B
848 B

344ms
327ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sY2-fd0wEwAQ&v=APEucNWET0IDM519V3i_LXUQNX5EWf2QeGo1dNOgbdyaNExuT7MiWhhAAcBKsKhxNgvwLwgKIp9oSxv2ydowghf3HXW9a6JVPw
Protocol: H3
Server: 104.18.19.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tKDvNQN5OlwuK68mOgA%2B2B3wDATeAiEv%2BzeCxdaQQQqbn7i2A4q0H7LLxYOPY3CZCsgZdM51oImu93RFR2IV%2F9HGhc3uwXUmq7I%2BbMrfINP1VoPLJM%2FqRRqgilPvfL%2FgPpmKr0LTlONDRg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 754268a5bcada93b-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eJcy6PdIxCs1v7DayTV%2B%2BJv9gdGLks1IYChjT5YiXeU968ltjyqcEhjBKXYUhw1dR9gXx7Mu9s8Ezbr58HEmY3PwC5GtjarCg1jj%2FU0wLIlwBv2y6rbbkk5RufsHx0IWwsvJLnvucdKgWw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1
cache-control: no-cache
cf-ray: 754268a43f9caac4-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 89ED
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YzpPhacHtwARAFazCVifyQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1

43 B
842 B

322ms
321ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sY2-fd0wEwAQ&v=APEucNWET0IDM519V3i_LXUQNX5EWf2QeGo1dNOgbdyaNExuT7MiWhhAAcBKsKhxNgvwLwgKIp9oSxv2ydowghf3HXW9a6JVPw
Protocol: H3
Server: 104.18.19.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FI6hhB0Xb3rMezYZuK1wcLM6bK5IcW5oOwxcu40KvrpRNAuDpSRi67fEk9TueX%2FJ%2BWT7Qxgu7MStQyTsLeKFmoaGLPK5XODec79VMKtvMGkZwFN9ALtCNYdb96dzEJ1m%2BNuMCX9yP09jiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 754268a908e0a93b-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 89ED
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEI6qopysGvGGccnz0w3fvy4&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1

43 B
1 KB

493ms
243ms

Image
image/gif

104.254.150.228
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sY2-fd0wEwAQ&v=APEucNWET0IDM519V3i_LXUQNX5EWf2QeGo1dNOgbdyaNExuT7MiWhhAAcBKsKhxNgvwLwgKIp9oSxv2ydowghf3HXW9a6JVPw

Protocol

HTTP/1.1

Server

104.254.150.228 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: 5b051575-3632-4bb9-8854-8d6ed29e1702
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: 291a9d0f-3f75-4e43-b249-7606f577bf1f
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 89ED
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk0MTg2MTUxMTc2Njg3ODkzMw%3D%3D

170 B
188 B

199ms
198ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk0MTg2MTUxMTc2Njg3ODkzMw%3D%3D

Requested by

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: b108742d-34ac-448b-822a-4b1bd53aa511
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk0MTg2MTUxMTc2Njg3ODkzMw%3D%3D
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 5F16
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1

43 B
837 B

316ms
312ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sY5PHd0wEwAQ&v=APEucNW3MkI34zrLXIGZ5SxWErJg1XbEtDLhKzgcFW_7-arFagrm3pR_WV8OBTzSKR1gYBEgx24pUQGtRU7ziCi98u7LFMcYCQ
Protocol: H3
Server: 104.18.19.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZuQ7avWojHnb6E6lMhNDJgPoWQueQ5M6n2SK24v7rRpK2SlR7eZD3YJIH6e5ritlahMOajsREKCCGGoWrxwsiluv75UcTHB3VsLBdGzNiyq1V8k89MDka6U6LG4O7OGSj5kL2G5HFO8CbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 754268a5dcbaa93b-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4spt23e%2BsNbalEpI%2FJ940OGA1aKilaKlmQnbiFw72XQrmW4UAyt5LWVwyiWN0GdAPzvPnjxSeCT%2FWHeolih7ot4h8qdTeHlR2OF6bSxEWUmKV7vTeBm%2FmvtNnh11Sk6QALHSbrWxd0ojVg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1
cache-control: no-cache
cf-ray: 754268a43f9daac4-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 5F16
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YzpPhacHtwARAFazCVifyQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1

43 B
842 B

334ms
334ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sY5PHd0wEwAQ&v=APEucNW3MkI34zrLXIGZ5SxWErJg1XbEtDLhKzgcFW_7-arFagrm3pR_WV8OBTzSKR1gYBEgx24pUQGtRU7ziCi98u7LFMcYCQ
Protocol: H3
Server: 104.18.19.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BT6LgfmX35vFLgQ6wlHMSd4t90IjxImm1fs4uuUKegPFGloLyh6nWJa1o%2B1mcuRFyC62j0Bf%2B47iJFZJX%2Fm4ooKjsYYrJxBiuCb5hQUAJerz47ttOFHDtgrIDf68ZlziGJfUxQk2ATK5ng%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 754268a95939a93b-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 5F16
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEI6qopysGvGGccnz0w3fvy4&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1

43 B
1 KB

515ms
267ms

Image
image/gif

104.254.150.228
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKyHPxCei3sY5PHd0wEwAQ&v=APEucNW3MkI34zrLXIGZ5SxWErJg1XbEtDLhKzgcFW_7-arFagrm3pR_WV8OBTzSKR1gYBEgx24pUQGtRU7ziCi98u7LFMcYCQ

Protocol

HTTP/1.1

Server

104.254.150.228 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: f16d3dac-8077-4282-b40d-5b707ab45615
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: b05bb1fc-39c6-46f8-9030-1efab073ad1f
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5F16
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk1NjI2MDU0MDczMjU1MTE1OQ%3D%3D

170 B
188 B

199ms
198ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk1NjI2MDU0MDczMjU1MTE1OQ%3D%3D

Requested by

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: c3620d01-dfc8-4368-a1e0-02a9a0a852e3
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk1NjI2MDU0MDczMjU1MTE1OQ%3D%3D
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame AB19
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1

43 B
844 B

267ms
244ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARiA-ITRATAB&v=APEucNXOZqQRWmFQrH35ltv-HhYbPoR8-lCW-_Rba8gi1Bmx5GhhLBSx7zq5LAfeWn1cG9-W_VxX4B-14Oc-k7ioUNaKWCqt5g
Protocol: H3
Server: 104.18.19.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J5szgbjorwGOyoVMp9PfSVrlxttkW41yunEhzl8zzGygNzCBWsrqR4ttgcNh%2BOr%2FfpNIHOfwlsl%2B16zjGPOKxiBYYLizy6jQPnHMgbDzTx54rrX1TbJU%2FaBWasfAe74YGqFaKOBYlDr9KQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 754268a5bca5a93b-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FD7Ry2CHBaXHatmzq7ivi2m0m32t8e18qTEAzr58LAheUI4TW2f9FhLZxKqmFFQnsAwgzB5ndQIVczjpZLywM4KN7LKxVJooP8kTY2WIypNbyneqysxHBENHzBnRvJ%2B%2FU0RcHdiDND8Lzg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEJPyuG9mQ68lVrTmEZ5WYQ8&google_cver=1&C=1
cache-control: no-cache
cf-ray: 754268a43f9eaac4-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame AB19
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YzpPhR7LVpAdryH5ww5bLQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1

43 B
839 B

223ms
221ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARiA-ITRATAB&v=APEucNXOZqQRWmFQrH35ltv-HhYbPoR8-lCW-_Rba8gi1Bmx5GhhLBSx7zq5LAfeWn1cG9-W_VxX4B-14Oc-k7ioUNaKWCqt5g
Protocol: H3
Server: 104.18.19.126 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oyO0ujEoYS83qtnciK5SEEL94nGtRlvwlhrYQ2oRNdNjEufQ5KWsExcnx8Usnlh0cSEZHy31ZXh0h3%2Bid5mBKow3eCHGuuj2e8yMlTFbZWuSgo6fzReFgtzDVRZ6B%2FgNFfEbN6UQ2PzVcw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 754268a8c8a3a93b-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEID34mk7FMEJJSXt7WgL_80&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame AB19
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEI6qopysGvGGccnz0w3fvy4&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1

43 B
1 KB

508ms
244ms

Image
image/gif

104.254.150.228
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARiA-ITRATAB&v=APEucNXOZqQRWmFQrH35ltv-HhYbPoR8-lCW-_Rba8gi1Bmx5GhhLBSx7zq5LAfeWn1cG9-W_VxX4B-14Oc-k7ioUNaKWCqt5g

Protocol

HTTP/1.1

Server

104.254.150.228 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: abd0b7dc-730b-47d4-9786-50794528c6a4
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: 3aa26c4b-df69-4dc7-b3c7-ff10852ddd1c
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEI6qopysGvGGccnz0w3fvy4%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AB19
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk0MTg2MTUxMTc2Njg3ODkzMw%3D%3D

170 B
188 B

197ms
197ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk0MTg2MTUxMTc2Njg3ODkzMw%3D%3D

Requested by

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: 7b83ed77-690c-402d-8dfc-1d9d46a46a64
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk0MTg2MTUxMTc2Njg3ODkzMw%3D%3D
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 907.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/ Frame 4804 30 KB
11 KB 193ms
193ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DVL5HhntpYXkI91shH0eofIjBeq-JC5d4h7VvpJ8j9SW9RS9l2BwdxN5qTurSP5GfnMTEGixsJKKoEYuaRqOmZuTdf9X7Ht2O6bTMTGQW4QlcjeJrJOpcn3pVijNsd5-fjRUvYBjvMtOO62W_E89KLLvU_9MiCIkxGYoAB9ZcPhdv1WpI&cry=1&dbm_d=AKAmf-CKcZ4b-Ic0oFKmtN-S5A5vvaqmCPgRGS4nDAmrzQBhNP8_7ezMLkK9y1o6q6H5T6fjPUAWx22Z_i4QHgGVJE5QwUm5Vsq3uuysZji0lnABdHEvSRgqL7erw82nqQ_WcDd3_L4SjLeZSAYqOnQKMIyCLxZx-mXUSLFgXSUbfNu5a6xTK7hDBbfSoaZCfl_gK7yRM8Ezt8iD7IZNAhBpUXYqdh9IqtjBdqFPemXR2p9oYBMoTlGzTNdnqiRHoftmcWPrDWLOYQSxedBxei5ul3WxUGpKA47cYoA8oNarsGDBLaGSPejqBd6q54yAix-10UZzCMSUKOLrSJL--Mb_6uXES9HscNeuByrkrdAPNiYgiZV-DalMqtnUS6fnGqEN29wsDfme68gDE7Ds6hXmMwznCtmMc-5d9Z2-YxD0Uc0TY1VyO435MJVOBS5akA3pKCKAzCP5d2G-JcQLyAgvtYkB-56-IvsePu_c7ff0yWurvd7dToK1DUWUyPFUAyr3Q7VuESckt11OqTYycIt016NoxvDu4V3ddgvKqc9JXvnSrcy0eoJ3ja-69pLew9TYdSKmcto4ahqlsOfRpfIvIQFbVz-PHjK4CfXxg0LPC3mLhIsk7Mm9xjz-HOT_6azCAqZHvCet-ikXTbrp4oInoDo3iouq2-6k0LfEgdI76yFhI9fQ9GiWL2UFbL09El4u3ASo6eDEgxyPYxOZacotifLhLr1A3HLxrazUhpgNWOCPqVkWFRhC_GCNWMY4kKHNVmx8KZr0ASuwFAukRLcm0ZU9MuAVT5Z0ogggtloElqMjFZZ_E5fOU9efzBHAxrwI2yRIoswnnE3ZouxWoDZAtXmeBbwPp-gHA-rNBPItCp_2Yz3m1joPv34H9btwcSSqfmx2qm_asNVMWJwXVD-45E1yxspL7PWRy7CVpAHBF2-SYdvUPWwSpr6MGKzOk4Zba8bQQ2BwzC3Pf6tyTCKe7Vuag87FmG2d5L_bbmuV2ShmTT0poDfk-T_NJhKGLFtCty2MYVQpBEM3QMsUfITB1viF7Xo6CqArqCBNBLPlibIUMVKwg8FrzoVn-HPPgvaaWM4QkyavmDQa4yqXY2bGsnav-SK8uD2HIQaR2RtHPgjnV7F9d8FoSE3m1Og2n66DKO-ZJmSSVlGYRn7Pp7DV0gImi98KbiLggtTIxwD0eA4PTBPBZKC0vwUZvvOFFPzoQAHR_yAbalSktn-d5VT7PbNjm2XYA2CPLosJo18pm7UXAteVq-KDZWfrbGhQkxt8XX1rGJYX-rbc7BDMl3ipO2SbmThiQEWUkVnf4piFON8Ew3CkWw_dJiS7IUv97m3fTEblyhUbrNa8on3z6KxC1F2O8Y5UDNyLeBiZF7t5bn9Gy91jXZ1uwF30T_irp8H735q8jtV_sOesu9KW8TrzOj_soSQhoT6P8cZ19O9QEEbdZtq7-1wYGNp19TB3dTCJtIQiyezDcQB4M_Q-j4n0r2BEAZMcSlZ2MFzGVAr173C_na8bIOaPLgiNyIILL_CK2zJjmFr39nbWORtWIubGEV4e6gblg_KcdQ5uivTF2oBYD6Cym_-3S-fUuHWu2cee9nlLZDyHhU5jt5KRx92KyORinF3dL4OWO8m4DR0dRpxkpcBJev8S2pM_uIhcPWEL9Jsa72ZT8tPPfkvG2Q2JtOvRPdt2pPhedFRSKt_IZFi6RB0B0N3ViQaX_GLZmbu_aoKA9lnQdqVk2a6V-_FSYdy6-LEi0ffEASpbesajxV_8X2xN1_cR8xVdf5fYcPyM-uGKRZVY4wAW2bdquZFFBRiizdzYZj0-l-hqaQs90wACxuLeFFtbyJZEIGHfShZwvW_GlBJKeQhlfSQ8xJWGO_Ch2HZI-02ZyzT-4s2OwWoJFTSLjWOeAE4mEWD-8f9ObwXn7OaBXBKCxIWD65HeHxL4DW_d8LzvbKVmTAn7F3p3gjo-xA9qV1qm82vOo0fIU9VgoQyazF9nCl9qgZqdiWCbwayuZt2fVNWXjQL7-9gfdLHBgRLlYRuVOZf9c4Dp0VM7dDEV16X9m-xeOmncZ6-2GvWTdobxCLfLLtVJ0NekD6Be8jIVMeT6Hb-hVLG-Jlar3xIHVgHtAKs5fqx-gWiJ0X2GlR2WceHbtfvBW8jXl_Tn2wavFls7uTXE8gsfSlmlayNSKh7EHmS61dA3K7MCr9uLVgwgUtu6Jk_yVD9FxDDs44PKEw5Qhz29YDtuwir93LzXIcPb0WooG9GTweCaUkrG0gKyBDyN46hMX0kjxyXivgDW5yx1IST2xO1Fvhb3ERKBcrqeb5d8UGWRTRC-4xOyn3Mr7NApr5gFQfVkWZrrOSXc68_OBJ1zAhooxeriWR45ZN7WT25tE2ukk-9IHkf1FHLhRzyOYXUn09IbY-rrSvCsRk-PUBaqOV6sLKgCqYEEKX3gVJSdsFXg3FlEHx5i1w_TE6emYMDspAFVJ0eUkrUfCaUwnJ0nclIzlKbu3LI5G-BVSohHoBqbzmjr2xh-cGNS5AyL2IBQ4ivS0jVBXiV7U4RYlInHUrzlN1gVudLtnEVMnA7EZlfcAm-5jfL26NBMGtIIzgqbmjXl106quxgZDHuJyqJLwruvmPhdSQIb8iavoINPD-kHeyPGNAR0TxBhO0udKA-pv9s2-nfGVUbbNjjapZy1IZ21JKljSiAJiuSItj-2mfXiUELa4x2QWpXuNQtBDKiMFs5FhkRgXqFVW81B2XiSR8LG1etj5rvEXN4xlXfAmBxLLmj2cxIvzvnHakQu5MXoHfivGzy9uy9PCPIU0Y6YgRjnsXJS7uGdX0aJzdbJjx899hnQD2R9UOC46LlPLHddUAwysPuKscnL5t-Qpa3S4CRLknlbgtJMiDFLYMkZnzFegAYjDVRodu3BcuGB4rYqN0YR_MTotTjs3qCpj5Z95_oRFx8uPlB_x6FX5ki7qFuMYv4wK-Zv62pacJqZQczxXiA-dhNB8z7VjaOtI0sauZ7VpT-Rki7DgUG0g-4VYu71Rjv3niOG1viigDxSroYhvGZZLkzTbQz0Ov4Qraplv-34dNeQRG-aVARMnqHEBRwLCU_Q51TF-4YOoOAZRJqDeS9s9OJMsIfBLxa28ODHm7dZlh_p9pk6IzBoqXVsuo__znZ-0Aewy5l5jXXltK085C5eo_TL4atUN5E0t6YE8_ctMDivgKIcifRTsLMKdyjwm6trRnfrBf_UynVpWqT_uZk3KYAZaTCcv3HSwrk_4z4kOkQaNTvI_w5446O5DcRHI64vxq9RnSl6MkzChjWKqYrYE_t07ScDXcKuX-De7u0jSZ4-DAoglSCmihU1gegmv3b15hCkg1aDX5l9KWLaij9uCSruGHfxRpDPH7-712_FuCqD_jPHnUHJjQDg1deF9o2svKpwxS8X6qqAYwrFmtCFJsRoPwwEL-65khOmxSR_T5PT2J86gPUtOuQf7hmz03AZIdoi1SgZnbtTVmHhQoVqT5qZIiuX1RtZwfGSoAOVEl4QYwdGj5sRuZunjoRRS1rX6S7CJgML9w8mq50NwZE-uKRm7cs&cid=CAASKORo3FLLUcGD_SdpTu2_MmKp61LNzdX6cylLm3OUIxM31sTrDwP3fXk&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

f03f34a896200ac3d36794a86a5b23d054f1982d05740b454078c8526a33b631

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:47:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 587
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11727
x-xss-protection: 0
server: cafe
etag: 4188671789125589074
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:47:22 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4804 41 KB
15 KB 193ms
193ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 12:36:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138017
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 01 Oct 2023 12:36:52 GMT

GET
H/1.1 200
OK dvbs_src_internal109.js Show response
cdn.doubleverify.com/ Frame A477 59 KB
19 KB 321ms
321ms Script
application/javascript 23.36.254.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal109.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=189094&plc=6695892&sid=18330&dvregion=0&unit=160x600&autt=1&ppid=103&aufilter1=3060631&prr=1&auevent=ABAjH0iAtTr8YdRARxYFyVllg2yQ&c1=3060631&auorder=1008962086&aulitem=18156675739&aucrtv=438388258&auxch=1&pltfrm=1&ausite=201491245482&turl=https://pastelink.net/53fgu29a&aubndl=&audeal=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.254.7 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-254-7.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: e9881b639c7528a358803222a3d5b1ea1fae69ede0ad9ee2e363be38a2712302

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:09 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Aug 2022 13:20:14 GMT
Server: Microsoft-IIS/10.0
ETag: "03bb312aabbd81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19455

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 234ms
234ms Image
text/html 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022092701&jk=3253086112556029&bg=!dHeldzPNAAYQgTJdMIE7ACkAdvg8WvsOa2-owHjwxRNkq3n5yq5Ojf4xyBOjyUmWyvUToK4ZChPMegIAAABeUgAAAAJoAQcKADc31lGYon9zPqtE5jFs1ehmkCrPmoHPjcVECrp66i4P2Wr6xRUpDkrRm5DtAi0bPxHfnZERZOnJmQKrgb87DO_zWpom_3pii_xtA2UMUjP-mDoPjyxfrpSVhvBl3L7WLCz2det3iaQyE35P5ZQVyFav1Kpy6i-pX-nc9R7xOu0838ymkfEAgFjLRjxXizOHGP1sHPQzvOOzdqqig5hSxRfhC_BGaeIuhnYdctxYrDTIXCIh2pVk60f8_JBtwjuf8hS1pueeuCC2psUL6R1r04376ei8s9H2AQe9a5r2ND76891x0x-ScgbyjOSFB2enLKlrsJn_ssXFxQ1W3e6PeZUoFy2uwwgF4BHYTiVSzVhxqP4xAkmVdvE44p6pPS2gocYJocPm8PxJQFY4TV17OvihpbP2hYKz97UdI2Hpz4IjSFzDDJC5Bz58F4t53gcwIALtRZ0OTbM8yFnx9pDYELnUzvAhl4lt0H211w797H3sabuG_KfcIYO6mEi1c9yXPXNOjXrmq0xc-OCV0iIH3He9hVBt8KHVbrFvDKEGXgK5FUl3o_ysd6IOGydIF2aVl1EqZgcP3lFG1Z8BZf9aCmPkCMJ6nWXV7_eel4mE4Hv5KKzpaiOqVabj57D1jDPMiEeDDuzke7ADOYdzu8uVV2l5tpvfwUdKAAAc21pNlRMXFSDVvTmsHxkthCmcRpx_Sf21cMKIMrsiOUMTjD3aXwRB3MDwWLWihNYVgR4fG9EvcCQOFHwlTqaFgf26VxkFYu-Q3V3QgmDCJ-czRIlKETUN2pBjD0Yn86-cJaEcUZvRTr5r9J8r_NiYL4yjqry_YXtLn1wWp6w-4hEsU7S5DJaJ8WRO0E3SaF52cCnNRV83yONGamTUojTtDmJgobg9h0-Xp9ftHWDHFCoKDatC3umR_H6DelbnpNJ6nr9UBch-xakZ5nhYGx-Wdf4Su5Jq5CD1PH83JHyoRVPl7Do90TNnxpfJS1M
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.24.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame C619 43 B
479 B 313ms
313ms Image
image/gif 52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=69c9c753-c788-4f36-ba89-92bc94fd1a13

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:09 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 7NBPS12NNXR32K14F08P
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame C619
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=a7820e1a-7af3-4c11-ba6f-97b933883918&gdpr=0&gdpr_consent=

68 B
279 B

199ms
198ms

Image
image/png

52.220.40.119
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=a7820e1a-7af3-4c11-ba6f-97b933883918&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 52.220.40.119 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-220-40-119.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:10 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=a7820e1a-7af3-4c11-ba6f-97b933883918&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H2

200

v1
match.sharethrough.com/sync/ Frame C619
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=a7820e1a-7af3-4c11-ba6f-97b933883918&gdpr=0&gdpr_consent=

68 B
279 B

197ms
196ms

Image
image/png

52.220.40.119
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=a7820e1a-7af3-4c11-ba6f-97b933883918&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 52.220.40.119 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-220-40-119.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:10 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=a7820e1a-7af3-4c11-ba6f-97b933883918&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H2

200

v1
match.sharethrough.com/sync/ Frame C619
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3
https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=$UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D0e8893f90b606c9c5d33f1be%26gdpr%3D0%26gdpr_consent%3D%26source_user_id%3D%24UID
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=7969831712906881363

68 B
279 B

197ms
197ms

Image
image/png

52.220.40.119
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=7969831712906881363
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 52.220.40.119 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-220-40-119.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:11 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
AN-X-Request-Uuid: 1bc8a3b1-55d0-4a85-aa4a-74e7274e25ea
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=7969831712906881363
Connection: keep-alive
X-Proxy-Origin: 173.245.209.46; 173.245.209.46; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET

v1
match.sharethrough.com/sync/ Frame C619
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4
https://image8.pubmatic.com/AdServer/ImgSync?p=156557&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156557%26pr%3Dhttps%253A%252F%252Fmatch.sharethrough.com%252F...
https://image8.pubmatic.com/AdServer/ImgSync?p=156557&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156557%26pr%3Dhttps%253A%252F%252Fmatch.sharethrough.com%252F...
https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6543021577934406525&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=fTYnwn9jLJtmNHfGfGM5wXk2cZRmNyeXfjzigpVo
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3DB5D3048E-F57D-4798-BCC1-50AFE1835279
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=B5D3048E-F57D-4798-BCC1-50AFE1835279

