kooora4lives.com Open in urlscan Pro
2606:4700:20::681a:3ce Public Scan

Software

sffe /

Resource Hash

7824408451ca83ed936e6f71fb374ccce1eef3c6931158f4aee3b46d402df650

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1064 / 307 of 1000 / last-modified: 1638813662"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26952
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 06 Dec 2021 18:47:06 GMT

GET
H/1.1 200
OK Kooora4lives.comdynamic.js Show response
jscdn.greeter.me/ 8 KB
8 KB 110ms
20ms Script
text/javascript 205.185.216.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://jscdn.greeter.me/Kooora4lives.comdynamic.js

Requested by

Host: kooora4lives.com
URL: https://kooora4lives.com:2096/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.10 , United States, ASN20446 (HIGHWINDS3, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

71895469b6ff513d909d23563b37a01f80b74341eb41acefb21d660a93d6a143

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Mon, 06 Dec 2021 18:47:06 GMT
Connection: Keep-Alive
Last-Modified: Thu, 28 Oct 2021 20:27:05 GMT
x-amz-request-id: tx0000000000000837b0b1a-0061ae4dce-25d72b1f-fra1b
etag: "e1acacc557b05f66336a68e0c755f97f"
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1638816426.dop003.tr2.t,1638816426.cds213.tr2.shn,1638816426.dop003.tr2.t,1638816426.cds210.tr2.c
Content-Type: text/javascript
Cache-Control: max-age=308
x-rgw-object-type: Normal
strict-transport-security: max-age=15552000; includeSubDomains; preload
Accept-Ranges: bytes
Content-Length: 7958

GET
H/1.1 200
OK kooora4lives.comhead.js Show response
jscdn.greeter.me/ 69 KB
69 KB 113ms
22ms Script
text/javascript 205.185.216.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://jscdn.greeter.me/kooora4lives.comhead.js

Requested by

Host: kooora4lives.com
URL: https://kooora4lives.com:2096/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.10 , United States, ASN20446 (HIGHWINDS3, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

7848e8fe8acaeb11f1fa92481bce612e12d101f25030f1cbb1d9ae4f0b6a1e74

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Mon, 06 Dec 2021 18:47:06 GMT
Connection: Keep-Alive
Last-Modified: Fri, 29 Oct 2021 15:04:01 GMT
x-amz-request-id: tx0000000000000837b0b22-0061ae4dce-25d72b1f-fra1b
etag: "821ea7dcf3435e1ee2b92f3c9340b9b5"
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1638816426.dop210.tr2.t,1638816426.cds011.tr2.shn,1638816426.dop210.tr2.t,1638816426.cds212.tr2.c
Content-Type: text/javascript
Cache-Control: max-age=308
x-rgw-object-type: Normal
strict-transport-security: max-age=15552000; includeSubDomains; preload
Accept-Ranges: bytes
Content-Length: 70371

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111300101/ 274 KB
99 KB 80ms
79ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111300101/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

151f4a405546820d8819707056417b349b5c463597ed78d413fc72344b967afc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100934
x-xss-protection: 0
server: cafe
etag: 10931032643439446866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 06 Dec 2021 18:47:07 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211201/r20190131/ Frame 4D1E 11 KB
5 KB 100ms
28ms Document
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211201/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

16923f9fcc118f6870a574a73697c19eb79210b2ce401e5e1b92a2a5fcda080a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 06 Dec 2021 15:51:56 GMT
expires: Mon, 20 Dec 2021 15:51:56 GMT
content-type: text/html; charset=UTF-8
etag: 6406113418471942685
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4879
x-xss-protection: 0
age: 10511
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 pubads_impl_2021120201.js Show response
securepubads.g.doubleclick.net/gpt/ 347 KB
117 KB 54ms
53ms Script
text/javascript 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

947dd8624842a892adc7ecc70ec3270e5792bb3cc509dd1ff5720f2f8fe66419

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119206
x-xss-protection: 0
last-modified: Thu, 02 Dec 2021 15:41:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 06 Dec 2021 18:47:07 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 193 B
150 B 66ms
37ms XHR
application/json 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=kooora4lives.com%3A2096

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3303ffe5d8f93d72bffb0050380082c6a1e558b41cba2b0a9f50903b792beebe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 125
x-xss-protection: 0
expires: Mon, 06 Dec 2021 18:47:07 GMT

GET
H2 200 1377538854.png
kooora4lives.com/wp-content/uploads/2021/03/ 3 KB
3 KB 429ms
428ms Image
image/png 2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2021/03/1377538854.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 40bcb9399f1d593a7ea38d62f7978492eb29cdfa579e614126298fa7cdff2318

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/m2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 2954
pragma: public
last-modified: Wed, 24 Mar 2021 04:26:26 GMT
server: cloudflare
etag: "605abf72-b8a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=09g7vmcJzuJ8iL3Qj0%2FGylvRDHaAB31bIvON1lBdOzaiGPLg4PF1D29Bq8jkUJfu220icZnU0el5rB8RDVJzubwrBNeTYq2tfrVOwvu49T23IFsGsJNvqNQRvYvNNFrUa2Mhy9eeb15JU1VuG1YyLfYxYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae4e0f097142-YUL
expires: Wed, 05 Jan 2022 18:47:07 GMT

GET
H2

200

download-2-7.png
kooora4lives.com/wp-content/uploads/2019/01/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/01/download-2-7.png
https://plus.kooora4live.net/wp-content/uploads/2019/01/download-2-7.png
https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-2-7.png

1 KB
2 KB

403ms
403ms

Image
image/png

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-2-7.png
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: edc6b2ff1002ed7e2d5a033e08d19ea423b262f898b4dd27c3b3ccb833714e67

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 1154
pragma: public
last-modified: Fri, 04 Jan 2019 22:53:54 GMT
server: cloudflare
etag: "5c2fe402-482"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pYFq6dMfpgQD4v40hCLe8HvDWBO7zfLKQh%2BLLfx6DGBs8Lrhof3ZmBiUjUUYKIIW6p7Kf9%2BZvD%2FU8AvqfE%2Fr4tCSs7gOo6%2BzMFSmrjIgK%2FhtHcwJ1K5ce2FBHhZB8xJUtmeGzXY5Mqbk9lZOukoH%2FfrFLw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae4ed82f7142-YUL
expires: Wed, 05 Jan 2022 18:47:07 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mm5MmJWwGbCjxrEyFuVb%2BLOyw7eNZcZKngeOnCbiA65jiJvMPCxwe1F5McJJg535YT%2BwUQa7tINwKTTooFeCp5edIP%2Bm3eZG6UV%2FLxnx8XhcKjizhZ7KTmL8IE9JvzahjlvskVBeQx6qKx008%2FGThmy3"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-2-7.png
cache-control: max-age=3600
cf-ray: 6b97ae4e78f74bd0-YUL
expires: Mon, 06 Dec 2021 19:47:07 GMT

GET
H2

200

download-1-11.png
kooora4lives.com/wp-content/uploads/2019/01/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/01/download-1-11.png
https://plus.kooora4live.net/wp-content/uploads/2019/01/download-1-11.png
https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-1-11.png

816 B
1 KB

416ms
415ms

Image
image/png

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-1-11.png
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 179344a9db700df82bbd09cea5445a926699e911484d5fd7f326ac5339151282

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 816
pragma: public
last-modified: Fri, 04 Jan 2019 23:11:26 GMT
server: cloudflare
etag: "5c2fe81e-330"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g1MwGk37Wob4Va%2F35QwLrehauJrECg3NSnHTPZD5PNwqxZa1F8jaolLBh%2FgDsHySk7sIy9a2CO%2BRPysj82SrYe%2FCZOXq6MbSMxWxNIxXQOZ%2BjmcxXJto9tO3wkzuPG6DED8YkWma6X7MuJZjV9ivxuLRhg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae4f38a67142-YUL
expires: Wed, 05 Jan 2022 18:47:07 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V9UTLtTU80sCynyIpaaHtBOyCeAwm1nmvKyTmjB%2FOI5HMEzfp7wn7kixkcIEr1jbKFiuyV2%2BuG%2BZAJK5cWG39Xm1IIHZwy5BI%2BPj1hcL6O0%2FLaaltEbXM5%2Fkpz3H9vGWmXn%2BEtA%2BmjqmNKpuBb9yLZ%2Fy"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-1-11.png
cache-control: max-age=3600
cf-ray: 6b97ae4ed9b44bd0-YUL
expires: Mon, 06 Dec 2021 19:47:07 GMT

GET
H2

200

download-11-1.png
kooora4lives.com/wp-content/uploads/2019/01/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/01/download-11-1.png
https://plus.kooora4live.net/wp-content/uploads/2019/01/download-11-1.png
https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-11-1.png

1 KB
1 KB

406ms
406ms

Image
image/png

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-11-1.png
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b3437e8b7bca98a5ba7e51ce860ea7e0422b9f77bd41895269adcb098be9870e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 1063
pragma: public
last-modified: Fri, 04 Jan 2019 23:07:36 GMT
server: cloudflare
etag: "5c2fe738-427"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fnWl3QykIt%2BnORs5yioeoUm28I9sQV8f2dPQX%2B3TH84RDZRCk8Z9hIZGt%2B1mDKwu%2FkqKx48XdESZZJBZXwcHfiVK6mFpZ2Ht%2F%2FGyXA9FaI%2BFMvJN%2FQ%2FK2UHdENzvCUOgy3n3EZ0kUe3kEA9Psc1buDyW7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae4ed82b7142-YUL
expires: Wed, 05 Jan 2022 18:47:07 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5pFvLJGC8IP8xEzEvi3zb3kGGvxeX1eVWnIOHCFPeeLagChgQQKQOZbcVcfKGX41WF9wrKKnzcrejCTFEWCjE8AyMDMV7OOlKTnBUy5aSvz4tyKcD2g5hTRuMJXbhdSTh7exjVlnCVW%2F0wUaN2FoOxqD"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-11-1.png
cache-control: max-age=3600
cf-ray: 6b97ae4e79064bd0-YUL
expires: Mon, 06 Dec 2021 19:47:07 GMT

GET
H2

200

download-1-6.png
kooora4lives.com/wp-content/uploads/2019/01/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/01/download-1-6.png
https://plus.kooora4live.net/wp-content/uploads/2019/01/download-1-6.png
https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-1-6.png

7 KB
8 KB

416ms
416ms

Image
image/png

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-1-6.png
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30c63d235979e3679e77069abc0ca1bf46d506015c0978089777bf4933684634

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 7416
pragma: public
last-modified: Fri, 04 Jan 2019 13:40:46 GMT
server: cloudflare
etag: "5c2f625e-1cf8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=durHNySrlYSsFfGyy1kbkw%2Fje8Tof7%2FrDV%2B1GPqZfoDT3XAIpPgG%2FTvlYyNHwLvACzAQA1%2BERcEVQOa1v5uy3YBllPQTl0HV%2BE1LBTkYbZTvgt4a1gwKkGHLRMS0iKH%2FerM5KbHgFM%2BWjjrVUeqeModiVw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae50eaed7142-YUL
expires: Wed, 05 Jan 2022 18:47:08 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ndaf6aj2dhYXNBwjtP%2FX1hjOU5LKXCB7jKHt%2Br%2Bd5m38suBAtLlovga32kACCk5a9OivxLeohe2wgBEO1lrKyf8N%2Fd7UhaeLFWRCvwO75jFqC2G%2FUEDpSTqipsn4xaZFiTjMaGNn9iO8j2iTxaIWMKqN"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-1-6.png
cache-control: max-age=3600
cf-ray: 6b97ae50ad364bd0-YUL
expires: Mon, 06 Dec 2021 19:47:07 GMT

GET
H2

200

180px-Arsenal_FC.svg_.png
kooora4lives.com/wp-content/uploads/2019/01/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/01/180px-Arsenal_FC.svg_.png
https://plus.kooora4live.net/wp-content/uploads/2019/01/180px-Arsenal_FC.svg_.png
https://kooora4lives.com:2096/wp-content/uploads/2019/01/180px-Arsenal_FC.svg_.png

28 KB
28 KB

505ms
505ms

Image
image/png

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/01/180px-Arsenal_FC.svg_.png
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e045ae784a5912fe98bb81005bbfaa36cef097b6a2bdd4ff1ce2fe915ac8ce8

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 28245
pragma: public
last-modified: Fri, 04 Jan 2019 13:35:08 GMT
server: cloudflare
etag: "5c2f610c-6e55"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7kO11%2BvloE%2FglEXN93yFnlaJkuNyD7gERZQXZXNgKo%2FK6cUBNXszW7IStoz%2FCTv5WuN49Omr85b3BTzGlocM4j9sU9BwW5SJ2tmgICU%2BjzV%2FvYfDXi23M6D7DeXQCPlrCVwfDUSFxecLCHVVKYF%2Fu5hjUw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae50eaf07142-YUL
expires: Wed, 05 Jan 2022 18:47:08 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yPCDAd4vsCn0JgWxPfrNDa%2FoZVpkcDDKgrtxqn%2BvxGN6h5rKf4Va7fF1mYe%2BJcTL6KjH1Pv0lgUv0HM86I2DWQQZcelFHm4ddMjNkyNKwC%2BNit3Bu%2FhtL%2F%2BC106PNpUa1PzrRDH8sJjRB3xtc96Evgsy"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/01/180px-Arsenal_FC.svg_.png
cache-control: max-age=3600
cf-ray: 6b97ae50bd3c4bd0-YUL
expires: Mon, 06 Dec 2021 19:47:07 GMT

GET
H2

200

download-4-5.png
kooora4lives.com/wp-content/uploads/2019/01/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/01/download-4-5.png
https://plus.kooora4live.net/wp-content/uploads/2019/01/download-4-5.png
https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-4-5.png

947 B
1 KB

415ms
414ms

Image
image/png

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-4-5.png
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c421ecb7612b3f46ff84c9686044c0fb00e119c63eafb4be54c39f0842fb09e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 947
pragma: public
last-modified: Fri, 04 Jan 2019 22:58:36 GMT
server: cloudflare
etag: "5c2fe51c-3b3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fQ9Izp5e43PNZ1bjlEf9K8ab%2FotyCkb7xX%2BIsUyx8W0eCqwQrC5qf2RBm1KnZ4ugbKmNpJVut5oNMoqnfUxJs%2BdoQX499bUU5otfgwNSq02QsmgrO7zKKDkRffW3%2B1T45SWdxjno91h7vM%2BsHLJlBdNXQA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae4ed82d7142-YUL
expires: Wed, 05 Jan 2022 18:47:07 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=moOq28Jd7pf235tV%2BxIlHIDrpPt63VyIDrocu2862FLKa6hAN0EYHFguIoviga340kRvXrCz33FH9tccg%2BXlQMqSjTz1ZPwgELrOd9GMnrwlIOhURtnujvXwJUv5P560biYfXPDA7ZctQQxflvBhjR2s"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-4-5.png
cache-control: max-age=3600
cf-ray: 6b97ae4e79044bd0-YUL
expires: Mon, 06 Dec 2021 19:47:07 GMT

GET
H2

200

flag_mauritania.gif
kooora4lives.com/wp-content/uploads/2019/05/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/05/flag_mauritania.gif
https://plus.kooora4live.net/wp-content/uploads/2019/05/flag_mauritania.gif
https://kooora4lives.com:2096/wp-content/uploads/2019/05/flag_mauritania.gif

2 KB
3 KB

420ms
420ms

Image
image/gif

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/05/flag_mauritania.gif
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 73d70cea0d76ca385b047d6b092fc480fa521f2cf38c9d50dabfcb1c7433ec83

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 2508
pragma: public
last-modified: Sat, 18 May 2019 13:30:14 GMT
server: cloudflare
etag: "5ce008e6-9cc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lDe6k5dH2cQhCwRFBBhCXGh7RYT2dgrZQrWQLKEpzZZ%2BSGI%2BpR4OeSxX%2FyagM75K9o6X6wI4XF33HyGPc7%2FotkILCZtC3SO7YtiJC2D6OlaFhqLu12%2FwVGO88PF7Kv73T3%2B4JO8pAlux50W0HvrJD0g2ZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae4ed8297142-YUL
expires: Wed, 05 Jan 2022 18:47:07 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2rnhDx%2FnGKIT0rTpHwluJu07Q25ZtVaaLXM0wAJYJAzS6qsW0l2uC7pR37GOSJr3pStXMzVozSlUh7K0emnH0IzPIDKyaOepPQXvoAAGj8neFuhTKjGpRWDOduZFxTvb27x6I0ceR2gz2eBt4EqFHwGy"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/05/flag_mauritania.gif
cache-control: max-age=3600
cf-ray: 6b97ae4e791f4bd0-YUL
expires: Mon, 06 Dec 2021 19:47:07 GMT

GET
H2

200

1377540149.png
kooora4lives.com/wp-content/uploads/2019/03/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/03/1377540149.png
https://plus.kooora4live.net/wp-content/uploads/2019/03/1377540149.png
https://kooora4lives.com:2096/wp-content/uploads/2019/03/1377540149.png

9 KB
10 KB

420ms
420ms

Image
image/png

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/03/1377540149.png
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e92ab3bc3d9bc6c228223f3393e594a6f05f00a85c951ff5c89957d84352fa74

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 9663
pragma: public
last-modified: Thu, 21 Mar 2019 05:24:51 GMT
server: cloudflare
etag: "5c932023-25bf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jgfh3ZiFu7F6S3YA2oCortSBiAftaIdsqKTJtHT2IyJDJOCPclur%2FnsDB6288GBmHAMMUuq5vl%2BdQKaJp%2FjGpplPCHRVfZgOgM90Z7akUx9yOYTkp1f3P9nt3ASoXvCRH0LaH3JAT85MB7xEkYbWQePuyA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae4ed8327142-YUL
expires: Wed, 05 Jan 2022 18:47:07 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z8d%2BxROYsFOf4B9oMbJS%2Bxp3g9S1QxSO0EZeeGcn1V3fLKe1LX8Fekz3L0AadeDdoaiDgz1remcmWiT3a3hhj6m9HoceOiggIaC6U0BYrDy%2ByJ5KlXUwP77tLXGzZ%2BeXwAlmCjgJO2TdtASFz7kCfM5v"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/03/1377540149.png
cache-control: max-age=3600
cf-ray: 6b97ae4e79304bd0-YUL
expires: Mon, 06 Dec 2021 19:47:07 GMT

GET
H2

200

1377285811.png
kooora4lives.com/wp-content/uploads/2019/03/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/03/1377285811.png
https://plus.kooora4live.net/wp-content/uploads/2019/03/1377285811.png
https://kooora4lives.com:2096/wp-content/uploads/2019/03/1377285811.png

3 KB
4 KB

414ms
413ms

Image
image/png

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/03/1377285811.png
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9363bb2866af69e681dd49395edeb9504fdef8eabaee5e521e1ecfd6d120a990

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 3299
pragma: public
last-modified: Wed, 20 Mar 2019 05:16:43 GMT
server: cloudflare
etag: "5c91ccbb-ce3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eo2sVsEs0BMMgGGggY%2BX7ZhSmEc9EgbS8ShNRnTzf8S1MqricjQAKzJp%2FBX5wuvIZpazY0ZhazqmNSS%2FqdjvQI1IE%2FmPI1gHPrWHnh709ITTanxwdor4dWRtPNccSQv1PdSbHXCB2fOemr8vpCDRdunY5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae4ed82e7142-YUL
expires: Wed, 05 Jan 2022 18:47:07 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3wRTZHUwXgw41BkMRo%2Bj9Wk1Y6ccrYj8W8seFbOS0fKanJRLkRHP0siv3Vn1fa4Y7k11DThHB3E%2BGmAlNaHFuT8q633szcaOy3hItU1ZsT6rr9hkG1rdeIXiDLvUkHNnYW1T05DECAIuV1RS9iAjSUx2"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/03/1377285811.png
cache-control: max-age=3600
cf-ray: 6b97ae4e792a4bd0-YUL
expires: Mon, 06 Dec 2021 19:47:07 GMT

GET
H2 200 6312212_1530871001-300x167.jpg
kooora4lives.com/wp-content/uploads/2021/12/ 8 KB
8 KB 428ms
427ms Image
image/jpeg 2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2021/12/6312212_1530871001-300x167.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d3ef083beb5194cd8310666ebd22f1e2eae67dc60223514d3457b4beaff0c8dd

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/m2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 8337
pragma: public
last-modified: Mon, 06 Dec 2021 14:00:25 GMT
server: cloudflare
etag: "61ae1779-2091"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4aLxPRSnnaHo5DfkunTunvc%2FRiXgRtwAr7JrJb06VA6E1wo0S0ZNHBIhd9OLEdZnwW8Vo%2BReE5jBnht8hrGgXQ7ikVMSh%2BHkjb68GdhIGksdQByr8JeTjpo9Wte64gr%2Fl7bviq7hwpOZ6dGGofvrrps8Mg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae4e0f127142-YUL
expires: Wed, 05 Jan 2022 18:47:07 GMT

GET
H2 200 GettyImages-1235370436-300x169.jpg
kooora4lives.com/wp-content/uploads/2021/12/ 10 KB
11 KB 417ms
416ms Image
image/jpeg 2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2021/12/GettyImages-1235370436-300x169.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d31dff72c3ab844940f3ac635fef7df38354822fcff6f43b3fb4fa325e69006f