0
0

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 40C2 106 KB
37 KB 769ms
553ms Script
text/javascript 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Origin: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 09:06:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64217
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Oct 2022 09:06:52 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/elements/html/ Frame 40C2 8 KB
3 KB 193ms
193ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BksKfDi68Wlx9w1nKqd230d4XK1zfe5kdfho1bnOwyGw7u4BRTjCH5bPEi9WjSa2AO4fvMbftsv5TRfWa8Lk5cFY4QKsUCLj4X_A4Of6G0PuJBO6SVre1bJGVBkjaJx_IMiAft4jqSBEeg9JQFrv6YISIro0B5ZDfRgFFFhed_8ybiB0g&cry=1&dbm_d=AKAmf-DBhExiI5wKwxh6e5sUEmx_IyNjxCVgL2myjmHuXKM_4m082Kw_4fbKyteAdO9x5ynsUVMOnaX6wYbi2-Z9HmSSqOSt_Bl1nNBIbS50pUJbAJA8fwY5WQQutQcao4i4FYMvjSmSrBJjwR2uKZLvqjwmVCzU5YJmeyE33kTP1xUWmpG6_i7XkxIDjTnnVlkmjTuo5hFuoabjZOVymKqQQVC9S4GcpxKB-FPQxVHoQT-TcBnYwsaNbaBBHPj9XnszPiUhRiD_04BuvXtRcQ9qZjc9Hvnm8pemFpPxUHKcsYpCccPbGzMgm7agpRp3KjS499dP2XO2nsE-JSmTCyKCgfCbo_LMaTrio-VR05XCkpQ1hi47vcuXgXPquKyYYQh6HzdEyKGDffkyesivgzyUVila-HMk4PYbWBUDyXmbCOIZIFYp6GqpWwnqdAELllQJE006ZyMSReh4U6CU29D78MUx6xa46r7KOfHFvbaje1YamKf3L8KDm-vVe3pu7BK0xxJcIB5J7N18B9yJdNpZWBoVvSoj4bGvDp6kLL4SHfahOnqFHCGPJp4isPdkoQy1BbKlbuI7FGqerZzDUR09wPbil_COfi7UxZtpzr0kX1vIxm_SeW7HrPntR2wcDphk6IjbaaidqxmPrNwCH5qyQS46Z4L3dWmlkBDFQbBjcCrFUPIxI4TSrIzS8FhHOl8h0anfw3_DsCbToJ1Fg2z5B00fwyCP2Q-fl5QkbIKWbbBtHYbMqclGlnsS2IVPd7D59ONBQ1RsJmZrY5VdTe1xSSI6Hp-JR9WgBvi8z8zP128KluEgBbKUeiOthHX77jhQassf1uy0I2EwEzVNR-1f05gjAENFJYxCbM_DdRskfRXrg_HXMLVPGhvZDhlzSUyVIM_X2Z9p8yxL_ZQkao4gM9uZoEHcWBuV5MB0cGW-kFnt0evAiHmq2bOFJb5hitmlJPpdaVy9tljT78Gsmk9ZFwz-PLfr3qa4vz2F_gjKkl6EDS6QKIiX2DFmnC8nhSoxPXyIRRgH4K-nyskp7ef0a2e88iJ--VfJO5-JM-karYwJDIjL34IvL6LLEsmKUwUXOPGw_U528C4k_3r20b-GEMbHVlq-92XW6iemaGk8HOYn_SfZE55QXRZsV70WMpmqsSf1HLGriaYw2jFqT-_tliSn-sQXZ3qCTeXHPEQoweUB5YhUx3lUuOCPIvM3xoP-_DECWEfHPvQSlF4jxG7fL_X-n4h1BDvURFv2iVCS_isbXEv91hbRTZ6c_v5rW93W88xJ_2LV5Mp9sa-d8imZhpYEak7JOuOtHkKvjtn2WCS9quqeBSm4ncapiWAlZhTAlj5ts6-kP4hrG4qqjKAblI2cb96sMTzweI2m8Dvxu7He49PpVQfXjKKFoTd7HzXcbpIHABfz_2K2bvfSkrbHUkFqbxPGOd-wEnSKe5nzCx1p9FF9sUJxzijuvUtYbT6DL3kx4uzRV6RJFP515rc-vWsnqZP-QqlWYvlJOIT9Cwdw4RTIxE_ielRjQvz1ATPI0PmB0RAjJCVX_UpkAV-iGFcBBcoNSBUKms63-KQOhfstH1cUzpr3rwPsuB0sRAKd-efbd3ZrMrn_g-ksHXxYXKAc7TX_LCoF6CdvZlAyMHCkzWhyiHRJtmbtk6Q6yaVy947VXipbIfVXa80nxNUTcCVXEQRE6FdfuNGm6YC97ooI5M06Oto0PrL-lfagtFAIIh-M2LX09LpY2zprylWaDSvJJZIxEz06F154p8yExlkQLR-NWIvXGXCBcWc6aX6HHXoDmw4sr_mNIPHWOms8Ly0WuwA9voL85BSMAoTBvfkXUzBbXJSosgt49E1_MQ64sOZpRDAYUz4qsldJPK98KTHMXACX2VOjkEa9-vBdvJ-WURBbCPuSyB-hhzK1E-TmkT6zGpOoeHJg-FWQQ0RwUg1MZdE6EMFil-DXByqBdPq72NEn0DhNZxSHZBqVtu8LOwr7KTxVPRdw6BjAoFE2q7Rpr43E6VnbzOUGrrDymkMmoJXK2vYe0fzNPtRQot4wZUVcbjQAjpmoV93JjNyjWdwkQby5W1HPlz9lKyT1L8trVl0vmJTcijNt9bdWb30XknChWcS8HMFLXa9AaAqlfIpeTY7nxSQ26vzzrCsMyPM3thQbbSD8QbPvFkD9JeypB3_BXdg8r8hW9q58OyZfcrmaoJrDS5i4RoIkkkLbK1p8LMKHAAHu8Tx7emKPVmJWIKX9o9m6Q9pHMBcrmMLIZrz_LdmhxfoFrKp9w-8I1WpzRSOlgJzoNhSFaIV5G_gotRmXE6CbHlQSEY-TTVb-6Ek3CG316kZzTso_nJoZwsdwtiLFhFZ10O4-r2ng08Rp-z9X5CmopuQJvFLLC-ul1ZnNeaTvYCnYb0AlUBAqQ5IUYP_1ei6KVdASg7cozs4f3RudoqUtuhQC2mziokYeSeSzp1vMUGEcOWLTQJjv-ezNEa3x1Kq6IuE76BOgX_iHd8v0ybllDOFVsWDJetxCfG9MuOmYJy8u5wQvD6To0L-I13kUHQTUztqePoy6qdf8kmfqL9bZRUpdrHrSK88UU75Kidrxp6o9JRuOHab-l1E-Nd0yHmWE19-wDjYX45JEz8u3nMl1grfAUwK76SJ3Kfl18cPaFNGkS4VRrOzM0VCKeTj5Q4frNRu75x9N_p1sSkf6bXBIy2FfKpI-25WNk-lxGS2Da17yPMTpmsgdnVPmw1QdEBKbpeEcUWWlo1qM1RHZAgStzhOPheFKyvzhNnznoPe75xMRxOto6iLPcZ8q6pB6Zr6glYrm1kepO5AFB9ajF-Eluf25iMYsQI8UQJUYnHGv3VCwYHMb4w3f6H8sEbpGzZSRwMi9kD9nl37VNDBfNweVOwU8pWavfx70C6lz80tzv2h3nvfj-2uKwg82VcAR6SLZ00FqPs9wU1jT__XHqISnVWc4ALoxdgfl8L1fpJOs-nP6HhYSY9OEwdBwrHKvdlhno4TYwdBpYG0kpSIMX7J7Cdel7Z-t6iGcJwTo0mDyoj39kY11ODlWH3BVR4nDZhyoawiyKrOfciadBkibok6j2fFOf3ZvUEMluYkPw1ySmR0_JvkcUoD0xjgcpw-qNgrNGwJ-kSuNa6-trIjZ6HPx1gTnpC2DARI3rAyQutVoY7iydDFXJF3fb6fIhsneg0buMAyAClttw6WjDLx0fVIIzpdJQmqmXL3DqRhejaJRpxh7FN7JsZcXKNBE3Tc_sGyFb0tRcdIVP3mnBY7INs6JsvI46so3kC0k2hbdB13ngM29Nq6Ta37-1Whs_ehbMpg-Gt1XfxeVO7wVqSYGn9oTq2WhC2XBjoJ3FD4S1jsdXv-JEybyUo4GgFwIGknKvz4Z_oPJjiVaDkz3rAWjNZ_IQAKAcCYCv_axfX_aD_ZUxKhj_doWID96Gjpu3R8gF9bnQ5emq950Z_6WDxuqmmnTbJglA9AfrFRYf75YA3aQhV2NaQuOZZ6Lspv65WCbNlu6fMHBHqkdHtSHQsIEKRBx18FiDgi72JT9yFALXB9g_1QP739qu3UykMlSpxrcLAN05jpA3OYvJ2sL9M99avsoY0is-IhjBSQxkoXH1RCD11tTQD6Nk1hp7U4nNxCFn-U&cid=CAASKORoKp5j2YRBsO7p-k5b8PfhmraAuRKXhx27RmmACM2rSm4Ulqs7Xtc&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:43:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 822
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:43:27 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/ Frame 40C2 30 KB
11 KB 195ms
195ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

f03f34a896200ac3d36794a86a5b23d054f1982d05740b454078c8526a33b631

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:47:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 587
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11727
x-xss-protection: 0
server: cafe
etag: 4188671789125589074
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:47:22 GMT

GET
H3 200 b4aq_x9zMiku-4ayY0gQrcEuJNMSghrM2Nuaea2nyAg.js Show response
pagead2.googlesyndication.com/bg/ Frame 9EB9 36 KB
16 KB 230ms
230ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/b4aq_x9zMiku-4ayY0gQrcEuJNMSghrM2Nuaea2nyAg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

sffe /

Resource Hash

6f86aaff1f7332292efb86b2634810adc12e24d312821accd8db9a79ada7c808

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 28 Sep 2022 18:34:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 375778
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15966
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Sep 2023 18:34:11 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A047 41 KB
15 KB 194ms
194ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 12:36:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138017
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 01 Oct 2023 12:36:52 GMT

GET
DATA 200
OK truncated
/ Frame A047 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e9a54b0fd1b1bb2bc001e40539aede08a5ba6a90e93a1a2226ba65e46a03a548

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame BB73 106 KB
37 KB 812ms
680ms Script
text/javascript 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Origin: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 09:06:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64217
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Oct 2022 09:06:52 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/elements/html/ Frame BB73 8 KB
3 KB 301ms
300ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D-vux09UgTLqghqfiVac_j6hwWWtemqH3-eB0cDdDlm6bN7gWOZulFkxLgw2aH_1F0gyp4XLOaKFwRNx_eGVnAeEfHTYYYcHku3YKXwDlqz2RYc2ti2GzalOnWr3wL7mVQYmXwvvwxxTAYGfk7Tu77fYNgnooFA-u8dA135VSTfioPPYY&cry=1&dbm_d=AKAmf-DQfS0A9iMF4k8B6TDiSHkpnkNjQWHW023HYj3S9IiZTeb9aHbiieE1OPG__afJixufNqlhLaErD2i3EjGQrlrZk1biPHWZ_HiL6wkwVSAOe7r4P-BOe4xiAJjQVl_ozUZbZ_dvQDOmmkf2zV3rK7MJsCfJtdXqVmlZr6O1w4KSGGoeJlfFFmbKRJtccVxooP7XhGt5z1JdnTlIkcH8A4_BzKtYgschN3idO5863Rs1ll-KLQrZ7Rp1GuVXBnfO5kU8h7i-UOUc6xY-HOri0srwN43_IOxk-Nt4VytdgzWakxKR5sXmYzcjHWo4qNz3Ii-ZKnckNFk8glDuxjBODJvIDlEn7WmEyZI9JMC9dSvwi1ho8FlkWyXGI-GDDR0gJ0nB4GUT2iFDs9iYrZCKYXPAMfIZNORGxTAvhyEDRE__WClYkGul699fUZPldkOST7hP58Z0HyW6x02I44VwtIE2-4zRgpdbWdVeZUmIeDUprEXq9fjhSQaWYZExcKu8HnKifwrOKtm5Owh2Y9S6ZojJw3gwaKQHItxrvmh1A1mh6Waxn__8DcPUNGRc01O80isqZkoy_BwAZESYlujc3S45UXWZwZ5Sx78BZmep4Z2hvCZ_BiCZ_cC0zPRvGlKg1uco2roOWnaTovkADIFXq1LyHRGK3cGdpFPt_pWPhIcgaXzPWyqv7m4k_wigouTeNo_91YI7CYxkO3W0sTevAug0u9XZ30I-Y7DPrKqd285DukYbVUwyNAX0MZT2xT-cIH-SiBuHbmEIdKJ4GDzIrjFfZUdBIeyGSBX8ez52NlFB24B6uWrkx29LcVLchCHvaY7yg7fG4EzCm_usDuqC-Mx0xWO9Y5HGGwfi9So1cGMjxIfCqZGQ-WCR8gKcLqfaKsPCAIzePnx-IYcV1oxMSqlSz_IHzDJ0HBoMOGYzT-UWkVyr1V-mTAp2tt-bKCx4kRcQpya71yTcTpJvv8ksBoMvzcsQ2VjKkli7ZDlJV9bgoC7GnzTBJlTf0eWx2L6FXYQ76uEKc0iWh23sFSHR00RcDOCRcy7fG-9Y0ed2Jo5rmRuwuLPj8SPbzqmUo8gk4JUyU0YGintAztkYKnbL_QhGWvDLVyKzX7Kbgapo27kJxMAdumZssTwiIObDp4jZXNeETnKhYxIDp1wrzRY0n_fgYFKr8GaV-6bLOughSoiX350D1DlLZIRvaeaMaW6MQDSCJez0CCMp5yBeormRQjsVL0qBc6JU2M1axdNjfSB5NLnJGc_gKNFbA7ldJ2_klOF-f4Bqa4F3YJn-j2kOxMARZWPhwchTrSNbXGKyfeh_zCsN2tT1bzyvVViBLBF3sv3NpXrSrQZUeR-XeM-c-q4aWSZVbona1hT_KOr5uQOMY51fPv6uKBu3yFGatMmL35kHq6VEda7Kqr3FWahoGtXkCstAdiBSh8C85hEnCw82zjxKVoWHdHxGWaQJ4wbPyjCUPiy_oq6kG-_WNjP4DaOKulhGWPpv-d2seGr9IJ6JXi8z_CGEaIlcf9IjO90537ruW0FvwRryqAXgU01CcLaf5UbIeu-jWsjLAfKCh7wuRWDDbeOfD6spIgnZ2g2AZ_Ed5bCY58l_Eqy_D_PLHLjClegvxzOo7ntbd93Q2VLcdX-LpEfNGlLqsYKD8SjbwSEVC-RxuJLKzAvSm0nOI5Vk1c3l4ZieYwJ_yrsV1FlDk0ergdYyWmzasvIPzwyExCbDbyJz_pZiuMNUrYKgzBN76msizE6Rb2zqvtPJisnAb9eHug-DDn12_KdBBJhIH5muK-gau8jxln5WQG34FvdEozeIdUF1WQ5RRt8shqJF5LlUcMenHFrM68qCj_2sbcftUO5HCPChfRjNcL8ZFV_tQ2Ixm3IZniAL7Fo2CRHQtbtTCi5ezlP8k9CH95gumR1sGABFcjkyFwRWi3vYXqtGb9C4nsuNN-OVhK11XO3rS9tkVTfyC_byPRJFmp6mOckCQXQrWd1KtHZrNSvC_54bGwziYAXfW2V-ehSb4OiZpMXWw-F3LYYijkfX-J_bcGxFDFbqrW5ciY7-g34RNavm6OuRHbfpEAWALtYDipHdIDXWgZcEQA85nEtqgt1J7VJALPYfKuYl0hIHrXyQxvrcubhFRsd3hRueCeRjh9xWFVlEFy30kW-cXxRwLG-5cLmi_eop83Y3iOJaCXJJgeLCqd9gB68xtMHhy4SFkoEs6bt4H_ct8eaC1epoUx-1P-CiEsh6Hjr5fRZhuwnObHwNjkUnyadq9YZ_mIGjuINR6lcCdEghNCeog2jODKFC6Xi44AY-zO5Rw_anRP_quOkdrDWpQSi9mcOkNOw8veeIOPl6xTmKa5o6EvWCjAE98oeqm2sBA6lx_raIOmlbgtgR33HWmp0cKCf2i1gyB_9UVjYuP_E76Onb2hEeEFYieVxoSpkcKqQ1jd2VR5JKbi7KwkNHibR0MRaAnOctBmrvukWZI5sk1fcRWf7zYtwwti1VpbTxzpxSbiPgf9zjpSFPObScDpC4p9sMBH1q_6FMHIc4yT9wpgv2RR4zucs2Fm5pOA7L8nxQwyBjSAW2WVTv9KW1S9-B6gkxcvdoYq0wEQRg7MXFD0VxJbttfpT-kH3W5d7atCRoDwi6vkoSZ7gFB-6b_LhX2r_Qk4VxT4Qc0B-moq1MTPEAeBM_YI96osnPiT2CcOYxAf-jl_mTncp-ykB3N4G65TdAHd2hC2C4wnyB3TgJFI2i_n2sI99q1Jcve01iAEd4EivU94jGj2G49VxmVM-7DW6zKGB2tzevQO0TKYi18UeYGkcT3BcK4CkswKS_1rSG5hAIlkFL2Vy-OU7O_tZFX6ycC58gfptPvbMVOuaYJ6BG-HE8EPcMQnnQKxu5Q9fkO2Q8jAkJCfM6IoniFqa4TVv2sCv1p5lMWOEzjn7WnU9SK0QX0mLIKaD2u4Zs3KBvEtyr2BdQbETSdxac58efliW3N84XbwixmyDQpxUKlZPjMeeuidizAawj4hbNkuEygrREECjizNXTTNHjforEv6bInWX2vzvkqX0tF2b_7BD2mvS5k0EtTQ2ZKP16Li4Kb1BlS3e394xkgH_Bydecj_Sj9LeCOIdMjyy2BKIX5y_nPgK-DQc_8t_6qzXYwa8BF-wZ9FVBTlQoK3hsSYNuVVmbVoNfjMiOrCbEf_z8z0SljRo4ww3OYrZ8sf9q64SMPYTgXhvnPZmCRyV1hqsuVTVzcMZYHnpgA8XFFl1Oq07IUXYjvTJ-cyyT3Z6XwsqqvLt1DewVw_Q8HJ2JXV8rtQus__ZC3r-NtYdsJAQXCT1njLMK35A-g8zfItE4Yg43j_sxO8b6hQeawNkYRAG8C3hltprMCrPUmlCLSk0L3CPN6Rm58W5wropFCE3qP8n_HtlExmbN3bfXYwa6rOer5oaiKo9rH2yNSBWxc2ZULaO0qrL0XK9E0PMIrqSpgPH_vorLHBZV7yXYiPy42n93VkWzt1M3KpXgfzKR5gqWQ5RGCICouDhIhSlp09rvzBje4hEylVP5o5yuQ0IuHri3M7rmYZfBwrBxuheA8npuDBCrcpjqSrTgRw_ycmKjVmvJHM51FUvtkZJ9DUd_uY8n-p8FayV5nLoCl3ytsn1_vucm0n8l1D6hTitubdW3DRsYsHmpqICRq_sKF9eboYJuH1slOuUIvwWv8KgI8_B7k2gqyqn9xHnHeGPMwAOt3iIVLSMLfv20asoctPvVAElQxj3AjO2dA7pRoy9e1Zc&cid=CAASKORoMpHkS1ddtjQFVRWNYPDA_fosIUycONLTIykiA3xZjfRutk4KviM&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:43:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 822
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:43:27 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/ Frame BB73 30 KB
11 KB 199ms
199ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

f03f34a896200ac3d36794a86a5b23d054f1982d05740b454078c8526a33b631

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:47:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 587
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11727
x-xss-protection: 0
server: cafe
etag: 4188671789125589074
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:47:22 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 36A0 22 KB
8 KB 194ms
193ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 90357
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 01:51:12 GMT
expires: Mon, 02 Oct 2023 01:51:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 06AB 106 KB
37 KB 517ms
437ms Script
text/javascript 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Origin: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 09:06:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64217
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 03 Oct 2022 09:06:52 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/elements/html/ Frame 06AB 8 KB
3 KB 263ms
263ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Df1iPYQvFGrfzeWsNYRMX8Pk6DzZ4bDHPJDVmaP9ONQcGZk6uEwkyMMJ5-YBONTzLKSypjrPEDubPQWeghne28_cWMwaXwDFSPLtS5EViN8KiTCE2yYHMEBSzehBLwBwFv09u5UtLNb8uBYFFitALmxKalqJDGn5CQftesa9T9kz63NPs&cry=1&dbm_d=AKAmf-CpUL5mhpeUkpsGX7eOxgfaRzYkiAyO59c43bWybJLd9gpP11ycMXyUB53fzT2JBD6kh1W2uZeHJ_QrkI5ONLW8VraSJOPvU8f4QcS0XXR0stat8L5JBsyxTu9cuQc-lnPWrWUHedJUVh__H9pW4tiEGmPEek4Zm8gf6YvU4gsunHbvznYwZ9TXClZiV6GX4VB3nYhhiOIeZTn2Qel_9Uem-iBE1A4wd9TOsxSG75FDC5GuArhy6v0hv2jBfvo4iZvP1gOAXrWQIH3obk23xIyPRw06zIHDQC_Rl-El8H8JEkB2Ly_T83d9Oloc8bimgO_p66O9LGPOguaT_263SvLA4NCvf7l285K915NCJoSiTi56tMpJ0SrWiHGFqoa3ZFg-CJ2oHBQsMYAg92gF_N9YlqAmA9L7-dnn1J6VLt3uG4ZsSoqJ-PK0ddmLOP6VkP7JO2-11Maf7E9jxwf56JQSaFM0KQTIWaiXR21NWL9YuDFZy7txnkMcfoyKM4sSxbRfMLE9HeltBxhpSEG6OxlSqMwIuj-gnpWGX6jC_3bs9ENi6s1iFiW4-twdEUKHNeKtMTn8kU1orY6K6h-WQjOwGpuj6eyhV6YWXNg6wMIGEEQTMCt69-DqxeS9dUQtp3S_ffb9brZwQ-8eOSMhfMNl8sMmsfQ2qo4aTlYBqClcEeNlqK72dGjZYSdk43MAdMRS-SURYdG5ktuya2CM1vUQj1d-TiWOIMuncvEsAPlHeJ54vxuu49n4x5xLdhYqgsVnpC0upZz_-34i1ittt7RMusRHwgTAUhzcPY8m1eEh6BL8Iz1hwu2K6l8q8_aBPvAlTuNhVFH6do3Qejuo5oczzSWUIAywyV6Gp8ct71RJxmcHSkCu5T0HLwoV-kZXZeVG6fT_GZkovw4C_Q31SMNqZjc32IbhFk93HvJLyPXHxLoZD5vjiiv-pWRQgg_RSRQSoGdG4N-m8AFk0LgFzZgAFZtonWIzMUQ4uVwC4xsBMQepLtH_WL1UDLmS-2ZnWWTV-8PBT6dkm5reQoxjXcLYMWHxXgStnSfmdDEaKE58ZvwF-rxamhanb-QxxZtv7QefYFe-gdLgIdldsA3qRQlkRviwAUeaqGJzpQmnrHg5x7NWRwMXRerkPaEuvB1EmMZ-ddTL-BgbiJt8BIT_lJiNcTsD9AAyR8g64tzyx31UUALbdLL_TfmcJ3r9T7RT6BkgiWdj4UI2o4T70zM5RXBPvERuPRHUb2gKsPk60i4ciARqPy17cp9RCE9_yY5B2q7peagnHecZhtOZ4J5WqY1vGkd38Q230CqK8pcz4g-vQdhcGH_IdeGV5sLHRCjn6bRxEWTMxDrDTfMOWA707DQSvJKOoPhXFKknQCvCnijZU640QLYLsaKdNio4x1Uit43Vbymd1LYsoKOxXPINenwOiyyAVuT2W8tdSmQafncIYfPXxAUdNZUmkn98tvdhGWi-DMS6i2iu3-2_qBJMoEn2KPJyWOfRyoNXJAkUF-C1G7ysm2ToBmZKyqKBdirqEHQki6KNf9mQyWTxi22TazulqivgsdnhVpOYGUR3C1HRFT5Mzfh8Kg4ZZv6PqaAhKtNdKuwOv8chvrsocmN_OpQZZ_sRA23zyXi2GmNgeV-ob8T-pUvPjo9UnND7XmqMbW0BG4jRqWYDHOMgP47SF2l6aU85ahdmMbvLGWDWrOTphYwyW0c_YzibfuNXO8v8GYo7-OhBtXU7HcASfKAwWUbKVEe4DZy1Lrh8AjNlAvwLFJ7vWH1OkI1rqZyU12MCfdgqIGVqmbDklckHFcTrHKEfhCEMKWehuJOODxhW5IOqBd_C5bFPu9oFiIa6cYqxt-cKZ11zDvatoVpLoxYHf6tD23Mk2lmyoGDlHaJy744HjzBV3bkqXy_Uvzkpu8nmg_F9BdWV0XfaDRQyChHoNOx_0l-Gll1X_Z-wnYiFLDHKXpgbIZWriznXiFjrT7uyf6vJG7FNpL3Frn3Ooih8lt5n2uiYPLGYcjnsnQf_911zg7FYiOeEtG6eSJ5wpyP_aUh6B5pmJe0R_t3FEqTR_euP-gZayCuO3pWWUjRLgLcaGOi9Vb6sZGm92publnI8xPHJ93q0ZjK_ZrH7aWFgc0tHy9oAGialtL4qNFNTrZmflyDe16oshcrsDo6mPfVCltTVhI6q6WxE23x3RPPyA6u5sAfzf1oHEDHY5kih4mHVulNEa9xzv8A0V7sKVFF4oLOilhFLc69Cw7oxOFk7zSKqZSo9aYiWrFyVjNcw0JMRIEp9zqnz5jwFTd2dN1A-KRjMeiRRUYpkghCvgBi_g0bgLN2qCio7i-CbydgEOD4fUtv2amDljwqdfMaoUUokWfKIU2XJyZuMaVMNo3Jm86WsVXMvDfH3UeFxtmU1f_4r3tonAjRsKrpOYcsMO-I4MuoOYLZ1yKU-6UgXKAQI51Z1MNDBffnEBu8GApwY-E9Qr0HYlR9Qf0YX_yNVkG5uNwz6lVzIKiVK_fSdZavT-ZxMitpS3Riw-OnmFWLSzOdNCBVwQzkqz68-TDGFA0iPFyklEVP4k8FMRUbt65wdGfh9Mz74pYvAXg44Yms1c2IEMf5Uo3NdX0lEiLUPmSC4ALOtaGgkhrPj5TaWPKtZ7xqEQ6g0kipYS0n61Ja7REnk7gGQY2vTsGySycYXqfJvPTvtYEvrLaojV7J_nRlooh05fRFn7Hc-ZmWc6tXZ5o6Tz0D9QNe9gFsfm8uqwZqBQLjQN33ks1Qoyp1nf6cVbko_AhKuY2jQBG95huUiQ7CLU1-pAojcV795h1sQe4hY5v4wvQi7eQCJnuIASR2hEZKcTqueBlQuIUlXRO9g7_vyKmwo04Hesk6m8Y3_y9GpSkSIhyAgy9s-AUU0NgBBrjrwF99Pj5LvGXdQxKxG6x5fogaDn-k9hF3Pjf_KeItLvjHFEUTl0IaR1ujjvFN60ZUHFYKe-J3Sr1NPxhSgPFSLOumtqPGqLl7qpeMCfQemuh3353O4AIi2FBINRfxWVxEiYatDkQwz-i7WcMUoCv8VEjbS-vFqj9U8zEATGagNGvaSVk3Zzn3rYte4b_kC0o7wcbQ7EgIy7XqyJ9WXMECCVUGDE63JBsjMbCHnrxmUrjaxxiEfnJ4g2U64UwgWQNyCrlZxLD2LnwdQjWecFScYs3goCPoAwrNunRk-84Tbhxus2wn341YvJ6bvAjUj3I43-VT0kVaiyJ3xD7a6ZCFj7ZdufjUGr06-303SHU5VPTU5iOe5DOYvcqiq9jhwXkDas_YdjDx6z6z6QdmqQpKZVBzE4Bsw0daZ0rLboawVCg3B4xI-uJSoOXlRaZWbGfP1-TJ8n2MMvWAkPZ0ruafQZqUlI6hUP5UUpW7GuNS7pZS2EneIUbs4Go3W39I-LkvhhvvKpxkxlVu8HTXtArJ9V6ReBg9Io5Z9cagVlKGq0REEIC1vj4fl0Yg9vdDbJENHscY7kWcTcCjqZVgCSiC3Gzv9pbpREZKLmP4rtXwyAN-EmpshANOqT3Vblo0jRZ1mOprNV2xPUqCrcyGwmM8OjX5wO__2M4yfdY___e6mSxb9ojuc5nqgYrkKTc_lBKZXNOTu70KCZ2aZGN29oYZi5szFI9V0m0YL2UXoIPGjd7X9alpJM37bUZGTlhgtGHNTTuCr3fOceE8Ra3y8HHHFRu2g-7O8nmSTfyPxQtno3KSHexwV-tJVOZCzYSD_OcJLsO7D25amT-7ocYFQvrcOGlMx8Tw&cid=CAASKORoYDhM9F-yc33YU48gP_6Jg1jt7JAZ5qPLcW6Ps6EgMsreeMzfJuY&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:43:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 822
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:43:27 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/ Frame 06AB 30 KB
11 KB 198ms
198ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220928/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

f03f34a896200ac3d36794a86a5b23d054f1982d05740b454078c8526a33b631

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:47:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 587
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11727
x-xss-protection: 0
server: cafe
etag: 4188671789125589074
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 17 Oct 2022 02:47:22 GMT

GET
H/1.1 200
OK dvbs_src_internal109.js Show response
cdn.doubleverify.com/ Frame 4804 59 KB
19 KB 312ms
312ms Script
application/javascript 23.36.254.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal109.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=189094&plc=6695893&sid=18330&dvregion=0&unit=300x250&autt=1&ppid=103&aufilter1=3060631&prr=1&auevent=ABAjH0iceNDUv6mq3_WT4Jlltz58&c1=3060631&auorder=1008962086&aulitem=18156675739&aucrtv=438385664&auxch=1&pltfrm=1&ausite=201491245482&turl=https://pastelink.net/53fgu29a&aubndl=&audeal=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.254.7 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-254-7.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: e9881b639c7528a358803222a3d5b1ea1fae69ede0ad9ee2e363be38a2712302

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:09 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Aug 2022 13:20:14 GMT
Server: Microsoft-IIS/10.0
ETag: "03bb312aabbd81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19455

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame AF6A 2 KB
2 KB 598ms
197ms Script
text/html 67.199.150.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=89063525&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.199.150.81 Los Angeles, United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 889d129904534e7eba00ee121c536ae32eb7ee069965a6a933fdc5617badb27e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 03 Oct 2022 02:57:10 GMT
content-length: 1610
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 2C0C 31 KB
10 KB 285ms
285ms Script
text/html 23.9.185.218
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.9.185.218 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-9-185-218.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: adc95bbf12184c1a406a301d34ffb8a8fbfa10ab0639ce675eb2476a317e7c37

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:09 GMT
Content-Encoding: gzip
Last-Modified: Thu, 15 Sep 2022 22:38:47 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=41636
Connection: keep-alive
Content-Length: 9422
Expires: Mon, 03 Oct 2022 14:31:05 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 40C2 41 KB
15 KB 193ms
193ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 12:36:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138017
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 01 Oct 2023 12:36:52 GMT

GET
DATA 200
OK truncated
/ Frame 40C2 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 09be9a21feeaab2be7e38959156864c6dfd86426669b9d8004b0d736e93a65b7

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame A477 8 KB
4 KB 960ms
202ms Script
text/javascript 34.149.43.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?flvr=0&jsCallback=__verify_callback_874215622315&jsTagObjCallback=__tagObject_callback_874215622315&num=6&ctx=1828362&cmp=189094&plc=6695892&sid=18330&advid=&adsrv=&unit=160x600&isdvvid=&uid=874215622315&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&nav_pltfrm=Win32&dvp_strhd=0.30&dvpx_strhd=0.30&brid=3&brver=89&bridua=3&dup=null&ppid=103&auevent=ABAjH0iAtTr8YdRARxYFyVllg2yQ&aucrtv=438388258&auorder=1008962086&ausite=201491245482&auxch=1&aulitem=18156675739&pltfrm=1&aufilter1=3060631&autt=1&c1=3060631&turl=https://pastelink.net/53fgu29a&srcurlD=0&ssl=1&refD=1&htmlmsging=1&prr=1&aUrlD=-1&m1=13&noc=4&fcifrms=9&brh=2&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=157&eparams=DC4FC%3Dl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETar9EEADTbpTauTau73dd_cf%60gb6c5_g7dc7h4cf3b5c7675_%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETaudb78Fah2&dvp_exetime=6.20&aubndl=&audeal=&callbackName=__verify_callback_874215622315
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal109.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.43.113 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 113.43.149.34.bc.googleusercontent.com
Software: /
Resource Hash: d4862d47461f6cc76c0ed47151a06e4a030a91cd028efb32cc0f2062b501d590

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
Content-Encoding: br
X-DV-Response: 0
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: close
Expires: 10/02/2022 02:57:10

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 1FE5 22 KB
8 KB 193ms
193ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 90357
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 01:51:12 GMT
expires: Mon, 02 Oct 2023 01:51:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame BB73 41 KB
15 KB 194ms
193ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 12:36:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138018
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 01 Oct 2023 12:36:52 GMT

GET
DATA 200
OK truncated
/ Frame BB73 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4d938d94de33c585096d0a376a7fe7f0359508ea20dd26b531276bf2e16a5fba

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 b4aq_x9zMiku-4ayY0gQrcEuJNMSghrM2Nuaea2nyAg.js Show response
pagead2.googlesyndication.com/bg/ Frame 36A0 36 KB
16 KB 193ms
193ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/b4aq_x9zMiku-4ayY0gQrcEuJNMSghrM2Nuaea2nyAg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

sffe /

Resource Hash

6f86aaff1f7332292efb86b2634810adc12e24d312821accd8db9a79ada7c808

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 28 Sep 2022 18:34:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 375779
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15966
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Sep 2023 18:34:11 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 06AB 41 KB
15 KB 194ms
194ms Script
text/javascript 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 12:36:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138018
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 01 Oct 2023 12:36:52 GMT

GET
DATA 200
OK truncated
/ Frame 06AB 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 740f0ff702055247ccd88904b297c34ec6af5f011a4dc7024cc18df298290f42

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 045F 22 KB
8 KB 194ms
194ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 90358
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 01:51:12 GMT
expires: Mon, 02 Oct 2023 01:51:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 4804 8 KB
4 KB 728ms
203ms Script
text/javascript 34.149.43.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?flvr=0&jsCallback=__verify_callback_481244500859&jsTagObjCallback=__tagObject_callback_481244500859&num=6&ctx=1828362&cmp=189094&plc=6695893&sid=18330&advid=&adsrv=&unit=300x250&isdvvid=&uid=481244500859&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&nav_pltfrm=Win32&dvp_strhd=0.20&dvpx_strhd=0.20&brid=3&brver=89&bridua=3&dup=null&ppid=103&auevent=ABAjH0iceNDUv6mq3_WT4Jlltz58&aucrtv=438385664&auorder=1008962086&ausite=201491245482&auxch=1&aulitem=18156675739&pltfrm=1&aufilter1=3060631&autt=1&c1=3060631&turl=https://pastelink.net/53fgu29a&srcurlD=0&ssl=1&refD=1&htmlmsging=1&prr=1&aUrlD=-1&m1=13&noc=4&fcifrms=9&brh=2&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=157&eparams=DC4FC%3Dl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETar9EEADTbpTauTau73dd_cf%60gb6c5_g7dc7h4cf3b5c7675_%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETaudb78Fah2&dvp_exetime=4.00&aubndl=&audeal=&callbackName=__verify_callback_481244500859
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal109.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.43.113 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 113.43.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 2db38acd18892fd6d3b7035a30597388567ee02987d64601c8983877886f7c9e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:10 GMT
Content-Encoding: br
X-DV-Response: 0
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: close
Expires: 10/02/2022 02:57:10

GET
H3 200 b4aq_x9zMiku-4ayY0gQrcEuJNMSghrM2Nuaea2nyAg.js Show response
pagead2.googlesyndication.com/bg/ Frame 1FE5 36 KB
16 KB 193ms
193ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/b4aq_x9zMiku-4ayY0gQrcEuJNMSghrM2Nuaea2nyAg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

sffe /

Resource Hash

6f86aaff1f7332292efb86b2634810adc12e24d312821accd8db9a79ada7c808

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 28 Sep 2022 18:34:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 375779
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15966
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Sep 2023 18:34:11 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 2C0C 284 B
932 B 926ms
196ms Image
image/jpg 69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 284
X-RPHost: 548ddf114c6f6bfbb66a4cdeb6a219f4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 0831 22 KB
8 KB 194ms
193ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 90358
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 01:51:12 GMT
expires: Mon, 02 Oct 2023 01:51:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9EB9 0
20 B 197ms
197ms Image
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B2_7chU86Y6a7AeCz4t4Po4OViAwAAAAAOAHgBAI&bg=!n5ylnNjNAAYQgTJdMIE7ACkAdvg8WnzmLBx13CC_M70PleaVkebeiBxeUHA-GW-Kdgr3wjsiz4WMVwIAAAB2UgAAAAJoAQeZAvNxbFqpSJwUeiOEwvdGCbnSrYOiZUin2ZCMqG8uzQZYlD3H7H9hMtLT0FEJ5FTo4CcdCwHYCmyTYrwmZPzCuGqsMGnavbZLNvCPpaXd-bt-qQGguEn192SZoqCNOB3unLI-sS_BBPW1D6oR7UY2_m91C7NUnIipdNmvT4gw6DJhjZ1GLHWi5MZvAMEpMs_vQJajTA82KEt-FE5Tcs2AWKNluTxRzPClJ18cekyRpJ6z5n1uSnkbmwPuVvivuDCS7D1mfMbBp0uXlWGPhdArq_7dOblukMVAe7TD-JnZvEUQcb9a7AXooKKOpX36XlY1HGgfWzdl8MBGoOhQaS8SVxy3JUBmX8Psj2kTFvqW0m86QiTojsMvH8ynf-6SIKgTszfF5ZIjO0ULQnP6HXlUIIIBA95o9fzc4aELapkRt6poEmGeo0mQ_9TBGGgq7NA0F03YXTWApjOQNTfr4aT_kGu9XV2SVtUumwgaLPU9SvoBtX87qrgXE33LtF3--eQ3HoZB-XMVOrJNd8Y08swL-FzTGcJS0xKZKcvxkA3qUDNb1K8DcSidtUq544UF6Ne1efmKVjvbem9Fa4B1H82T3iWMMiaQVj4cOW-_ifqiMWYIUmbKg5R2sxkQIK1aQlRNrhIV42fkkR8VIa6Kbi6a47Js70L9_WawLqZf3NtPIczvpiY9PsSsx5f1Ttfxj8zx7zGjEkunJqdLJoPzct9UQ_Yz2vs5_5hhJk8wzaEPySEcKL8rproVMqHiqpDbvJtB1TfEMIXNSbm6zL3iFrqmMVnYrpII-Na5jrPFvfCkA8dGvW0SnUu3bJg-w775kJKKJJdZg50tvTaHAwdDNH-GAq_T6vLCPYYuy6iTaWBu5PAZ3LJWX-FKccFPYCtUg2uc3lHkwDH021hH-aNKQb7X8_fkFqYqjBIqIngWinWop07WopDCmbiuQPbCWTUEeYsxSvbTDqZ0IrwtMPfgjGSIeN4YxMqgXoLUvXiuBlrTdjxVF_w5gg

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C5CF 22 KB
8 KB 194ms
193ms Document
text/html 172.217.194.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.194.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f132.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 90358
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 01:51:12 GMT
expires: Mon, 02 Oct 2023 01:51:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A047 0
55 B 598ms
209ms Ping
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssOM9TE0_jVXZffXrrsMonJgsfxIxDPvRFCCBBBw44IRw4VpOVnOumTdp3LpFUCz1CJXgiYndLr9TSSFkTEH1tIqRtRmH4WS_0fZaryPC5gd1VnqbhZJEK6bc0QjaD9Z0-dtBzRTS8vosEqYNJNnd2AC62WPGHVMcVevvkmBlALjlLSKgx55j4sg4YBPDy7HlpmP_aWApjCiyHR0ygiKw-rvCA8f55rwpX47UM_wf-7JF7k5oqdAzWzfIwWIiA8R1wk71Aem2_3j7XVJRghCW9qSsYsBSyo5dxOwXt_eEsHmfsDLCZcOrjOY5W9wnEdORV37MH_LUoD4WqzGoebL70H8LjevkreDXn4thuXTrEQOCVyFmZ4KcnNp3pjxveknSIV-ETQ_vlRG3d4g9HPS3ywgUZ223a66wZHlVJ4uWbp0kxpTGYSoksl7Oa1yU41PpFY1JshG6mfg0hBwpfJ6r_d_Wb5f66LG-g-sNu4I2e2YlSG3S6vWAW9MxBy9X8ZPzLF038iaU32Z6vmI8PIRVQGqTk5A1WTsRV5c40Cd1_sc0hGYmCknmUTtA4aKoimq4OvljkwYSSHKm0FGGy975BSMNytYcFUS9SDr3Sz_TXLZW_Q9GQcicI9uQMoFYmN9swdfL0ABVLn61rprp7wE27krtKDy75033DWPWIH2i4FfpSGVfg9U_rIgkELAcMVrWrDnz3ZECZDsbmk8FgQogJTnTm81W7AVwu2DmLbpcfNTsURBbD7y3L8Y-ttCwszUsPCZyyWku-l2jbhyV19PIxiUSDATpuObA8nEPEl_S7WVezFOf8tItkojp7KdWJd6kdEwvTbmJZvTHOQSKIXc-YPKltmScvEstvRs0wz1-_XrHjP2ZZSXF-WDgQOwk05zX2esjC_nrPjDLqUGdN3PaOmvK1RXpNztHOwRNrylipUBUWzbmUNrHSZghbPQzX_sZo6MYzJIWtlpnZ8_V_poUHQufwOFZNdqsSyGaQIKj8xYBqX3TaPUrvoPodlExruKXhRIxRek4ocFFwe_Fm2pVVesnBLSyeD-DkfYoUvYjYkO5afD1M8swkrSy639Bv-Ed6QrFTkxhG3_-FlfRMO3j6O3rIfTkC3BlSWjFBTO731JD08CQnDHVkPpxroLAwOI9WpWQFZzN3ExCexyFrzqvGLljPHHyssnPFrC9xKXHboxptGopwQPzH3o1Nr7r8ApR5Yp5HDGTmssiWD-18HV07wikvJ38zgHpcs4JOKLtgtJgmWGw&sai=AMfl-YQ_o_HiCQsT32Raes-4q8JK-CKY2MaHUZFvPj-YsgklstgLTX9woqEqX_RBqkieEtNRLd8SoIaJuWyQfXjn0fRtLw2O0udSphrYwif6t1xPrHGpQOBHEP6iVhS69oL3RdlBLHpDjRubUJNBN84QMuUe2HPLNumbkQjybMZuM_9OOKZOc4N4ULIMj07bL7DqgJ75YxkX-PmKLDvyfK5c78myVhAcGWp2wPlT&sig=Cg0ArKJSzO9qDDVFcPrTEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=839&cbvp=1&cisv=r20220928.48927&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sl-in-f156.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 03 Oct 2022 02:57:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 14649442771231458876
s0.2mdn.net/simgad/ Frame A047 34 KB
34 KB 579ms
194ms Image
image/jpeg 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/14649442771231458876

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

3ab31abef139aaf53d6e3aa7c7d209132df4190bab0d7f38038cdfa8e0e7b5c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 02:31:08 GMT
x-content-type-options: nosniff
age: 87962
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35208
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 07:15:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 02 Oct 2023 02:31:08 GMT

GET
H3 200 b4aq_x9zMiku-4ayY0gQrcEuJNMSghrM2Nuaea2nyAg.js Show response
pagead2.googlesyndication.com/bg/ Frame 045F 36 KB
16 KB 196ms
195ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/b4aq_x9zMiku-4ayY0gQrcEuJNMSghrM2Nuaea2nyAg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

sffe /

Resource Hash

6f86aaff1f7332292efb86b2634810adc12e24d312821accd8db9a79ada7c808

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 28 Sep 2022 18:34:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 375779
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15966
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Sep 2023 18:34:11 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 36A0 0
20 B 197ms
196ms Image
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B6hCnhU86Y_vYDYHmoAPgyLaYAwAAAAA4AeAEAg&bg=!dXaldjLNAAYQgTJdMIE7ACkAdvg8WvvUQAfesv-5p5_hc7uT6BHdwiJNywqzNrIBjy_81J5B8id05wIAAACGUgAAAAFoAQeZAvkSZ5AJGNIt1nlyY7BW63YGgoda4n_V4ndHLGTXAANcLgA6emjGGP--vX2idMSnquLHCHgZDe5dnhExdz2pfAzcayPRqseMYlqnL3a0zY4qI1qYHFundXLE7zDG9ZkUADg86I6_GHg4MVr7PKSL4Jb72FS_uHaJwQLF1masomw7MLoPBmOM6t8Ctigcy7L1wPQnsMIWItE0bcdjlmjrTYrXcXx2xb3NssArlxobKSpg-svlvkVzExvJNZ7lfB2Icp9MaY2g7tQkfH9YF3iibpiE5O8P2HVHEgqkmEtpoSiSF9fr40qxOdbVIVR6-c8lkvpDftA_5R4Vi76AgW38CFtNtAOkCfqc_o28L3_X3n0ZbahzhcBWkokgbmZW2Ty93C4Mk5mbG8Rn-N7qxm3Vu2-u8sAwhRQ0ARAXdFyjxhYsb3woeXoVeXTXb_PPdbytGGnwuMdlhWSq63Nec2wPox8KgyxFRIDqgVt4bsH4i4075UG0x7co7228Me8Ut7LEHn983D0pNCdbMVurfvgvwqpsXy2MKlPJeEI2bcAX602xbTYebE_egJ1ANE4syax87C4K_TnDd1hd1mzsZc_tf3jhG6pr-rVuH6j1nRpUODG6KIk9NjUnVhWIz6UvpXZZnw4kxnNuuxDRuEvUmG-L4uljxAKgwkuLQlybzinl-LWoNGQLi6ZrdIGO7gzcXKZnQiDOpnWqynZwr2jgZrHVLDJPu-Gm8enQONxBRjp3nBQW3TotcK1QgOEh_PvWaO-iXRRGTczY8yLzpS66X3GiJNM6aWPYYtm2ZtDy7tKij0qp2TGcPY99b4vuTlGYaAgPNZahphi-qCgBBhZAjxpMtqlR2VsVzrox1qSjf-wcgBgkP-sIGVIuRgo6iGGFc9mPBhHUxpuyizzuJgW57dAyUDaNurWlDIcF0ObqX2sfIIvk9DSYtl1MdtwaNi1JIaTYwbnzf5lzYNvKEwaTmz4GZrNftuzf9QA4y0MY5d6RxO7B6eWUgmOtGChX0Q