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/m2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 10493
pragma: public
last-modified: Mon, 06 Dec 2021 13:35:45 GMT
server: cloudflare
etag: "61ae11b1-28fd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7NQRdxQrK%2Bq17ORfaIjVcHtv4ei6n1gyfNQ0OOsibGeSglJFssTptRpETuCRpS9Wzv6gBB9%2BA5q7Sdy0Q%2Ftgu1qmBTmRujZuser1Y9Zt2bBgM6aAFT%2B7OhnFWPVY%2Bz7sJ9J%2BGv1Hh9lBEahXRgGEUWSoXQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae4e0f137142-YUL
expires: Wed, 05 Jan 2022 18:47:07 GMT

GET
H2 200 177409-300x200.jpg
kooora4lives.com/wp-content/uploads/2021/12/ 12 KB
12 KB 419ms
419ms Image
image/jpeg 2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2021/12/177409-300x200.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 80fb13311b1a5f9061a85e1658e882174c70b542b36cf1a6c7d41fa622fcc006

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/m2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 11828
pragma: public
last-modified: Mon, 06 Dec 2021 13:30:29 GMT
server: cloudflare
etag: "61ae1075-2e34"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oqMRBIMCB8RvSAgch4CnIhoL5fW%2FW4yLEjgyIfu8J0NAmx742ou%2BDCgQ65eMoDegCQ9a46ZX%2FSPPqWmtf8PLC5gEaW%2F6Xf4GF9p%2B%2BIKtCPefuyX83ffSClCWgat1fMgaEaBM6Ssri93YkMJtMuobsGYGcg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae4e0f157142-YUL
expires: Wed, 05 Jan 2022 18:47:07 GMT

GET
H2 200 1531389_0-300x200.jpg
kooora4lives.com/wp-content/uploads/2021/12/ 13 KB
14 KB 420ms
419ms Image
image/jpeg 2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2021/12/1531389_0-300x200.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 987486d9651b0fad5ad058dd053f138162d505b58be9abcefead6b8e79c14d26

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/m2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 13599
pragma: public
last-modified: Mon, 06 Dec 2021 13:24:40 GMT
server: cloudflare
etag: "61ae0f18-351f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=36Z0PpdgwQUXoTKyKMf21t3%2B6UBDzkQQNhxLqMs%2BQbJ3ba9EAS%2FUxAcdkNCjl01W8JyBpDA4jOJTTClqbBjqT%2BpXzs4n9MuJIS3nQHxZOc0ZBYe229avxqZm11jh1DQjzugRyAPaJwoYKkIqO0QbqYyn2g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae4e0f167142-YUL
expires: Wed, 05 Jan 2022 18:47:07 GMT

GET
H2 200 hb_501006_12923.js Show response
player.adtelligent.com/prebidlink/ex18968/ 304 KB
93 KB 119ms
34ms Script
application/javascript 45.133.44.3
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Requested by: Host: jscdn.greeter.me
URL: https://jscdn.greeter.me/kooora4lives.comhead.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.3 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx /
Resource Hash: d3f60a0796d071acc31952bc3e659f4291f540bc763bf45ad3a4d8be887a9f67

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
last-modified: Fri, 12 Nov 2021 12:48:42 GMT
server: nginx
etag: W/"618e62aa-4c0d4"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Mon, 06 Dec 2021 19:47:07 GMT
cache-control: max-age=3600
x-proxy-cache: HIT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 79 KB
27 KB 118ms
43ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: jscdn.greeter.me
URL: https://jscdn.greeter.me/kooora4lives.comhead.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7824408451ca83ed936e6f71fb374ccce1eef3c6931158f4aee3b46d402df650

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1064 / 569 of 1000 / last-modified: 1638813662"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26952
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 06 Dec 2021 18:47:07 GMT

GET
H2 200 adipolo_logo.png
adipolo.com/wp-content/uploads/2020/06/ 7 KB
8 KB 65ms
19ms Image
image/png 2606:4700:3037::ac43:81bf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://adipolo.com/wp-content/uploads/2020/06/adipolo_logo.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:81bf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b071563c8b59cdc2b12b2703f3b5d147f555b1c41d83e5c5ef4a02395aed89c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1246
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 7068
last-modified: Tue, 02 Jun 2020 09:04:16 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jf3tssKbfYZyh1dUv1KnyxuCEJhRMV7mh%2FFtKMonYYwDabBUnEPK8Cm14c9coreB%2BcTkjzItgz12M9F1XWeR54bCTkwjKDiTh5%2BCjBSN3VyJ8vWpMSLg%2FHN4GJ6sc69WMnZH%2B6HtWN%2BLmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6b97ae4e5eef7157-YUL

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 68ms
18ms Script
text/javascript 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-150096121-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 1512
date: Mon, 06 Dec 2021 18:21:55 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 06 Dec 2021 20:21:55 GMT

GET /
ghb.adtelligent.com/geo/ 0
0

GET tracking
ghb.adtelligent.com/adunit/ 0
0

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 220 B
418 B 47ms
45ms Script
text/javascript 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=kooora4lives.com&callback=_gfp_s_&client=ca-pub-8605854106910601

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111300101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e88e08570dcd912e075f06113eb1a848313e4d9099367145ac2e24a0867b8d09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 203
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
792 B 113ms
34ms Script
application/javascript 2607:f8b0:4006:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=kooora4lives.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111300101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 126ms
48ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=kooora4lives.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111300101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9F83 603 B
68 B 93ms
56ms Document
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8605854106910601&output=html&adk=1812271804&adf=3025194257&lmt=1638816427&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fkooora4lives.com%3A2096%2Fm2%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638816427158&bpp=3&bdt=650&idt=123&shv=r20211201&mjsv=m202111300101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=481118744695&frm=20&pv=2&ga_vid=428231269.1638816427&ga_sid=1638816427&ga_hid=1502021003&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C31063824&oid=2&pvsid=338030884393098&pem=146&tmod=1761430614&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=146

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111300101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 06 Dec 2021 18:47:07 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 06 Dec 2021 18:47:07 GMT
cache-control: private

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 95ms
52ms XHR
application/json 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20211201&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111300101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3401ae3d7bf9145c72a7ff1a6131461e6058584b9842d15961ed158227341a44

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8473
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 274A 79 KB
27 KB 799ms
796ms Document
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4903453974745530&output=html&h=280&slotname=go4darsiapl%2Fbanners&adk=872605085&adf=3852535245&pi=t.ma~as.go4darsiapl%2Fbanners&w=1100&fwrn=4&fwrnh=100&lmt=1638816427&rafmt=1&psa=0&format=1100x280&url=https%3A%2F%2Fkooora4lives.com%3A2096%2Fm2%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638816427161&bpp=2&bdt=653&idt=170&shv=r20211201&mjsv=m202111300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=481118744695&frm=20&pv=2&ga_vid=428231269.1638816427&ga_sid=1638816427&ga_hid=1502021003&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=250&ady=1904&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C31063824&oid=2&pvsid=338030884393098&pem=146&tmod=1761430614&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=zp5xN7PIvs&p=https%3A//kooora4lives.com%3A2096&dtd=177

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111300101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4e9f6122f71bb679d05bb792825bc14bfbf89c9d6e60352bdfe455043fff95dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 06 Dec 2021 18:47:08 GMT
server: cafe
content-length: 27295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 06 Dec 2021 18:47:08 GMT
cache-control: private

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 41 KB
10 KB 549ms
548ms XHR
text/plain 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=338030884393098&correlator=633926866096650&output=ldjh&impl=fifs&eid=31060888&vrg=2021120201&ptt=17&sc=1&sfv=1-0-38&ecs=20211206&iu_parts=21715635079%3A22630893834%2Ckooora4lives.com%2Ckooora4lives.com_970x250&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C970x250&fluid=height&prev_scp=excl_cat%3DPREPOST&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1638816427&dt=1638816427417&dlt=1638816426508&idt=849&frm=20&biw=1600&bih=1200&oid=2&adxs=315&adys=100&adks=667468269&ucis=1&ifi=3&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fkooora4lives.com%3A2096%2Fm2%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1100x0&msz=1100x0&ga_vid=428231269.1638816427&ga_sid=1638816427&ga_hid=1502021003&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5a7518d9800ac1e0716d1ef8eda5a6b96d5e20ddea01c0f25e18d0a77055733f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10409
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://kooora4lives.com:2096
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 53 KB
20 KB 510ms
509ms XHR
text/plain 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=338030884393098&correlator=3663173421560372&output=ldjh&impl=fifs&eid=31060888&vrg=2021120201&ptt=17&sc=1&sfv=1-0-38&ecs=20211206&iu_parts=21715635079%3A22630893834%2Ckooora4lives.com%2Ckooora4lives.com_970x250_2&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C970x250&fluid=height&prev_scp=excl_cat%3DPREPOST&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1638816427&dt=1638816427422&dlt=1638816426508&idt=849&frm=20&biw=1600&bih=1200&oid=2&adxs=315&adys=995&adks=8585039&ucis=2&ifi=4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fkooora4lives.com%3A2096%2Fm2%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1100x0&msz=1100x0&ga_vid=428231269.1638816427&ga_sid=1638816427&ga_hid=1502021003&ga_fc=false&fws=4&ohw=1100&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b036ea77a836a6b47f61e84140d5834c455a998d434845a29c05cc88ea977172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20635
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://kooora4lives.com:2096
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 63 KB
30 KB 497ms
496ms XHR
text/plain 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=338030884393098&correlator=264906056633861&output=ldjh&impl=fifs&eid=31060888&vrg=2021120201&ptt=17&sc=1&sfv=1-0-38&ecs=20211206&iu_parts=21715635079%3A22630893834%2Ckooora4lives.com%2Ckooora4lives.com_728x90&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C728x90&fluid=height&prev_scp=excl_cat%3DPREPOST&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1638816427&dt=1638816427424&dlt=1638816426508&idt=849&frm=20&biw=1600&bih=1200&oid=2&adxs=436&adys=995&adks=1802332895&ucis=3&ifi=5&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fkooora4lives.com%3A2096%2Fm2%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1100x0&msz=1100x0&ga_vid=428231269.1638816427&ga_sid=1638816427&ga_hid=1502021003&ga_fc=false&fws=4&ohw=1100&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4cf465b6b994dff3ebca5ca8f27b79c2ec5722f7b02c25a798755434d2a13074

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30888
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://kooora4lives.com:2096
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 113 KB
32 KB 541ms
540ms XHR
text/plain 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=338030884393098&correlator=3656769551021956&output=ldjh&impl=fifs&eid=31060888&vrg=2021120201&ptt=17&sc=1&sfv=1-0-38&ecs=20211206&iu_parts=21939239661%3A202189885%2Capl%2Cinter&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ists=1&fas=8&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1638816427&dt=1638816427427&dlt=1638816426508&idt=849&frm=20&biw=1600&bih=1200&oid=2&adxs=-9&adys=-9&adks=239510233&ucis=4&ifi=6&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fkooora4lives.com%3A2096%2Fm2%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x-1&msz=0x-1&ga_vid=428231269.1638816427&ga_sid=1638816427&ga_hid=1502021003&ga_fc=false&fws=2&ohw=0&btvi=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

970cdffd17c63275cd88907fba6320758dfc91eb313ad63e30c7fd6ad2348dc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32381
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://kooora4lives.com:2096
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame BAC8 6 KB
4 KB 158ms
52ms Document
text/html 2607:f8b0:4006:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 06 Dec 2021 18:47:07 GMT
expires: Tue, 06 Dec 2022 18:47:07 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 pubads_impl_page_level_ads_2021120201.js Show response
securepubads.g.doubleclick.net/gpt/ 34 KB
13 KB 40ms
40ms Script
text/javascript 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2021120201.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a9c50ea65a2241c5dd7eb698a88496716a307ae73381653cf06b1fafb64f16f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12907
x-xss-protection: 0
last-modified: Thu, 02 Dec 2021 15:41:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 06 Dec 2021 18:47:07 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 113ms
61ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1502021003&t=pageview&_s=1&dl=https%3A%2F%2Fkooora4lives.com%2Fm2%2F&ul=en-us&de=UTF-8&dt=%D9%83%D9%88%D8%B1%D8%A9%204%20%D9%84%D8%A7%D9%8A%D9%81%20%7C%20kora4live%20%D9%85%D8%A8%D8%A7%D8%B1%D9%8A%D8%A7%D8%AA%20%D8%A7%D9%84%D9%8A%D9%88%D9%85%20%D8%A7%D9%88%D9%86%20%D9%84%D8%A7%D9%8A%D9%86%20%D8%8C%20%D8%A7%D8%AE%D8%A8%D8%A7%D8%B1%20%D9%88%20%D9%86%D8%AA%D8%A7%D8%A6%D8%AC%20%D8%A7%D9%84%D9%85%D8%A8%D8%A7%D8%B1%D9%8A%D8%A7%D8%AA&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAAC~&jid=753108537&gjid=1550744219&cid=428231269.1638816427&tid=UA-150096121-1&_gid=917072645.1638816427&_r=1&gtm=2ouc10&z=771031525

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://kooora4lives.com:2096
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 177ms
92ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111300101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 06 Dec 2021 18:47:07 GMT

GET
H2 200 config.json Show response
player.adtelligent.com/exchange_rates/313490/ 9 KB
4 KB 84ms
27ms XHR
application/json 45.133.44.3
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://player.adtelligent.com/exchange_rates/313490/config.json?cb=https%3A%2F%2Fkooora4lives.com%3A2096%2Fm2%2F
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.3 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx /
Resource Hash: 42f2381176a97e5bb3a4899c9609be15f911daea21e367396dfb3f39e7655176

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
last-modified: Mon, 06 Dec 2021 12:01:33 GMT
server: nginx
etag: W/"61adfb9d-2255"
content-type: application/json
access-control-allow-origin: https://kooora4lives.com:2096
expires: Mon, 06 Dec 2021 19:47:07 GMT
cache-control: max-age=3600
x-proxy-cache: HIT

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
290 B 163ms
110ms XHR
application/json 74.119.119.129
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?profileId=207&av=34&wv=5.20.0&cb=91671195366
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.119.119.129 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS: bidder.va1.vip.prod.criteo.com
Software: Finatra /
Resource Hash: ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:06 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 44

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 25 B
527 B 111ms
39ms XHR
application/json 69.175.41.79
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_5.20.0
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.175.41.79 Downers Grove, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: sovrn-193627-chi03-placeholder
Software: /
Resource Hash: 24425a179572deef03c63bfab13ebf837a5fac9de6eb35f446149488936f181b

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 06 Dec 2021 18:47:07 GMT
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://kooora4lives.com:2096
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap5ord1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 25

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
368 B 74ms
24ms XHR
application/json 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://kooora4lives.com:2096
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
196 B 187ms
143ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bX9srg4dmr64KsaKjGFx_2
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 5ff4a3af90403a240b8ff4a25c9499886c6c18addeecae88d2e85b99e82bfeee

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
196 B 140ms
96ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bX9srg4dmr64KsaKjGFx_2
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 16d433417f330a10d680c8312518b22799343727e9067ffd9015e6dd2ca94649

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
196 B 162ms
119ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bX9srg4dmr64KsaKjGFx_2
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 99082270ca9f5dc052df45579664eb647f78acea2bb72eb6fc11bad49b3257d1

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
196 B 176ms
133ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bX9srg4dmr64KsaKjGFx_2
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 8adc90eefe69fda9faa6859921e17b24d0b349bfdc41dd012484458cb18a804f

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
205 B 115ms
73ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bX9srg4dmr64KsaKjGFx_2
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: f358f736d4d1c321b45c23e874a30b12020e658d19f6ebb379024f06d6044a57

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
204 B 189ms
146ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bX9srg4dmr64KsaKjGFx_2
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: b9964bcdeae60455c483dab0a584fae5fb5bfc2374d22c29f120e0b147422c13

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
205 B 145ms
103ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bX9srg4dmr64KsaKjGFx_2
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 6776edc4ba3d71d37d2629d61a45948cd4bcce4a5114bb15851db868098ecea7

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
196 B 502ms
460ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bX9srg4dmr64KsaKjGFx_2
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 8a1dd2c4cc56f0ec42c5d1d6f1bcca2b7a8b5550011ed8f99882f2c625440c6c

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 118 B
349 B 112ms
71ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bX9srg4dmr64KsaKjGFx_2
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 36034d66046f5576e9a5759d15e9d3b1fbcad5bac4396f8dc057c990f9257dac

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 c Show response
prebid.a-mo.net/a/ 361 B
658 B 322ms
257ms XHR
application/json 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 51a2ed4442694e0cc414c9ecfca8b063dc18b1cbdd900b4d25770fc6933822e1

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 228
content-length: 225

GET
H2 200 GettyImages-1235370436-300x169.jpg
kooora4lives.com/wp-content/uploads/2021/12/ 10 KB
11 KB 417ms
415ms Image
image/jpeg 2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2021/12/GettyImages-1235370436-300x169.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d31dff72c3ab844940f3ac635fef7df38354822fcff6f43b3fb4fa325e69006f

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/m2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 10493
pragma: public
last-modified: Mon, 06 Dec 2021 13:35:45 GMT
server: cloudflare
etag: "61ae11b1-28fd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PMeMJKYy4vrxdXVtgcCXZQwlvJTXQ%2F%2BszAE95j8kgbOWPz1v4YT93mNKF37tZMVAi3FuN8UPtUq63Uy8mrUSyM19ltACa%2BiSdkiqk%2BDXl9FvkZtFM6LRd4oxwaNy2bBx7KHB3RSS9O%2FZWspLKTcvmGAXvA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae50ba907142-YUL
expires: Wed, 05 Jan 2022 18:47:07 GMT

GET
H2 200 177409-300x200.jpg
kooora4lives.com/wp-content/uploads/2021/12/ 12 KB
12 KB 420ms
419ms Image
image/jpeg 2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2021/12/177409-300x200.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 80fb13311b1a5f9061a85e1658e882174c70b542b36cf1a6c7d41fa622fcc006

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/m2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 11828
pragma: public
last-modified: Mon, 06 Dec 2021 13:30:29 GMT
server: cloudflare
etag: "61ae1075-2e34"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E1CJDA35Q%2B11bh1%2Frr4D%2F%2BfeJ6a2IPdME0W3sVOxAMmnzYrXfmWuXUHlotqMCC5KTuNc9pE0mDkpzbbFKmPXQYH%2F8SAOK6tXBhK8qaQg8gQzJHVDQ9MJUu6bDvwkL5cPdWPfyjZPD0Ai%2F8UBkUG0AM%2B2mA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae50cacc7142-YUL
expires: Wed, 05 Jan 2022 18:47:08 GMT

GET
H2 200 1531389_0-300x200.jpg
kooora4lives.com/wp-content/uploads/2021/12/ 13 KB
14 KB 418ms
417ms Image
image/jpeg 2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2021/12/1531389_0-300x200.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 987486d9651b0fad5ad058dd053f138162d505b58be9abcefead6b8e79c14d26

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/m2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 13599
pragma: public
last-modified: Mon, 06 Dec 2021 13:24:40 GMT
server: cloudflare
etag: "61ae0f18-351f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=INO9oO8s9tByzyeEoik55R1IvmjTNYOYlLxOLC89wMVy%2BMXhORcN0JTANC%2BdVD23xEbua%2Fn9Udkkx4kNZ9JynLpxdWgXGag8vV9XOfWS66EFieHODE31cTzBFB9Ay86Q4vXPKeC2zLFgFaww38Yz8lViSg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae50cacd7142-YUL
expires: Wed, 05 Jan 2022 18:47:07 GMT

GET
H2 200 1377538854.png
kooora4lives.com/wp-content/uploads/2021/03/ 3 KB
3 KB 433ms
432ms Image
image/png 2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2021/03/1377538854.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 40bcb9399f1d593a7ea38d62f7978492eb29cdfa579e614126298fa7cdff2318

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/m2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 2954
pragma: public
last-modified: Wed, 24 Mar 2021 04:26:26 GMT
server: cloudflare
etag: "605abf72-b8a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n3FTH1kqJp5dF69xZVXNhH%2F%2BEL6deXBzteZtSrX%2BwiZ78JxOZC7LLjF9xcs%2Fw6%2BoND8mL4UZlubtbr6Re29FXCizkaAsM0z0OAi%2B1TxR3euLTeVRATIZwMVAe8FlzrlBVxESgiZnaxcIzpRoGZrBMhDQRA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae50cace7142-YUL
expires: Wed, 05 Jan 2022 18:47:08 GMT

GET
H2 200 6312212_1530871001-300x167.jpg
kooora4lives.com/wp-content/uploads/2021/12/ 8 KB
9 KB 433ms
433ms Image
image/jpeg 2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2021/12/6312212_1530871001-300x167.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d3ef083beb5194cd8310666ebd22f1e2eae67dc60223514d3457b4beaff0c8dd

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/m2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 8337
pragma: public
last-modified: Mon, 06 Dec 2021 14:00:25 GMT
server: cloudflare
etag: "61ae1779-2091"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zlu%2BgDpMgVWnew3wXgxtL8GiYhQIn5SzeAQmAmhDHMS8cfrWzYx7IJc8HjHidyE%2FAvbYKMY%2BJbSyR6V77QI8jnpzSl6KPfGX%2Ft0fYPa6izxDS8n%2BaqZ8uUvbwBIr1EAhwwQJQt6Z4AcRmrPwqhDTzFh%2FNw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae50cacf7142-YUL
expires: Wed, 05 Jan 2022 18:47:08 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame AFF6 13 KB
5 KB 56ms
21ms Document
text/html 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
date: Mon, 06 Dec 2021 06:39:45 GMT
expires: Tue, 06 Dec 2022 06:39:45 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 43642
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0DB0 783 B
1 KB 99ms
39ms Document
text/html 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