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 b4aq_x9zMiku-4ayY0gQrcEuJNMSghrM2Nuaea2nyAg.js Show response
pagead2.googlesyndication.com/bg/ Frame 0831 36 KB
16 KB 193ms
193ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/b4aq_x9zMiku-4ayY0gQrcEuJNMSghrM2Nuaea2nyAg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

sffe /

Resource Hash

6f86aaff1f7332292efb86b2634810adc12e24d312821accd8db9a79ada7c808

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 28 Sep 2022 18:34:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 375779
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15966
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Sep 2023 18:34:11 GMT

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 25D8
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=B5D3048E-F57D-4798-BCC1-50AFE1835279
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=B5D3048E-F57D-4798-BCC1-50AFE1835279

35 B
467 B

405ms
405ms

Document
image/gif

185.84.60.30

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=B5D3048E-F57D-4798-BCC1-50AFE1835279

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.84.60.30 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Mon, 03 Oct 2022 02:57:12 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Mon, 03 Oct 2022 02:57:11 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=B5D3048E-F57D-4798-BCC1-50AFE1835279
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET

v1
match.sharethrough.com/sync/ Frame CDC3
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:edb9633a-4f87-4000-a28c-f20b447855b0&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=ruQIIKyxA3m15lglquEWcqmzWXK1tQ5x_bQHsnJt
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3DB5D3048E-F57D-4798-BCC1-50AFE1835279
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=B5D3048E-F57D-4798-BCC1-50AFE1835279

0
0

GET
H/1.1 200
OK ecm3 Show response
s.amazon-adsystem.com/ Frame 2D2F 43 B
479 B 311ms
308ms Document
image/gif 52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UIDB5D3048E-F57D-4798-BCC1-50AFE1835279

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Mon, 03 Oct 2022 02:57:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: YTXZD0K8M9DGQFMEY6BS

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame AF6A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tdMEjvV9R5i8wVCv4YNSeQ%3D%3D
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

15 KB
15 KB

262ms
262ms

Image
text/html

23.72.44.196
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 23.72.44.196 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-72-44-196.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:10 GMT
content-encoding: gzip
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
server: Apache
etag: "1300708-3de4-5d6ef246ef4cf"
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=129604
accept-ranges: bytes
content-length: 5549
expires: Tue, 04 Oct 2022 14:57:14 GMT

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET

ddp
pippio.com/api/sync/ Frame AF6A
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=B5D3048E-F57D-4798-BCC1-50AFE1835279
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJEI1RDMwNDhFLUY1N0QtNDc5OC1CQ0MxLTUwQUZFMTgzNTI3ORAAGg0Ihp_pmQYSBQjoBxAAQgBKAA
https://pippio.com/api/sync?pid=5324&it=1&iv=8a0f4ca1ac2de6cdffa91e63cce7f02c0b92f55be097db322ec0d07454515fbd791426b5417dce21&_=2
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA4YTBmNGNhMWFjMmRlNmNkZmZhOTFlNjNjY2U3ZjAyYzBiOTJmNTViZTA5N2RiMzIyZWMwZDA3NDU0NTE1ZmJkNzkxNDI2YjU...
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA4YTBmNGNhMWFjMmRlNmNkZmZhOTFlNjNjY2U3ZjAyYzBiOTJmNTViZTA5N2RiMzIyZWMwZDA3NDU0NTE1ZmJkNzkxNDI2YjU0MTdkY2UyMRAAGgwIiJ_pmQYSBAgCEABCAEoA&goog...

0
0

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame AF6A
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=b253633a-4f87-4d00-816b-5d13c9985a2d

0
260 B

913ms
196ms

Image
text/plain

67.199.150.85

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=b253633a-4f87-4d00-816b-5d13c9985a2d
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 67.199.150.85 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:12 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Mon, 03 Oct 2022 02:57:11 GMT
Server: MT3 4525 e1952b7 master hkg-pixel-x18 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=b253633a-4f87-4d00-816b-5d13c9985a2d
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 03 Oct 2022 02:57:10 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame AF6A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QjVEMzA0OEUtRjU3RC00Nzk4LUJDQzEtNTBBRkUxODM1Mjc5&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
95 B

824ms
300ms

Image
image/gif

103.231.98.194
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 103.231.98.194 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 03 Oct 2022 02:57:11 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame AF6A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEB4JU7Mlh29X_VORjwq8K88&google_cver=1

42 B
300 B

821ms
299ms

Image
image/gif

103.231.98.194
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEB4JU7Mlh29X_VORjwq8K88&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 103.231.98.194 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 03 Oct 2022 02:57:11 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEB4JU7Mlh29X_VORjwq8K88&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET

v1
match.sharethrough.com/sync/ Frame AF6A
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:CBF888B986A14940B2B742F09F217922
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=eQg4rXtdM_RiCmipdlkm9Hdabf1iCGr9Ll7YIHYa
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3DB5D3048E-F57D-4798-BCC1-50AFE1835279
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=B5D3048E-F57D-4798-BCC1-50AFE1835279

0
0

GET
H2 200 B5D3048E-F57D-4798-BCC1-50AFE1835279
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame AF6A 43 B
602 B 611ms
207ms Image
image/gif 18.136.93.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/B5D3048E-F57D-4798-BCC1-50AFE1835279?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.136.93.127 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-136-93-127.ap-southeast-1.compute.amazonaws.com

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:10 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame AF6A
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=a7820e1a-7af3-4c11-ba6f-97b933883918

42 B
507 B

909ms
300ms

Image
image/gif

103.231.98.194
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=a7820e1a-7af3-4c11-ba6f-97b933883918
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Server: 103.231.98.194 , Japan, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 03 Oct 2022 02:57:11 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=a7820e1a-7af3-4c11-ba6f-97b933883918
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 313

GET
H3 200 b4aq_x9zMiku-4ayY0gQrcEuJNMSghrM2Nuaea2nyAg.js Show response
pagead2.googlesyndication.com/bg/ Frame C5CF 36 KB
16 KB 193ms
193ms Script
text/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/b4aq_x9zMiku-4ayY0gQrcEuJNMSghrM2Nuaea2nyAg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

sffe /

Resource Hash

6f86aaff1f7332292efb86b2634810adc12e24d312821accd8db9a79ada7c808

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 28 Sep 2022 18:34:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 375779
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15966
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Sep 2023 18:34:11 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1FE5 0
20 B 197ms
196ms Image
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BkT5KhU86Y8DoAZfYvQTm_azQCgAAAAA4AeAEAg&bg=!paalpuLNAAYQgTJdMIE7ACkAdvg8WizOWeL0o0TEHMhqwdt5heKzLHnnP3i_nqwNQd2Vt_gSSdlKcQIAAABvUgAAAAFoAQcKAGIuoeCi7UNftazWtUJnmbh4dD9I2JIF6I3IunKLk5JnpkTa1_zWS7-CVMI5Xs6AkSvh4TfckSA-k_IQmsIoaZPP3_YSDFDoqli6dq3tUrk-6a24JrkgEvxgUW84JauJXAyYZJkC6u-oyubm1J6xqo4zsnkOVofZ4dpIabYYgYbiS3VvVSOdEff55sPHPXLo2cYPp_d7OLwg-8aqyEDw_ughBwq_B5jZkDmASWJ1PSgt_IsmKMiX4wnAPe_W4qWgbANQKp0VFquW0Bxh1EOX5fIuvcBWbrAwExk0bAabvszwoPYR-u1xuEWrFlriuWzewGMpIhIwro4TReFb27q0QJ4RocX8e-G-JYMRqmj2z4IwX7SWxoJZbk_e2mYW1VnOgKOmUtyPFrD_V2_j9Tgh8yT6buD4ExJDH8-qacxmMTIXEfi-TGj_ulAKINOboviLSRScpqborDJcr_fttKqowbCUYHUTTxqIOxuGONUwc4t2cKVQgl6Uhl062AVgEolD1ZejTDK8vRERvnsIuajqd_VaVF56xLHzCLl-2bf5e9dlusO9-V0a4-tT6CDqoqB1kDaZ7MTrOh74q12fo4whvN5mhyIOl6xGeplzGdhSehNcboWHICVejFckZgtbJQJUtUASBQ5qUhRKaeARvph6rKAohJJ12zqrEx8bU7ux8cDVWOaTUxTmarWiYYF3gdYqtqAncSoyIaEhTEMo5tYTiznqLwGF4Cz6f6WmHGE_sC-YOC1V-3ms6aaUdBwXH5g4A0XASOqltkQKdWtwenkQxRmwRCV6W7G3QN5nIUjrTcxJbxqT-XLj4_bUWY7BDYtThu4PO9qGQZLTK-8t-itK6Ne0yI6V9eJCou_wHIt6tsQSKYvkWmNVnbza70K5nyFP92i8QWovbcGn1KFk4iAUvdABYSigdYZdAsADhcmXHFBZ6fk0b4tWj9lXZFX5XmK0JbiLxdeHSZ88TJDXols6CCdK35fEWzyEhNpWAZC-_m7iC9CzCPFRqTBHiMgQFgsWox-RvsoDLrX4nRGMCU1BUR5avJwXQG-D_eAAPyEUJuta2K0N714BNGaJu5ZlSHqU5aeAUrkNYJB5iegJDtnaR-a0BwlUwOyaHpSaex383ZDq

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 06AB 0
55 B 382ms
209ms Ping
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvvx7B9x-U_a7yp5dEo4xhudKhKGXxFgPjY8esSJn1x-CVztG5ErBdsRfLKYoGOGa78aTcmQbfDquQOwbLPm0aE-81lH09ujsr_TBiqNoy-crH2m2dpETD7XotyDl6InHLHnG6eY7BUGjFJs1NMRJde4xCSujA6gEQONGckmBphdFIYVZlK0tg_UPVnNAlwBDQohBt1NZ3U0lfSa9bA1vFgG_GCV7VvM-uSnIwGxVv9FUjpOa4o3vCQC79dIqR9x81pV322RT0ixrB58hCR-WJOgMNYwco4wTC8Y9dhiU1Oh_0GjPKVvZ7NE8ZdmJDTW_Gb7q3yr_QYlqmC-5lcb4DnAOI5rl4rV3b-P9t3gY-4msys7cUl2MQOwxtGrau6XMQAVmAz_jvKlHPjv71kmaR40oZBjkpi_Sz4GFOWY3kykAGm0_CRiL5Oip9EyKOKgvf412Nitmu9DRAdCJN1o-G_BcQ9Q9LFD47HII4rYjyIrJgdL0DrL4wLcIzQrV1RGrP6rLXdJE6-bq5QzeGq1v_68vXCuwLH5vC-SccQAx0emLtF0dQ5Cw-kvT8AluYuxsVGUgb7w5alTXz3w6yOvvQASZb1XDAjEd36elBVpvMWwQvUWP5z8XMfYRES942uvvk-Lm9ZQv7KX9vqVVPKwCGHCKjBU0R6sQ4NN2OSbODQDOzaWngJXRWZcOdjyvmzTT0OPwo80xenAvrjDB6b4pQE-ml5t8qtp_V3coT5zfAVnDIAIDCf1l4CtnivfucxcG1bsav_GWnJ9zlX_3gHD-JLZrJ1keHnE8IfYmvhjk77h44nK1SL0ikmQe68SoApPJIdIIyi_ni5j5jl_jHKN-JJy5893eMecLh2HVrWwmKk7KMbgHEuz5Ec1Iz8Et6If6L0nqR5pHUyBDnLJEp-BtgylscaCKL82TTwpFRkQ_BVaMo6PvtPz4ynnoGBTIUoEGyPL4T9JRewwQ-_eIdGcEqfpBspjf10Iww_KglaZUn8hv1LXvPyx7DalinSngcYFYp7SHBCjSYL9ZU9XRXiPhDbs6FMUYMzZiR2-9OYnY52Drd9T1ipIbBJOCr_7zlm_zt48vnwjqUEG6s_lzchEh0i8AaQ7g-tzQJUQSj5wbG46jEVZztjGq_DyhhbUB-BX0x3FETtkSnMUQP5OUXuSMasLd3Myu3BRVNuHz2ysim-UTqRhFrGsj7JXhPrc_9__uR7jZ6owmo8clfwjM1gjvQG9Xf5e1DHFWPlEnmiuSp3zqEaOhI-p6TZ&sai=AMfl-YREXa-WFul6Xmac8En7pDIoJyodg4h8XhdMRCc5syvn6w3e7-SauiFJx_nO_bCxzxJMHf2QYQR3y4CARudXJRbPwOmkm4z7d1fh-7qnFMkk7gHVauG5qfQGx4hutePhp01xd4D9mEbPAChCJLOqHYWtjQyCYGRf8i8zOSh_2g7OP77ofcqZaCVTAoGGPfhYdoOaflkGHyvs1V0zzSWfPQwUxVp2ev7OIC7w&sig=Cg0ArKJSzHNeCLxpb9ypEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=745&cbvp=1&cisv=r20220928.14463&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sl-in-f156.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 03 Oct 2022 02:57:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 3281129904874203120
s0.2mdn.net/simgad/ Frame 06AB 38 KB
38 KB 747ms
577ms Image
image/jpeg 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/3281129904874203120

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

1fda3689c8ac609a55c5ec145333edc4fd6d4561d0bdfd200691f40ea0a1bf67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:56 GMT
x-content-type-options: nosniff
age: 9014
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38482
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:56 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 40C2 0
55 B 365ms
208ms Ping
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstRX0fHXzEIPxSrR6ElzXWUfvrf4IeOwBhPCRSp16M1965SvS4m0u7-4eYGmvDpOQ37VIaKVaWcy4nhd0wkJXuPILamvmiXBtCTZ9WE5Ir5W4qtb4AsZnC-7OjG2NI116DAGNRt30eAH0TnoIzivb82R5BbrZ-iTe3gmhabdJg4BgStKvbnhMIuoudMb0sd8hOxp2Jgv0yWO9AJMqLrsp-hK0Q8ryGU6X1JCI4ndOA1oxbYssjds4F28e771MQfBQlgMBlC5VRSpvTmWYE35ebE4_l7nwRFIEDN5dPy5fBJOhIZsAn5Ad1rQgLUwpr1d4w68zQ6zaVXUKhrdaNqBWak9JSj8gB3J9W1ktkUHt8WGdPaqEtzSYvgu5ZJ3R4Edru8LnaBQg1Gxove3BZ_o9ggMg79Us8VKzYEkxp296tqR4IO1q4mdaKPcTSlORu0wfKm3xtxdwDBAPpAD6PIHJuisRJqYoaeghyBds_D5mXkG19D5fXukvOtfpgzyPBEiopLAPq7B4U_vNMf7cJCsnO73UaYSesyIOaDateWyd7yPA24JpRnwDdsLt7WarDQ8TbAqDhaCcGpbWvvaNTXyTAJ79NpZ8vz8euC4WOA2TH-p6_b9zDV7cJPIb64QCkelhyRnZ1x0gFWSfIn3Rs07fDNRfFoKznpZp-GKInBGDlgLijdRv-6uzVMelv9wvEkPNqfWPTxXwFjyHq_8ZId4ZHW_DFFeuWyWS8L7HAbq8AwaMPMkKAQl3_CxsgqdTDnWv0itU6_Ir-y_C8O-YM2D7Ye4QaM56dB63tMoZ83dK8H9b4I3v_yDXSAZG7eKCA1Ibl73gK6C73bvlB4spgasIW0BmqJG_FR6pTOiwyZtTMqRADkxtGsGj08D-KIgplPUj3cdDwHV3O7Foe4O_bb9OsivaHXS5TfTP9RtxRxzjhXBRGqwGv6Fyg6HlJZ4ZlHsc03K6Ef-OIU5irAKhwsnrNSyhvKgZOfVWSOEYebmxPX2uxICwB6ZIArgnqNrDuS5iZl6heXxNAHlogwrBwMvgI4pFwNAtmx9_N865G0p-ftjX7YQqNA8afV_UsUJF4pSrLNnxXkb4sdEjR9ySfXkKTyLrFQdDKUpHoRFta6EK9Tqdcl14K2meX4eliSUwiuPpbFi4kSlpc62wllKw7fgV7Ta7g2rcl6rIyZHv2fP4OtYhR4Hvsk_7rR6i5fL1UZRHZEURZUcuDtWjfJND-FLhwTeLKLFwcNv8-_veaiEpm5&sai=AMfl-YS_ywc1ADpQdHiqmvpIwWS5rIzM99PaGhPYpVOioua8MF8d_tHcmfP9W9cQwulFdrsEFjlzUlDrbgr0GQ1eJNsZ_VyBmjhqBu2NLNtMAisaA6j8f3-NmDzWwayMY4Sr52UxjM8GS7IaSw0iot7XCJs8A1LKS_dDLHbquIaiTtHdhPhhFnWs0_7gzb4n3T5xJXBN4PLyuup5pj10A1SZbtxuthjYPGGg8Oow&sig=Cg0ArKJSzJ2rrOpF_eo8EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=897&cbvp=1&cisv=r20220928.71245&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sl-in-f156.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 03 Oct 2022 02:57:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 12210180036776569841
s0.2mdn.net/simgad/ Frame 40C2 34 KB
34 KB 358ms
204ms Image
image/jpeg 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/12210180036776569841

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

acd687db295a95f20001a6a8a6712944fb246b40b86589bc77947326e62dc3ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 02:03:36 GMT
x-content-type-options: nosniff
age: 176014
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35039
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 07:15:41 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Oct 2023 02:03:36 GMT

GET
H3 200 3281129904874203120
s0.2mdn.net/simgad/ Frame BB73 38 KB
38 KB 341ms
276ms Image
image/jpeg 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/3281129904874203120

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

1fda3689c8ac609a55c5ec145333edc4fd6d4561d0bdfd200691f40ea0a1bf67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:56 GMT
x-content-type-options: nosniff
age: 9014
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38482
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:56 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame BB73 0
613 B 274ms
207ms Ping
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv45BPMU0x3jc4lennjzE-ahQ2R4mkvgrjXzRA8f4Hmh0AIXbiLaK9UZbYmI0tjLT5aRxYKkiTflJy5b_kTK72aVPBPDsx8ERML5TR4ia8X9zIwaIbwQEhiWTOLCdjYB3CmXUXpAbZWLX4YhYGkPFJccjUNRsNrEZlk-tGaZpHaMSGpLIY7oCLKzri6TwIEIQYAD_Bms3aY0NZOd_XJcCcydp4deV56FVMEEjQRoiQy2hgdXcE0Z3fnmgb4ZrnnPtAZzx9i1Z3R9kGInx0WIQqnuXYvzGzHsXJgPpPPGeKIMICo30AmZKiP_fZ209W0O32srhVok3o-3gVsR_tHk6-Fi7D6HZnokTNQLL0JVEhqq5rQmBJLpAWkpbkz99K-qE2BF57WKceAIjKiQHJ1ScgkkNPEwcoPd04vXuZCJqkdqKHoS83fIgB1fiHEDZbPdq9TEhvaNFqRrjZ5EGoJ9thi2NcZuuHruiVoHe_tk2VXppzoRqmuoUmy0Bt-kQLceKJBv3-xgatMcEhdD0stGRDdPfLLjB7kNWKhH4brct0FPcqEctSAJ3xuB5cKTR6_XvaTB9dw32FqCLdj1CkRmp8ooL_OeNe1i3_SqsrL86MpMYZwowlNwrcoUTDrDFka2Zlg0_lMc48_1xefVsNUSA14pO87IxUVsle0JeXgWxvCkpSRDNs6aPkxk4IQ7AZ156m3fnBwt_VSp4a-efIm2UOVB2vRF-ZNc4lG2f6AvSNsm4KXrvCAi1JHQVDFWvbX3OmGKBTSPVoHMhTXexKdyq5J2oBUQ8KXC_l1aHyxgYHw33XeexTuQyhuXhbf3yO_9cmUe3Dv20A1dfA5s6uYwfEY6mQPKKTuxf9Kx0856GAfK5105kO9yUf2FR0JsUXtwPkhfZKhl0SN_SrUpkrA-cb1WQkWqyUnqJzm8iqrOpBbja1SL5Hxvv_m5oQOYLyfVEET5rYEiarmhRm-7szec0VXgE-X1BZL8FK9xaPKjPSUP4qwIlTYUeZbnHrOZwWh8wxqJnOZWVnFgo3RiIw3VGZ6mI-GWEz_gbD3OzvF5w9MFpEldYQq8O5RBbxDXy97cpYkTJfcWI2MmE5bpPQ2noY7DI_JTq3jxhUpYF9kJMWLBLXRdpRPL97iO8FSz92UvxzdpnQ76AOJvD-Rhuezcn5DhECQJkMlktvPrWIRrCCsYmiUwPS21kUFGW17_yxdjtYaIaAGXbD06-u8Wee5jprBYzL79J7G_NCDrjXxFJxTZWiuSoSYW-ZW&sai=AMfl-YSP23NU3RjVX06TsEWhkFkN2MdfKnlzqDiCFt9HSuTodPIx4FSlu6tVW8PeadhryF1c2JZFlyfGYHn4ZP3OT_gbspK0_cHRGOMuCMItpUSS_Uzg7sEL9wyxvuYjVFC6BibIk1hIwpxyuE2bkgjDX_OuO8H9HXGTPAsEsHmrowRy2pk9n233rj8PinAFxLrVMOoSnvfz_caVDCNJ408TAdZUcQ9byxXaN0W9&sig=Cg0ArKJSzKwZSmRXOzEgEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=903&cbvp=1&cisv=r20220928.08965&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sl-in-f156.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 03 Oct 2022 02:57:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 045F 0
20 B 197ms
197ms Image
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BefQmhU86Y56iDc-DwgOu9ISIAQAAAAA4AeAEAg&bg=!paalpuLNAAYQgTJdMIE7ACkAdvg8WlB1S23BegQwLCqWcJabU9E3r84xcWjSoe7bhlL8OByP63yORgIAAABEUgAAAAFoAQcKAEc5bkGP4pW3v4bVZaZQ3v3FeJTXdauusE2_oxzYrsNDcvbFULsj9GhKr3kBA0vtx2CpqcUD7x_-vh7EuxdcJR2S6fsOwcHecJkC7gW4sEd05_WyYVhM3K2_6kOp2CbOiOyPk7oak7_Y97HX0caqej038p6w_wlya0PzDvKwShuvvuSpVr3wPjy-l2jJcI3rOzIlibY5fSPa2jlOWJWyRPPK-wY7HQh93dZ0eYosjEB9ajOlo_I3beW-ijed7UQH3IZDwW3uFP1hVJ2jsmvpWUNB08JePCIC5O6eFI7ZpIMkneNchRUm8XntL59OtU5aut_sMPH8cEBwkdEjr7ULQ5oawCP4uTF50opDGtoEF4NDZc1g9bc_7Pnb-oziuTFgOTzWeB_5GXJZTgHkyg7DHNXPqweShV2Ki9C-oEZQVzx0zk6tPkWXBqhbbLgZ4TZlPHVsTPNFhCPhlzLymkq_eFQBkAMAIo6K7WHHL45merORc-wNqfB3Hq2fRE8Ynbis7n6cdv6Wgb8OsbkWE6fpKjfWLDEuvqx2ADL4Zw6cywVEfE09eY4Ggh4FxwpIV8toOXRQNbU1AysBVjutyNieazzrjL8dfXRUN1Zq3PjPFuyFQ7cKFLQeVeVCAtcMcuhprzrG0LJsqs77BHBMtLb7KeGeEo3qtjw8Jw5Xw1cdYJ9V4j8t2ZD43_cGX2SxN3G2-2IHOVt0toacSXZY_HgR2dgFzc2sY0W-t-MNlhS2-5LRj0euiwvXdpqM8yAqNe4SWlYIKKSq_AgamtOHz9Sl1Ab05YhlaaPR4YvSyXML8dmRWTC-q1OhWFQ4pKvA6Z965GzIW50kVWSIMJad_lgaAOKn7NuanEd9DwLQzqJrOJWpJ-6tca28DIw6xwi6v6bkdPxkpZpfI06phC71iqmTX_-ugmagmYtD7bJXNLFm4jvywK7H3TDzqlmp6WD7V8Hja6uwXR0IlgYFmK9DCUpklJ7mCGrJLF0_SpfuzCFoLo2CVjsAi8FjTS6Ae-l47CgEGTdLjXT3XqRXyZwnoda26qqXI56Fom550owsvje-3wjlILkpJ30cdFKGtGFGieQjIaQ9QU0jH2_pJQ