40a8cba948c79dc3677fcbe280e8cf00f212c25b73ef04de51fa2e7728004a26

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-FTovHCeOHFPHfjpHwe7A/Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Mon, 06 Dec 2021 18:47:07 GMT
date: Mon, 06 Dec 2021 18:47:07 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-FTovHCeOHFPHfjpHwe7A/Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 _q4UmNMOTmtef9d1r6OTn_fK0q4sseVsYwM_ZArHqzc.js Show response
pagead2.googlesyndication.com/bg/ Frame AFF6 35 KB
13 KB 21ms
20ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/_q4UmNMOTmtef9d1r6OTn_fK0q4sseVsYwM_ZArHqzc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

feae1498d30e4e6b5e7fd775afa3939ff7cad2ae2cb1e56c63033f640ac7ab37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 14:44:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14573
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13548
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 06 Dec 2022 14:44:14 GMT

GET
H2

200

download-2-7.png
kooora4lives.com/wp-content/uploads/2019/01/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/01/download-2-7.png
https://plus.kooora4live.net/wp-content/uploads/2019/01/download-2-7.png
https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-2-7.png

1 KB
1 KB

401ms
401ms

Image
image/png

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-2-7.png
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: edc6b2ff1002ed7e2d5a033e08d19ea423b262f898b4dd27c3b3ccb833714e67

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 1154
pragma: public
last-modified: Fri, 04 Jan 2019 22:53:54 GMT
server: cloudflare
etag: "5c2fe402-482"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QLd%2B6rWCyjskiJq4qMdB9N60iAzqEq81N5AZhaLbSIroj7HCeS7F8tF8DlDg9%2BrMJcYIyQfrnhWNRM7Xmec%2FYi0YLjo3TuZzmvuqbsrFSZqB1zui2W%2Bitc6fnEi%2BVgZ1H6gHijCkEcsmPsow7OjnCFQiQw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae51dc617142-YUL
expires: Wed, 05 Jan 2022 18:47:08 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QQEIx0J9BFpOl0ID8pWWvjb1HlxdZCh4SEQaKVvm9Z7HtJCHNtz7CAR4dDi4HrTW162kj%2Bo77S%2BDnFsAiWkBBxjAPNfMIcMlkd1sNSQOhnUlc4Jki8igKDImI7Q10m52m%2BqWx0QB6qoUQdOZzEoWyzkj"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-2-7.png
cache-control: max-age=3600
cf-ray: 6b97ae51be8d4bd0-YUL
expires: Mon, 06 Dec 2021 19:47:07 GMT

GET
H2

200

download-11-1.png
kooora4lives.com/wp-content/uploads/2019/01/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/01/download-11-1.png
https://plus.kooora4live.net/wp-content/uploads/2019/01/download-11-1.png
https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-11-1.png

1 KB
1 KB

411ms
411ms

Image
image/png

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-11-1.png
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b3437e8b7bca98a5ba7e51ce860ea7e0422b9f77bd41895269adcb098be9870e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 1063
pragma: public
last-modified: Fri, 04 Jan 2019 23:07:36 GMT
server: cloudflare
etag: "5c2fe738-427"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F8c0YMS4WokSqUHVuTTiS0mN1vWgCCoIA1bDOM%2BSYZveVGQnShDaOQQ3%2BEe5QOVBcy1GwKOEqjcxkzw8MIggST9oN9elStlaDFQMUD4SCujnMjFeo%2BamSfxr4fIYRmVMUteLItXZvV4Zxt4C5WpmWlJbzw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae51dc6c7142-YUL
expires: Wed, 05 Jan 2022 18:47:08 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4uwqta5NiJF2evnG9YBEqU2rdn7kGOdPF8jzsj5EeH3kcKkDHAfY1HqOegNHhkNPL3wuu5XCR8CBhWWq8x%2BGG1uVB56Yw9HUPkPF8A5y2hW7NtSx3MZmRdqW3ZNOvnDbPDIwPvab2vpZM53%2BlVCxrGea"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-11-1.png
cache-control: max-age=3600
cf-ray: 6b97ae51ce964bd0-YUL
expires: Mon, 06 Dec 2021 19:47:07 GMT

GET
H2

200

1377285811.png
kooora4lives.com/wp-content/uploads/2019/03/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/03/1377285811.png
https://plus.kooora4live.net/wp-content/uploads/2019/03/1377285811.png
https://kooora4lives.com:2096/wp-content/uploads/2019/03/1377285811.png

3 KB
4 KB

398ms
398ms

Image
image/png

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/03/1377285811.png
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9363bb2866af69e681dd49395edeb9504fdef8eabaee5e521e1ecfd6d120a990

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 3299
pragma: public
last-modified: Wed, 20 Mar 2019 05:16:43 GMT
server: cloudflare
etag: "5c91ccbb-ce3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ww6UV%2FZd7hz33h16wqM0ortsMGlYgREyGhWIJjRKpZlDFF48LR1C8oZKJvGYPdBlMHV9Ta0sPMe8fASE9hZVkgHO4M88MK7h5hw7Svk3y7a65kgvyLLlCXJtNvJ5H%2BxvpMSjAW8cG1Dia3xshtu16yKfWA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae51fcab7142-YUL
expires: Wed, 05 Jan 2022 18:47:08 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gPtfuELaGJHBjfAiyXcd7QrDKI8QZCeagMWbwPnwpIFkl9g5iL%2Bd2y9F9EPIGT1dnpVufo4f9Dp1cbrNOFs3hOcch2SFnEIZ2l%2FPFVJaBoE4MF5ep9YC6nKEazvX6tpN%2Bd5HFDiWIVhQw9BXcaXJpBPC"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/03/1377285811.png
cache-control: max-age=3600
cf-ray: 6b97ae51dea84bd0-YUL
expires: Mon, 06 Dec 2021 19:47:07 GMT

GET
H2

200

download-4-5.png
kooora4lives.com/wp-content/uploads/2019/01/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/01/download-4-5.png
https://plus.kooora4live.net/wp-content/uploads/2019/01/download-4-5.png
https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-4-5.png

947 B
1 KB

405ms
405ms

Image
image/png

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-4-5.png
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c421ecb7612b3f46ff84c9686044c0fb00e119c63eafb4be54c39f0842fb09e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 947
pragma: public
last-modified: Fri, 04 Jan 2019 22:58:36 GMT
server: cloudflare
etag: "5c2fe51c-3b3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zmsF0FbUD5jrZYRdK4H8VFASGntOmIO7VmmvqMWvZSZmO7KiuarMKoKv1ANKpUf1hVlONWuo0mJire%2BkAVrrFLzBGDD6Nmj4dEO1OuFKGXyV29zlKf%2B15oaWBMNiFgJbFcy7QZjDL1DFeQ2dGSfSFM23tg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae51ec7f7142-YUL
expires: Wed, 05 Jan 2022 18:47:08 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kB6%2B4POBsRM4opu9vYhmqwbJdHR5DLszquffKAPBQgTruGKN2li%2BUjh9ojvrYRH38PN5F3%2FaqcRutB4e%2FwtuumtTIQxGz3vGo4xdaYkCWQerqyDung9noSSdH0mha2uEcZogrYWGl1kn%2BIgHvnBVn6Mx"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-4-5.png
cache-control: max-age=3600
cf-ray: 6b97ae51ce9c4bd0-YUL
expires: Mon, 06 Dec 2021 19:47:07 GMT

GET
H2

200

flag_mauritania.gif
kooora4lives.com/wp-content/uploads/2019/05/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/05/flag_mauritania.gif
https://plus.kooora4live.net/wp-content/uploads/2019/05/flag_mauritania.gif
https://kooora4lives.com:2096/wp-content/uploads/2019/05/flag_mauritania.gif

2 KB
3 KB

410ms
410ms

Image
image/gif

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/05/flag_mauritania.gif
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 73d70cea0d76ca385b047d6b092fc480fa521f2cf38c9d50dabfcb1c7433ec83

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 2508
pragma: public
last-modified: Sat, 18 May 2019 13:30:14 GMT
server: cloudflare
etag: "5ce008e6-9cc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H%2BQVH53kCBBjwJXq2HNsn4Cx0IPrGaqHCUq8lhax5HSKCZEvNUKZLdUvtK1KNLFPh2tvTR8SoLyqtcu8ZMEwJ8%2Bh%2FTav2GPIvO%2BewrDVgoTAdeXYoB4ZQVr2IPCXCoFwbZ7WFM5%2Fj3mdHGRzjWM0WWvoKg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae51fcac7142-YUL
expires: Wed, 05 Jan 2022 18:47:08 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7QwHUAam0J7Q2k8q1Y70X0tPUAGPFTVmu1MOkN0tVlT7uIXN0BqfPDDq56DoVRd1FwgNXz16JOhVoCBGRAkOPBr0e%2FwTt26hckie1AJ%2FyF5KwEAja7zerYhy1jMp05AWfxwlHn655c4ssd8FPu6kLQ0H"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/05/flag_mauritania.gif
cache-control: max-age=3600
cf-ray: 6b97ae51deb74bd0-YUL
expires: Mon, 06 Dec 2021 19:47:07 GMT

GET
H2

200

1377540149.png
kooora4lives.com/wp-content/uploads/2019/03/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/03/1377540149.png
https://plus.kooora4live.net/wp-content/uploads/2019/03/1377540149.png
https://kooora4lives.com:2096/wp-content/uploads/2019/03/1377540149.png

9 KB
10 KB

424ms
423ms

Image
image/png

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/03/1377540149.png
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e92ab3bc3d9bc6c228223f3393e594a6f05f00a85c951ff5c89957d84352fa74

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 9663
pragma: public
last-modified: Thu, 21 Mar 2019 05:24:51 GMT
server: cloudflare
etag: "5c932023-25bf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=slQTcbwdDiz4tPk5yrlpyuNGvaqe6RZshkNVggcZdaSP11f7TmukOpB2TmS9AZV%2BXnfVBjytyUA68lrfqmdSG19diOhfbwDVQyOvy5YOXqJX142nHEXGxeWcJw7W%2Fdm%2FPbIsyq6iXO6Pe6So2MI%2FEWmOXA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae520caf7142-YUL
expires: Wed, 05 Jan 2022 18:47:08 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nstdfSNxqnflguyuBsuMwKxBkk7bnISSJyOVXWOnpDdQPzDO4NAzf%2F4Q2SGRfXwY4cYeOnvlt2qyoFxsJ7TGPW24f6lI53XVQ5ponpxFGCZczMin%2Bfm407rGEOaGSTHHP2vVCYdfWm73k%2FP5FPQnha5I"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/03/1377540149.png
cache-control: max-age=3600
cf-ray: 6b97ae51eec54bd0-YUL
expires: Mon, 06 Dec 2021 19:47:07 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0DB0 0
0 57ms
56ms Image
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20211201&jk=338030884393098&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H2

200

download-1-11.png
kooora4lives.com/wp-content/uploads/2019/01/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/01/download-1-11.png
https://plus.kooora4live.net/wp-content/uploads/2019/01/download-1-11.png
https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-1-11.png

816 B
1 KB

114ms
113ms

Image
image/png

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-1-11.png
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 179344a9db700df82bbd09cea5445a926699e911484d5fd7f326ac5339151282

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 816
pragma: public
last-modified: Fri, 04 Jan 2019 23:11:26 GMT
server: cloudflare
etag: "5c2fe81e-330"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=akFajEuhAm89NHaoMoZaQf1gYri%2ForfUZ0hRJqhfAQv9RxaIrxayK4eh7%2FoUvzp%2BnzO%2B2Z%2BRnLngPyU88khSPH49o0S5tsWrv6vznPQrtjjFd%2FUndM7vFE3X0RcitMAJuU5CUy%2FFJhIDgj9ajYpK2sIJgg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae523cfa7142-YUL
expires: Wed, 05 Jan 2022 18:47:07 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YxBuJfnjYagMXE%2FTm5P80t3fCnazGdqLfVTxGQVyIAN9YpIoDXn9BkMoCnSvCbASuKG%2FKs%2BCBhNKmzA%2FJWoNiGaIwr9rDy2lAqkHD9tqGBIIX2g0EFIi%2Ft2UnP1jsHqZjE%2F6hCrYGRvOOXy3vN4vJgfN"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-1-11.png
cache-control: max-age=3600
cf-ray: 6b97ae521f064bd0-YUL
expires: Mon, 06 Dec 2021 19:47:07 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 45ms
45ms Image
image/gif 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20211201&jk=338030884393098&bg=!UVKlUhbNAAaQHwIOkB87ACkAdvg8Wuf0FG9NlrcRPwdOCCfLRY8ErgfZo3TkONG7187nFbuxbo1tEAIAAABfUgAAAAtoAQcKAJIBpu8plHtgWrhVSjSXJiM4Ja5HNJ3OqydPT99y1UVGFEHz2ZsNIjODrqrnCrcxQ78f-Og5YabqaXmIoHYxA2788xhU03u0s5Cl8K4zhQZRX5QcRYEAgXtzV1GLC7hEFamFdZwmpyx6O3X29OXbZogmHwNcSZseYRdDqXCRlnnWm8n1IujahRtXTOeBxLaTVQTxA5kClCgpU7hIqrUsaLww6HwfO2zjegkbGmRXp92NAIV9BLyd21bg9fLeCvRExqx9g-PuftaIzmgnqdBAh3SnmnolaYvBu2gRinbK7cSpYJ1TTs9l4gzoKKiT-Aiznm8UtPsLcc5b62fOF6fKyev-Y4CJYt9_GExmUtg6hc6WcgB4V44lfgPs-ERR7-OFoAKG4TpWCKgXOnXLofo2_xubSTZaQ1e7AGV6RNRbfeFQ2FY4ysNlR-zaPDx06NOreNTlPK7OLyDyBdfwmmFPztvDo1hSVcZQeunhbJBBDwJaiL6sbCZHnnRO1VRkZDxLx0VdEXStc5vtf_jjH5jL89dMWI2cNWdQ_qlRWaS65yKv5jM9hGyg9hYMmR69vmajTh14vicFZXL59ahKGKeYm1LOtDbmhGiNsoPJfLECalPDXyspCVGD4XKJznc2bN6G3MmTQj-0apL_iTajl6cWl6emPfEK4uYz7VGwcm8OGLq3-iCMSxq_NCFGRceElk85J8dwbxXoFhJYfW0zhGekMRj8tHnrjd8WJKk5Km1n01SC6nqkoLOZklwfPMj-2rd6grlHw1gOlBWeyP1EsxtUR6ZTgL3N71XOKF1HKVp2P5AWpe4LWJVX_1JBK50_n3bvk8shRn7yRG9UNjRu8L8H0UOQVIEA69ejUCKN6C5k-s7tSSNMSZes9e6BA2IcriTbjYCvxpX77CoaoJCO612d1hI-OCRZmI3nYfZDZXEvm014_ObNrY1JrTsyDqslkiP2Ae7hab5wcUwvKLy8ESqPCty6edUDdCPIvocipIWPKcXJ3isgtJD_gFGdwpjWm4GMDHtXTWy2_iNU2hDQKNQwGS8NyyV6JEM8c4ZvaN5iAXtUUWEPwgsI6opJ6w

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 99EA 6 KB
3 KB 51ms
22ms Document
text/html 2607:f8b0:4006:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 06 Dec 2021 18:47:07 GMT
expires: Tue, 06 Dec 2022 18:47:07 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 33A2 6 KB
3 KB 41ms
25ms Document
text/html 2607:f8b0:4006:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 06 Dec 2021 18:47:07 GMT
expires: Tue, 06 Dec 2022 18:47:07 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 737B 6 KB
3 KB 22ms
22ms Document
text/html 2607:f8b0:4006:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 06 Dec 2021 18:47:07 GMT
expires: Tue, 06 Dec 2022 18:47:07 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012111011823000/ Frame 5823 189 KB
55 KB 93ms
22ms Script
text/javascript 2607:f8b0:4006:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111011823000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98ba8f881333898d751dabe4f8b4cacc4489a9f5b6b4fd1fc67c571dbfec95cf

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 44328
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55592
x-xss-protection: 0
server: sffe
date: Mon, 06 Dec 2021 06:28:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "11dee2040f5fc1d7"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 06 Dec 2022 06:28:20 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012111011823000/v0/ Frame 5823 13 KB
5 KB 122ms
51ms Script
text/javascript 2607:f8b0:4006:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111011823000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65f6185cfe1cf88fa7981160dd6fa443e111887215b72953718ea70f8e2ba9f2

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 44328
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4992
x-xss-protection: 0
server: sffe
date: Mon, 06 Dec 2021 06:28:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "858600ba27ef7413"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 06 Dec 2022 06:28:20 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012111011823000/v0/ Frame 5823 89 KB
28 KB 115ms
44ms Script
text/javascript 2607:f8b0:4006:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111011823000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e97fc43ecd2f16948c3a8d2de65e0e5483db4ed5ab174058c178ca1c8665d0b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 44328
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28555
x-xss-protection: 0
server: sffe
date: Mon, 06 Dec 2021 06:28:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "a64e482645fd262b"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 06 Dec 2022 06:28:20 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012111011823000/v0/ Frame 5823 5 KB
2 KB 121ms
50ms Script
text/javascript 2607:f8b0:4006:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111011823000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d76ab4ac854cafef51bbbb5177ea75816df90e3c775294991a016404f2b6bb5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 44328
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1731
x-xss-protection: 0
server: sffe
date: Mon, 06 Dec 2021 06:28:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "cb4f0e89d7d37d9b"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 06 Dec 2022 06:28:20 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012111011823000/v0/ Frame 5823 40 KB
13 KB 119ms
48ms Script
text/javascript 2607:f8b0:4006:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111011823000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a630b852e94f20cb8140704fd830bf40bfea0a2effaa67d06a0eadafbf3d508

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 44328
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12826
x-xss-protection: 0
server: sffe
date: Mon, 06 Dec 2021 06:28:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f02165e023e70703"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 06 Dec 2022 06:28:20 GMT

GET
DATA 200
OK truncated
/ Frame 5823 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a62021bf3815968bd968c2d73eb6e00e73721defb1149f2d85ea59632fcb3b34

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 6316434543986537125
tpc.googlesyndication.com/daca_images/simgad/ Frame 5823 74 KB
74 KB 23ms
20ms Image
image/png 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/6316434543986537125

Requested by

Host: kooora4lives.com
URL: https://kooora4lives.com:2096/m2/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9028bcc00119fec81d56286c009016ecec816488f6424cff00ce99fa70c0536f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 03:41:01 GMT
x-content-type-options: nosniff
age: 54367
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 75541
x-xss-protection: 0
last-modified: Sat, 27 Nov 2021 16:34:33 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 06 Dec 2022 03:41:01 GMT

GET
H3 200 ar.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 5823 3 KB
3 KB 37ms
33ms Image
image/png 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/ar.png

Requested by

Host: kooora4lives.com
URL: https://kooora4lives.com:2096/m2/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dfa586fa8b70c056272ef189e613dc9f6bcb8f9b659259219fa776f639dd3374

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 06 Dec 2021 05:28:05 GMT
x-content-type-options: nosniff
server: cafe
age: 47943
etag: 9421415325968714010
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2737
x-xss-protection: 0
expires: Tue, 07 Dec 2021 05:28:05 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 5823 344 B
368 B 36ms
33ms Image
image/png 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: kooora4lives.com
URL: https://kooora4lives.com:2096/m2/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 06 Dec 2021 16:11:55 GMT
x-content-type-options: nosniff
server: cafe
age: 9313
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 344
x-xss-protection: 0
expires: Tue, 07 Dec 2021 16:11:55 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 5823 0
0 83ms
44ms Image
text/html 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRnMulrP1mEq5Wotb5_5CH_ijqn168oe0whW1QM6JduCbtGuqTH8OF8wMeSqFdS42xoELFtHyvQicXP7PqHLC4711YHhQ
Requested by: Host: kooora4lives.com
URL: https://kooora4lives.com:2096/m2/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:807::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 5823 0
0 50ms
47ms Image
text/html 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=COyZaq1quYbWAHo_Do9kPt6GBuAnnvo_lZpvQ-KL0DpaCzYWIFhABIL3Phmhg_eiigfADoAHG5LDIA8gBAuACAKgDAcgDCKoE8QFP0K6cmCewVpRfeWTMr17Wd0lAxZXd_jy-IcgdYcz4AhSxxwXpiwPan_zERfunPKhxCnEAAhegymMfMwOmX5zBx-21OEflhQr5EESR7P_wnmwdmvzGb-qlEwrQHQlcTLf0Zm5ARlJorH8pArv3RZ95q9zJexQGZpRbs-1jgpX0_JW7bJdPwcu2QRJwh8iWnJ8w4oteMLByuLUDF6vZlBo6sdioB2febEHR7nWxvRr2Y9zfzwd6NKUJ6SpePTCzGRYyeBq7gbjPLW_AtdS0rIEQWh-MJrauAHbI0UOTw6dwk6RL28ATqXVHdrwh_yfnQUupwATi0s306QPgBAGSBQQIBBgBkgUECAUYBKAGAoAHzvr9JKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEOusPNIIBwiAYRABGB2ACgPICwHYEwvQFQGAFwGyFx4KHAgAEhRwdWItOTAzNTA4Nzc5MjY5Mjc3NRjgkG0&sigh=oTC1foTAkP4&uach_m=[UACH]&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)
Requested by: Host: kooora4lives.com
URL: https://kooora4lives.com:2096/m2/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s72-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 84ms
45ms Script
application/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=kooora4lives.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 06 Dec 2021 18:47:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 82ms
48ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=kooora4lives.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 06 Dec 2021 18:47:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 39 KB
10 KB 836ms
835ms XHR
text/plain 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=338030884393098&correlator=875114923821797&output=ldjh&impl=fifs&eid=31060888&vrg=2021120201&ptt=17&sc=1&sfv=1-0-38&ecs=20211206&iu_parts=21939239661%3A202189885%2Capl%2Caplmcm%2Cresponsive2%2Cresponsive3%2Cresponsive4%2Cresponsive5%2Cresponsive6%2Cresponsive7%2Cresponsive%2Csky2%2Csticky&enc_prev_ius=%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F4%2C%2F0%2F1%2F2%2F5%2C%2F0%2F1%2F2%2F6%2C%2F0%2F1%2F2%2F7%2C%2F0%2F1%2F2%2F8%2C%2F0%2F1%2F2%2F9%2C%2F0%2F1%2F2%2F10%2C%2F0%2F1%2F2%2F11&prev_iu_szs=970x250%2C970x250%2C970x250%2C970x250%2C970x250%2C970x250%2C970x250%2C120x600%7C160x600%7C300x600%2C970x90%7C728x90&prev_scp=hb_rfBid%3D0%26excl_cat%3DPREPOST%7Chb_rfBid%3D0%26excl_cat%3DPREPOST%7Chb_rfBid%3D0%26excl_cat%3DPREPOST%7Chb_rfBid%3D0%26excl_cat%3DPREPOST%7Chb_rfBid%3D0%26excl_cat%3DPREPOST%7Chb_rfBid%3D0%26excl_cat%3DPREPOST%7Chb_rfBid%3D0%26excl_cat%3DPREPOST%7Chb_rfBid%3D0%26excl_cat%3DPREPOST%7Ctest%3Drefresh%26hb_rfBid%3D0%26excl_cat%3DPREPOST&eri=1&cookie=ID%3D289350c65ac41bf9%3AT%3D1638816427%3AS%3DALNI_MaKqi6ObFC2BpRvVSufLMRGjlrW9w&bc=31&abxe=1&lmt=1638816428&dt=1638816428090&dlt=1638816426508&idt=849&frm=20&biw=1600&bih=1200&oid=2&adxs=-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9&adys=-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9&adks=2236882750%2C4020262501%2C1704966600%2C2488029984%2C3604116806%2C886624018%2C3649763571%2C2695618550%2C1791824620&ucis=5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd&ifi=7&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fkooora4lives.com%3A2096%2Fm2%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1&msz=0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1&ga_vid=428231269.1638816427&ga_sid=1638816427&ga_hid=1502021003&ga_fc=true&fws=2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2&ohw=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0&btvi=-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d50f80f2e1d4baeb755ae5db44a059809486400d8fc06c096a742eed0b1d0507

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10350
x-xss-protection: 0
google-lineitem-id: -2,-2,-2,-2,-2,-2,-2,5778121850,5504336788
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-2,-2,-2,-2,-2,-2,138361597512,138326746042
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://kooora4lives.com:2096
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 080B 624 B
297 B 48ms
48ms Document
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPa-pwIQxc3Y_wEY6Y-2twEwAQ&v=APEucNUuItzERiD5-OM7NytOP41RvLINUwuqxKu43XalSGxTYUtIOOnyzMZ2ojtskQR83JneXqUrZmsTC5HdIUOnhR1HyHiURw

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 06 Dec 2021 18:47:08 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 abg_lite_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/ Frame 99EA 19 KB
8 KB 27ms
26ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/abg_lite_fy2019.js

Requested by

Host: kooora4lives.com
URL: https://kooora4lives.com:2096/m2/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

615050cfd7cd77d6941c6c0b4551d20c4d5ad825bc9fd7acc61a0bdca7783d26

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:09:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2264
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7857
x-xss-protection: 0
server: cafe
etag: 2255741555227857113
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:09:24 GMT

GET
H3 200 omrhp_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/ Frame 99EA 6 KB
3 KB 35ms
28ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/omrhp_fy2019.js

Requested by

Host: kooora4lives.com
URL: https://kooora4lives.com:2096/m2/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2d0744b54be7eab148245653f8fad2e4a0e8875b886bcacbb2c70741872eda55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 14:02:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 17051
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2626
x-xss-protection: 0
server: cafe
etag: 8548655983161038638
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 14:02:57 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 99EA 0
571 B 117ms
48ms Ping
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuoV2KOtajHvYlFzaBTcwIDTvSeX4AG4b68rAyYaF6VXtRC6IPsT60jsv00G6vtKkWELEDaQfuMr-MnbToy6YdJaTEffZRlvxyGwIGYXlSsbCMf1sXAWFstQslNKGZuMgPFRwmMcnaove5WgC5ZwhMiy1EX6q7sbHGTAAm90uQX2DX5nPhlk1gGGiNx_cG-NzCYilAzyMnT1RcIJRdrWEEnIrzTIEv3FX_RBpLlD6wfRf7NrqOIyc2313LLtIpa1gr7sc6H4-1ZPt4F_aR0sc05wVmB36dCrnu03vHb4wpg2ANQ-jjuIQkirsiGidGU8cFgsI7BxiVZ7AM5MmJq0H5I7lRR1V1ZYf9G4r3APt4h40AVUWIjRKiUwgZ066w4kxrEFrmQGqzdS9FYSuuPCE3OLJoWEoYuG64uP63I5JCNw-G4Q3TvxfKySN_gQz8vOQfW0CHQNLgyyXWIilvKaim8tB2qy6D96NP8e1rhgKh3gNGMV2lA2kmeI1nOtvqSp7Rx_Q_ua1Mkvbl21sR28EHuEu-AMe0Gs8DwG8Nz5Xk3p4uRJsNNpDWASJ6mZglIgHW0rnCaugFFAGRoJ06ehGYRmudj3RWxbTSv2lgoOFQibREpW49FPKYK0bS3RVOVPYANUPuXU6SOP2EsuSYxGrm7TDCM3KDa1zzJ293EWmoIUZWhSbfkT5JLo9JdWSEsQnZfCMYqFGov3ZbdsQQav6N_3SdhyzPkr8V5MKJ83H_OM6NT4TgIqMXsMyyXFRt5tDeq8r4YRmFaKnuD13Ra6XJY7J-q_l7pcR48k8pT7lEDZKeIkltYlxGlXN3IcieBh4-pVs-EdzJsBk0sqn8idfTUH-I_0bRjUZmRwNSdhFCtiibfOYrezXEQR39MelYj2Yt7rXCNnxi9MeyhU85zIbPEe_CGuZNd7OR_Thj1T3UN0MTdgtV5DpPtXwR3Rrc2vqosZY3r6FyKIGGZuwKz39O5gGvG9E7N77cuCTSPkE2CS7-CTstxAYevJbU4GiBFQLlmIdP1yfo8PwrUD4SqCpNfuMkPwbToIf-M0PfhrZvT2mqg91NqBb1XKjg5vLVUoWlmruIy6WOGgrfnNqXr6Z7KJzOuSrCZPUxgF5FTBaxmnIrvGJH_xj_GkkrfbJd7NXAOBt8OVBJ6p2UXJQ&sai=AMfl-YRc1eAkcUFieFr2VZv-tbhbFCIiiVHLSaZcPkaz4qwI7chweyfOPN2fwFQy2fSuaXy_VfsKTrjrhdkteYuQD8ljz7HcZUZpd0BDoCJdDmA0oYPbTXbUcDHhJbQlf_MFRSmzpX_sVAqssScmsZaPiMC6LaiQTKKBaq_eyUkiu5DJYNPPAaL8wVc3jKCASHqptk4RkiQHlr4H6gUd6wUgwRJLBKo1cKPaC2zeEqpXnjqanHdH3pO66FemQLrwSlGwMGy594BV1yYgMFnSfocAIJZ9R4sR-v_Rixq6mso&sig=Cg0ArKJSzJ8qqR3ffEm1EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=1&cisv=r20211201.10634&adurl=

Requested by

Host: kooora4lives.com
URL: https://kooora4lives.com:2096/m2/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 06 Dec 2021 18:47:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 99EA 41 KB
15 KB 23ms
19ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: kooora4lives.com
URL: https://kooora4lives.com:2096/m2/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 06:39:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43647
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Tue, 06 Dec 2022 06:39:41 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 99EA 42 B
63 B 50ms
44ms Image
image/gif 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CPA8vQAGgRcs8QngXTliTrDtnnbQuy0SI5LMBkHWdy6VxTbpaI-IQY8lPie8h1ByYg5ihs7Wwu8baPwxhbNMWPcWLeK6s6sKaITEi3qheQeZHDA0g

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 99EA 2 KB
1 KB 27ms
21ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/window_focus_fy2019.js

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:45:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:45:24 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 99EA 119 KB
36 KB 146ms
111ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 06 Dec 2021 18:47:08 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 99EA 15 KB
6 KB 26ms
21ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6257e792f9aef240d1954956a6ea7982c0268035f15a79931a110ed6344c8c4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 113
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6446
x-xss-protection: 0
server: cafe
etag: 5472324691301332805
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:45:15 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 99EA 0
0 53ms
48ms Image
text/html 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRc6WY1W8BBR9cSy1EjaeUZG0clbZSc_AAcc45y_WN2A36PyrNOoMi2ii4UCuxLqWNbMYgji-UOYQamrqYjgaqcSYddtw
Requested by: Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:807::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H2 200 3964203188461327315
s0.2mdn.net/simgad/ Frame 99EA 19 KB
19 KB 102ms
27ms Image
image/png 2607:f8b0:4006:823::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/3964203188461327315

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

01f187e6713a3a85c6aece15ea7bd1a1045a4ed5539c40f9d58b66c68c627eda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 16:00:56 GMT
x-content-type-options: nosniff
age: 441972
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18944
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 20:10:42 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 01 Dec 2022 16:00:56 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 33A2 0
0 51ms
46ms Fetch
text/html 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CtMfHq1quYcmyHdrSo9kPvIiFuAHnvo_lZpvQ-KL0DpaCzYWIFhABIL3Phmhg_eiigfADoAHG5LDIA8gBAuACAKgDAcgDmQSqBPcBT9Dsz6MxcG02F7HcQBX0cjMsSEI0vLoI2JF1hwkHhOGJvi90uURHMUJ5liLwh1fe8I6jVabsSvmwixzNskHZGyATB_j0qhgrsC3JUtLM7JnfRyVwNgocJxtbtRQgvnHbELqEvuRGUsPhrvQUODum6X8695dR5DPAk2nzsO0cX8IX6Cad2lkr66YtCXZKGDqyVD72aGdJNwDnA7q_ioGDXoQlhSQZ-XtqyE9JzS-NKguaUgMMQhqJdfcKDPay8YR_I1H3oeUp_3CixBMsW0jDBhJ_-hFQ2lo561V4DMijcsehfMqFIprRTLcuqJEU8CplEP5MWcogpsAE4tLN9OkD4AQBkgUECAQYAZIFBAgFGASgBgKAB876_SSoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBCKwhzSCAcIgGEQARgdgAoDyAsB2BML0BUBgBcBshceChwIABIUcHViLTkwMzUwODc3OTI2OTI3NzUY4JBt&sigh=2OfTdLYWGmU&uach_m=[UACH]
Requested by: Host: kooora4lives.com
URL: https://kooora4lives.com:2096/m2/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s72-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 6316434543986537125
tpc.googlesyndication.com/daca_images/simgad/ Frame 33A2 74 KB
74 KB 29ms
21ms Image
image/png 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/6316434543986537125

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9028bcc00119fec81d56286c009016ecec816488f6424cff00ce99fa70c0536f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 03:41:01 GMT
x-content-type-options: nosniff
age: 54367
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 75541
x-xss-protection: 0
last-modified: Sat, 27 Nov 2021 16:34:33 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 06 Dec 2022 03:41:01 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/ Frame 33A2 19 KB
8 KB 30ms
22ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/abg_lite_fy2019.js

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

615050cfd7cd77d6941c6c0b4551d20c4d5ad825bc9fd7acc61a0bdca7783d26

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:45:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 84
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7857
x-xss-protection: 0
server: cafe
etag: 2255741555227857113
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:45:44 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 33A2 2 KB
1 KB 39ms
32ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/window_focus_fy2019.js

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:45:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:45:24 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 33A2 119 KB
36 KB 136ms
105ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 06 Dec 2021 18:47:08 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 33A2 15 KB
6 KB 30ms
23ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6257e792f9aef240d1954956a6ea7982c0268035f15a79931a110ed6344c8c4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 113
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6446
x-xss-protection: 0
server: cafe
etag: 5472324691301332805
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:45:15 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 33A2 0
0 55ms
48ms Image
text/html 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRV0s0jdR6hMn1T-_unwk8W7yChMbIDIMMZ6N7l3N1nfKfVwV00CJNlHYk4oSH3AX-ACz-cK6Ybk-Al8dvZYHnJQqvFdQ
Requested by: Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:807::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 33A2 27 KB
11 KB 39ms
32ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e11652e7b04cdcc9c0bc7948055c05aaf8f7c066e6059d52f9b186c55368cb9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 14:31:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15341
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11392
x-xss-protection: 0
server: cafe
etag: 7769099329773015066
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 14:31:27 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame 737B 4 KB
1 KB 91ms
35ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 17:38:13 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 06 Dec 2021 18:47:08 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 06 Dec 2021 18:47:08 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 0D9C 1 KB
882 B 26ms
26ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:37:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 558
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 853
x-xss-protection: 0
server: cafe
etag: 7170004918125193417
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:37:50 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/ Frame 0D9C 19 KB
8 KB 25ms
20ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/abg_lite_fy2019.js

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

615050cfd7cd77d6941c6c0b4551d20c4d5ad825bc9fd7acc61a0bdca7783d26

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:45:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 84
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7857
x-xss-protection: 0
server: cafe
etag: 2255741555227857113
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:45:44 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 0D9C 2 KB
1 KB 30ms
19ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/window_focus_fy2019.js

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:45:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:45:24 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0D9C 119 KB
36 KB 127ms
117ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 06 Dec 2021 18:47:08 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 0D9C 15 KB
6 KB 30ms
19ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6257e792f9aef240d1954956a6ea7982c0268035f15a79931a110ed6344c8c4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 113
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6446
x-xss-protection: 0
server: cafe
etag: 5472324691301332805
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:45:15 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 0D9C 0
0 59ms
48ms Image
text/html 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSdXW_kYnd-AmgQOswbOAHMcCnvT2mGZrWKTdyUDQVB6oig0-CACaDQ6y4BxKkyBOb3mjJoMQmla5JSerUBAUC1hF2-_A
Requested by: Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:807::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H2 200 6d065ef8aad4e53a06604e1059b7b7b3.js Show response
www.gstatic.com/mysidia/ Frame 0D9C 27 KB
12 KB 106ms
21ms Script
text/javascript 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/6d065ef8aad4e53a06604e1059b7b7b3.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b138f0b28fe44581bebb03d0ff7046e4f8416deeb5d152ede640eaa3dc1c7872

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 06:31:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 44121
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11408
x-xss-protection: 0
last-modified: Tue, 30 Nov 2021 18:18:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 06 Mar 2022 06:31:47 GMT

GET
H3 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/ Frame 737B 19 KB
8 KB 31ms
20ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d71682fbb31fc64ba19097a9eb389593ba1bf9f9f913bef6eaf563eb08c2a7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:45:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 95
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8210
x-xss-protection: 0
server: cafe
etag: 6499249944067270656
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:45:33 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 737B 205 B
520 B 106ms
30ms Image
image/png 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 22:40:56 GMT
x-content-type-options: nosniff
age: 590772
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 29 Nov 2022 22:40:56 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 737B 604 B
696 B 107ms
31ms Image
image/png 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 05 Dec 2021 00:11:42 GMT
x-content-type-options: nosniff
age: 153326
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 05 Dec 2022 00:11:42 GMT

GET
H2

200

download-1-6.png
kooora4lives.com/wp-content/uploads/2019/01/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/01/download-1-6.png
https://plus.kooora4live.net/wp-content/uploads/2019/01/download-1-6.png
https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-1-6.png

7 KB
8 KB

427ms
416ms

Image
image/png

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-1-6.png
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30c63d235979e3679e77069abc0ca1bf46d506015c0978089777bf4933684634

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 7416
pragma: public
last-modified: Fri, 04 Jan 2019 13:40:46 GMT
server: cloudflare
etag: "5c2f625e-1cf8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yYfpGS%2BI6SVBxKvtmDwk8JAla0pvkQfYJl4TuanNnWvrYSdsxjAIOPcCMODMF%2BJRv%2FEQrE7WZ3xPh49tfWKF22KffuPgwP%2F0%2F8VxBYHhqoeZBUJEKt6i5qD0n2s9PRhilxOGE4WAD1Sgl6Z0XsN5do8oeA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae54f8c17142-YUL
expires: Wed, 05 Jan 2022 18:47:08 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qKlc72O2XhFVZ632%2FKUQK4ElOmpV5JZ8rltlUkXMYAyIIp5%2BgNbgzSeB08EQdYDyAl4ENUrEu3E0kCYhLSTUjIl%2BOdDPH1AJPob%2BDfk7vgMPgich%2FL%2BUSOfW2ouKAg4qhwuUVOHAOtY64G5Y6URIelNk"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/01/download-1-6.png
cache-control: max-age=3600
cf-ray: 6b97ae547a574bd0-YUL
expires: Mon, 06 Dec 2021 19:47:08 GMT

GET
H2

200

180px-Arsenal_FC.svg_.png
kooora4lives.com/wp-content/uploads/2019/01/
Redirect Chain

https://www.kooora4live.com/wp-content/uploads/2019/01/180px-Arsenal_FC.svg_.png
https://plus.kooora4live.net/wp-content/uploads/2019/01/180px-Arsenal_FC.svg_.png
https://kooora4lives.com:2096/wp-content/uploads/2019/01/180px-Arsenal_FC.svg_.png

28 KB
28 KB

497ms
495ms

Image
image/png

2606:4700:20::681a:3ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kooora4lives.com:2096/wp-content/uploads/2019/01/180px-Arsenal_FC.svg_.png
Protocol: H2
Server: 2606:4700:20::681a:3ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e045ae784a5912fe98bb81005bbfaa36cef097b6a2bdd4ff1ce2fe915ac8ce8

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 28245
pragma: public
last-modified: Fri, 04 Jan 2019 13:35:08 GMT
server: cloudflare
etag: "5c2f610c-6e55"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q%2B4l8X%2FAVFjAvQOn8S9JeS4eSelHRg7HKyzIgxCEopVPQiZwOLsTeCUE6XTh3YbJncVEDFuaHWOn9U%2B7dLPVYh%2BEY9hmn4BxN0uvhLVHKtUP9jCfnIZZQdWpAbaBm40gcjSuX6OYpvsHVBdynCasQgK%2B0w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b97ae5549387142-YUL
expires: Wed, 05 Jan 2022 18:47:08 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2PU2pfO5zN80nm0CH3luZ7HE5shpZesTOUZfFtZF1ZN6DkfB1F0T%2Be5IR7yOI6wY2PqgfcqgF3Zg%2Ba5MIA60fhUdue1xHJX1DvAu1YESA8OXh5DxTQ9hN6LIrDX7Ng3sPqeTdAyjpj9EH508Gr9DtVMz"}],"group":"cf-nel","max_age":604800}
location: https://kooora4lives.com:2096/wp-content/uploads/2019/01/180px-Arsenal_FC.svg_.png
cache-control: max-age=3600
cf-ray: 6b97ae54dac04bd0-YUL
expires: Mon, 06 Dec 2021 19:47:08 GMT

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 5823
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

54ms
54ms

Image
text/html

2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: kooora4lives.com
URL: https://kooora4lives.com:2096/m2/
Protocol: H3
Server: 2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Redirect headers

date: Mon, 06 Dec 2021 18:47:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 6316434543986537125
tpc.googlesyndication.com/daca_images/simgad/ Frame 274A 74 KB
74 KB 25ms
25ms Image
image/png 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/6316434543986537125

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4903453974745530&output=html&h=280&slotname=go4darsiapl%2Fbanners&adk=872605085&adf=3852535245&pi=t.ma~as.go4darsiapl%2Fbanners&w=1100&fwrn=4&fwrnh=100&lmt=1638816427&rafmt=1&psa=0&format=1100x280&url=https%3A%2F%2Fkooora4lives.com%3A2096%2Fm2%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638816427161&bpp=2&bdt=653&idt=170&shv=r20211201&mjsv=m202111300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=481118744695&frm=20&pv=2&ga_vid=428231269.1638816427&ga_sid=1638816427&ga_hid=1502021003&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=250&ady=1904&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C31063824&oid=2&pvsid=338030884393098&pem=146&tmod=1761430614&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=zp5xN7PIvs&p=https%3A//kooora4lives.com%3A2096&dtd=177

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9028bcc00119fec81d56286c009016ecec816488f6424cff00ce99fa70c0536f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 03:41:01 GMT
x-content-type-options: nosniff
age: 54367
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 75541
x-xss-protection: 0
last-modified: Sat, 27 Nov 2021 16:34:33 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 06 Dec 2022 03:41:01 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/ Frame 274A 19 KB
8 KB 26ms
26ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