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A047 42 B
174 B 498ms
197ms Fetch
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsumUMn-asIe0cm87mJFAEwoaofCA8gSIr1SinN2M89vJh-IOhs-ofpubyWPXCrhszE6TXIbOdoAwOjv4V43lZjId8WKYoyU4G5254Ah9fTKcjrqsy9fvHwEA6Qgj8iWIwOHmbXW&sai=AMfl-YR-0SNOfbuH_n78hwa7J47jmuLnG1wCyd53gUG-A4vPKVU0D_WMKWh9IGmKQDmhfcNYZQb2coac6goGySifnEvcQEokKM8uTgUM1vvFA0vRDt1pN_AF5MEFKh8uDKvRKZo&sig=Cg0ArKJSzLRdHE4d293mEAE&cid=CAASKORoYQAqXKudns1cy3_pbTxD2JN5_jmpRs6nHfYcAsrKsoY23h8ON5E&id=lidar2&mcvt=1010&p=325,513,575,813&mtos=1010,1010,1010,1010,1010&tos=1010,0,0,0,0&v=20220928&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1666686559&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1664765828021&rpt=1641&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0831 0
20 B 197ms
197ms Image
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B8PQUhU86Y_K7Daq34t4PpcGQoAYAAAAAOAHgBAI&bg=!7e6l7qrNAAYQgTJdMIE7ACkAdvg8WiEiZV8B9hy6Q0Z4c0Qq8CZ7I1XC7xKRdLRCctWeH2stilCiWAIAAABqUgAAAAFoAQcKAAvGufYJxV9z80a9XZkC6p3Tz66h6Xdr0BRqJ1mtRdZwmjQzSFIITmMBIG5j1YoyegVLz0SJs9rOgoCHLL-Y0VdZ0gSGE-LscCA207jSGekkhEa88S0cjLTHqmvs_heSpYAgJOoUrcxZYh_E5vXfXKhMsSnG4ABpgy489Gv8w7fLjQ2mz4UWl35ngWYjV6No0hSlhGOcGM6gTqx6PMciLFwX8qi3ENEsDO3FDb8eP09OAXRX3zb0UatEkAlKOGFIjVC397HcN2jEkM3MeXvKsQy5WWZzJS__cp6LAWOmqK0XgB7l8YIY34hYx7La7WaF9BeMD8iIgAmvuxvZnvSnEJ8-4sR8jBHd7K1sud0z-pIyvQyimRUEJmmiotsgWIuVcPWGDCPANDDMNKyyYVYUuBbdEW4vb7Bjl7NnjJr63KofmT5uFykbPDrtKNuqd4OO4QyKdXtE_KDqsdOa0C_w8XtT8mOQonJF7tFfGyvn8ohJvpdj5VZNA-Uj8zGMYdQhAcloIjMNgJPQVNsArSd2Q2cXbu1gh-0473wO7126sYTXbs9VKS1X46gDOQ3Faup1fFjTE646Rrg6QP9Cr9h8oGdB8L_NvwyRfvkU08VbclIrdZGieB_oDZH_MrFqy1G6FQt76TJOzI5SisBb99fG-AHv5Z55Qov-3I-uW9lXg2pJx5IECkPOOcoVjwULwBWzT-4-yJvICw3s3YQUwFLQi9cUr7p8TPkLcZNxP2s5kGxzw-t07rQMRJfyjcmTuC0m8BFGEKp_Yf4zjn1PPE0p6f-vS3sBqq7pl8Mft4tftXWS7mwvfKpvluhvP1WzcLTJlZe8bqqB7RhJYAzfwzr5ytYTHpUc6tVsgNa52frBfd2A3y3cADVV8uu_y7pkcZ7pcAjbrha8qx7f9MUwAgxxPKPGzaWnEppCcPKjEvXjFju3gWA9XZigMYNaIF7rBTry---nbxzb0BLbocF22pWZ98vHNTL6ju0xC-0aBVnjmQt86skQswGPFtxL

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C5CF 0
20 B 197ms
197ms Image
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BCzV4hU86Y5_rDcun4t4PnYal2AsAAAAAOAHgBAI&bg=!vr2lvfnNAAYQgTJdMIE7ACkAdvg8Whpx_7fBNQG0rN5LCC_raUTkZU9btTiVCKI4CdzBC4sM6MlZfAIAAABkUgAAAAJoAQcKAFC2EPGzC2zOI1O4Mq3XiOjWzYkbutXVv27A2G7yD1YpK8gVApOPeqDVCUTp8cF1SBw84oNBWUH95edhFYYu7Q-HTvNjp1A8BHbQp3q4DvhtRpkC-TicUjqj-E4SXMtmsoPrJmKPbw91E_3VCdjX2Dk63CKRykZm5w8fxDc43HWUGuk8iEmXlnRowZn3zVsR7c8PWNcwi0BOSVE-WDcm082Y1idJt_UUx__LCv9iuX-bHgK-JnKKD_iBkwFx0flYaP5WvvOEqe3Z242PCAR03EArUAJ34R8BxlFXvZOE0ocFH2hRN2DZyBNUY38XMjgtdPgR7TJ5s7H2-MxrHBzEGBSoLcfSMjbOhPGlyyh4jkoyTT6dcAhr9e2T3209msoUF5ltziyuX2VaJ0xSr4pCwD4oQ9YOJZu2PiDb_INAYzCKDQWAxzQ9fHsDuett1lVJgK7mgjUGoUqWYDtfXo3m6gSTVhDYXFrB1DsrHE1ScYx9SNDyKA852AX5fX0nrYCDNf_gzg7sU0z9Musdnt5H3U7J-Re8xlcA0KFiMyVv_diHoeTsQ1_oCtMxgNmchI_ouH-qEkZn0iJqJkB7sQ_j4fY57f76w41tUb3hzad9H0TOn60bUL_daPHARZWaUMF9c9RQl5F7cB2FrvMx6wuqAO6fT732pcYl2Bt-e7BwM3XnqigutBe4quBoXRIB9mhSmVMwMasPzDHzRroPMdumAWUlhE9IeYJjZxYGShXcFLtq393UrYHj8BCd3yVXRwngjpvlN7EzUR1fMZARkCezz8aovvzKDJSv43jM1SkN37R0iAn5ht3CcyciPssYaFEbin-e-vTiqdMnn-nTl_x1zmvE7Lk3b1LdUMHz9wf8sVsPRuzZKftZYgXdY0Y_kFWvaWTWASC8qpafyuHoDyFSdg0mn95o1gWxhETk2JH3oTg3X6T1xwkjqQrPW_BjVe8exZZJdjqp12mf_wv9hmW8ZP60S0t1ZWnXQBnrdGMiRuV1y-dPSdYB8jhN5SZDtR16LdYT5Ml1iyItJLwxwUo-FSlk5MWO9j8Lz4BSMgbY_JDtzVBTwh4xRTMFPX3rEwB1Jh0nbwzKOwsRWVFqzAmXUHA1Liysi21-0HiCMTnV

Requested by

Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 204
No Content bsevent.gif
rtbc-ae1.doubleverify.com/ Frame A477 0
229 B 402ms
196ms Ping
text/plain 34.149.43.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtbc-ae1.doubleverify.com/bsevent.gif?flvr=0&impid=2c0cbc6e2f39423ea1e64b6123afbf25&dvp_ac_version=0810&dvp_acibv=&bsigr=19860153565696&cbust=1664765830832587
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal109.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.43.113 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 113.43.149.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:11 GMT
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Connection: close
Expires: 10/02/2022 02:57:11

POST
H/1.1 204
No Content bsevent.gif
rtbc-ae1.doubleverify.com/ Frame 4804 0
229 B 398ms
195ms Ping
text/plain 34.149.43.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtbc-ae1.doubleverify.com/bsevent.gif?flvr=0&impid=cc6a1012dadf4695935176321731f1e1&dvp_ac_version=0810&dvp_acibv=&bsigr=19860153565696&cbust=1664765830835210
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal109.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.43.113 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 113.43.149.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:11 GMT
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Connection: close
Expires: 10/02/2022 02:57:11

GET
H/1.1 200
OK / Show response
servedby.flashtalking.com/imp/8/189094;6695892;201;jsappend;DV360;DV360FY23StockBEHInMarketVideoAUDSKBAN160x600/ Frame A477 2 KB
2 KB 418ms
110ms Script
text/javascript 209.197.3.19
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://servedby.flashtalking.com/imp/8/189094;6695892;201;jsappend;DV360;DV360FY23StockBEHInMarketVideoAUDSKBAN160x600/?ftOBA=1&ft_domain=pastelink.net&ft_ifb=1&ft_agentEnv=0&ft_referrer=https%3A%2F%2Fpastelink.net%2F&us_privacy=${US_PRIVACY}&cachebuster=886196.4299778626&ft_dv=%5B%25ft_dv%25%5D
Requested by: Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 209.197.3.19 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: vip0x013.map2.ssl.hwcdn.net
Software: prod-xre-app3.syd11 /
Resource Hash: 2ad386a434e7f838464691eee8c0336a12d11e5f574c50da3298917adf30a2e2

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:11 GMT
Server: prod-xre-app3.syd11
X-HW: 1664765830.dop202.sy2.t,1664765831.cds024.sy2.shn,1664765831.dop202.sy2.t,1664765831.cds024.sy2.sc,1664765831.cds024.sy2.p
Content-Type: text/javascript;charset=ISO-8859-1
Cache-Control: no-cache, no-store
Connection: Keep-Alive
Content-Length: 1696
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dv-measurements3094.js Show response
cdn.doubleverify.com/ Frame 2B93 545 KB
105 KB 361ms
361ms Script
application/javascript 23.36.254.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements3094.js
Requested by: Host: pastelink.net
URL: https://pastelink.net/53fgu29a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.254.7 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-254-7.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 540f48245870c99b467d8171b70e0fac699be40281033d7d90e4a70eb4666f0b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:10 GMT
Content-Encoding: gzip
Last-Modified: Sun, 18 Sep 2022 19:04:54 GMT
Server: Microsoft-IIS/10.0
ETag: "0cf338991cbd81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 106974

GET
DATA 200
OK truncated
/ Frame A477 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7408cbca7cf7cd616151956d0bc051ad10b3ddb2bd872773f986577795104754

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK / Show response
servedby.flashtalking.com/imp/8/189094;6695893;201;jsappend;DV360;DV360FY23StockBEHInMarketVideoAUDSKBAN300x250/ Frame 4804 2 KB
2 KB 423ms
118ms Script
text/javascript 209.197.3.19
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://servedby.flashtalking.com/imp/8/189094;6695893;201;jsappend;DV360;DV360FY23StockBEHInMarketVideoAUDSKBAN300x250/?ftOBA=1&ft_domain=pastelink.net&ft_ifb=1&ft_agentEnv=0&ft_referrer=https%3A%2F%2Fpastelink.net%2F&us_privacy=${US_PRIVACY}&cachebuster=959765.2459222535&ft_dv=%5B%25ft_dv%25%5D
Requested by: Host: fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
URL: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 209.197.3.19 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: vip0x013.map2.ssl.hwcdn.net
Software: prod-xre-app4.syd11 /
Resource Hash: 6c682d8ad1a027aead5431b5793a62467ac32c7bea6e29a2b3a61baaa9a5355c

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:11 GMT
Server: prod-xre-app4.syd11
X-HW: 1664765831.dop018.sy2.t,1664765831.cds205.sy2.shn,1664765831.dop018.sy2.t,1664765831.cds205.sy2.sc,1664765831.cds205.sy2.p
Content-Type: text/javascript;charset=ISO-8859-1
Cache-Control: no-cache, no-store
Connection: Keep-Alive
Content-Length: 1696
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dv-measurements3094.js Show response
cdn.doubleverify.com/ Frame 0FA6 545 KB
105 KB 353ms
353ms Script
application/javascript 23.36.254.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements3094.js
Requested by: Host: pastelink.net
URL: https://pastelink.net/53fgu29a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.254.7 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-254-7.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 540f48245870c99b467d8171b70e0fac699be40281033d7d90e4a70eb4666f0b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:10 GMT
Content-Encoding: gzip
Last-Modified: Sun, 18 Sep 2022 19:04:54 GMT
Server: Microsoft-IIS/10.0
ETag: "0cf338991cbd81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 106974

GET
DATA 200
OK truncated
/ Frame 4804 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 23cd96106bd73fbdafa0af05f3f78d81671eaf7b287ea4e774e54340d61860b2

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 40C2 42 B
64 B 345ms
197ms Fetch
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst0RluxYfd2ThvHc2iuj65slrLmDH5SZz5M9rq4pMZrE_dqxm4es-GWQSnUrkf2-hJRYFMcxJCMz1YXw937epVn45iXDzZYQpSj_WWDVTxYxxptbHfUP6Xi1BkG-hkcslPFA2PQ&sai=AMfl-YTUb9sAWXeIlqLlVSxvy4duxBQTRbVSQ3EDIb-II9RpyAd0iL0VntNBXxRSQwhjw_lYwBLqLvg4AGt3q0db90dlcsYriz-qJb6Vrm0Li9H6OVF1tgafdL6w8QGXaxQ0WTw&sig=Cg0ArKJSzOLIqU3LT0_dEAE&cid=CAASKORoKp5j2YRBsO7p-k5b8PfhmraAuRKXhx27RmmACM2rSm4Ulqs7Xtc&id=lidar2&mcvt=1042&p=1105,436,1195,1164&mtos=1042,1042,1042,1042,1042&tos=1042,0,0,0,0&v=20220928&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3402602959&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1664765828017&rpt=1835&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 2C0C
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=L8S6LC8B-1P-58LZ
https://s.amazon-adsystem.com/ecm3?id=L8S6LC8B-1P-58LZ&ex=d-rubiconproject.com&status=ok

43 B
479 B

314ms
313ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=L8S6LC8B-1P-58LZ&ex=d-rubiconproject.com&status=ok

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: SPQ2TWK45C860E1XF14J
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=L8S6LC8B-1P-58LZ&ex=d-rubiconproject.com&status=ok
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: d5a7ef20801cf5cb1ee516b6110e672f
Expires: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 2C0C
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=5yDGlGYYSLq5XoyQpYn8Ow&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=5yDGlGYYSLq5XoyQpYn8Ow

43 B
479 B

308ms
307ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=5yDGlGYYSLq5XoyQpYn8Ow

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: HREEDBNAAP44BQPYY25M
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=5yDGlGYYSLq5XoyQpYn8Ow
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: d264e84c9dc1a645a3048554992c5d82
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame 2C0C 43 B
855 B 1646ms
456ms Image
image/gif 52.94.222.140

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.94.222.140 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 03 Oct 2022 02:57:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 7070R5F3YBK6ZVSXR3QE
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 2C0C
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/--TspjIWK93R85JyxJZEDsn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5569503473443212140

42 B
689 B

796ms
198ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5569503473443212140
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 4b9b5fe4fdc8ed94e0f7cdc225df187a
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Mon, 03 Oct 2022 02:57:11 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5569503473443212140
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 2C0C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEJ3vv760ARVnEYp_ddMOsUk&google_cver=1

42 B
689 B

1000ms
198ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEJ3vv760ARVnEYp_ddMOsUk&google_cver=1
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: d335433bbbe0efeac67146df47932f6f
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEJ3vv760ARVnEYp_ddMOsUk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2C0C
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NGY1ZmQ5YmQwZGM2Y2NhNjVjYzMzN2E3ODRmMmU0NWQ4ZWZjMDhjZQ

170 B
188 B

199ms
198ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NGY1ZmQ5YmQwZGM2Y2NhNjVjYzMzN2E3ODRmMmU0NWQ4ZWZjMDhjZQ

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NGY1ZmQ5YmQwZGM2Y2NhNjVjYzMzN2E3ODRmMmU0NWQ4ZWZjMDhjZQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: f60a7260b0ebb7a40a81234af4a9e826
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 2C0C
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L8S6LC8B-1P-58LZ

0
572 B

733ms
322ms

Image
text/plain

13.107.42.14

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L8S6LC8B-1P-58LZ
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: H2
Server: 13.107.42.14 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:11 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 04B062B6FDC84B2882FAA9B36D535BF8 Ref B: SYD03EDGE1414 Ref C: 2022-10-03T02:57:12Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXqGIAO1Ti8JI28tWTlAA==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L8S6LC8B-1P-58LZ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 808ed95536e7f55d8adbcb9fc76d309d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 2C0C
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=a7820e1a-7af3-4c11-ba6f-97b933883918&gdpr=0&gdpr_consent=&expires=30

42 B
689 B

1093ms
197ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=a7820e1a-7af3-4c11-ba6f-97b933883918&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: c80248407eff6cf595ce43a76c04e23f
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:11 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=a7820e1a-7af3-4c11-ba6f-97b933883918&gdpr=0&gdpr_consent=&expires=30
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 289

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2C0C
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDhTNkxDOEItMVAtNThMWg==

170 B
188 B

198ms
197ms

Image
image/png

142.251.10.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDhTNkxDOEItMVAtNThMWg==

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

Server

142.251.10.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDhTNkxDOEItMVAtNThMWg==
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: d264e84c9dc1a645a3048554992c5d82
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A047 0
54 B 498ms
197ms Ping
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssOM9TE0_jVXZffXrrsMonJgsfxIxDPvRFCCBBBw44IRw4VpOVnOumTdp3LpFUCz1CJXgiYndLr9TSSFkTEH1tIqRtRmH4WS_0fZaryPC5gd1VnqbhZJEK6bc0QjaD9Z0-dtBzRTS8vosEqYNJNnd2AC62WPGHVMcVevvkmBlALjlLSKgx55j4sg4YBPDy7HlpmP_aWApjCiyHR0ygiKw-rvCA8f55rwpX47UM_wf-7JF7k5oqdAzWzfIwWIiA8R1wk71Aem2_3j7XVJRghCW9qSsYsBSyo5dxOwXt_eEsHmfsDLCZcOrjOY5W9wnEdORV37MH_LUoD4WqzGoebL70H8LjevkreDXn4thuXTrEQOCVyFmZ4KcnNp3pjxveknSIV-ETQ_vlRG3d4g9HPS3ywgUZ223a66wZHlVJ4uWbp0kxpTGYSoksl7Oa1yU41PpFY1JshG6mfg0hBwpfJ6r_d_Wb5f66LG-g-sNu4I2e2YlSG3S6vWAW9MxBy9X8ZPzLF038iaU32Z6vmI8PIRVQGqTk5A1WTsRV5c40Cd1_sc0hGYmCknmUTtA4aKoimq4OvljkwYSSHKm0FGGy975BSMNytYcFUS9SDr3Sz_TXLZW_Q9GQcicI9uQMoFYmN9swdfL0ABVLn61rprp7wE27krtKDy75033DWPWIH2i4FfpSGVfg9U_rIgkELAcMVrWrDnz3ZECZDsbmk8FgQogJTnTm81W7AVwu2DmLbpcfNTsURBbD7y3L8Y-ttCwszUsPCZyyWku-l2jbhyV19PIxiUSDATpuObA8nEPEl_S7WVezFOf8tItkojp7KdWJd6kdEwvTbmJZvTHOQSKIXc-YPKltmScvEstvRs0wz1-_XrHjP2ZZSXF-WDgQOwk05zX2esjC_nrPjDLqUGdN3PaOmvK1RXpNztHOwRNrylipUBUWzbmUNrHSZghbPQzX_sZo6MYzJIWtlpnZ8_V_poUHQufwOFZNdqsSyGaQIKj8xYBqX3TaPUrvoPodlExruKXhRIxRek4ocFFwe_Fm2pVVesnBLSyeD-DkfYoUvYjYkO5afD1M8swkrSy639Bv-Ed6QrFTkxhG3_-FlfRMO3j6O3rIfTkC3BlSWjFBTO731JD08CQnDHVkPpxroLAwOI9WpWQFZzN3ExCexyFrzqvGLljPHHyssnPFrC9xKXHboxptGopwQPzH3o1Nr7r8ApR5Yp5HDGTmssiWD-18HV07wikvJ38zgHpcs4JOKLtgtJgmWGw&sai=AMfl-YQ_o_HiCQsT32Raes-4q8JK-CKY2MaHUZFvPj-YsgklstgLTX9woqEqX_RBqkieEtNRLd8SoIaJuWyQfXjn0fRtLw2O0udSphrYwif6t1xPrHGpQOBHEP6iVhS69oL3RdlBLHpDjRubUJNBN84QMuUe2HPLNumbkQjybMZuM_9OOKZOc4N4ULIMj07bL7DqgJ75YxkX-PmKLDvyfK5c78myVhAcGWp2wPlT&sig=Cg0ArKJSzO9qDDVFcPrTEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1805&vt=11&dtpt=966&dett=3&cstd=1804&cisv=r20220928.48927&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sl-in-f156.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/11801784320751736007/ Frame 9E7C 16 KB
4 KB 193ms
193ms Document
text/html 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11801784320751736007/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