615050cfd7cd77d6941c6c0b4551d20c4d5ad825bc9fd7acc61a0bdca7783d26

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:45:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 84
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7857
x-xss-protection: 0
server: cafe
etag: 2255741555227857113
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:45:44 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 274A 2 KB
1 KB 31ms
25ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:45:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:45:24 GMT

GET
H3 200 transparent.png
tpc.googlesyndication.com/pagead/images/ Frame 274A 67 B
95 B 32ms
26ms Image
image/png 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/transparent.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 06 Dec 2021 01:09:43 GMT
x-content-type-options: nosniff
server: cafe
age: 63445
etag: 2462972746714251406
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67
x-xss-protection: 0
expires: Tue, 07 Dec 2021 01:09:43 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 274A 119 KB
36 KB 76ms
70ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 06 Dec 2021 18:47:08 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 274A 15 KB
6 KB 31ms
25ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6257e792f9aef240d1954956a6ea7982c0268035f15a79931a110ed6344c8c4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 113
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6446
x-xss-protection: 0
server: cafe
etag: 5472324691301332805
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:45:15 GMT

GET
H3 200 6316434543986537125
tpc.googlesyndication.com/daca_images/simgad/ Frame 5823 74 KB
74 KB 24ms
22ms Image
image/png 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/6316434543986537125

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012111011823000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9028bcc00119fec81d56286c009016ecec816488f6424cff00ce99fa70c0536f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 03:41:01 GMT
x-content-type-options: nosniff
age: 54367
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 75541
x-xss-protection: 0
last-modified: Sat, 27 Nov 2021 16:34:33 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 06 Dec 2022 03:41:01 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3B47 1 KB
749 B 35ms
25ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 05 Dec 2021 19:21:13 GMT
expires: Mon, 06 Dec 2021 19:21:13 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 84355
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 274A 27 KB
11 KB 32ms
27ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e11652e7b04cdcc9c0bc7948055c05aaf8f7c066e6059d52f9b186c55368cb9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 14:31:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15341
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11392
x-xss-protection: 0
server: cafe
etag: 7769099329773015066
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 14:31:27 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D5EB 1 KB
749 B 35ms
28ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 05 Dec 2021 19:21:13 GMT
expires: Mon, 06 Dec 2021 19:21:13 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 84355
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 080B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGsPBRt_1HTYop1Md4vWna0&google_cver=1

43 B
1012 B

33ms
27ms

Image
image/gif

23.52.162.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGsPBRt_1HTYop1Md4vWna0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPa-pwIQxc3Y_wEY6Y-2twEwAQ&v=APEucNUuItzERiD5-OM7NytOP41RvLINUwuqxKu43XalSGxTYUtIOOnyzMZ2ojtskQR83JneXqUrZmsTC5HdIUOnhR1HyHiURw
Protocol: HTTP/1.1
Server: 23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-162-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 06 Dec 2021 18:47:08 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 06 Dec 2021 18:47:08 GMT

Redirect headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGsPBRt_1HTYop1Md4vWna0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 080B
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Ya5arK5MMWmz3JXDQ5rlOAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGsPBRt_1HTYop1Md4vWna0&google_cver=1

43 B
892 B

32ms
31ms

Image
image/gif

23.52.162.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGsPBRt_1HTYop1Md4vWna0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPa-pwIQxc3Y_wEY6Y-2twEwAQ&v=APEucNUuItzERiD5-OM7NytOP41RvLINUwuqxKu43XalSGxTYUtIOOnyzMZ2ojtskQR83JneXqUrZmsTC5HdIUOnhR1HyHiURw
Protocol: HTTP/1.1
Server: 23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-162-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 06 Dec 2021 18:47:08 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 06 Dec 2021 18:47:08 GMT

Redirect headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGsPBRt_1HTYop1Md4vWna0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 080B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEO0yNeMCxYl3jW988VZTnTA&google_cver=1

43 B
1006 B

27ms
20ms

Image
image/gif

68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEO0yNeMCxYl3jW988VZTnTA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPa-pwIQxc3Y_wEY6Y-2twEwAQ&v=APEucNUuItzERiD5-OM7NytOP41RvLINUwuqxKu43XalSGxTYUtIOOnyzMZ2ojtskQR83JneXqUrZmsTC5HdIUOnhR1HyHiURw

Protocol

HTTP/1.1

Server

68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 06 Dec 2021 18:47:08 GMT
X-Proxy-Origin: 37.120.205.149; 37.120.205.149; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 9d0cd524-d569-43f0-9b8a-58c5c1c7e3e2
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEO0yNeMCxYl3jW988VZTnTA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 080B
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzk4MjYzMzY5MzE0OTk0Nzc5Mw%3D%3D

170 B
188 B

72ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzk4MjYzMzY5MzE0OTk0Nzc5Mw%3D%3D

Requested by

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 06 Dec 2021 18:47:08 GMT
X-Proxy-Origin: 37.120.205.149; 37.120.205.149; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 2ad37f60-7a93-4f67-9402-72c6092e4f16
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzk4MjYzMzY5MzE0OTk0Nzc5Mw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 938C 22 KB
8 KB 26ms
25ms Document
text/html 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Mon, 06 Dec 2021 06:39:41 GMT
expires: Tue, 06 Dec 2022 06:39:41 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 43647
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 99EA 0
23 B 71ms
43ms Ping
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: kooora4lives.com
URL: https://kooora4lives.com:2096/m2/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 06 Dec 2021 18:47:08 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame F828 143 B
163 B 36ms
25ms Document
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 06 Dec 2021 18:06:46 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 2422
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 26F3 1 KB
749 B 33ms
25ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 05 Dec 2021 19:21:13 GMT
expires: Mon, 06 Dec 2021 19:21:13 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 84355
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 33A2 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2b5e4c6d52b919c994967c52f204751ccb118c9448a3969579fbde246910f027

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 1779 143 B
163 B 22ms
21ms Document
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4903453974745530&output=html&h=280&slotname=go4darsiapl%2Fbanners&adk=872605085&adf=3852535245&pi=t.ma~as.go4darsiapl%2Fbanners&w=1100&fwrn=4&fwrnh=100&lmt=1638816427&rafmt=1&psa=0&format=1100x280&url=https%3A%2F%2Fkooora4lives.com%3A2096%2Fm2%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638816427161&bpp=2&bdt=653&idt=170&shv=r20211201&mjsv=m202111300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=481118744695&frm=20&pv=2&ga_vid=428231269.1638816427&ga_sid=1638816427&ga_hid=1502021003&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=250&ady=1904&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C31063824&oid=2&pvsid=338030884393098&pem=146&tmod=1761430614&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=zp5xN7PIvs&p=https%3A//kooora4lives.com%3A2096&dtd=177

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 06 Dec 2021 18:06:46 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 2422
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 99EA 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ce16a19020ea7fa623d4c6c390e67906c0e46d367e926742be602144c7eeac97

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 274A 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 92fb972850b501e1e1bfdea4dc153d75ba1e6d630f67974065707e4c66a7b7a4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

POST multitracking
ghb.adtelligent.com/adunit/ 0
0

GET /
google2waycm.netmng.com/cm/ Frame 3B47 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3B47
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEBYgCUSmCHIbN80S6AC0hI0&google_cver=1&google_push=AYg5qPLRoV9YE_vF02hJI-BNKKdWDNKFh_mgU53veNONSR7WSI_-eGM...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=1209c236d7801205&is_secure=true&networkId=14000&version=1&google_gid=CAESEBYgCUSmCHIbN80S6AC0hI0&google_cver=1&google_push=AYg5qPLRoV9Y...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGZuOgUzHgoQNy7x1gAAAAAAA&expiration=1638902828&google_cver=1&is_secure=true&google_gid=CAESEBYgCUSmCHIbN80S6AC0h...

170 B
188 B

36ms
35ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGZuOgUzHgoQNy7x1gAAAAAAA&expiration=1638902828&google_cver=1&is_secure=true&google_gid=CAESEBYgCUSmCHIbN80S6AC0hI0&google_push=AYg5qPLRoV9YE_vF02hJI-BNKKdWDNKFh_mgU53veNONSR7WSI_-eGMdOVyveUmHAfgDjs9vIrj6xkINpL9zEPlVgKA71vFmMzPs

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGZuOgUzHgoQNy7x1gAAAAAAA&expiration=1638902828&google_cver=1&is_secure=true&google_gid=CAESEBYgCUSmCHIbN80S6AC0hI0&google_push=AYg5qPLRoV9YE_vF02hJI-BNKKdWDNKFh_mgU53veNONSR7WSI_-eGMdOVyveUmHAfgDjs9vIrj6xkINpL9zEPlVgKA71vFmMzPs
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 3B47
Redirect Chain

https://onetag-sys.com/sync/i,19/?google_gid=CAESEJnlZt4X2XCJBnA7rdTmfrA&google_cver=1&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPK-ZSez87ER90qs9XRiro6og-5KT21xwG6CKloJXjtelQXnWxkqgyjsN4e8JbNzYHCl5ul2UZTJc9ULdlLnJ-MHHWg-wmZk&google_hm=NThzRjNtSzA1M1ZNZkVs...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3B47
Redirect Chain

https://google.partners.tremorhub.com/sync?UIDF=CAESEJSGoV3EDuopC3DfpE1Qlbc&google_cver=1&google_push=AYg5qPLN6Vo4pdmLz4bTFiYufXLPMDfOpk9q2lagzNY8h0j8AsFsWTOk1otdVzXJsRDHIBsA9Q-4jD1BLg4YNYkTGPjNd6g...
https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=YzM4NjkzNjY4NjA1NGI3ZjkyN2U1ZmYyOWQ2NTdhNDE%3D&UIDF=CAESEJSGoV3EDuopC3DfpE1Qlbc&google_cver=1&google_push=AYg5qPLN6Vo4pdmLz4bTFiYufXLP...

170 B
188 B

41ms
40ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=YzM4NjkzNjY4NjA1NGI3ZjkyN2U1ZmYyOWQ2NTdhNDE%3D&UIDF=CAESEJSGoV3EDuopC3DfpE1Qlbc&google_cver=1&google_push=AYg5qPLN6Vo4pdmLz4bTFiYufXLPMDfOpk9q2lagzNY8h0j8AsFsWTOk1otdVzXJsRDHIBsA9Q-4jD1BLg4YNYkTGPjNd6gX5IG8

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=YzM4NjkzNjY4NjA1NGI3ZjkyN2U1ZmYyOWQ2NTdhNDE%3D&UIDF=CAESEJSGoV3EDuopC3DfpE1Qlbc&google_cver=1&google_push=AYg5qPLN6Vo4pdmLz4bTFiYufXLPMDfOpk9q2lagzNY8h0j8AsFsWTOk1otdVzXJsRDHIBsA9Q-4jD1BLg4YNYkTGPjNd6gX5IG8
date: Mon, 06 Dec 2021 18:47:08 GMT
server: Apache-Coyote/1.1
content-length: 0
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3B47
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEMGrhH3ck4Iijzqfrs-DkSI&google_cver=1&google_push=AYg5qPJIEq5_WI6Or5OzvM21QW1ELX_Z9GdbkPI6k12RFAF4WP910cmIKlrikjQhBxP6rS1Nxk_aDR4QizRmBTx9Omlzl4PTirkg
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=0&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPJIEq5_WI6Or5OzvM21QW1ELX_Z9GdbkPI6k12RFAF4WP910cmIKlrikjQhBxP6rS1Nxk_aDR4QizRmBTx9Omlzl4PTirkg&goog...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=OTYzMjM0MDY2ODUzMTgwOTc2OA%3D%3D&google_push=AYg5qPJIEq5_WI6Or5OzvM21QW1ELX_Z9GdbkPI6k12RFAF4WP910cmIKlri...

170 B
188 B

37ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=OTYzMjM0MDY2ODUzMTgwOTc2OA%3D%3D&google_push=AYg5qPJIEq5_WI6Or5OzvM21QW1ELX_Z9GdbkPI6k12RFAF4WP910cmIKlrikjQhBxP6rS1Nxk_aDR4QizRmBTx9Omlzl4PTirkg

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=OTYzMjM0MDY2ODUzMTgwOTc2OA%3D%3D&google_push=AYg5qPJIEq5_WI6Or5OzvM21QW1ELX_Z9GdbkPI6k12RFAF4WP910cmIKlrikjQhBxP6rS1Nxk_aDR4QizRmBTx9Omlzl4PTirkg
date: Mon, 06 Dec 2021 18:47:08 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3B47
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=google&ssp_init=step1&google_gid=CAESELiHlD3WFKmO3l_BgDyhzO8&google_cver=1&google_push=AYg5qPLftSNiMCx_vDxGTWBJuuFKE6VfQGNWDpXro2I0m_6_-l-ubK-45bzRl5yZivMDs2hZ45wE...
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=google&ssp_init=step1&google_gid=CAESELiHlD3WFKmO3l_BgDyhzO8&google_cver=1&google_push=AYg5qPLftSNiMCx_vDxGTWBJuuFKE6VfQGNWDpXro2I0m_6_-l-ubK-45bzRl5yZivMDs2...
https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=X4Xv5yOBT5uWAWWkTovZ-Q==&no_redirect=1&google_push=AYg5qPLftSNiMCx_vDxGTWBJuuFKE6VfQGNWDpXro2I0m_6_-l-ubK...

170 B
188 B

35ms
35ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=X4Xv5yOBT5uWAWWkTovZ-Q==&no_redirect=1&google_push=AYg5qPLftSNiMCx_vDxGTWBJuuFKE6VfQGNWDpXro2I0m_6_-l-ubK-45bzRl5yZivMDs2hZ45wEI8Ejs0R28ANL5RB2cNsXU5Dxgg

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=X4Xv5yOBT5uWAWWkTovZ-Q==&no_redirect=1&google_push=AYg5qPLftSNiMCx_vDxGTWBJuuFKE6VfQGNWDpXro2I0m_6_-l-ubK-45bzRl5yZivMDs2hZ45wEI8Ejs0R28ANL5RB2cNsXU5Dxgg
date: Mon, 06 Dec 2021 18:47:08 GMT
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H3 200 dot.gif
s0.2mdn.net/ Frame 3B47 43 B
65 B 71ms
38ms Image
image/gif 2607:f8b0:4006:823::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEM9u22r_u5M6HBZ0D45kzd8&google_cver=1&google_push=AYg5qPKn-s_hd8fNS9wm-azeWZPB84VamDe8b2vxBFyUQAkH7cle3ljCn4PKmdIHFqteZcfkSqPbZ2dX5VKuDUDXFCd-mUlVGKwQ0w

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 07 Dec 2021 18:47:08 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 3B47 0
12 B 40ms
33ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LmPHu7V4OkMTF9OnDO5MVtDQZxTpB4oLVaMnsmivNx2IqHX8QR26hpVNy3iMkE-p5Doy5Iu-Y

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET /
google2waycm.netmng.com/cm/ Frame D5EB 0
0

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame D5EB
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEBFyOfeqsPS-VDo7d4Kt_p8&google_cver=1&google_push=AYg5qPIjXNsgZBwWRjbpS3E1ft65RbsQMTGYd-NxB0s4ZH79KeJVFYrYQ15HvNUjIgAREDvAimFWiYMjN6ynu5yWhc33BfLWeJEC
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzU0MjMyNjI5ODQ5MDY2Nzk0Ng==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEHM9Bj5QDU9rBAdmmXkxAHU&google_cver=1

43 B
407 B

120ms
43ms

Image
image/gif

2620:112:f002:bbbb::21
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEHM9Bj5QDU9rBAdmmXkxAHU&google_cver=1
Protocol: H2
Server: 2620:112:f002:bbbb::21 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEHM9Bj5QDU9rBAdmmXkxAHU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D5EB
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEEK3Fw4vrejNTT2RV31T_V4&google_cver=1&google_push=AYg5qPIurQeTqv04NUWS8qHakBQqsmNa8KSx7ac38o9XaVoKJeRUSW4aAEX2g1QtmiWiAAcMDW8zCAstrtN0RTF1...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIurQeTqv04NUWS8qHakBQqsmNa8KSx7ac38o9XaVoKJeRUSW4aAEX2g1QtmiWiAAcMDW8zCAstrtN0RTF1OZDMU_kd0FAR

170 B
188 B

35ms
35ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIurQeTqv04NUWS8qHakBQqsmNa8KSx7ac38o9XaVoKJeRUSW4aAEX2g1QtmiWiAAcMDW8zCAstrtN0RTF1OZDMU_kd0FAR

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 06 Dec 2021 18:47:08 GMT
Server: MT3 4103 f8fad19 master ord-pixel-x56 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIurQeTqv04NUWS8qHakBQqsmNa8KSx7ac38o9XaVoKJeRUSW4aAEX2g1QtmiWiAAcMDW8zCAstrtN0RTF1OZDMU_kd0FAR
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 06 Dec 2021 18:47:07 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D5EB
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECVvMy30GbrjIJzRxtnN-J0&google_cver=1&google_push=AYg5qPKI-WqmnphCq7au37rDeawnxJDZeNafV4Sc6Nan3qP8LKzb7aSzcULa7xZmzknXphyqRobMbCaxoJrIoy-AB_6UVw0...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPKI-WqmnphCq7au37rDeawnxJDZeNafV4Sc6Nan3qP8LKzb7aSzcULa7xZmzknXphyqRobMbCaxoJrIoy-AB_6UVw07qUW7&google_hm=Mzc4NzYwODQ4MzA1OTg3OD...

170 B
188 B

41ms
41ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPKI-WqmnphCq7au37rDeawnxJDZeNafV4Sc6Nan3qP8LKzb7aSzcULa7xZmzknXphyqRobMbCaxoJrIoy-AB_6UVw07qUW7&google_hm=Mzc4NzYwODQ4MzA1OTg3ODY1OA%3D%3D

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:08 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPKI-WqmnphCq7au37rDeawnxJDZeNafV4Sc6Nan3qP8LKzb7aSzcULa7xZmzknXphyqRobMbCaxoJrIoy-AB_6UVw07qUW7&google_hm=Mzc4NzYwODQ4MzA1OTg3ODY1OA%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D5EB
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEAcfxlJHBEsmn6pLRpY_p0I&google_cver=1&google_push=AYg5qPLZoEJFAAno7n92xL3gJ96ZiXwqyCyfQ25q_Zw1UoGcd8hibcNJyQmpJmy3Hj2afNX4b3R7Ummt...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEAcfxlJHBEsmn6pLRpY_p0I&google_cver=1&google_push=AYg5qPLZoEJFAAno7n92xL3gJ96ZiXwqyCyfQ25q_Zw1UoGcd8hibcNJyQmpJmy3Hj2afNX4b3R...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTU5NzAzNjE2ODI4NzA0NTQ2Mw&google_push=AYg5qPLZoEJFAAno7n92xL3gJ96ZiXwqyCyfQ25q_Zw1UoGcd8hibcNJyQmpJmy3Hj2afNX4b3R7Um...

170 B
188 B

36ms
34ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTU5NzAzNjE2ODI4NzA0NTQ2Mw&google_push=AYg5qPLZoEJFAAno7n92xL3gJ96ZiXwqyCyfQ25q_Zw1UoGcd8hibcNJyQmpJmy3Hj2afNX4b3R7Ummt2jtz0PHOG3BAqSu0wp8

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTU5NzAzNjE2ODI4NzA0NTQ2Mw&google_push=AYg5qPLZoEJFAAno7n92xL3gJ96ZiXwqyCyfQ25q_Zw1UoGcd8hibcNJyQmpJmy3Hj2afNX4b3R7Ummt2jtz0PHOG3BAqSu0wp8
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D5EB
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEPDEl_7H6z3LF8dTMITyhPM&google_cver=1&google_push=AYg5qPLuQl1ZwEdhPkqlZa8FD7Q4pxnmaJrOAQFoJdkpeSRJOs3YZ50gpGQbVAjMMCyTzqH94LgHkrTmeljaW...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEPDEl_7H6z3LF8dTMITyhPM&google_push=AYg5qPLuQl1ZwEdhPkqlZa8FD7Q4pxnmaJrOAQFoJdkpeSRJOs3YZ50gpGQbVAjMMCyTzqH94LgHkrTmeljaW...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AYg5qPLuQl1ZwEdhPkqlZa8FD7Q4pxnmaJrOAQFoJdkpeSRJOs3YZ50gpGQbVAjMMCyTzqH94LgHkrTmeljaWwDLY1JycQ_KMbnD&google_hm=M21BeVhzTy1NTW9mclJH...

170 B
188 B

36ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AYg5qPLuQl1ZwEdhPkqlZa8FD7Q4pxnmaJrOAQFoJdkpeSRJOs3YZ50gpGQbVAjMMCyTzqH94LgHkrTmeljaWwDLY1JycQ_KMbnD&google_hm=M21BeVhzTy1NTW9mclJHVlV0RWo=

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 06 Dec 2021 18:47:08 GMT
P3p: CP="We do not support P3P header."
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AYg5qPLuQl1ZwEdhPkqlZa8FD7Q4pxnmaJrOAQFoJdkpeSRJOs3YZ50gpGQbVAjMMCyTzqH94LgHkrTmeljaWwDLY1JycQ_KMbnD&google_hm=M21BeVhzTy1NTW9mclJHVlV0RWo=
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 236
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D5EB
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsonobi%26google_push%3DAYg5qPJnRErodzBSJEuWpZhtOr-IadAVpoGorAL4I9sTxJ-5XhrQKIbG-wgqpLcPU3wDerBOcbh6U8pzhI...
https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_push=AYg5qPJnRErodzBSJEuWpZhtOr-IadAVpoGorAL4I9sTxJ-5XhrQKIbG-wgqpLcPU3wDerBOcbh6U8pzhIy5L43U1Eue85qd9Dq3&google_hm=2d52db05-bf91-4375-b7...