839f12e9d0378281911784546aa7f6eab3b6b82d0e3d1d5d7f95485f99c0c015

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 3905
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 4491
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 01:52:06 GMT
expires: Tue, 03 Oct 2023 01:52:06 GMT
last-modified: Mon, 19 Sep 2022 07:14:56 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 40C2 0
63 B 499ms
198ms Ping
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstRX0fHXzEIPxSrR6ElzXWUfvrf4IeOwBhPCRSp16M1965SvS4m0u7-4eYGmvDpOQ37VIaKVaWcy4nhd0wkJXuPILamvmiXBtCTZ9WE5Ir5W4qtb4AsZnC-7OjG2NI116DAGNRt30eAH0TnoIzivb82R5BbrZ-iTe3gmhabdJg4BgStKvbnhMIuoudMb0sd8hOxp2Jgv0yWO9AJMqLrsp-hK0Q8ryGU6X1JCI4ndOA1oxbYssjds4F28e771MQfBQlgMBlC5VRSpvTmWYE35ebE4_l7nwRFIEDN5dPy5fBJOhIZsAn5Ad1rQgLUwpr1d4w68zQ6zaVXUKhrdaNqBWak9JSj8gB3J9W1ktkUHt8WGdPaqEtzSYvgu5ZJ3R4Edru8LnaBQg1Gxove3BZ_o9ggMg79Us8VKzYEkxp296tqR4IO1q4mdaKPcTSlORu0wfKm3xtxdwDBAPpAD6PIHJuisRJqYoaeghyBds_D5mXkG19D5fXukvOtfpgzyPBEiopLAPq7B4U_vNMf7cJCsnO73UaYSesyIOaDateWyd7yPA24JpRnwDdsLt7WarDQ8TbAqDhaCcGpbWvvaNTXyTAJ79NpZ8vz8euC4WOA2TH-p6_b9zDV7cJPIb64QCkelhyRnZ1x0gFWSfIn3Rs07fDNRfFoKznpZp-GKInBGDlgLijdRv-6uzVMelv9wvEkPNqfWPTxXwFjyHq_8ZId4ZHW_DFFeuWyWS8L7HAbq8AwaMPMkKAQl3_CxsgqdTDnWv0itU6_Ir-y_C8O-YM2D7Ye4QaM56dB63tMoZ83dK8H9b4I3v_yDXSAZG7eKCA1Ibl73gK6C73bvlB4spgasIW0BmqJG_FR6pTOiwyZtTMqRADkxtGsGj08D-KIgplPUj3cdDwHV3O7Foe4O_bb9OsivaHXS5TfTP9RtxRxzjhXBRGqwGv6Fyg6HlJZ4ZlHsc03K6Ef-OIU5irAKhwsnrNSyhvKgZOfVWSOEYebmxPX2uxICwB6ZIArgnqNrDuS5iZl6heXxNAHlogwrBwMvgI4pFwNAtmx9_N865G0p-ftjX7YQqNA8afV_UsUJF4pSrLNnxXkb4sdEjR9ySfXkKTyLrFQdDKUpHoRFta6EK9Tqdcl14K2meX4eliSUwiuPpbFi4kSlpc62wllKw7fgV7Ta7g2rcl6rIyZHv2fP4OtYhR4Hvsk_7rR6i5fL1UZRHZEURZUcuDtWjfJND-FLhwTeLKLFwcNv8-_veaiEpm5&sai=AMfl-YS_ywc1ADpQdHiqmvpIwWS5rIzM99PaGhPYpVOioua8MF8d_tHcmfP9W9cQwulFdrsEFjlzUlDrbgr0GQ1eJNsZ_VyBmjhqBu2NLNtMAisaA6j8f3-NmDzWwayMY4Sr52UxjM8GS7IaSw0iot7XCJs8A1LKS_dDLHbquIaiTtHdhPhhFnWs0_7gzb4n3T5xJXBN4PLyuup5pj10A1SZbtxuthjYPGGg8Oow&sig=Cg0ArKJSzJ2rrOpF_eo8EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1640&vt=11&dtpt=743&dett=3&cstd=1639&cisv=r20220928.71245&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sl-in-f156.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/16303439989154602609/ Frame 8676 15 KB
4 KB 194ms
194ms Document
text/html 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16303439989154602609/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

da49f9618f7ab65bdc5eae51b2a36d1408ae1c4f14fe38bcaf5d8ad607ca8f6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 176010
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 4415
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 01 Oct 2022 02:03:41 GMT
expires: Sun, 01 Oct 2023 02:03:41 GMT
last-modified: Mon, 19 Sep 2022 07:15:37 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame BB73 0
54 B 500ms
199ms Ping
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv45BPMU0x3jc4lennjzE-ahQ2R4mkvgrjXzRA8f4Hmh0AIXbiLaK9UZbYmI0tjLT5aRxYKkiTflJy5b_kTK72aVPBPDsx8ERML5TR4ia8X9zIwaIbwQEhiWTOLCdjYB3CmXUXpAbZWLX4YhYGkPFJccjUNRsNrEZlk-tGaZpHaMSGpLIY7oCLKzri6TwIEIQYAD_Bms3aY0NZOd_XJcCcydp4deV56FVMEEjQRoiQy2hgdXcE0Z3fnmgb4ZrnnPtAZzx9i1Z3R9kGInx0WIQqnuXYvzGzHsXJgPpPPGeKIMICo30AmZKiP_fZ209W0O32srhVok3o-3gVsR_tHk6-Fi7D6HZnokTNQLL0JVEhqq5rQmBJLpAWkpbkz99K-qE2BF57WKceAIjKiQHJ1ScgkkNPEwcoPd04vXuZCJqkdqKHoS83fIgB1fiHEDZbPdq9TEhvaNFqRrjZ5EGoJ9thi2NcZuuHruiVoHe_tk2VXppzoRqmuoUmy0Bt-kQLceKJBv3-xgatMcEhdD0stGRDdPfLLjB7kNWKhH4brct0FPcqEctSAJ3xuB5cKTR6_XvaTB9dw32FqCLdj1CkRmp8ooL_OeNe1i3_SqsrL86MpMYZwowlNwrcoUTDrDFka2Zlg0_lMc48_1xefVsNUSA14pO87IxUVsle0JeXgWxvCkpSRDNs6aPkxk4IQ7AZ156m3fnBwt_VSp4a-efIm2UOVB2vRF-ZNc4lG2f6AvSNsm4KXrvCAi1JHQVDFWvbX3OmGKBTSPVoHMhTXexKdyq5J2oBUQ8KXC_l1aHyxgYHw33XeexTuQyhuXhbf3yO_9cmUe3Dv20A1dfA5s6uYwfEY6mQPKKTuxf9Kx0856GAfK5105kO9yUf2FR0JsUXtwPkhfZKhl0SN_SrUpkrA-cb1WQkWqyUnqJzm8iqrOpBbja1SL5Hxvv_m5oQOYLyfVEET5rYEiarmhRm-7szec0VXgE-X1BZL8FK9xaPKjPSUP4qwIlTYUeZbnHrOZwWh8wxqJnOZWVnFgo3RiIw3VGZ6mI-GWEz_gbD3OzvF5w9MFpEldYQq8O5RBbxDXy97cpYkTJfcWI2MmE5bpPQ2noY7DI_JTq3jxhUpYF9kJMWLBLXRdpRPL97iO8FSz92UvxzdpnQ76AOJvD-Rhuezcn5DhECQJkMlktvPrWIRrCCsYmiUwPS21kUFGW17_yxdjtYaIaAGXbD06-u8Wee5jprBYzL79J7G_NCDrjXxFJxTZWiuSoSYW-ZW&sai=AMfl-YSP23NU3RjVX06TsEWhkFkN2MdfKnlzqDiCFt9HSuTodPIx4FSlu6tVW8PeadhryF1c2JZFlyfGYHn4ZP3OT_gbspK0_cHRGOMuCMItpUSS_Uzg7sEL9wyxvuYjVFC6BibIk1hIwpxyuE2bkgjDX_OuO8H9HXGTPAsEsHmrowRy2pk9n233rj8PinAFxLrVMOoSnvfz_caVDCNJ408TAdZUcQ9byxXaN0W9&sig=Cg0ArKJSzKwZSmRXOzEgEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1572&vt=11&dtpt=669&dett=3&cstd=1572&cisv=r20220928.08965&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sl-in-f156.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/4680915739791191111/ Frame 32A7 17 KB
4 KB 194ms
193ms Document
text/html 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

6b7fb2822d7854c59223c7adece9d68f9c8741b8d36efc18c84b90180a52327a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 9014
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 4444
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 00:26:57 GMT
expires: Tue, 03 Oct 2023 00:26:57 GMT
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H/1.1 200
OK j-6695892-3854153.js Show response
cdn.flashtalking.com/xre/669/6695892/3854153/js/ Frame A477 92 KB
24 KB 422ms
108ms Script
text/javascript 205.185.216.42

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/xre/669/6695892/3854153/js/j-6695892-3854153.js
Requested by: Host: servedby.flashtalking.com
URL: https://servedby.flashtalking.com/imp/8/189094;6695892;201;jsappend;DV360;DV360FY23StockBEHInMarketVideoAUDSKBAN160x600/?ftOBA=1&ft_domain=pastelink.net&ft_ifb=1&ft_agentEnv=0&ft_referrer=https%3A%2F%2Fpastelink.net%2F&us_privacy=${US_PRIVACY}&cachebuster=886196.4299778626&ft_dv=%5B%25ft_dv%25%5D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.216.42 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 25d23221861a30d28e53b6f171fbc2ab92372597f13a3686ec10ff04403fe511

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:11 GMT
Content-Encoding: gzip
x-amz-request-id: 5TJGZXVYTB1B3KE8
Connection: Keep-Alive
Content-Length: 24020
x-amz-id-2: pYKyDXhQkzKy1egkE24dAONcMUIzUj/wty0eWSPLk9EBpQKm2ic7ZhHqwVA+d2VZVnIFctnZhhs=
Last-Modified: Mon, 08 Aug 2022 21:04:32 GMT
ETag: W/"9d3d20c8c8971478c68a054c9e0408f9"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
X-HW: 1664765831.dop202.sy2.t,1664765831.cds018.sy2.shn,1664765831.cds018.sy2.c
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=580
Accept-Ranges: bytes

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 06AB 0
54 B 499ms
198ms Ping
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvvx7B9x-U_a7yp5dEo4xhudKhKGXxFgPjY8esSJn1x-CVztG5ErBdsRfLKYoGOGa78aTcmQbfDquQOwbLPm0aE-81lH09ujsr_TBiqNoy-crH2m2dpETD7XotyDl6InHLHnG6eY7BUGjFJs1NMRJde4xCSujA6gEQONGckmBphdFIYVZlK0tg_UPVnNAlwBDQohBt1NZ3U0lfSa9bA1vFgG_GCV7VvM-uSnIwGxVv9FUjpOa4o3vCQC79dIqR9x81pV322RT0ixrB58hCR-WJOgMNYwco4wTC8Y9dhiU1Oh_0GjPKVvZ7NE8ZdmJDTW_Gb7q3yr_QYlqmC-5lcb4DnAOI5rl4rV3b-P9t3gY-4msys7cUl2MQOwxtGrau6XMQAVmAz_jvKlHPjv71kmaR40oZBjkpi_Sz4GFOWY3kykAGm0_CRiL5Oip9EyKOKgvf412Nitmu9DRAdCJN1o-G_BcQ9Q9LFD47HII4rYjyIrJgdL0DrL4wLcIzQrV1RGrP6rLXdJE6-bq5QzeGq1v_68vXCuwLH5vC-SccQAx0emLtF0dQ5Cw-kvT8AluYuxsVGUgb7w5alTXz3w6yOvvQASZb1XDAjEd36elBVpvMWwQvUWP5z8XMfYRES942uvvk-Lm9ZQv7KX9vqVVPKwCGHCKjBU0R6sQ4NN2OSbODQDOzaWngJXRWZcOdjyvmzTT0OPwo80xenAvrjDB6b4pQE-ml5t8qtp_V3coT5zfAVnDIAIDCf1l4CtnivfucxcG1bsav_GWnJ9zlX_3gHD-JLZrJ1keHnE8IfYmvhjk77h44nK1SL0ikmQe68SoApPJIdIIyi_ni5j5jl_jHKN-JJy5893eMecLh2HVrWwmKk7KMbgHEuz5Ec1Iz8Et6If6L0nqR5pHUyBDnLJEp-BtgylscaCKL82TTwpFRkQ_BVaMo6PvtPz4ynnoGBTIUoEGyPL4T9JRewwQ-_eIdGcEqfpBspjf10Iww_KglaZUn8hv1LXvPyx7DalinSngcYFYp7SHBCjSYL9ZU9XRXiPhDbs6FMUYMzZiR2-9OYnY52Drd9T1ipIbBJOCr_7zlm_zt48vnwjqUEG6s_lzchEh0i8AaQ7g-tzQJUQSj5wbG46jEVZztjGq_DyhhbUB-BX0x3FETtkSnMUQP5OUXuSMasLd3Myu3BRVNuHz2ysim-UTqRhFrGsj7JXhPrc_9__uR7jZ6owmo8clfwjM1gjvQG9Xf5e1DHFWPlEnmiuSp3zqEaOhI-p6TZ&sai=AMfl-YREXa-WFul6Xmac8En7pDIoJyodg4h8XhdMRCc5syvn6w3e7-SauiFJx_nO_bCxzxJMHf2QYQR3y4CARudXJRbPwOmkm4z7d1fh-7qnFMkk7gHVauG5qfQGx4hutePhp01xd4D9mEbPAChCJLOqHYWtjQyCYGRf8i8zOSh_2g7OP77ofcqZaCVTAoGGPfhYdoOaflkGHyvs1V0zzSWfPQwUxVp2ev7OIC7w&sig=Cg0ArKJSzHNeCLxpb9ypEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1558&vt=11&dtpt=813&dett=3&cstd=1558&cisv=r20220928.14463&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/53fgu29a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sl-in-f156.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/4680915739791191111/ Frame 783F 17 KB
4 KB 193ms
193ms Document
text/html 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

6b7fb2822d7854c59223c7adece9d68f9c8741b8d36efc18c84b90180a52327a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 9014
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 4444
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 03 Oct 2022 00:26:57 GMT
expires: Tue, 03 Oct 2023 00:26:57 GMT
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H/1.1 200
OK j-6695893-3893991.js Show response
cdn.flashtalking.com/xre/669/6695893/3893991/js/ Frame 4804 92 KB
24 KB 405ms
104ms Script
text/javascript 205.185.216.42

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/xre/669/6695893/3893991/js/j-6695893-3893991.js
Requested by: Host: servedby.flashtalking.com
URL: https://servedby.flashtalking.com/imp/8/189094;6695893;201;jsappend;DV360;DV360FY23StockBEHInMarketVideoAUDSKBAN300x250/?ftOBA=1&ft_domain=pastelink.net&ft_ifb=1&ft_agentEnv=0&ft_referrer=https%3A%2F%2Fpastelink.net%2F&us_privacy=${US_PRIVACY}&cachebuster=959765.2459222535&ft_dv=%5B%25ft_dv%25%5D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.216.42 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3e85ae8b62a5de9ba0cb2f2ca840cbfda4060e1f3cbe994c12396524da2550db

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:11 GMT
Content-Encoding: gzip
x-amz-request-id: KWKW6K0GHH7AJ2NH
Connection: Keep-Alive
Content-Length: 24092
x-amz-id-2: j4yiDGm2yE4HEY/iHUIDH93Vwes9jDcNsyV1O6F6ypOV4dNwfydEj4hFrWemIAZO8/bJGWvb/b4=
Last-Modified: Mon, 08 Aug 2022 21:04:42 GMT
ETag: W/"ab03e529c7b8a188c57ed505f721ae88"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
X-HW: 1664765831.dop202.sy2.t,1664765831.cds204.sy2.shn,1664765831.dop202.sy2.t,1664765831.cds022.sy2.c
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=1199
Accept-Ranges: bytes

GET
H3 200 32fad7e511d4b8b7fedb11c9cb2d77fc.js Show response
s0.2mdn.net/sadbundle/11801784320751736007/ Frame 9E7C 75 KB
19 KB 194ms
194ms Script
application/x-javascript 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11801784320751736007/32fad7e511d4b8b7fedb11c9cb2d77fc.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11801784320751736007/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

1d89d1a8fb2e732a747e86df51b772dc67867ff1c8514f1b17a93d1aded6a4b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11801784320751736007/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 03:14:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85367
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19536
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 07:14:56 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 02 Oct 2023 03:14:24 GMT

GET
H3 200 263a85bdc262033b94b85a8adf74c201.js Show response
s0.2mdn.net/sadbundle/16303439989154602609/ Frame 8676 75 KB
19 KB 200ms
200ms Script
application/x-javascript 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16303439989154602609/263a85bdc262033b94b85a8adf74c201.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16303439989154602609/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

91d949c6ce449015804a85f8d5f4f9d08c387b2530308cd9969448d002b65195

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16303439989154602609/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 02:03:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 176005
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19563
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 07:15:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Oct 2023 02:03:46 GMT

GET
H3 200 863f13e8798c9ba9efda507e6cf473e2.js Show response
s0.2mdn.net/sadbundle/4680915739791191111/ Frame 32A7 64 KB
17 KB 201ms
200ms Script
application/x-javascript 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/863f13e8798c9ba9efda507e6cf473e2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

ecb222a25a53b48dcced1e2237e24bed3ebd1726e8e4c491a7dc80f881023cea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9014
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17355
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H3 200 863f13e8798c9ba9efda507e6cf473e2.js Show response
s0.2mdn.net/sadbundle/4680915739791191111/ Frame 783F 64 KB
17 KB 193ms
192ms Script
application/x-javascript 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/863f13e8798c9ba9efda507e6cf473e2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

ecb222a25a53b48dcced1e2237e24bed3ebd1726e8e4c491a7dc80f881023cea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9014
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17355
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H3 200 user_uploaded_garage_gothic_400_normal.ttf
s0.2mdn.net/sadbundle/11801784320751736007/fonts/ Frame 9E7C 45 KB
23 KB 193ms
193ms Font
font/ttf 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11801784320751736007/fonts/user_uploaded_garage_gothic_400_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11801784320751736007/32fad7e511d4b8b7fedb11c9cb2d77fc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

86366eb9905cc4734aa4b295f5d91c5d02c1cf26c0c05f952bd638f8f180de4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/11801784320751736007/index.html
Origin: https://s0.2mdn.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 02:27:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 260978
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23451
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 07:14:56 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 30 Sep 2023 02:27:33 GMT

GET
H3 200 user_uploaded_brixton_lead_400_normal.ttf
s0.2mdn.net/sadbundle/11801784320751736007/fonts/ Frame 9E7C 1 MB
604 KB 197ms
196ms Font
font/ttf 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11801784320751736007/fonts/user_uploaded_brixton_lead_400_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11801784320751736007/32fad7e511d4b8b7fedb11c9cb2d77fc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

23cf10e6885b8282707433ff5398ea37d5e087ca0b4d4574ebb9749f23d39321

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/11801784320751736007/index.html
Origin: https://s0.2mdn.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 02:03:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 176022
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 07:14:56 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Oct 2023 02:03:29 GMT

GET
H3 200 f9aa447af3fa8808f4c1a99889848920.png
s0.2mdn.net/sadbundle/11801784320751736007/media/ Frame 9E7C 50 KB
50 KB 900ms
899ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11801784320751736007/media/f9aa447af3fa8808f4c1a99889848920.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11801784320751736007/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

54422bff5f297db48012ba2d3fa5ded1524fd083bd7124578f3ac2907a58fbc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11801784320751736007/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 02:31:13 GMT
x-content-type-options: nosniff
age: 87958
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50932
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 07:14:56 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 02 Oct 2023 02:31:13 GMT

GET
H3 200 ef46e956ad5ad6728d091061bdb045ac.svg
s0.2mdn.net/sadbundle/11801784320751736007/media/ Frame 9E7C 29 KB
12 KB 904ms
903ms Image
image/svg+xml 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11801784320751736007/media/ef46e956ad5ad6728d091061bdb045ac.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11801784320751736007/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

80020dea2d69183b36333ed89062b8827822803e7927f6cd97a5b9455ac3f3e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11801784320751736007/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 02:03:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 176022
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12354
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 07:14:56 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Oct 2023 02:03:29 GMT

GET
H3 200 3de19605ba2ed53851f1ff067faf7905.png
s0.2mdn.net/sadbundle/11801784320751736007/media/ Frame 9E7C 2 KB
2 KB 906ms
906ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11801784320751736007/media/3de19605ba2ed53851f1ff067faf7905.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11801784320751736007/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

42ec0652b11694f171c5eb365cb708b7d890278b9db280ccffd7667dd41750c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11801784320751736007/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 02:03:29 GMT
x-content-type-options: nosniff
age: 176022
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2373
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 07:14:56 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Oct 2023 02:03:29 GMT

GET
H3 200 user_uploaded_brixton_lead_400_normal.ttf
s0.2mdn.net/sadbundle/16303439989154602609/fonts/ Frame 8676 1 MB
604 KB 681ms
681ms Font
font/ttf 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16303439989154602609/fonts/user_uploaded_brixton_lead_400_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16303439989154602609/263a85bdc262033b94b85a8adf74c201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

23cf10e6885b8282707433ff5398ea37d5e087ca0b4d4574ebb9749f23d39321

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/16303439989154602609/index.html
Origin: https://s0.2mdn.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 02:03:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 176004
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 07:15:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Oct 2023 02:03:47 GMT

GET
H3 200 user_uploaded_garage_gothic_400_normal.ttf
s0.2mdn.net/sadbundle/16303439989154602609/fonts/ Frame 8676 45 KB
23 KB 688ms
688ms Font
font/ttf 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16303439989154602609/fonts/user_uploaded_garage_gothic_400_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16303439989154602609/263a85bdc262033b94b85a8adf74c201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

86366eb9905cc4734aa4b295f5d91c5d02c1cf26c0c05f952bd638f8f180de4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/16303439989154602609/index.html
Origin: https://s0.2mdn.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 08:46:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65464
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23451
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 07:15:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 02 Oct 2023 08:46:07 GMT

GET
H3 200 70461a6a7d0fc175507025c087e32664.png
s0.2mdn.net/sadbundle/16303439989154602609/media/ Frame 8676 35 KB
35 KB 891ms
890ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16303439989154602609/media/70461a6a7d0fc175507025c087e32664.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16303439989154602609/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

c2e41f3f8e2e68fa6a386d7623210f41ef34c763c900e977bbf1d95f8f45b47d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16303439989154602609/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 08:46:07 GMT
x-content-type-options: nosniff
age: 65464
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35636
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 07:15:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 02 Oct 2023 08:46:07 GMT

GET
H3 200 ef46e956ad5ad6728d091061bdb045ac.svg
s0.2mdn.net/sadbundle/16303439989154602609/media/ Frame 8676 29 KB
12 KB 895ms
894ms Image
image/svg+xml 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16303439989154602609/media/ef46e956ad5ad6728d091061bdb045ac.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16303439989154602609/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

80020dea2d69183b36333ed89062b8827822803e7927f6cd97a5b9455ac3f3e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16303439989154602609/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 02:03:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 176004
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12354
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 07:15:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Oct 2023 02:03:47 GMT

GET
H3 200 a30357d708cc40f0ad44c3e46d5c973a.png
s0.2mdn.net/sadbundle/16303439989154602609/media/ Frame 8676 2 KB
2 KB 897ms
897ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16303439989154602609/media/a30357d708cc40f0ad44c3e46d5c973a.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16303439989154602609/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

2eba9239b41d0f06fd7651deaf6c300dc2ea077ad0d76a40e7d6c77e840add66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16303439989154602609/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 02:03:47 GMT
x-content-type-options: nosniff
age: 176004
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1984
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 07:15:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Oct 2023 02:03:47 GMT

GET
H3 200 b2e0334380e8a08f3221596f823be37c.png
s0.2mdn.net/sadbundle/4680915739791191111/media/ Frame 32A7 66 KB
66 KB 886ms
885ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/media/b2e0334380e8a08f3221596f823be37c.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

da9c60b0d106a93a4e3a86bd5117286fad848b0ed7fc716d8bd6ea9804430dc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
x-content-type-options: nosniff
age: 9014
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67948
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H3 200 4b2b5830410f51765fafab3b12d0f86a.png
s0.2mdn.net/sadbundle/4680915739791191111/media/ Frame 32A7 2 KB
2 KB 890ms
888ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/media/4b2b5830410f51765fafab3b12d0f86a.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