170 B
188 B

35ms
35ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_push=AYg5qPJnRErodzBSJEuWpZhtOr-IadAVpoGorAL4I9sTxJ-5XhrQKIbG-wgqpLcPU3wDerBOcbh6U8pzhIy5L43U1Eue85qd9Dq3&google_hm=2d52db05-bf91-4375-b756-d26b2cb07a7f

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 06 Dec 2021 18:47:08 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-74
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_push=AYg5qPJnRErodzBSJEuWpZhtOr-IadAVpoGorAL4I9sTxJ-5XhrQKIbG-wgqpLcPU3wDerBOcbh6U8pzhIy5L43U1Eue85qd9Dq3&google_hm=2d52db05-bf91-4375-b756-d26b2cb07a7f
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame D5EB 0
12 B 38ms
33ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Jy-ygEoGLSzKkNpWUC2ibnIUz_kEZa3s-AqwINKIpk352dBEps6gvCvzXr2HFqVzab92Wz

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 26F3
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPJnfjB4KM2tiAADX76l4Mk3d_qSv4rvwBz5aN2...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWE1YXJBQUFBVEkxT1Q2Rg&google_push=AYg5qPJnfjB4KM2tiAADX76l4Mk3d_qSv4rvwBz5aN25JGp4a7-jvtXJFvRdXp1pQQ8lKOFRkjuchgE-1HOxqY6IEyy4tdIxNz...

170 B
188 B

37ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWE1YXJBQUFBVEkxT1Q2Rg&google_push=AYg5qPJnfjB4KM2tiAADX76l4Mk3d_qSv4rvwBz5aN25JGp4a7-jvtXJFvRdXp1pQQ8lKOFRkjuchgE-1HOxqY6IEyy4tdIxNzNPmg

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWE1YXJBQUFBVEkxT1Q2Rg&google_push=AYg5qPJnfjB4KM2tiAADX76l4Mk3d_qSv4rvwBz5aN25JGp4a7-jvtXJFvRdXp1pQQ8lKOFRkjuchgE-1HOxqY6IEyy4tdIxNzNPmg
Date: Mon, 06 Dec 2021 18:47:08 GMT
Server: Apache
Connection: keep-alive
Content-Length: 393
Content-Type: text/html; charset=iso-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 26F3
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEOYGiI7Otx4HDeUJzdsinn8&google_cver=1&google_push=AYg5qPKLz2xTNXoe8lhGEaKQpQMTrgcllVqw3vIgf2rxE4gYEWTNy5_PWgehx4GYGrgyHHPVmvOD5Na...
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=8&google_gid=CAESEOYGiI7Otx4HDeUJzdsinn8&google_cver=1&google_push=AYg5qPKLz2xTNXoe8lhGEaKQpQMTrgcllVqw3vIgf2rxE4gYEWTNy5_PWgehx4GYGrgyH...
https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Z685-WFTTAud1enFkEDiR2GuWqw

170 B
188 B

35ms
34ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Z685-WFTTAud1enFkEDiR2GuWqw

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Z685-WFTTAud1enFkEDiR2GuWqw
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H/1.1 200
OK CookieSyncAdX
rtb.adentifi.com/ Frame 26F3 0
88 B 377ms
26ms Image
text/plain 52.202.47.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESEL4RR-K5Xn_R8oolZ1CxF0A&google_cver=1&google_push=AYg5qPLkirqRPGI6fzTMlIF-3c2lbi0flTKSFKMN6gurGoMairuIPydwek_d1XFjxvbNyiZoMX2CiYJp1WBMUjkbqowCLExq1KmS
Requested by: Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.47.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-47-217.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0
Content-Type: text/plain

GET google
pix.impdesk.com/csync/ Frame 26F3 0
0

GET
H/1.1 200
OK us.php
c.us1.dyntrk.com/adx/ga/ Frame 26F3 0
215 B 97ms
26ms Image
text/plain 135.148.55.37
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.us1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_push=%GOOGLE_PUSH%&cty=br&google_gid=CAESED5DJIG8WQoaKKTJrcFKGsI&google_cver=1&google_push=AYg5qPLtPwzbwTtkgGnbIYtfCTZrFzx9E3qqnRTS7sLwwuGVD80nxHo1R_pgUpuy99VoSwmE-7nvzMwA4UZ6SOH6LP_9YR-AnIYWEQ
Requested by: Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 135.148.55.37 , United States, ASN16276 (OVH, FR),
Reverse DNS: ns1007674.ip-135-148-55.us
Software: proxy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
cache-control: private, no-cache, no-store, proxy-revalidate, no-transform
x-rc: 10
server: proxy
content-length: 0
content-type: text/plain

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 26F3
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBraOKFiBfs7efrJV6r4Z5Q&google_cver=1&google_push=AYg5qPKld8X4wvnIS-UeF3xwnWnASTiV6d8kpZlhvXffV_UimTrWgfEsz3jPTb7iQO9SUAoGdEO...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dWMFpMQjUtSy1GQVBZ&google_push=AYg5qPKld8X4wvnIS-UeF3xwnWnASTiV6d8kpZlhvXffV_UimTrWgfEsz3jPTb7iQO9SUAoGdEOuudMgxpQdxORigGvYU4AO-YhRCA

170 B
188 B

37ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dWMFpMQjUtSy1GQVBZ&google_push=AYg5qPKld8X4wvnIS-UeF3xwnWnASTiV6d8kpZlhvXffV_UimTrWgfEsz3jPTb7iQO9SUAoGdEOuudMgxpQdxORigGvYU4AO-YhRCA

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dWMFpMQjUtSy1GQVBZ&google_push=AYg5qPKld8X4wvnIS-UeF3xwnWnASTiV6d8kpZlhvXffV_UimTrWgfEsz3jPTb7iQO9SUAoGdEOuudMgxpQdxORigGvYU4AO-YhRCA
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4f2e9ddc15e6cc2c3861f8e2683d2514
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 26F3
Redirect Chain

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESEKK8Z3xCtcPPjx206Fkkrp4&google_cver=1&google_push=AYg5qPJNF7VEmeIP-T1sYTJGQz93YsHOGJFHp9RZ6Mi2Se5w6jFTJsC9P4Wp81cG7c...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AYg5qPJNF7VEmeIP-T1sYTJGQz93YsHOGJFHp9RZ6Mi2Se5w6jFTJsC9P4Wp81cG7clrK-6O1aOc2-Mte2m0Prr5_sEhK5jaV3-EeGk&google_hm=...

170 B
188 B

40ms
39ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AYg5qPJNF7VEmeIP-T1sYTJGQz93YsHOGJFHp9RZ6Mi2Se5w6jFTJsC9P4Wp81cG7clrK-6O1aOc2-Mte2m0Prr5_sEhK5jaV3-EeGk&google_hm=zKP5SdV_SOeAKuauwM_9VZU

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:07 GMT
via: 1.1 google
server: Apache-Coyote/1.1
status: 302
p3p: CP="NOI DSP COR NID CUR OUR NOR"
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AYg5qPJNF7VEmeIP-T1sYTJGQz93YsHOGJFHp9RZ6Mi2Se5w6jFTJsC9P4Wp81cG7clrK-6O1aOc2-Mte2m0Prr5_sEhK5jaV3-EeGk&google_hm=zKP5SdV_SOeAKuauwM_9VZU
cache-control: no-cache, must-revalidate
content-type: text/html;charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 26F3 0
12 B 37ms
33ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LwDl7YMXK4RWhHj--ZFXqEEsI30VmIKcMkSmxRvbOoj0S6fkq2v8k-dgAWjdib1uSRgVyvpg

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js Show response
pagead2.googlesyndication.com/bg/ Frame 938C 35 KB
13 KB 28ms
24ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lpsW2_ffPYTZ8rZJjb0UUxqN4MuIngUyqdH9Px88Rrc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

969b16dbf7df3d84d9f2b6498dbd14531a8de0cb889e0532a9d1fd3f1f3c46b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 23:52:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 413698
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13349
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 01 Dec 2022 23:52:10 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame F828
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

47ms
47ms

Document
text/html

2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 06 Dec 2021 18:47:08 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 06 Dec 2021 18:47:08 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 06 Dec 2021 18:47:08 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 1779
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

47ms
45ms

Document
text/html

2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 06 Dec 2021 18:47:08 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 06 Dec 2021 18:47:08 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 06 Dec 2021 18:47:08 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 _q4UmNMOTmtef9d1r6OTn_fK0q4sseVsYwM_ZArHqzc.js Show response
pagead2.googlesyndication.com/bg/ Frame CA55 35 KB
13 KB 23ms
23ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/_q4UmNMOTmtef9d1r6OTn_fK0q4sseVsYwM_ZArHqzc.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

feae1498d30e4e6b5e7fd775afa3939ff7cad2ae2cb1e56c63033f640ac7ab37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 14:44:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14574
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13548
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 06 Dec 2022 14:44:14 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 938C 0
20 B 53ms
53ms Image
image/gif 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BhIV_q1quYbv6HuuLqMwPsMuhgAMAAAAAOAHgBAI&bg=!_v2l_bnNAAaQHwIOkB87ACkAdvg8Wlf-8q9daOCjZqf6-tfUHLCmqKQjnx0GYmMkaOrjihQzfom9LgIAAADLUgAAAAZoAQeZAvlx7SMbYC3OhonkRuxv3D2-rfwXJE5uKCrRQ646AYeTQafYI3gF-yuVTdrjC2m47zq4m1SrRfwdBZByEfN5Wv710LJhT-EZDKOdpKzMXp_v5hQc8rwLEw837yMIcnidS3dBPhc57_nj8hqtbnplTAAzLE408b__IhBBZIiVEb66EQ-6REYTlFJ8fMoM1CFDXBgC23czi0H0fJuoZScgMpistFi5L45s6c4TlyuRkdOdUiH9QA_YBS3KNFn9EhPz-JP7ZfJlqeYDw6Hv66d7yA1Co2VtNnCWvrfHoRh2cKGTEpUBPULwN54CUucKX54c7HCxw4dKIFvVAaH_iHlJJf8zLHasjuZRoXAapwV_JrYIdiWaknPGUpYHzUUNJMJGlvdVxJ8YVrEwDffvqa9kiJz7FiOezj-YiI6fukGdSJyWaSGjOIqUJxom8tQ2TciuAYqBpgqB5Bdlhl2N8t6Rb5m4CdfV8gUWs7JQG3i6NKFd4e-VdcFIKjVxcAycs_HEI32m37C6P4XWn4Rd7S2DovVoejxRGZndpyPwqXYMNVrYSp5xvdkvr6PyJz4zh_JYWsB-MuAJFqduSm73qxUKONObaim9aUyfkqO39YCojJ7b7bXheEZroL5MeiP2Z_33xli_Tv30N1Ai1CZwvPNSEtWgCIEwZm2Cx5SykTZlDeYNP7ZnmJg6GpoKHhui8jNbmgj36FTr5jcrwOXm-G1_NWpE-S9lazQ4m8DfGFlDz0MPdtrHdIkgMLkv0pchYVM9f4H9g1zlcQ_S5nfpa2JPCzgtpTVA4-XHwV0mvTtVtyhH1rglpStUO4s45saC3u_J9AmtmM0tQM__6koQApdOKdNPjOB7MMZNKLwZcxOUxLVfSvaTiIwz0Rce-HOCfjgQpUzmCHVtFQuLsPgxuM-yr3LoMfgPj5Ggv0Mh1RpEHgNyinnLXHgoDmr07VtKV7puQkHtGYgi-kAS0X0yNe7HpDkFQrFQyQNZUcbIJbP05kAhgRzRUd2Pm0nYtA

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
158 B 27ms
27ms XHR
text/plain 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://kooora4lives.com:2096
date: Mon, 06 Dec 2021 18:47:08 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
server: envoy
x-envoy-upstream-service-time: 1
vary: origin, Accept-Encoding

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
290 B 112ms
111ms XHR
application/json 74.119.119.129
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?profileId=207&av=34&wv=5.20.0&cb=72167568926
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.119.119.129 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS: bidder.va1.vip.prod.criteo.com
Software: Finatra /
Resource Hash: ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:08 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 44

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 25 B
527 B 34ms
34ms XHR
application/json 69.175.41.79
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_5.20.0
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.175.41.79 Downers Grove, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: sovrn-193627-chi03-placeholder
Software: /
Resource Hash: 17c6f746f6a844cd77ceb8a1fea4a1d7cda491d1fdab7dfac8951c253b63ef35

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 06 Dec 2021 18:47:09 GMT
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://kooora4lives.com:2096
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap5ord1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 25

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
368 B 143ms
143ms XHR
application/json 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://kooora4lives.com:2096
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 119 B
197 B 109ms
108ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bX9srg4dmr64KsaKjGFx_2
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 073cc077ee22ea8efd514945da6de9a1a1f231d3f59bdd3f3a01a14183146e2b

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:09 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 47ms
46ms Script
application/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=kooora4lives.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 06 Dec 2021 18:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 39ms
39ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=kooora4lives.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 06 Dec 2021 18:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 16 KB
9 KB 493ms
493ms XHR
text/plain 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=338030884393098&correlator=2824239199499357&output=ldjh&impl=fifs&eid=31060888&vrg=2021120201&ptt=17&sc=1&sfv=1-0-38&ecs=20211206&iu_parts=21939239661%3A202189885%2Capl%2Caplmcm%2Cdynamic&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x600&prev_scp=refresh%3Dtrue%26test%3Devent%26hb_rfBid%3D0%26excl_cat%3DPREPOST&eri=1&cookie=ID%3D289350c65ac41bf9%3AT%3D1638816427%3AS%3DALNI_MaKqi6ObFC2BpRvVSufLMRGjlrW9w&bc=31&abxe=1&lmt=1638816429&dt=1638816429416&dlt=1638816426508&idt=849&frm=20&biw=1600&bih=1200&oid=2&adxs=-300&adys=601&adks=1771543664&ucis=e&ifi=16&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fkooora4lives.com%3A2096%2Fm2%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x-1&msz=300x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H82HzPzSnCWJ_0A7n-EerAZAgkAhIJHh7TzSwdJsG6ap6ogx1k_QDKKJoZB79SYzg03a_hadg7NR-m3Gl04GnwVB87btbRl%2CAGkb-H_NGuXEsD4JiPRU4ScoIdX-V2NHZPe3R0NInaY2MbwYXyRGNpfMmGz8lapB0PuL5nOGGt7tmHFiYwaXBSf0kWY5neBY7qSS&ga_vid=428231269.1638816427&ga_sid=1638816427&ga_hid=1502021003&ga_fc=true&fws=516&ohw=300&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b56c76c9cf6decaf4258fb1de706780743f9b60b0465d457b96bceb1dc83b1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:09 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9204
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://kooora4lives.com:2096
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 5823 42 B
64 B 50ms
50ms Image
image/gif 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstFVxOPwdudMxsaf0Z6J0El86EO_S3R4vgloXSpFnG-uLWnv5oiVzOp6S34k-v8riRCcSqtqXHkeoYncRUkUiTl_Ywy4gCsxcEtAVanvQ70a_8iVZI&sai=AMfl-YTQGTVLOiTi7JTS13spLrpvaHeFinMDZuu6m-Yg8qTJUaWBGiEAtjiyQOqz1crSBZu6RSvelladJWgn0yVmtgUglxtzbx3Iti-S0-gkpg6ITpBXag8zoUziodk&sig=Cg0ArKJSzBHmwnCczhFaEAE&cid=CAASFeRo-NWI-STKNPv_19JBneP9KOXarw&id=ampim&o=315,100&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,0,1000,1000&tos=0,0,0,1000,0&tfs=310&tls=1310&g=100&h=100&tt=1310&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&adk=667468269

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 publishertag.prebid.113.js Show response
static.criteo.net/js/ld/ 85 KB
27 KB 234ms
35ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.113.js
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: e6969b69570c743952ab51b9fba22410be503db91b0566753d6da10894e76dad

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:09 GMT
content-encoding: gzip
last-modified: Wed, 08 Sep 2021 12:50:31 GMT
server: nginx
etag: W/"6138b197-1532d"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 07 Dec 2021 18:47:09 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame CA97 11 KB
5 KB 76ms
26ms Document
text/html 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=kooora4lives.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.113.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

6de355c79c0d5e8d4c373e4b79a36d59aacca27ecc8c5cbd2e3191ab2871c440

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 2389
date: Mon, 06 Dec 2021 18:47:09 GMT
content-length: 4684

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 83 KB
26 KB 78ms
28ms XHR
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.js
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.113.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 3d1ed1affc8bef9859778b9821375af240dff09e4aa8411456d3168206ed6fe7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:09 GMT
content-encoding: gzip
last-modified: Thu, 11 Nov 2021 06:35:11 GMT
server: nginx
etag: W/"618cb99f-14b33"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 07 Dec 2021 18:47:09 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame CA97
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=kooora4lives.com&sn=ChromeSyncframe&so=0&topUrl=kooora4lives.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=IDx8-HxHQUs1MUYrNlhzUnpNWVQwTnJrREpjYUVXd1NtRmd0Y01GOEhSblRva0o0RUJ4SEhKcWhwM0VtQU4yM2ZlNFZjWWluTUxwRW4rRkdIb01KMU52bHQ2VjNIVjlkYlgrUEhZRTV4THJ0MG5kRXkwYmk5V1RBd3pSNl...

427 B
620 B

74ms
26ms

Fetch
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=IDx8-HxHQUs1MUYrNlhzUnpNWVQwTnJrREpjYUVXd1NtRmd0Y01GOEhSblRva0o0RUJ4SEhKcWhwM0VtQU4yM2ZlNFZjWWluTUxwRW4rRkdIb01KMU52bHQ2VjNIVjlkYlgrUEhZRTV4THJ0MG5kRXkwYmk5V1RBd3pSNlpFVllMbmx0ZGgzVDZWRzVsWXdHUGs0dFpSU29xSGRyZFlsVG1SYjlEZ1JkUEw0bUFaZEQ4TTExZzEyZjNxbW8wT1VUZGhWQncxMTIyNlBVd3hsWGUzdkNoNnB5eVNTTGU2TkkvQUs4RzdHbzA3MUN6dlpCMWNrd1FDK09ETXNlWThtaTBkTDBvMDU5UDMrYW5KazVNb0NudGN1bUs4QT09fA&cppv=2

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

002c9941a7f2ef6272ab61ad5163c2be5635327bdf95cd85db7d08b62484f0ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Mon, 06 Dec 2021 18:47:08 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 4433
expires: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 06 Dec 2021 18:47:09 GMT
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=IDx8-HxHQUs1MUYrNlhzUnpNWVQwTnJrREpjYUVXd1NtRmd0Y01GOEhSblRva0o0RUJ4SEhKcWhwM0VtQU4yM2ZlNFZjWWluTUxwRW4rRkdIb01KMU52bHQ2VjNIVjlkYlgrUEhZRTV4THJ0MG5kRXkwYmk5V1RBd3pSNlpFVllMbmx0ZGgzVDZWRzVsWXdHUGs0dFpSU29xSGRyZFlsVG1SYjlEZ1JkUEw0bUFaZEQ4TTExZzEyZjNxbW8wT1VUZGhWQncxMTIyNlBVd3hsWGUzdkNoNnB5eVNTTGU2TkkvQUs4RzdHbzA3MUN6dlpCMWNrd1FDK09ETXNlWThtaTBkTDBvMDU5UDMrYW5KazVNb0NudGN1bUs4QT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 2209
content-length: 541
expires: 0

GET
H3 200 container.html Show response
406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 4882 6 KB
3 KB 22ms
21ms Document
text/html 2607:f8b0:4006:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 06 Dec 2021 18:47:07 GMT
expires: Tue, 06 Dec 2022 18:47:07 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 52B5 640 B
316 B 39ms
38ms Document
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEPTNpIoCGNGPmrwBMAE&v=APEucNVOYQPSmfKY7wuCBr7MvgbvyfHR4ADvLqrkNFNd_-qY8E7VLv8ZuC2Qrj7uaKEMFKDbsUGL23iZKoKHyzKAvdL5MiFkHw