35e05d6984c3fc3dba52b7e743a24e97227a3e3e4a78b264bf3ca70c3bb2d033

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
x-content-type-options: nosniff
age: 9014
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2018
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H3 200 0f42e87eff44d230c129533cc13b95e4.png
s0.2mdn.net/sadbundle/4680915739791191111/media/ Frame 32A7 5 KB
5 KB 896ms
894ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/media/0f42e87eff44d230c129533cc13b95e4.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

e3d9e48acdf852916e6677f059fe827ba0f02b1344c18041bb38b2df9caad4d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
x-content-type-options: nosniff
age: 9014
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4961
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H3 200 df7321c69808f6d38b043f22c087d08e.png
s0.2mdn.net/sadbundle/4680915739791191111/media/ Frame 32A7 7 KB
7 KB 893ms
892ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/media/df7321c69808f6d38b043f22c087d08e.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

38abcb3f3b32b445a1faad64b5310125a1e5fa26c4bcb013dc891de10184ba8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
x-content-type-options: nosniff
age: 9014
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7587
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H3 200 d9747243af16e92400789c37c0f95638.png
s0.2mdn.net/sadbundle/4680915739791191111/media/ Frame 32A7 7 KB
7 KB 892ms
891ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/media/d9747243af16e92400789c37c0f95638.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

a5b098b05270c9406c0991df49043466ac58c64ec408082cab0a66858561ca74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
x-content-type-options: nosniff
age: 9014
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7482
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H3 200 237fe1f499e2fe6068a3ab01e72b8352.png
s0.2mdn.net/sadbundle/4680915739791191111/media/ Frame 32A7 7 KB
7 KB 890ms
889ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/media/237fe1f499e2fe6068a3ab01e72b8352.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

902acf7686dd2dac908fe93f66611c03388ab7b035d089901c1ff2aa971840f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
x-content-type-options: nosniff
age: 9014
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7390
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H3 200 f452e2a452aa3b9ade8b9c981c9f4095.png
s0.2mdn.net/sadbundle/4680915739791191111/media/ Frame 32A7 8 KB
8 KB 891ms
890ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/media/f452e2a452aa3b9ade8b9c981c9f4095.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

930a5ab9e3e21a2a8321ce720d3f27338da96c95738666104a43d000c64107de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
x-content-type-options: nosniff
age: 9014
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8491
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H3 200 9abcfd0074337ceefcacc9941eacece5.png
s0.2mdn.net/sadbundle/4680915739791191111/media/ Frame 32A7 2 KB
2 KB 889ms
888ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/media/9abcfd0074337ceefcacc9941eacece5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

b471b90708736be85a9f0c9da79c1e893b506f22a2529a56d8783f4c5620073b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
x-content-type-options: nosniff
age: 9014
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2141
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET visit.js
tps.doubleverify.com/ Frame 2B93 0
0

GET visit.js
tps.doubleverify.com/ Frame 0FA6 0
0

GET
H3 200 b2e0334380e8a08f3221596f823be37c.png
s0.2mdn.net/sadbundle/4680915739791191111/media/ Frame 783F 66 KB
66 KB 610ms
609ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/media/b2e0334380e8a08f3221596f823be37c.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/863f13e8798c9ba9efda507e6cf473e2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

da9c60b0d106a93a4e3a86bd5117286fad848b0ed7fc716d8bd6ea9804430dc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
x-content-type-options: nosniff
age: 9015
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67948
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H3 200 4b2b5830410f51765fafab3b12d0f86a.png
s0.2mdn.net/sadbundle/4680915739791191111/media/ Frame 783F 2 KB
2 KB 614ms
611ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/media/4b2b5830410f51765fafab3b12d0f86a.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/863f13e8798c9ba9efda507e6cf473e2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

35e05d6984c3fc3dba52b7e743a24e97227a3e3e4a78b264bf3ca70c3bb2d033

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
x-content-type-options: nosniff
age: 9015
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2018
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H3 200 0f42e87eff44d230c129533cc13b95e4.png
s0.2mdn.net/sadbundle/4680915739791191111/media/ Frame 783F 5 KB
5 KB 614ms
611ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/media/0f42e87eff44d230c129533cc13b95e4.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/863f13e8798c9ba9efda507e6cf473e2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

e3d9e48acdf852916e6677f059fe827ba0f02b1344c18041bb38b2df9caad4d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
x-content-type-options: nosniff
age: 9015
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4961
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H3 200 df7321c69808f6d38b043f22c087d08e.png
s0.2mdn.net/sadbundle/4680915739791191111/media/ Frame 783F 7 KB
7 KB 617ms
614ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/media/df7321c69808f6d38b043f22c087d08e.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/863f13e8798c9ba9efda507e6cf473e2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

38abcb3f3b32b445a1faad64b5310125a1e5fa26c4bcb013dc891de10184ba8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
x-content-type-options: nosniff
age: 9015
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7587
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H3 200 d9747243af16e92400789c37c0f95638.png
s0.2mdn.net/sadbundle/4680915739791191111/media/ Frame 783F 7 KB
7 KB 626ms
623ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/media/d9747243af16e92400789c37c0f95638.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/863f13e8798c9ba9efda507e6cf473e2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

a5b098b05270c9406c0991df49043466ac58c64ec408082cab0a66858561ca74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
x-content-type-options: nosniff
age: 9015
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7482
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H3 200 237fe1f499e2fe6068a3ab01e72b8352.png
s0.2mdn.net/sadbundle/4680915739791191111/media/ Frame 783F 7 KB
7 KB 618ms
616ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/media/237fe1f499e2fe6068a3ab01e72b8352.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/863f13e8798c9ba9efda507e6cf473e2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

902acf7686dd2dac908fe93f66611c03388ab7b035d089901c1ff2aa971840f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
x-content-type-options: nosniff
age: 9015
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7390
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H3 200 f452e2a452aa3b9ade8b9c981c9f4095.png
s0.2mdn.net/sadbundle/4680915739791191111/media/ Frame 783F 8 KB
8 KB 620ms
618ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/media/f452e2a452aa3b9ade8b9c981c9f4095.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/863f13e8798c9ba9efda507e6cf473e2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

930a5ab9e3e21a2a8321ce720d3f27338da96c95738666104a43d000c64107de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
x-content-type-options: nosniff
age: 9015
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8491
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H3 200 9abcfd0074337ceefcacc9941eacece5.png
s0.2mdn.net/sadbundle/4680915739791191111/media/ Frame 783F 2 KB
2 KB 628ms
626ms Image
image/png 142.250.4.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4680915739791191111/media/9abcfd0074337ceefcacc9941eacece5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4680915739791191111/863f13e8798c9ba9efda507e6cf473e2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f149.1e100.net

Software

sffe /

Resource Hash

b471b90708736be85a9f0c9da79c1e893b506f22a2529a56d8783f4c5620073b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4680915739791191111/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 00:26:57 GMT
x-content-type-options: nosniff
age: 9015
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2141
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 04:05:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Oct 2023 00:26:57 GMT

GET
H/1.1 200 d9core Show response
d9.flashtalking.com/ Frame A477 11 KB
11 KB 804ms
197ms Script
application/javascript 3.1.212.219

General

Check archive.org

Show headers Download Go to

Full URL: https://d9.flashtalking.com/d9core
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/669/6695892/3854153/js/j-6695892-3854153.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.1.212.219 -, , ASN (),
Reverse DNS
Software: Apache/2.4.52 () OpenSSL/1.0.2k-fips /
Resource Hash: c860438996117d855f9a6271afe1527894080cd64e7f8cc61af36acd756230c5

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:12 GMT
Server: Apache/2.4.52 () OpenSSL/1.0.2k-fips
ETag: 5bc31bf7d4a298e1bef9d35fce222bfc
Access-Control-Allow-Methods: GET,POST,SERVER
P3P: policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Access-Control-Allow-Origin: d9.flashtalking.com
Content-Type: application/javascript;charset=utf-8
Cache-Control: private, must-revalidate, proxy-revalidate, max-age=172800
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 10814

GET
H/1.1 200
OK main.html Show response
cdn.flashtalking.com/155165/3854153/ Frame AB7C 25 KB
6 KB 103ms
103ms Document
text/html 205.185.216.42

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/155165/3854153/main.html
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/669/6695892/3854153/js/j-6695892-3854153.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.216.42 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 45c317079cfaf580e765a33b7dd4b33ada275cfb498487e7504e7bca190d3a23

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Access-Control-Max-Age: 3000
Cache-Control: max-age=1080
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 5541
Content-Type: text/html
Date: Mon, 03 Oct 2022 02:57:12 GMT
ETag: W/"baf14546d67a78f8ea03dcbab2ec5ffa"
Last-Modified: Thu, 05 May 2022 22:27:31 GMT
X-HW: 1664765831.dop202.sy2.t,1664765831.cds204.sy2.shn,1664765832.dop202.sy2.t,1664765832.cds202.sy2.c
x-amz-id-2: bdEPCYKm5rAHS7HfrjvQRJ2o04s8A/WwlefAcwfyuU0RaHhgde++VoyswmphuLOJaI2J+QzPDwE=
x-amz-request-id: 9C5VBBBM1FY99GZK

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame A477 8 KB
4 KB 287ms
287ms Script
application/javascript 23.36.254.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=1828362&cmp=189094&sid=18330&plc=6695892&num=&adid=&advid=&adsrv=29&btreg=6695892&btadsrv=flashtalking&crt=3854153&crtname=&chnl=&unit=&pid=&uid=&dvtagver=6.1.src&dvp_ftimpid=7C6E081A-19C6-B59B-9964-B5AB82CC8BDC&auevent=&430721259
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/669/6695892/3854153/js/j-6695892-3854153.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.254.7 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-254-7.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 9dc99a92f9d68c0bb47cf55e03971e0f068090465859bd483c97bf9c6fdd32e3

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:12 GMT
Content-Encoding: gzip
Last-Modified: Mon, 19 Sep 2022 15:59:20 GMT
Server: Microsoft-IIS/10.0
ETag: "0fc3bc740ccd81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3314

GET iconc.png
secure.flashtalking.com/oba/icon/ Frame A477 0
0

GET
H/1.1 200 d9core Show response
d9.flashtalking.com/ Frame 4804 11 KB
11 KB 793ms
198ms Script
application/javascript 3.1.212.219

General

Check archive.org

Show headers Download Go to

Full URL: https://d9.flashtalking.com/d9core
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/669/6695893/3893991/js/j-6695893-3893991.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.1.212.219 -, , ASN (),
Reverse DNS
Software: Apache/2.4.52 () OpenSSL/1.0.2k-fips /
Resource Hash: 6ddf94f906aef4aa43244513cbee18c7f08e92e1358669657cb1c3d08d7550d1

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:11 GMT
Server: Apache/2.4.52 () OpenSSL/1.0.2k-fips
ETag: 5bc31bf7d4a298e1bef9d35fce222bfc
Access-Control-Allow-Methods: GET,POST,SERVER
P3P: policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Access-Control-Allow-Origin: d9.flashtalking.com
Content-Type: application/javascript;charset=utf-8
Cache-Control: private, must-revalidate, proxy-revalidate, max-age=172800
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 10813

GET
H/1.1 200
OK main.html Show response
cdn.flashtalking.com/155165/3893991/ Frame 2CD4 25 KB
6 KB 101ms
101ms Document
text/html 205.185.216.42

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/155165/3893991/main.html
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/669/6695893/3893991/js/j-6695893-3893991.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.216.42 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfd1f45ddc1f115c779a139f625e62bb84cc7b0983478fa5b9a54baaccc9dfe8

Request headers

Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Access-Control-Max-Age: 3000
Cache-Control: max-age=881
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 5528
Content-Type: text/html
Date: Mon, 03 Oct 2022 02:57:12 GMT
ETag: W/"b560a125bd55da1c1e23cb43d8e35479"
Last-Modified: Thu, 05 May 2022 21:14:49 GMT
X-HW: 1664765831.dop202.sy2.t,1664765832.cds018.sy2.shn,1664765832.cds018.sy2.c
x-amz-id-2: u4s97e3tnuIUBBXN82aY1YghMpyHM8I4L3jXXchOAZcvK7qXjOn0/PytVv9/sba82qMYbD0L7zI=
x-amz-request-id: 10SB04Q9TFSWFP4A

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 4804 8 KB
4 KB 290ms
289ms Script
application/javascript 23.36.254.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=1828362&cmp=189094&sid=18330&plc=6695893&num=&adid=&advid=&adsrv=29&btreg=6695893&btadsrv=flashtalking&crt=3893991&crtname=&chnl=&unit=&pid=&uid=&dvtagver=6.1.src&dvp_ftimpid=7D229FC6-694C-BE7C-A1FA-183C8853DBF3&auevent=&491246029
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/669/6695893/3893991/js/j-6695893-3893991.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.254.7 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-254-7.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 9dc99a92f9d68c0bb47cf55e03971e0f068090465859bd483c97bf9c6fdd32e3

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:12 GMT
Content-Encoding: gzip
Last-Modified: Mon, 19 Sep 2022 15:59:20 GMT
Server: Microsoft-IIS/10.0
ETag: "0fc3bc740ccd81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3314

GET iconc.png
secure.flashtalking.com/oba/icon/ Frame 4804 0
0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4804 42 B
64 B 208ms
208ms Fetch
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstQyEx-sRjWjltZzRLVs2YsGEGPm_eM0YndJdUouAa_vwx7m-XT21BziUeTUbi6dN1HmhpS6z4ajtb8NplQYtHs4NgH69s2biEHMOXfPrUIaNaRlvuEUdwvhT4tn4NdSSbV44ov&sai=AMfl-YS_6GRNF0tanjalzA1ARDuWhif7mon6rwmQlqxsP0KwFk2CFCgdXjxvVcd6bHRrIgW1fZg6xuLEdUF5tJZ8HkaNfQI6GVWbkH0e4LRTLSXjW6p4AhW_dpO4OYpMVPXziEk&sig=Cg0ArKJSzIxgGSOcg6K2EAE&cid=CAASKORo3FLLUcGD_SdpTu2_MmKp61LNzdX6cylLm3OUIxM31sTrDwP3fXk&id=lidar2&mcvt=1072&p=865,513,1115,813&mtos=1072,1072,1072,1072,1072&tos=1072,0,0,0,0&v=20220928&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2365527928&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1664765828083&rpt=2821&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A477 42 B
64 B 207ms
207ms Fetch
image/gif 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstxvIbOhQ9iTOHkf5u5vzXkw8oM_Z6cZ6QHakUBfq_VpsQpdSrZ9K2acMmT6D-62iNPTkYGyFBk1eth_96-COL2ZgUwA2meoiRFWp6iM-d3rUGIlTs3XLR_sYrSBML1ZJCB7TpQ&sai=AMfl-YTG_jG_jIcHFfKE-KMCrmSSFkw8N07ycxWexq6w1kyUG2HLbSCIhT3EbBvADgTzOTroBj_h_5O-qH_wfmcjTHErODA6hG8hryYim_nJIjiAYY3Hx9lg0njRKBfnIiHwyXs&sig=Cg0ArKJSzGPARTuMuRiIEAE&cid=CAASKORosT8jYfRoHGvypkaXqZoeVl83tvAqXUee34dC70ZpWF3M7qlcafo&id=lidar2&mcvt=1073&p=521,1190,561,1231&mtos=1073,1073,1073,1073,1073&tos=1073,0,0,0,0&v=20220928&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2108190548&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1664765828099&rpt=2771&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Oct 2022 02:57:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET 74edff_45ca1d6addf56406.js
adstudio-asset-lib.flashtalking.com/live/shared_libraries/ Frame AB7C 0
0

GET 229ff9_45ca1d6addf56406.js
adstudio-asset-lib.flashtalking.com/live/shared_libraries/ Frame 2CD4 0
0

GET consumer-privacy-logo.png
secure.flashtalking.com/oba/icon/ Frame A477 0
0

GET consumer-privacy-logo.png
secure.flashtalking.com/oba/icon/ Frame 4804 0
0

GET
H/1.1 200
OK dv-measurements3094.js Show response
cdn.doubleverify.com/ Frame C644 545 KB
105 KB 314ms
314ms Script
application/javascript 23.36.254.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements3094.js
Requested by: Host: pastelink.net
URL: https://pastelink.net/53fgu29a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.254.7 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-254-7.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 540f48245870c99b467d8171b70e0fac699be40281033d7d90e4a70eb4666f0b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:12 GMT
Content-Encoding: gzip
Last-Modified: Sun, 18 Sep 2022 19:04:54 GMT
Server: Microsoft-IIS/10.0
ETag: "0cf338991cbd81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 106974

GET
H/1.1 200
OK dv-measurements3094.js Show response
cdn.doubleverify.com/ Frame C37F 545 KB
105 KB 312ms
311ms Script
application/javascript 23.36.254.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements3094.js
Requested by: Host: pastelink.net
URL: https://pastelink.net/53fgu29a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.254.7 Singapore, Singapore, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-254-7.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 540f48245870c99b467d8171b70e0fac699be40281033d7d90e4a70eb4666f0b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 03 Oct 2022 02:57:12 GMT
Content-Encoding: gzip
Last-Modified: Sun, 18 Sep 2022 19:04:54 GMT
Server: Microsoft-IIS/10.0
ETag: "0cf338991cbd81:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 106974

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame AF6A 0
48 B 201ms
196ms Script
text/plain 67.199.150.85

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156011&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.199.150.85 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 02:57:12 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET visit.js
tps.doubleverify.com/ Frame C644 0
0

POST lgc
d9.flashtalking.com/ Frame A477 0
0

POST lgc
d9.flashtalking.com/ Frame 4804 0
0

GET visit.js
tps.doubleverify.com/ Frame C37F 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: pro.ip-api.com
URL: https://pro.ip-api.com/json/?key=ZxSSLwZtxrKxQbv&fields=status,countryCode,region

Domain: lbs.eu-1-id5-sync.com
URL: https://lbs.eu-1-id5-sync.com/lbs/v1

Domain: match.sharethrough.com
URL: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=B5D3048E-F57D-4798-BCC1-50AFE1835279

Domain: match.sharethrough.com
URL: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=B5D3048E-F57D-4798-BCC1-50AFE1835279

Domain: pippio.com
URL: https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA4YTBmNGNhMWFjMmRlNmNkZmZhOTFlNjNjY2U3ZjAyYzBiOTJmNTViZTA5N2RiMzIyZWMwZDA3NDU0NTE1ZmJkNzkxNDI2YjU0MTdkY2UyMRAAGgwIiJ_pmQYSBAgCEABCAEoA&google_gid=CAESEHvAUMQFTkbQlhpdJumUd90&google_cver=1

Domain: match.sharethrough.com
URL: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=B5D3048E-F57D-4798-BCC1-50AFE1835279

Domain: tps.doubleverify.com
URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=859&ttfrms=29&brid=3&brver=89.0.4389.72&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETar9EEADTbpTauTau73dd_cf%60gb6c5_g7dc7h4cf3b5c7675_%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETaudb78Fah2&srcurlD=0&aUrlD=-1&ssl=https:&uid=1664765831724592&jsCallback=dvCallback_1664765831724759&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=600&winw=160&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=3094&tgjsver=3094&lvvn=28&m1=13&refD=1&referrer=https%3A%2F%2Ffb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&fcifrms=9&brh=2&sdf=2&dvp_epl=277&noc=4&nav_pltfrm=Win32&ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&adsrv=0&advid=3398311&turl=https://pastelink.net/53fgu29a&c1=3060631&errorURL=https://tps.doubleverify.com/visit.jpg&ppid=103&auevent=ABAjH0iAtTr8YdRARxYFyVllg2yQ&aucrtv=438388258&auorder=1008962086&ausite=201491245482&auxch=1&aulitem=18156675739&pltfrm=1&aufilter1=3060631&autt=1&mib=0&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=83286100409.28157&dvp_tukv=63997850.567930944&dvp_uuid=107046600.89913966&dvp_strhd=0.2999999523162842&dvpx_strhd=0.2999999523162842&dvp_tuid=1349013245459

Domain: tps.doubleverify.com
URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=977&ttfrms=7&brid=3&brver=89.0.4389.72&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETar9EEADTbpTauTau73dd_cf%60gb6c5_g7dc7h4cf3b5c7675_%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETaudb78Fah2&srcurlD=0&aUrlD=-1&ssl=https:&uid=1664765831858316&jsCallback=dvCallback_1664765831858193&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=3094&tgjsver=3094&lvvn=28&m1=13&refD=1&referrer=https%3A%2F%2Ffb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&fcifrms=9&brh=2&sdf=2&dvp_epl=277&noc=4&nav_pltfrm=Win32&ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&adsrv=0&advid=3398311&turl=https://pastelink.net/53fgu29a&c1=3060631&errorURL=https://tps.doubleverify.com/visit.jpg&ppid=103&auevent=ABAjH0iceNDUv6mq3_WT4Jlltz58&aucrtv=438385664&auorder=1008962086&ausite=201491245482&auxch=1&aulitem=18156675739&pltfrm=1&aufilter1=3060631&autt=1&mib=0&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=736180.8491614066&dvp_tukv=3983661.190001366&dvp_uuid=23909115821.192757&dvp_tuid=75487017486

Domain: secure.flashtalking.com
URL: https://secure.flashtalking.com/oba/icon/iconc.png?EDAA_icon=y

Domain: secure.flashtalking.com
URL: https://secure.flashtalking.com/oba/icon/iconc.png?EDAA_icon=y

Domain: adstudio-asset-lib.flashtalking.com
URL: https://adstudio-asset-lib.flashtalking.com/live/shared_libraries/74edff_45ca1d6addf56406.js

Domain: adstudio-asset-lib.flashtalking.com
URL: https://adstudio-asset-lib.flashtalking.com/live/shared_libraries/229ff9_45ca1d6addf56406.js

Domain: secure.flashtalking.com
URL: https://secure.flashtalking.com/oba/icon/consumer-privacy-logo.png

Domain: secure.flashtalking.com
URL: https://secure.flashtalking.com/oba/icon/consumer-privacy-logo.png

Domain: tps.doubleverify.com
URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=508&ttfrms=6&brid=3&brver=89.0.4389.72&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETar9EEADTbpTauTau73dd_cf%60gb6c5_g7dc7h4cf3b5c7675_%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETaudb78Fah2&srcurlD=0&aUrlD=-1&ssl=https:&dfs=3871&ddur=288&uid=1664765832771165&jsCallback=dvCallback_1664765832771168&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=600&winw=160&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=3094&tgjsver=3094&lvvn=28&m1=13&refD=1&referrer=https%3A%2F%2Ffb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&fcifrms=9&brh=2&sdf=2&dvp_epl=277&noc=4&nav_pltfrm=Win32&ctx=1828362&cmp=189094&sid=18330&plc=6695892&crt=3854153&btreg=6695892&btadsrv=flashtalking&adsrv=29&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&dvp_ftimpid=7C6E081A-19C6-B59B-9964-B5AB82CC8BDC&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_tcnt=2&dvp_sukv=83286100409.28157&dvp_tukv=23530668156.806057&dvp_uuid=665540983.811254&dvp_strhd=0.10000014305114746&dvpx_strhd=0.10000014305114746&dvp_tuid=1160725980311

Domain: d9.flashtalking.com
URL: https://d9.flashtalking.com/lgc

Domain: d9.flashtalking.com
URL: https://d9.flashtalking.com/lgc

Domain: tps.doubleverify.com
URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=509&ttfrms=6&brid=3&brver=89.0.4389.72&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETar9EEADTbpTauTau73dd_cf%60gb6c5_g7dc7h4cf3b5c7675_%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTauA2DE6%3D%3A%3F%3C%5D%3F6ETaudb78Fah2&srcurlD=0&aUrlD=-1&ssl=https:&dfs=3898&ddur=291&uid=1664765832792142&jsCallback=dvCallback_1664765832792292&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=3094&tgjsver=3094&lvvn=28&m1=13&refD=1&referrer=https%3A%2F%2Ffb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&fcifrms=9&brh=2&sdf=2&dvp_epl=277&noc=4&nav_pltfrm=Win32&ctx=1828362&cmp=189094&sid=18330&plc=6695893&crt=3893991&btreg=6695893&btadsrv=flashtalking&adsrv=29&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&dvp_ftimpid=7D229FC6-694C-BE7C-A1FA-183C8853DBF3&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_tcnt=2&dvp_sukv=736180.8491614066&dvp_tukv=898658987.6278635&dvp_uuid=598022509212.022&dvp_strhd=0.09999990463256836&dvpx_strhd=0.09999990463256836&dvp_tuid=1281065848299