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 06 Dec 2021 18:47:09 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4882 58 KB
28 KB 84ms
84ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D9_wbgm9VS8X6TPYs4oPjEXhmEiksVXYh33DAlLazMumii5yqUKzcaFopEiOhVvPaN8MSrdnp6P46aVHY8Dfr_oL70MFtT34VAjFhNQBmiMftcqkLAW6vl8D5357-543j21Hdy8TfQLEvkeZp32J8tUCtTJw&dbm_d=AKAmf-AtUaJ_fVNOMPmsH2FGZwqGtAPsCWWby5MenRsKYkr0UKxErGMb8Xdu17f4UhjaR_nMyn381JUru-4XIcHOwZ0wa0eEQgjWowq5UVOJHQK0p6fAo23AT9QrweYJinhHyaFymXEYe7PXlmgkpr04yU2QOZhJsfnO7spQPkvu1rnltATqlXukz4e2tZ3rE2lniYTn22KPkyrwBr3-fvE3WcyBT7I9JPHSyyLA8-COHpooG240BPvmabdS9gm9mDPniICyiEZnMMZLKowb_qNbQcRETjAa6pMTsDNvz83Xo1cIIkj2n3DxWrtUk5LnXNS0h1S9oYSeGr0n3_HhiWh54U_wn2zNdCkSOrQ8u08h8jQ8kXue6QG150LIqD-onzF1VyU84z3t4TTc__ayNuF6mltAhBT3EAhvpnMRYOzeidl_sk7I8Te72kpZNpnj-bX5-NAVsaoooGtMo0BhP4o3s0ze2uVnYbtgwzAFK1EBnVkmebx35w6Zmg4T_6IayPUOvcAt57uUmNfDxpuJb9qj_S1idQpHi59hznvNZEy2O9INvqMVIDG6cC4yZ69ANzYuzccwsLRfINmyrGzWk-tp_DfeITtn5lJVJk59xGbJs1bMiWplnikSwEXbbrHdkhVwEZO1pZztdpV63fLbOkSjb1lPL9wXpXv71N5iJOYjxP8rAxI5BNIbQ-KWw35RteJiChj1yeWN3YfYw28h6DxAhCIt5eSvKLxufC4Hka_hGmIaCHCWWAQI-hH0LYy661-fYYlULhsBrexb0xsmNGXenVgRt93RYNyKPJ_yuP21MYNjlAUdgJPPqYcbzkVT-E_y18RYQ44hOfi3DjubU2P3lv9rNUp0eeC_UJhsGff4L1xS_St3K5BL6tGHPtGOeXcJx_5xmvYR2ZjlPI5spI04-bFquwZm3LlbWaUPNDrQeXqqz8cAwz9WbppMG0IQHgzHIB-sAm4ZoqJf19uxmH8shZEhnDW4mHgowWF0RcTWCJb0YFoHWFltzGTWA5SiuoGHxinv5YiewTDTeYYHgkgqLNmGqyHoRFkuR96UxLFvnKCRIzm2P8og0YxRtAsCoKCW14qyk470wT35qed3Gv82xHC-VHnwB2HxhO414O_Vketg6ObegAKBsewuUSqqNp2pvF8RT5njeGaDRmOhfvqzCKmxi5Om9yORLjNzSo4NpyQVtbFO1uaYAkd04eSCsMM6eHJ9f_ezRyiDDUrM-IwGNhzGjCo8GXGIr6WpVXUSVptd6KMcj9VALkrLpJNNy4ctU9lpZi6Zc6pqYBvLG8EjZg2NYH0rL-bv-8I_beBJyh8XTZkMFcADvpyebGqXNVmhjc-J-Kk-ayYw7vbo-AFXHh4s1rssu5aOiOpFBcXCCQVlrDU-CcCXO2bC5m3HpdwkeXjy0DLM1c87NBqp3Cwto6Bgo7UrjGVSaihPbU3nyEAVE3GbvZp4lbY4YoUlGhN6NPqk30j70A0SZmjDqtehtxi3VSGeci9JkairXm9mmLrjJIAkzIKW_oqBTGCrM3vse0u9Ddb4AFLG_v-TyQu06VwI8aXArU3-jVvGWyzmNk_2XSIXqnU83AiRpwLmb6vZ2FN7KBeIv-fyOOkdA9UTJ1GLtOjQz_qSOD7_G1zv5MIN479xNIrozH77oOCIGergFsShND6FzOWk2sahkiFrz2PKkdK-BdmEmjf2M4HdBVw9ugB6XJ48INrFWqAeeLyHkqZ-jXpm2NqsK4bREBLrPWhReYGvwD7uvwjd7baKuX9jIOxsZ8DvsNTjmlPNn2Ad3o-H37VJ36rPIAr6NF8NqOODM9oG3RWd9gWPAwm4zVtu_UMRM1SLNHBqLdBN4OQdVUJ7l44FXGFEcv8Fkh_ZCkZnF2Fo4TlCZMRG7Ie6GPxk-HKKrRhO4zx63IRML9F2FfHBl9eRmc2ii19GBoEXVJrzok-NA0li0eKlD8bwEDEG1neoN6NxfEojwEKNJYovSec1V7iswo_bnw5X7_FMc7KEPeBGexDax2Tk5YfTlCb0MqwjASGkdlaqkXXnNYHrhism8hrqiXmw6qg2f0Ek5YzZffMnbxsWBM5Vkupf6Ljdv0GmG49ijpK476XmkWfE9KnLqCYFbeRAhHBkr6NH-RLi3D_zkpQNYsb5X1AIPzwW_S5S_yKtWJI-ItIckhnXN7yKrhormb4aHP38u4mZfddDZQWFGfwn0dzlPO6p09UD3eQXEMD3mwI3b21qMehPxnDJkLKDBZJZ4Gmdsm0cKPErOVj6aXQrFjNRf-Il810cBpZhg882k7k4wGstQd0OR_bq6GJBnvCaYArvHEZA2z4bQQZHTu6aU4r9deCCHr48vsLWPzzh3L5pkHRz-9agVG_CWqSiilUSzM6Bkjz39BBIHMtTuyK1-tLPFLjuBtOQ8Yqd_8i-52-Qk6-juzf9XJYOMPH956sl1pHCmxWrgUAOQ3x6NdAwxMMyAH43FRN1HLJc5l_QMWDI9x_O2frkrIydqTCfOak0gHcDerMAlimzEPKMbWx_HaZ0bcZb2D90HGv-XRk-hIRY7pHHcVVVN9s_FPOKvcHLFOjIv33qSVG04tf57KXWKGDXoMLLz3FffyflUXrQ-Nx1SAzIqYQG0urGLG0vmCsJ8DgXP8-cAbeDNMpWOZixAdpEfz5S2fSNBBY18zW84LFL2Ugld2gJ8GUV0kFGoCG7iWV_-JNQHHIiRgUGEU1AmnZKJtAHI4X115kaik247T74NIjA1x8ts8aWF52MvkeNUbUYa0fF7IaJSkeqi9nO9Ty-FYJDCugxagcGZkok5hY-RVODwEtS_lQK3lKVeiJn5HMTmJh9VxVD_f3odeY1zbXmg6GpzD9dzI791MKC4zF8QS2KX5R2STcP62P-5u5KInVstwcdyy0VBB6k9qxeSOei6dst7bFtwi_XqtcRkxMRegm15KDYCdfsI8U_07s7ej8YE3A_LjzECGFiprRISZATnp6yiz7rtNwnJfQR9-O41F2IVw7MhSCsYc-vTctUy9fwPXJqkJK1jCi-rooDP3cuZRJftce1k5kBiCJ3e8jKoPZrsCK2dO3UjZKR0M2W6hQVTLi5d91kaee8D1Ca30PCJxK0o7pbdwSHb4vUF9qU7KbWnLItij7Mm2zGj6muYB0kfUEcW0TqygBgXE-Wkpic2y0xd_wunW8bRvZqohmPB-0Wlglt2bW2Oo7rGxLlufnBXuKxxYE89hqAUA&cid=CAASEuRoNhgO4JnUGpRR3Ix9gl__gw&rfl=1%2Chttps%253A%252F%252Fkooora4lives.com%253A2096%252F%240

Requested by

Host: kooora4lives.com
URL: https://kooora4lives.com:2096/m2/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b63c0dd84754c095d71c50490750246015cba2afebf7246149100abd5a204fe2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29020
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4882 42 B
63 B 42ms
41ms Image
image/gif 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DmK_hLQcUJ-TnZkRpgi2_m4UoERrkm-jeS321p4S-xD-RQBoGOurP9nMdfsJ_byr4c7HR3_q5O1YunMsqDeIscaeCt30i_dJi_CZgFb9RhxyKsg0k

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 4882 2 KB
1 KB 19ms
18ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/window_focus_fy2019.js

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:45:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 105
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:45:24 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4882 119 KB
36 KB 81ms
80ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 06 Dec 2021 18:47:10 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 4882 15 KB
6 KB 19ms
19ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6257e792f9aef240d1954956a6ea7982c0268035f15a79931a110ed6344c8c4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 114
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6446
x-xss-protection: 0
server: cafe
etag: 5472324691301332805
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:45:15 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 4882 0
0 49ms
49ms Image
text/html 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSiSt106FmkCZGylVujQBgmdJaEmZtSH8sT9oM1FCygnilmYnRzh_qbA6C7aKajlRCutu5ND-yC81eIfFJm8IwF-KdJQw
Requested by: Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:807::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 52B5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDJh31077SEsreFsltQOqP4&google_cver=1
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEDJh31077SEsreFsltQOqP4&google_cver=1

43 B
61 B

50ms
29ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEDJh31077SEsreFsltQOqP4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEPTNpIoCGNGPmrwBMAE&v=APEucNVOYQPSmfKY7wuCBr7MvgbvyfHR4ADvLqrkNFNd_-qY8E7VLv8ZuC2Qrj7uaKEMFKDbsUGL23iZKoKHyzKAvdL5MiFkHw
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.221.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:10 GMT
via: 1.1 google
server: OXGW/16.221.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEDJh31077SEsreFsltQOqP4&google_cver=1
date: Mon, 06 Dec 2021 18:47:10 GMT
via: 1.1 google
server: OXGW/16.221.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 52B5
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZWI2ODg0MzAtMDI2ZS0yMTVmLWRmMjktN2YzNGVkOTQ3Yzc4

170 B
188 B

37ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZWI2ODg0MzAtMDI2ZS0yMTVmLWRmMjktN2YzNGVkOTQ3Yzc4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEPTNpIoCGNGPmrwBMAE&v=APEucNVOYQPSmfKY7wuCBr7MvgbvyfHR4ADvLqrkNFNd_-qY8E7VLv8ZuC2Qrj7uaKEMFKDbsUGL23iZKoKHyzKAvdL5MiFkHw

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:10 GMT
content-encoding: gzip
server: OXGW/16.221.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZWI2ODg0MzAtMDI2ZS0yMTVmLWRmMjktN2YzNGVkOTQ3Yzc4
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame 52B5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEH8OBVFIKaybz291dZ_v6h4&google_cver=1

23 B
287 B

84ms
28ms

Image
image/gif

23.195.109.72
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEH8OBVFIKaybz291dZ_v6h4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEPTNpIoCGNGPmrwBMAE&v=APEucNVOYQPSmfKY7wuCBr7MvgbvyfHR4ADvLqrkNFNd_-qY8E7VLv8ZuC2Qrj7uaKEMFKDbsUGL23iZKoKHyzKAvdL5MiFkHw
Protocol: H2
Server: 23.195.109.72 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-195-109-72.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.6 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:10 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 06 Dec 2021 18:47:10 GMT
server: akka-http/10.2.6
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:10 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEH8OBVFIKaybz291dZ_v6h4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 52B5
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=MjMyZjFhMTAtMTZlNS00NTFmLWE3ZTQtNWEyM2M3MWE0NmU1

170 B
188 B

36ms
35ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=MjMyZjFhMTAtMTZlNS00NTFmLWE3ZTQtNWEyM2M3MWE0NmU1

Requested by

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:10 GMT
server: akka-http/10.2.6
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=MjMyZjFhMTAtMTZlNS00NTFmLWE3ZTQtNWEyM2M3MWE0NmU1
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Mon, 06 Dec 2021 18:47:10 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/ Frame 4882 24 KB
9 KB 26ms
25ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D9_wbgm9VS8X6TPYs4oPjEXhmEiksVXYh33DAlLazMumii5yqUKzcaFopEiOhVvPaN8MSrdnp6P46aVHY8Dfr_oL70MFtT34VAjFhNQBmiMftcqkLAW6vl8D5357-543j21Hdy8TfQLEvkeZp32J8tUCtTJw&dbm_d=AKAmf-AtUaJ_fVNOMPmsH2FGZwqGtAPsCWWby5MenRsKYkr0UKxErGMb8Xdu17f4UhjaR_nMyn381JUru-4XIcHOwZ0wa0eEQgjWowq5UVOJHQK0p6fAo23AT9QrweYJinhHyaFymXEYe7PXlmgkpr04yU2QOZhJsfnO7spQPkvu1rnltATqlXukz4e2tZ3rE2lniYTn22KPkyrwBr3-fvE3WcyBT7I9JPHSyyLA8-COHpooG240BPvmabdS9gm9mDPniICyiEZnMMZLKowb_qNbQcRETjAa6pMTsDNvz83Xo1cIIkj2n3DxWrtUk5LnXNS0h1S9oYSeGr0n3_HhiWh54U_wn2zNdCkSOrQ8u08h8jQ8kXue6QG150LIqD-onzF1VyU84z3t4TTc__ayNuF6mltAhBT3EAhvpnMRYOzeidl_sk7I8Te72kpZNpnj-bX5-NAVsaoooGtMo0BhP4o3s0ze2uVnYbtgwzAFK1EBnVkmebx35w6Zmg4T_6IayPUOvcAt57uUmNfDxpuJb9qj_S1idQpHi59hznvNZEy2O9INvqMVIDG6cC4yZ69ANzYuzccwsLRfINmyrGzWk-tp_DfeITtn5lJVJk59xGbJs1bMiWplnikSwEXbbrHdkhVwEZO1pZztdpV63fLbOkSjb1lPL9wXpXv71N5iJOYjxP8rAxI5BNIbQ-KWw35RteJiChj1yeWN3YfYw28h6DxAhCIt5eSvKLxufC4Hka_hGmIaCHCWWAQI-hH0LYy661-fYYlULhsBrexb0xsmNGXenVgRt93RYNyKPJ_yuP21MYNjlAUdgJPPqYcbzkVT-E_y18RYQ44hOfi3DjubU2P3lv9rNUp0eeC_UJhsGff4L1xS_St3K5BL6tGHPtGOeXcJx_5xmvYR2ZjlPI5spI04-bFquwZm3LlbWaUPNDrQeXqqz8cAwz9WbppMG0IQHgzHIB-sAm4ZoqJf19uxmH8shZEhnDW4mHgowWF0RcTWCJb0YFoHWFltzGTWA5SiuoGHxinv5YiewTDTeYYHgkgqLNmGqyHoRFkuR96UxLFvnKCRIzm2P8og0YxRtAsCoKCW14qyk470wT35qed3Gv82xHC-VHnwB2HxhO414O_Vketg6ObegAKBsewuUSqqNp2pvF8RT5njeGaDRmOhfvqzCKmxi5Om9yORLjNzSo4NpyQVtbFO1uaYAkd04eSCsMM6eHJ9f_ezRyiDDUrM-IwGNhzGjCo8GXGIr6WpVXUSVptd6KMcj9VALkrLpJNNy4ctU9lpZi6Zc6pqYBvLG8EjZg2NYH0rL-bv-8I_beBJyh8XTZkMFcADvpyebGqXNVmhjc-J-Kk-ayYw7vbo-AFXHh4s1rssu5aOiOpFBcXCCQVlrDU-CcCXO2bC5m3HpdwkeXjy0DLM1c87NBqp3Cwto6Bgo7UrjGVSaihPbU3nyEAVE3GbvZp4lbY4YoUlGhN6NPqk30j70A0SZmjDqtehtxi3VSGeci9JkairXm9mmLrjJIAkzIKW_oqBTGCrM3vse0u9Ddb4AFLG_v-TyQu06VwI8aXArU3-jVvGWyzmNk_2XSIXqnU83AiRpwLmb6vZ2FN7KBeIv-fyOOkdA9UTJ1GLtOjQz_qSOD7_G1zv5MIN479xNIrozH77oOCIGergFsShND6FzOWk2sahkiFrz2PKkdK-BdmEmjf2M4HdBVw9ugB6XJ48INrFWqAeeLyHkqZ-jXpm2NqsK4bREBLrPWhReYGvwD7uvwjd7baKuX9jIOxsZ8DvsNTjmlPNn2Ad3o-H37VJ36rPIAr6NF8NqOODM9oG3RWd9gWPAwm4zVtu_UMRM1SLNHBqLdBN4OQdVUJ7l44FXGFEcv8Fkh_ZCkZnF2Fo4TlCZMRG7Ie6GPxk-HKKrRhO4zx63IRML9F2FfHBl9eRmc2ii19GBoEXVJrzok-NA0li0eKlD8bwEDEG1neoN6NxfEojwEKNJYovSec1V7iswo_bnw5X7_FMc7KEPeBGexDax2Tk5YfTlCb0MqwjASGkdlaqkXXnNYHrhism8hrqiXmw6qg2f0Ek5YzZffMnbxsWBM5Vkupf6Ljdv0GmG49ijpK476XmkWfE9KnLqCYFbeRAhHBkr6NH-RLi3D_zkpQNYsb5X1AIPzwW_S5S_yKtWJI-ItIckhnXN7yKrhormb4aHP38u4mZfddDZQWFGfwn0dzlPO6p09UD3eQXEMD3mwI3b21qMehPxnDJkLKDBZJZ4Gmdsm0cKPErOVj6aXQrFjNRf-Il810cBpZhg882k7k4wGstQd0OR_bq6GJBnvCaYArvHEZA2z4bQQZHTu6aU4r9deCCHr48vsLWPzzh3L5pkHRz-9agVG_CWqSiilUSzM6Bkjz39BBIHMtTuyK1-tLPFLjuBtOQ8Yqd_8i-52-Qk6-juzf9XJYOMPH956sl1pHCmxWrgUAOQ3x6NdAwxMMyAH43FRN1HLJc5l_QMWDI9x_O2frkrIydqTCfOak0gHcDerMAlimzEPKMbWx_HaZ0bcZb2D90HGv-XRk-hIRY7pHHcVVVN9s_FPOKvcHLFOjIv33qSVG04tf57KXWKGDXoMLLz3FffyflUXrQ-Nx1SAzIqYQG0urGLG0vmCsJ8DgXP8-cAbeDNMpWOZixAdpEfz5S2fSNBBY18zW84LFL2Ugld2gJ8GUV0kFGoCG7iWV_-JNQHHIiRgUGEU1AmnZKJtAHI4X115kaik247T74NIjA1x8ts8aWF52MvkeNUbUYa0fF7IaJSkeqi9nO9Ty-FYJDCugxagcGZkok5hY-RVODwEtS_lQK3lKVeiJn5HMTmJh9VxVD_f3odeY1zbXmg6GpzD9dzI791MKC4zF8QS2KX5R2STcP62P-5u5KInVstwcdyy0VBB6k9qxeSOei6dst7bFtwi_XqtcRkxMRegm15KDYCdfsI8U_07s7ej8YE3A_LjzECGFiprRISZATnp6yiz7rtNwnJfQR9-O41F2IVw7MhSCsYc-vTctUy9fwPXJqkJK1jCi-rooDP3cuZRJftce1k5kBiCJ3e8jKoPZrsCK2dO3UjZKR0M2W6hQVTLi5d91kaee8D1Ca30PCJxK0o7pbdwSHb4vUF9qU7KbWnLItij7Mm2zGj6muYB0kfUEcW0TqygBgXE-Wkpic2y0xd_wunW8bRvZqohmPB-0Wlglt2bW2Oo7rGxLlufnBXuKxxYE89hqAUA&cid=CAASEuRoNhgO4JnUGpRR3Ix9gl__gw&rfl=1%2Chttps%253A%252F%252Fkooora4lives.com%253A2096%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2b2d2472f310f3a4c880947f473b8de3e58662291206e24a5426ee2bd64684ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:44:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 145
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9494
x-xss-protection: 0
server: cafe
etag: 6798282995721486617
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:44:45 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/ Frame 4882 8 KB
3 KB 27ms
26ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:40:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 420
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3140
x-xss-protection: 0
server: cafe
etag: 17163059639670574047
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Dec 2021 18:40:10 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4882 0
24 B 52ms
51ms Ping
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuRpcoz_Kyx9gdaCANa3-tDf6U27u5QcH5kOui3oHMQMSgMsS05QTlEG_ZYR1mpzQbM4YyV_EkBn88kT1rZ4416MFErsWHxbrbuFEJJVHxtMCwea2wmSRZjrdzb6YhYVySqhYhowOY1drnCm52Zh7RJVGtlMeFOyjadzMH_pnrPTAA1IAPmTAbxwM21363f4HLOhqWD8y6DfMmtjTbFRAp2Ux7ldOb9BRiitYIVw6rrCF4lLIQjCkcu0n17gURJUetadKw96kW5poMRQqaySHtoqynfu0mtUI-sy921JmfOngAwleDTXQagfj6njc9JkZQHfK_NQn6uh4caDWBdpxZktQCGMejjqVXhXodxPR3yYKqOOLtXEziOZhh9A-9f4ac-Z0-cWeCIuHZjYDz4uaXqJB2zTgEgtvsFCjIY1ncld8i-89ZJlSZPnLH3DdVvXD6bQIExAI66N0rFrdGD2d1vaZaiEFeqXqHr4sP3g7LQW8r3rY4ODdIcoW3VY7lVw1DnTmgpc7_Y2GXkRoQr_TUgO2c_MFWUU4zh1gWwayvh4Wckd7RumMd6Vvu6A7m7oEYIfgVZGzsOX8mwLuGpXpzgm5m-3Pg51dr2rbon43b2OnTBXRwe3xJ77VhuqWWVHmYJw6SbLacr7X027Y-0VX34zw7gHIXGOex7gZH2tk5RNV2ve6dUuXMZpIgFtbmm6dPFFgr-84oJctWAQbuq75K3_VOuXRzhkOFRLRtZsKx48BAdkDnTqGGAtL5svgouYLB1A4q0PChHGaS9F3t6TyJl1gT9yvXUXBMn3EslGh1-Mg4jlAxXbh5Zqq5XbfSa8nKg6NagwlyxHmMpg4bCzpK73gj20foW6OdAt238lEXr9qni-8P-5NBuFcw8tubGKVrLVp8svXfResEUdGO6VFEiFxVDa4XfWAaG7UaJP1fvGGlwP_jmYgAcYm120oaW7TETJ0G1DpDp1yGdIkQnavkHODkXd5mwcDABhoxKRAD0_7da-suGMIjd8xbh8zOnWMjEJYdgA7fVPEYvaSYzBniJIFzkRL82avngkejwOD34HUPVCkHjW9-3sgmjrnLXnY-Hyw1dgrBybQWIz2JyWnfrNn-6yTnK-jkZmincLut7czxn1SLb0C5g2Nj6U1vTLF1e48XbAD7McETRcOWWYfAVhReATFHIBFJqRclwS1On86a-0VoRIAU&sai=AMfl-YTCLGtfjXJf98p7xgRajlLK6V1Kn3YiZGyo8DbOEjrze8SJrMVvFJDJcuxBreK9OwlPZWovkbzEm4s7cdoz5LFfGH7O3Merfm99MFUGVc6WKG8bMuLQ5j1tVD86F3RwMXqnKA26jkFBBzq87mTZzjRSIvHG-Q&sig=Cg0ArKJSzEYHCspBuQFAEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211201.29882&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 06 Dec 2021 18:47:10 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4882 41 KB
15 KB 24ms
23ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 06:39:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43649
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Tue, 06 Dec 2022 06:39:41 GMT