Verdicts & Comments Add Verdict or Comment

165 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

56 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
pastelink.net/	1970-01-20 07:16:05	Name: PHPSESSID Value: ili8pg0red72rqv52571bidcmd
.pastelink.net/	1970-01-20 08:35:41	Name: _gcl_au Value: 1.1.604315998.1664765826
.pastelink.net/	1970-01-20 06:27:32	Name: _gid Value: GA1.2.184655491.1664765826
.pastelink.net/	1970-01-20 06:26:05	Name: _gat_UA-55088947-2 Value: 1
pastelink.net/	1970-01-20 06:27:32	Name: plTest Value: false
.pastelink.net/	1970-01-20 16:02:05	Name: _ga Value: GA1.2.877371335.1664765826
.pastelink.net/	1970-01-20 06:26:05	Name: _gat_advallyTrackerpl Value: 1
pastelink.net/	1970-01-20 07:09:17	Name: _pbjs_userid_consent_data Value: 3524755945110770
.crwdcntrl.net/	1970-01-20 12:54:50	Name: _cc_dc Value: 2
.crwdcntrl.net/	1970-01-20 12:54:50	Name: _cc_id Value: fc22b54cd28a6f079c36df6650c2eaab
.pastelink.net/	1970-01-20 12:54:53	Name: _cc_id Value: fc22b54cd28a6f079c36df6650c2eaab
.pastelink.net/	1970-01-20 06:27:32	Name: panoramaId_expiry Value: 1664852227778
.pastelink.net/	1970-01-20 15:47:41	Name: __gads Value: ID=8c139d71871a110e-22f65400d3d6000e:T=1664765826:S=ALNI_MbQJVzeKMw9fpez2z0QSsxISV0NIw
.pastelink.net/	1970-01-20 15:47:41	Name: __gpi Value: UID=00000a17ef53d16b:T=1664765826:RT=1664765826:S=ALNI_Ma-N30IckM0cq4VYK0YE6cUGwAdag
.pastelink.net/	1970-01-20 16:02:05	Name: _ga_S3DKHVPF03 Value: GS1.1.1664765826.1.0.1664765828.0.0.0
.amazon-adsystem.com/	1970-01-20 12:56:20	Name: ad-id Value: A8oFeIb-10t2ifDinWE9QEA
.amazon-adsystem.com/	1970-01-20 16:02:05	Name: ad-privacy Value: 0
.id5-sync.com/	1970-01-20 08:35:41	Name: id5 Value: 42d3bb36-54bb-4f8b-9f6e-0be73212d018#1664765829090#1
.smaato.net/	1970-01-20 06:56:20	Name: SCM Value: 3b716c22
.smaato.net/	1970-01-20 06:41:13	Name: SCMaps Value: 3b716c22
.sharethrough.com/	1970-01-20 07:09:17	Name: stx_user_id Value: 69c9c753-c788-4f36-ba89-92bc94fd1a13
.doubleclick.net/	1970-01-20 16:02:05	Name: IDE Value: AHWqTUmlxmgV9_juRw1KipOzSJFKBxd6HRqtxL_QYKdNfjC2ZS8UrxPjY_OG7uFvjac
.ads.pubmatic.com/	1970-01-20 06:27:32	Name: KCCH Value: YES
.bidswitch.net/	1970-01-20 15:11:41	Name: tuuid Value: e62429d9-e11f-4445-a2b3-e4c4aa4dceea
.bidswitch.net/	1970-01-20 15:11:41	Name: c Value: 1664765829
.bidswitch.net/	1970-01-20 15:11:41	Name: tuuid_lu Value: 1664765829
.smartadserver.com/	1970-01-20 15:56:20	Name: pid Value: 2570014997578740130
.casalemedia.com/	1970-01-20 08:35:41	Name: CMPS Value: 5337
.adsrvr.org/	1970-01-20 15:11:41	Name: TDID Value: a7820e1a-7af3-4c11-ba6f-97b933883918
.zemanta.com/	1970-01-20 15:11:41	Name: zuid Value: _HrWR-X0tNcHrruwK45A
.casalemedia.com/	1970-01-20 15:11:41	Name: CMID Value: YzpPhacHtwARAFazCVifyQAA
.casalemedia.com/	1970-01-20 08:35:41	Name: CMPRO Value: 4781
.pubmatic.com/	1970-01-20 08:35:41	Name: KADUSERCOOKIE Value: B5D3048E-F57D-4798-BCC1-50AFE1835279
.pubmatic.com/	1970-01-20 08:35:41	Name: DPSync3 Value: 1664841600%3A174%7C1665964800%3A197_201%7C1665360000%3A164
.pubmatic.com/	1970-01-20 06:27:32	Name: KTPCACOOKIE Value: YES
.pubmatic.com/	1970-01-20 08:35:41	Name: SyncRTB3 Value: 1665964800%3A13_71_3_7_54_220_21
.pubmatic.com/	1970-01-20 06:26:05	Name: ipc Value: 156557^https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156557%26pr%3Dhttps%253A%252F%252Fmatch.sharethrough.com%252Fsync%252Fv1%253Fsource_id%253DuFFr5RFBYgoUJbWMAWGEZKS3%2526source_user_id%253D%2523PMUID^2^0
.pubmatic.com/	1970-01-20 06:27:32	Name: pi Value: 156557:3
.pubmatic.com/	1970-01-20 08:35:41	Name: chkChromeAb67Sec Value: 2
.casalemedia.com/	1970-01-20 08:35:41	Name: CMTS Value: 4725
.adnxs.com/	1970-01-20 08:35:41	Name: anj Value: dTM7k!M41.D>6NRF']wIg2Hb9s)^jm!@wnfH8K6pQK`!5=E<L5?%M1]B'Hc_Mqp:m-!g^^OIRs66F>4:'jHwgJ-2_%nugO%v4VB%nnRx7$wa
.yahoo.com/	1970-01-20 15:12:03	Name: A3 Value: d=AQABBIZPOmMCELzG_-azmud9yjtu-vrfVXsFEgEBAQGhO2NEYwAAAAAA_eMAAA&S=AQAAAuWjccxO71kVEmaYhgjhI-o
.adnxs.com/	1970-01-20 08:35:41	Name: uuid2 Value: 6543021577934406525
.rubiconproject.com/	1970-01-20 15:11:41	Name: khaos Value: L8S6LC8B-1P-58LZ
.simpli.fi/	1970-01-20 15:13:08	Name: suid Value: CBF888B986A14940B2B742F09F217922
.mathtag.com/	1970-01-20 15:52:01	Name: uuid Value: b253633a-4f87-4d00-816b-5d13c9985a2d
.adsrvr.org/	1970-01-20 15:11:41	Name: TDCPM Value: CAESGwoMc2hhcmV0aHJvdWdoEgsI5sTs95-9kjsQBRIWCgdydWJpY29uEgsItI37gaC9kjsQBRgBIAIoAjILCOir5qe2vZI7EAU4AVoIcHVibWF0aWNgAg..
.flashtalking.com/	1970-01-20 16:02:05	Name: flashtalkingad1 Value: "GUID=53899A26B3F546"
.rubiconproject.com/	1970-01-20 15:11:41	Name: audit Value: 1\|RmzCNllvta1j3uQH9KoFNDkGPm9vV+TTNGX0SXZMNb61Mnm1d2tbLVi00ZxU5He8Rr16sn3JwsXqFTrNE4+z9kqVaHlG5SlgpmvllXEtYN4=
.rlcdn.com/	1970-01-20 15:11:41	Name: rlas3 Value: ak0BQTu9F7LgGXi/D3GStLSpkTE2iHQAKsUIGwPBSD8=
.rlcdn.com/	1970-01-20 07:52:29	Name: pxrc Value: CIef6ZkGEgUI6AcQABIFCOhHEAA=
.pubmatic.com/	1970-01-20 08:35:41	Name: KRTBCOOKIE_377 Value: 6810-a7820e1a-7af3-4c11-ba6f-97b933883918&KRTB&22918-a7820e1a-7af3-4c11-ba6f-97b933883918&KRTB&23031-a7820e1a-7af3-4c11-ba6f-97b933883918
.pubmatic.com/	1970-01-20 07:09:17	Name: PugT Value: 1664765831
.pubmatic.com/	1970-01-20 08:35:41	Name: KRTBCOOKIE_80 Value: 22987-CAESEB4JU7Mlh29X_VORjwq8K88&KRTB&16514-CAESEB4JU7Mlh29X_VORjwq8K88&KRTB&23025-CAESEB4JU7Mlh29X_VORjwq8K88&KRTB&23386-CAESEB4JU7Mlh29X_VORjwq8K88
.pubmatic.com/	1970-01-20 07:09:17	Name: KRTBCOOKIE_148 Value: 19421-uid:CBF888B986A14940B2B742F09F217922
.pubmatic.com/	1970-01-20 08:35:41	Name: KRTBCOOKIE_27 Value: 16735-uid:edb9633a-4f87-4000-a28c-f20b447855b0&KRTB&16736-uid:edb9633a-4f87-4000-a28c-f20b447855b0&KRTB&23019-uid:edb9633a-4f87-4000-a28c-f20b447855b0&KRTB&23208-uid:edb9633a-4f87-4000-a28c-f20b447855b0

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://lbs.eu-1-id5-sync.com/lbs/v1 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aax-dtb-cf.amazon-adsystem.com
aax-eu.amazon-adsystem.com
ads.pubmatic.com
adservice.google.com
adservice.google.com.au
adstudio-asset-lib.flashtalking.com
b1sync.zemanta.com
bcp.crwdcntrl.net
c.amazon-adsystem.com
c1.adform.net
cdn.adligature.com
cdn.doubleverify.com
cdn.flashtalking.com
cdn.id5-sync.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
code.jquery.com
d9.flashtalking.com
dsum-sec.casalemedia.com
eus.rubiconproject.com
fb55047183e4d08f54f9c47b3d4fefd0.safeframe.googlesyndication.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
id5-sync.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
lb.eu-1-id5-sync.com
lbs.eu-1-id5-sync.com
match.adsrvr.org
match.sharethrough.com
pagead2.googlesyndication.com
pastelink.net
pippio.com
pixel-us-east.rubiconproject.com
pixel.rubiconproject.com
pr-bh.ybp.yahoo.com
pro.ip-api.com
px.ads.linkedin.com
rtb0.doubleverify.com
rtbc-ae1.doubleverify.com
s.ad.smaato.net
s.amazon-adsystem.com
s0.2mdn.net
secure.adnxs.com
secure.flashtalking.com
securepubads.g.doubleclick.net
servedby.flashtalking.com
simage2.pubmatic.com
simage4.pubmatic.com
ssbsync-us.smartadserver.com
stags.bluekai.com
sync.mathtag.com
tags.crwdcntrl.net
token.rubiconproject.com
tpc.googlesyndication.com
tps.doubleverify.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
x.bidswitch.net
adstudio-asset-lib.flashtalking.com
d9.flashtalking.com
lbs.eu-1-id5-sync.com
match.sharethrough.com
pippio.com
pro.ip-api.com
secure.flashtalking.com
tps.doubleverify.com
103.229.206.241
103.231.98.194
104.17.25.14
104.18.19.126
104.22.53.86
104.254.148.252
104.254.150.228
104.69.148.168
13.107.42.14
13.33.30.231
13.33.79.24
13.33.88.107
13.33.88.90
141.95.98.65
141.95.98.70
142.250.4.149
142.250.4.155
142.251.10.155
142.251.10.94
142.251.12.105
142.251.12.132
142.251.12.139
142.251.12.154
142.251.12.156
15.197.193.217
172.217.194.132
172.217.194.95
172.253.118.156
172.67.202.177
178.79.155.87
18.136.93.127
18.139.54.231
185.84.60.30
199.187.193.202
205.185.216.42
209.197.3.19
23.36.254.7
23.72.44.196
23.9.185.218
3.1.212.219
34.149.43.113
35.213.12.39
52.220.40.119
52.46.130.91
52.94.222.140
64.202.112.255
67.199.150.81
67.199.150.85
69.16.175.42
69.173.151.100
69.173.158.64
74.125.200.155
74.125.200.97
74.125.24.155
74.125.24.94
01408f8061623faa6d2c0f015cd23483c3aa363c095e152f613ed94c87a5803d
02fa73100d13c90974291ee6eaf8a759fc421727ee2632a41c61fdcb8689303f
044310f45a5f75b5c510d535acdb78b42734c88cf31696b05c58be67e7c2219d
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
09be9a21feeaab2be7e38959156864c6dfd86426669b9d8004b0d736e93a65b7
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
13100cd3879e5c1385581d7c88153e60cd7c3e4b0578fe2838daa56da689769b
13b3a06a53813881a61adf6cffdde0f7916c3ba7d7117ebc06920103f4c1feaa
15f20e02ef301e62ed325d633f971c506dcf1be3458c2371b849b505bb8673dc
1c9e4c65f9d921b1c0829958cc7b2f307a3e22ac7a23e8315b6db4c0954e1107
1ca7d45c26841657f394d905623d5e5c9c7f32aecc66d66ff8401388ffc43097
1d89d1a8fb2e732a747e86df51b772dc67867ff1c8514f1b17a93d1aded6a4b4
1e7fe399c7403b7595e5407e504692ae4e0fd6ba6261bffc44f80bef676ae618
1fda3689c8ac609a55c5ec145333edc4fd6d4561d0bdfd200691f40ea0a1bf67
23cd96106bd73fbdafa0af05f3f78d81671eaf7b287ea4e774e54340d61860b2
23cf10e6885b8282707433ff5398ea37d5e087ca0b4d4574ebb9749f23d39321
25d23221861a30d28e53b6f171fbc2ab92372597f13a3686ec10ff04403fe511
2ad386a434e7f838464691eee8c0336a12d11e5f574c50da3298917adf30a2e2
2db38acd18892fd6d3b7035a30597388567ee02987d64601c8983877886f7c9e
2e68abe4eaa63ef8655118e46734567bd0850085352c47eddf019d1c37a7fe84
2e732d9584917f154bc9cf99d21a81ff38d3b509128ab9212c823d912ae63aa3
2eba9239b41d0f06fd7651deaf6c300dc2ea077ad0d76a40e7d6c77e840add66
3051295be310aee32fae99246e1198471a0782aa125206c010f3da3bf0fc3065
328f7808cfa82581e66b87932fd28a928ce58f69a388aabe667e5154c3a9a437
34c9ee51c2dd7fafb4df5f5e0bbb0a2a3508db0692f97b90b44ab89a50a545ef
35029063e2a5ce56cba3fec0420418d5e7e12800b9a77d4c5f71ba1eda308f9c
35e05d6984c3fc3dba52b7e743a24e97227a3e3e4a78b264bf3ca70c3bb2d033
38abcb3f3b32b445a1faad64b5310125a1e5fa26c4bcb013dc891de10184ba8e
3a73b36061944ebbb33696553917d393280f796e212afcd09057b441c1168606
3ab31abef139aaf53d6e3aa7c7d209132df4190bab0d7f38038cdfa8e0e7b5c2
3e85ae8b62a5de9ba0cb2f2ca840cbfda4060e1f3cbe994c12396524da2550db
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
42ec0652b11694f171c5eb365cb708b7d890278b9db280ccffd7667dd41750c7
45877403f3c1932bbdbf87c7f02f250b9ddd3d5ed4dc59b30ac9c4f876d83d4b
45c317079cfaf580e765a33b7dd4b33ada275cfb498487e7504e7bca190d3a23
4676e7602647baaf46b374fe06866f0d1d6993386531ad5152302d19267e5e3d
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
49bbad20ccb27a96fdfc238056a6756c0b6db09a489764ae4c9a04a1b0549211
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b6d244a569a8befc0b901e3dca8e82f19b188e2d3e76f7c62fce96935ed6311
4d938d94de33c585096d0a376a7fe7f0359508ea20dd26b531276bf2e16a5fba
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50a60e5e5f2e8f10a2f8685031ec9849ba8faff613139f3a402e89f25ccbbabc
540f48245870c99b467d8171b70e0fac699be40281033d7d90e4a70eb4666f0b
54422bff5f297db48012ba2d3fa5ded1524fd083bd7124578f3ac2907a58fbc0
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
57226adbc32c91a8cd4ec9ee08e4f155f3450e79256731c04f81709a58c4c1fc
5740ea039fa2894da5942c74ebbd622c42f128d2777881b5c654c85fe07cb66f
58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488
59b0485c1fec4f53ce71bbf2805f19215f6651cc406e6ff66548444594eebc7b
5ca180607fd93a9e1b6b1d03e5ac2c4d9f661f7ce867be2b9b91ba3c3e9da926
5ff2e306c2cc23ba10e3035c75bb94c95c3af84614e37b126fa894ab14f2be37
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
612ac93fa7a4f369ab6549ed35e681c03fb942081d36944edeec8b9ea3a0c1e8
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6b7fb2822d7854c59223c7adece9d68f9c8741b8d36efc18c84b90180a52327a
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6c682d8ad1a027aead5431b5793a62467ac32c7bea6e29a2b3a61baaa9a5355c
6ddf94f906aef4aa43244513cbee18c7f08e92e1358669657cb1c3d08d7550d1
6ef08d34204cfd31d34b7f4102f7c1735897594da5c7ee9efa071c04d6ddd16e
6f0507591c49aa88fab2433451c6c3154c5d4450636b43b749afa1ae2521fe2f
6f86aaff1f7332292efb86b2634810adc12e24d312821accd8db9a79ada7c808
71a8fa712da17bc9d8ecce5391498e6cf29b9834e61406c59ea0a25d0b2f2a69
7408cbca7cf7cd616151956d0bc051ad10b3ddb2bd872773f986577795104754
740f0ff702055247ccd88904b297c34ec6af5f011a4dc7024cc18df298290f42
752ff8324271233c2135a95dde8adf84e507296eacd17db421c623b0c5e5af85
7c81987e392c2d32084c5f8a1eb4a085b0dcb74f5599544444c0ebbdae18dd4b
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
80020dea2d69183b36333ed89062b8827822803e7927f6cd97a5b9455ac3f3e8
82476f0bcb8304f958253a8df6336966c1273ff5720089d7b54495306f3a788e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
839f12e9d0378281911784546aa7f6eab3b6b82d0e3d1d5d7f95485f99c0c015
84e7581561fd3acff11f06fa5a730a5957eb852153324a75dff118bcb0b59d2b
86366eb9905cc4734aa4b295f5d91c5d02c1cf26c0c05f952bd638f8f180de4b
86d8e892ceacd8c8a7e7125c68dd0e1b311f8399871b6d64b8b6795f0235c1d4
88455c9e51c8fdd216db8cfa62f5179eaac2c25076b277ca98fc5a18f59493c8
889d129904534e7eba00ee121c536ae32eb7ee069965a6a933fdc5617badb27e
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8af24d7350dbdc8eea22e4737deaa35a795b19b0560d7173113bec7e8a3effb7
902acf7686dd2dac908fe93f66611c03388ab7b035d089901c1ff2aa971840f1
91d949c6ce449015804a85f8d5f4f9d08c387b2530308cd9969448d002b65195
930a5ab9e3e21a2a8321ce720d3f27338da96c95738666104a43d000c64107de
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
9dc99a92f9d68c0bb47cf55e03971e0f068090465859bd483c97bf9c6fdd32e3
9e25469f734732205f33dd80ff8ca12080406c18d2fa99a1f368103e51f7999f
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5b098b05270c9406c0991df49043466ac58c64ec408082cab0a66858561ca74
a6b239f8cdad5923fe554248842662056e33a278b280b9b9dffb5e632e3e0994
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a7f18b9dd88458ff488af1bf4edb96c9d6d6134f72673b20066c54e3c58e80bc
aa68e17fb13028f96c0d5b38fcf7006182894eb694625f9dedf5824d5066a5f0
acd687db295a95f20001a6a8a6712944fb246b40b86589bc77947326e62dc3ce
adc95bbf12184c1a406a301d34ffb8a8fbfa10ab0639ce675eb2476a317e7c37
ae7f9c300dc88b20419cc040be2f89038803ad45cf02c55512d6836eacfc91ec
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b42f035c593881359488262fdaf928acd4b9e6129051810120cc361c2a9688dd
b471b90708736be85a9f0c9da79c1e893b506f22a2529a56d8783f4c5620073b
bec7e5a49219ef10544321dbd44f27849644f20623c16f05baeeeaa73e3b9332
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c24ccee9a35eef9e74411eac871935bdff6bcb895cce80b754b66d3e4292a3ce
c2e41f3f8e2e68fa6a386d7623210f41ef34c763c900e977bbf1d95f8f45b47d
c436c070b4846bddc3edcd9b1a64b2847af21d3725bf4e9e297c978db85259b6
c5a3d7fc1ccaaeed6f62298f0816f423d6b3f806a82f53b4affc015da457d0f5
c860438996117d855f9a6271afe1527894080cd64e7f8cc61af36acd756230c5
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
d4862d47461f6cc76c0ed47151a06e4a030a91cd028efb32cc0f2062b501d590
da49f9618f7ab65bdc5eae51b2a36d1408ae1c4f14fe38bcaf5d8ad607ca8f6b
da8438b81e390283f6eb8cc9cf49ccde3d00c954b4fbccdf6372c162c4b58ab2
da9c60b0d106a93a4e3a86bd5117286fad848b0ed7fc716d8bd6ea9804430dc9
dfd1f45ddc1f115c779a139f625e62bb84cc7b0983478fa5b9a54baaccc9dfe8
e383ed7917855bf3d2db643cf5b1b2bd2a4ce6f2dd7e44e9c54c8e7533c04dc4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d9e48acdf852916e6677f059fe827ba0f02b1344c18041bb38b2df9caad4d7
e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73
e9881b639c7528a358803222a3d5b1ea1fae69ede0ad9ee2e363be38a2712302
e9a54b0fd1b1bb2bc001e40539aede08a5ba6a90e93a1a2226ba65e46a03a548
ea911e1f073a044fa417f444f003343e78f4e59097988b08014724db5d515084
ebfd96030683611d9ed054682f1ddf8b9098bc7d10105602b338605b0ae82a9a
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152
ecb222a25a53b48dcced1e2237e24bed3ebd1726e8e4c491a7dc80f881023cea
ed6cd01c384db70bedbe24986aa85b0745f994ad71b7e5712f8a60e1ff457d7f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f03f34a896200ac3d36794a86a5b23d054f1982d05740b454078c8526a33b631
f66dc585e78bf41ae910db3ccb4cde465cb30787c3060ad83d271c2c606aa1f1
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

pastelink.net Open in urlscan Pro 178.79.155.87 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

292 Requests

79 %HTTPS

0 %IPv6

37 Domains

66 Subdomains

47 IPs

7 Countries

4533 kBTransfer

11656 kBSize

56 Cookies

15 Outgoing links

Redirected requests

292 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

pastelink.net Open in urlscan Pro
178.79.155.87 Public Scan

Screenshot
Live screenshot

Full Image

292
Requests

79 %
HTTPS

0 %
IPv6

37
Domains

66
Subdomains

47
IPs

7
Countries

4533 kB
Transfer

11656 kB
Size

56
Cookies

292 HTTP transactions
8 data transactions