GET
H3 200 16992208333542648262
s0.2mdn.net/simgad/ Frame 4882 256 KB
256 KB 29ms
29ms Image
image/png 2607:f8b0:4006:823::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/16992208333542648262

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be28746bde188add0bdceae0ca96028e8c17a22a02d58f74f4fdfa9c8483f342

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 05 Dec 2021 08:45:51 GMT
x-content-type-options: nosniff
age: 122479
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 262384
x-xss-protection: 0
last-modified: Wed, 24 Nov 2021 14:03:43 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 05 Dec 2022 08:45:51 GMT

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame 4882
Redirect Chain

https://s.amazon-adsystem.com/iu3?d=forester-did&ex-fch=4167913&ex-fargs=1JDhLkbwBT0wZjkbLf-NDvLgGuA64DZPlNgkd532tIzQ1rDfakRXjM41VJI51HH74a94nMNO1jg3JbsCMu9c5dL3i5KZFHBZ9_Tcm&cb=
https://s.amazon-adsystem.com/iu3?d=forester-did&ex-fch=4167913&ex-fargs=1JDhLkbwBT0wZjkbLf-NDvLgGuA64DZPlNgkd532tIzQ1rDfakRXjM41VJI51HH74a94nMNO1jg3JbsCMu9c5dL3i5KZFHBZ9_Tcm&cb=&dcc=t

0
0

47ms
46ms

Image
text/html

209.54.177.54
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?d=forester-did&ex-fch=4167913&ex-fargs=1JDhLkbwBT0wZjkbLf-NDvLgGuA64DZPlNgkd532tIzQ1rDfakRXjM41VJI51HH74a94nMNO1jg3JbsCMu9c5dL3i5KZFHBZ9_Tcm&cb=&dcc=t
Requested by: Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 209.54.177.54 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Mon, 06 Dec 2021 18:47:10 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: DQ1TFC8TV9G0FD2KDC2Z
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?d=forester-did&ex-fch=4167913&ex-fargs=1JDhLkbwBT0wZjkbLf-NDvLgGuA64DZPlNgkd532tIzQ1rDfakRXjM41VJI51HH74a94nMNO1jg3JbsCMu9c5dL3i5KZFHBZ9_Tcm&cb=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK adServerESI.aspx
secure.insightexpressai.com/adServer/ Frame 4882 35 B
2 KB 124ms
45ms Image
image/gif 2600:1400:d:59b::1ec4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.insightexpressai.com/adServer/adServerESI.aspx?script=false&bannerID=9307021&siteID=N720476.1972103DOUBLECLICKBIDMA0&creativeID=162113824&placementID=321677386&rnd=28713354&gdpr=&gdpr_consent=&redir=https://secure.insightexpressai.com/adserver/1pixel.gif

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1400:d:59b::1ec4 New York, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

22816a00dfe9fcdc30063d22717ab9cbab3aeb2a8e9844e9d774d256dc48b7c8

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
P3P: CP="NOI DSP COR NID CUR ADMa OUR STP STA"
Connection: keep-alive
Content-Length: 35
X-XSS-Protection: 1; mode=block
Request-Context: appId=cid-v1:5b4dbfaf-2d3f-4217-81a4-dbc3623f316f
Pragma: no-cache
Referrer-Policy: unsafe-url
X-Frame-Options: ALLOWALL
Date: Mon, 06 Dec 2021 18:47:10 GMT
Vary: Accept-Encoding
Content-Type: image/gif
Access-Control-Expose-Headers: Request-Context
Cache-Control: max-age=0, no-cache
Feature-Policy: accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'
Expires: Mon, 06 Dec 2021 18:47:10 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0158 1 KB
749 B 27ms
26ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 05 Dec 2021 19:21:13 GMT
expires: Mon, 06 Dec 2021 19:21:13 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 84357
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 4882 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3bfc9811b357e61b77cdae427c4fb0d252a03a7e72c85bc9163faec98facc5a5

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 57A0 22 KB
8 KB 22ms
19ms Document
text/html 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Mon, 06 Dec 2021 06:39:41 GMT
expires: Tue, 06 Dec 2022 06:39:41 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 43649
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET /
google2waycm.netmng.com/cm/ Frame 0158 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0158
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEIGBjawgkzvfRo5CQNcvCig&google_cver=1&google_push=AYg5qPJw44aMKdwvOwBfgq-uiYjS3_0DeqXCNpzuTS4hqEgJ7BRf7XS...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=700c1c06168a1206&is_secure=true&networkId=14000&version=1&google_gid=CAESEIGBjawgkzvfRo5CQNcvCig&google_cver=1&google_push=AYg5qPJw44aM...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGZz6TZK5tvwM1Z2VaAAAAAAA&expiration=1638902830&google_cver=1&is_secure=true&google_gid=CAESEIGBjawgkzvfRo5CQNcvC...

170 B
188 B

36ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGZz6TZK5tvwM1Z2VaAAAAAAA&expiration=1638902830&google_cver=1&is_secure=true&google_gid=CAESEIGBjawgkzvfRo5CQNcvCig&google_push=AYg5qPJw44aMKdwvOwBfgq-uiYjS3_0DeqXCNpzuTS4hqEgJ7BRf7XSWnKH8mnDIFa74rqJgAIweExIIDYQ1nHLZiyVT1B0QUkE

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:10 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGZz6TZK5tvwM1Z2VaAAAAAAA&expiration=1638902830&google_cver=1&is_secure=true&google_gid=CAESEIGBjawgkzvfRo5CQNcvCig&google_push=AYg5qPJw44aMKdwvOwBfgq-uiYjS3_0DeqXCNpzuTS4hqEgJ7BRf7XSWnKH8mnDIFa74rqJgAIweExIIDYQ1nHLZiyVT1B0QUkE
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0158
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESECqZ22_Te-JCdWBaMb0SB-s&google_cver=1&google_push=AYg5qPLjYT74Pi6ic7GIJajTWKN2COC88KyYHT9FmVyHT4S12P76fuaDhdPaB8O4VjkSQCBOHUH4TUZJE5y-U_yxR4LhWkCAR6U
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=3953E3F64DF7401F90DC5A769E2924A2&google_push=AYg5qPLjYT74Pi6ic7GIJajTWKN2COC88KyYHT9FmVyHT4S12P76fuaDhdPaB8O4VjkSQCBOHUH4TUZJE5y-U_y...

170 B
188 B

37ms
36ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=3953E3F64DF7401F90DC5A769E2924A2&google_push=AYg5qPLjYT74Pi6ic7GIJajTWKN2COC88KyYHT9FmVyHT4S12P76fuaDhdPaB8O4VjkSQCBOHUH4TUZJE5y-U_yxR4LhWkCAR6U

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 06 Dec 2021 18:47:10 GMT
x-content-type-options: nosniff
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=3953E3F64DF7401F90DC5A769E2924A2&google_push=AYg5qPLjYT74Pi6ic7GIJajTWKN2COC88KyYHT9FmVyHT4S12P76fuaDhdPaB8O4VjkSQCBOHUH4TUZJE5y-U_yxR4LhWkCAR6U
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Sun, 05 Dec 2021 18:47:10 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0158
Redirect Chain

https://ads.yieldmo.com/exptsync?google_gid=CAESEA888O_ZK5CylmqQLFXevIY&google_cver=1&google_push=AYg5qPLrTlxPUzPmDPF-iLYEMOn7B850cR2PbJh1p6TL4gH0hkFxzsKCQ3X-shoAwHw5RBnOBigGuAELeGbYgsIzkil6xY9k8mdM
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AYg5qPLrTlxPUzPmDPF-iLYEMOn7B850cR2PbJh1p6TL4gH0hkFxzsKCQ3X-shoAwHw5RBnOBigGuAELeGbYgsIzkil6xY9k8mdM&google_hm=ZzQzYzZjZTU3YmI2ODUz...

170 B
188 B

39ms
39ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AYg5qPLrTlxPUzPmDPF-iLYEMOn7B850cR2PbJh1p6TL4gH0hkFxzsKCQ3X-shoAwHw5RBnOBigGuAELeGbYgsIzkil6xY9k8mdM&google_hm=ZzQzYzZjZTU3YmI2ODUzMjMzMjA=

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:10 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AYg5qPLrTlxPUzPmDPF-iLYEMOn7B850cR2PbJh1p6TL4gH0hkFxzsKCQ3X-shoAwHw5RBnOBigGuAELeGbYgsIzkil6xY9k8mdM&google_hm=ZzQzYzZjZTU3YmI2ODUzMjMzMjA=
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0158
Redirect Chain

https://cs.media.net/cksync?type=g&google_gid=CAESEPeh31i7r87KXZUZjbR9wK4&google_cver=1&google_push=AYg5qPLMZG4iN_86Mbb0KbMSIP27emyi-HqRoyOloA32XZzTxEzOFiaIv9k2F1FxwGH26KLitKEHZvfbmZRSDHn__-Yje0Wf49U
https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MjgxODE4MDMwNzM5NDE3MzAwMFYxMA%3d%3d&mn_hm=MjgxODE4MDMwNzM5NDE3MzAwMFYxMA%3d%3d&google_sc=1&google_push=AYg5qPLMZG4iN_86Mbb0KbMSIP27emy...

170 B
188 B

37ms
37ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MjgxODE4MDMwNzM5NDE3MzAwMFYxMA%3d%3d&mn_hm=MjgxODE4MDMwNzM5NDE3MzAwMFYxMA%3d%3d&google_sc=1&google_push=AYg5qPLMZG4iN_86Mbb0KbMSIP27emyi-HqRoyOloA32XZzTxEzOFiaIv9k2F1FxwGH26KLitKEHZvfbmZRSDHn__-Yje0Wf49U&gdpr=&gdpr_consent=

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 06 Dec 2021 18:47:10 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MjgxODE4MDMwNzM5NDE3MzAwMFYxMA%3d%3d&mn_hm=MjgxODE4MDMwNzM5NDE3MzAwMFYxMA%3d%3d&google_sc=1&google_push=AYg5qPLMZG4iN_86Mbb0KbMSIP27emyi-HqRoyOloA32XZzTxEzOFiaIv9k2F1FxwGH26KLitKEHZvfbmZRSDHn__-Yje0Wf49U&gdpr=&gdpr_consent=
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html
Content-Length: 154
X-MNET-HL2: E
Expires: Mon, 06 Dec 2021 18:47:10 GMT

GET
H2 204 pub
cs.chocolateplatform.com/ Frame 0158 0
90 B 87ms
27ms Image
text/plain 35.212.101.174
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.chocolateplatform.com/pub?pid=ebda&google_gid=CAESEG8W1TFvpt4HOIzqoD2U_4E&google_cver=1&google_push=AYg5qPJTD87iZxbqq8pGz6jJMYyNjSDNpHEeT06OcCVZDsKrunuQVcvcKZb8MC7u7R3NRjkCNcIvaoAheU3i4Gr-G5juZUXz7qlg
Requested by: Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.212.101.174 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 174.101.212.35.bc.googleusercontent.com
Software: Chocolate Cookie Sync Powered by Vdopia /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:09 GMT
via: 1.1 google
server: Chocolate Cookie Sync Powered by Vdopia
alt-svc: clear

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0158
Redirect Chain

https://rtb2-useast.e-volution.ai/sync?exchange=193&google_gid=CAESEEmpIWGpoJgTQwUESNuxEYg&google_cver=1&google_push=AYg5qPIJ7mXb6ef8fGjp3PAua7_s7F38Jc_XZKmqZRYbxJMkRNa2b8gfrjX-oaLfPBvwla1tglyAsfZz...
https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.e-volution.ai%2Fsync%3Fexchange%3D193%26google_gid%3DCAESEEmpIWGpoJgTQwUESNuxEYg%26google_cver%3D1%26google_push%3DAYg5qPIJ7mXb6ef8fGjp3P...
https://rtb2-useast.e-volution.ai/sync?adkuid=A501291959492459202&exchange=193&google_gid=CAESEEmpIWGpoJgTQwUESNuxEYg&google_cver=1&google_push=AYg5qPIJ7mXb6ef8fGjp3PAua7_s7F38Jc_XZKmqZRYbxJMkRNa2b...
https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTUwMTI5MTk1OTQ5MjQ1OTIwMg&google_push=AYg5qPIJ7mXb6ef8fGjp3PAua7_s7F38Jc_XZKmqZRYbxJMkRNa2b8gfrjX-oaLfPBvwla1tglyAsfZz...

170 B
188 B

35ms
34ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTUwMTI5MTk1OTQ5MjQ1OTIwMg&google_push=AYg5qPIJ7mXb6ef8fGjp3PAua7_s7F38Jc_XZKmqZRYbxJMkRNa2b8gfrjX-oaLfPBvwla1tglyAsfZz0UaA8w3uLCcJm5ES0cq0

Protocol

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTUwMTI5MTk1OTQ5MjQ1OTIwMg&google_push=AYg5qPIJ7mXb6ef8fGjp3PAua7_s7F38Jc_XZKmqZRYbxJMkRNa2b8gfrjX-oaLfPBvwla1tglyAsfZz0UaA8w3uLCcJm5ES0cq0
Date: Mon, 06 Dec 2021 18:47:10 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 0158 0
12 B 36ms
33ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LgxrZ3c_us77J_deLOsKXYEg1yR6qNxCBXY091BOeup5y8RlN83ZdcJQt_sTcSlGK7oIp9Vg

Requested by

Host: 406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com
URL: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:10 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4882 0
23 B 43ms
41ms Ping
image/gif 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 06 Dec 2021 18:47:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 _q4UmNMOTmtef9d1r6OTn_fK0q4sseVsYwM_ZArHqzc.js Show response
pagead2.googlesyndication.com/bg/ Frame 57A0 35 KB
13 KB 26ms
25ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/_q4UmNMOTmtef9d1r6OTn_fK0q4sseVsYwM_ZArHqzc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

feae1498d30e4e6b5e7fd775afa3939ff7cad2ae2cb1e56c63033f640ac7ab37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 14:44:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14576
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13548
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 06 Dec 2022 14:44:14 GMT

GET
H2 200 v3_501006_12923.json Show response
player.adtelligent.com/prebidlink/2731360/ 10 KB
2 KB 60ms
57ms XHR
application/json 45.133.44.3
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://player.adtelligent.com/prebidlink/2731360/v3_501006_12923.json?cb=kooora4lives.com%3A2096
Requested by: Host: jscdn.greeter.me
URL: https://jscdn.greeter.me/kooora4lives.comhead.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.3 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx /
Resource Hash: c1b32e585f73a96cc23268195ffe60f1797b66ed221aaf08fbbc433b73b9b456

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:10 GMT
content-encoding: gzip
last-modified: Wed, 17 Nov 2021 20:07:29 GMT
server: nginx
etag: W/"61956101-2798"
content-type: application/json
access-control-allow-origin: https://kooora4lives.com:2096
expires: Mon, 06 Dec 2021 19:47:10 GMT
cache-control: max-age=3600
x-proxy-cache: HIT

POST multitracking
ghb.adtelligent.com/adunit/ 0
0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 57A0 0
20 B 50ms
50ms Image
image/gif 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Br4SirVquYYSxPOKNoPMPiZiB4A4AAAAAOAHgBAI&bg=!IiGlIWXNAAaQHwIOkB87ACkAdvg8WmZZ-CWJa_zs5WOz3uGRLk17dIqFqKp9LU7m_GVns0cwN3dWJAIAAABXUgAAAAtoAQeZAukxuqlDSq1XL3oHRZb5iRvIXtHEIXm2iZYT1FSvpQ3QFjA1NaJmMZa8puQIqwJP-4hx2SUwL4GmO-EVDPtc5DloAmFEnC-K8VBqRMLzKuTTEu_6O3-Re-Fq0WKcWHoMXbIwrMS4oVWTMK2KAXH1oEVbukotoud0PWB07XPSZ_x_8voHztFwPio7YJsZtNmMlbMj9SV4qW41tA2qzPBtcaj5D9XnNjAGxsb6AY_rLLv9PCU8Bpk11bfYRc9bTt2hjabdmcCYjo4M_V6X0u6X3rrrk7Ju8H6hmrxpc7DLzxa4RT6jgsL7WSwlZ8TKsSmoyBFxoy27Z9oLNNWEK7o4eGCSJwSpeqyB24rDmThVYkaza_Uj1sKkw1sKfIJ0oQteEgiCPPyBLR7r8kV6Znp3YEV93cnx06FJm37BP0t_lJ5LO27JBO3RBEnhbCghonWGYs2xiBU0lxoxX7FX0L4egWIl7_WUUVnBHkg2hh_AbGhrDGU3hxXWV2XklpeCrdvneJ8xX-zvIM5nMfcXoyjz7XebUXE0gnI8VUjo34X54ke3k5pl-93lrGc5KGFsYak5QXO4LalwpncUIngZbq_JjjB2QIebQQ7mS09i4dwnDYfflCn5fUVVXoqtAXoXwBJ2OJE0HpQzE9SgN2ZdVm2F-MsNnLM47xza-nw0b41egmyJfKeykuadGgCS8iXCmECwM4AcR2re8xQzNb_cd7IIaeFC6UeyEFtVQ8V478-n4iMuwUDxmSrI8TtoTearA8FKBS8XQxmo7JLBEsPhjvsy-_F1lBYThY0Se_gcqX-CZ06R_TcBk4X0-WCmKuWWbB2Ld1ERJlJXiwFBGse2acZcnvlZVba3xkXzsEM0KE2VPyDm1np0Cid4fltdnNaM1j_TvWPd_g6JV68B62uQkAI3AGv7Kr56s1Dt9TI3EWM2K1vgX0VVfL6qtl7RqWoIyan7carbxYF_HVW1cJT_XQti3-yPxOJLF--SBlFc

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 73ms
26ms Preflight
application/json 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fkooora4lives.com%3A2096%2F&domain=kooora4lives.com&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://kooora4lives.com:2096
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: https://kooora4lives.com:2096
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1876
date: Mon, 06 Dec 2021 18:47:10 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fkooora4lives.com%3A2096%2F&domain=kooora4lives.com&cw=1&pbt=1&lsw=1
https://mug.criteo.com/sid?cpp=OHl13nxuSWwyL3lYK1JVblcwT2lCdU53NHEzeU9kTzVsVnpIS0NsTDdhOXI4b1Jha003dmNIOEFkYUx5Q1c2SnRhWWFISm1xejIvRWJjU0RPSitDZVdNSVhDNjBDck5jQ2VXQ0VjSDZXaHFpaHRqUHo1MW1ZbDZ1UzQrQU...

449 B
679 B

26ms
25ms

XHR
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=OHl13nxuSWwyL3lYK1JVblcwT2lCdU53NHEzeU9kTzVsVnpIS0NsTDdhOXI4b1Jha003dmNIOEFkYUx5Q1c2SnRhWWFISm1xejIvRWJjU0RPSitDZVdNSVhDNjBDck5jQ2VXQ0VjSDZXaHFpaHRqUHo1MW1ZbDZ1UzQrQU5qUmdSYTZYdXRUYzlrcVAxdUVVNVpyZlROZ2FsY1dqWXlyRDJ4VHlXazZxbklRbFBzVnpSbmpHZjRQNGZKMktvSlV4Ym5PQlJxaWFWdEJZZVd3bmRxdzRhVFBqcjBmUG1FSWJ5Z00wT0MveHpVMExleU02dVE1RHJGL2xXYUhld1ZUMHdDZStKREpHQzJrNnhpci9aUzYxRTAybk5iZz09fA&cppv=2

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

12a62fee41c02b4c3d54f0567cae3e110100e10bae21d7af81489f9718fd9144

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Mon, 06 Dec 2021 18:47:10 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3190
expires: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 06 Dec 2021 18:47:10 GMT
location: https://mug.criteo.com/sid?cpp=OHl13nxuSWwyL3lYK1JVblcwT2lCdU53NHEzeU9kTzVsVnpIS0NsTDdhOXI4b1Jha003dmNIOEFkYUx5Q1c2SnRhWWFISm1xejIvRWJjU0RPSitDZVdNSVhDNjBDck5jQ2VXQ0VjSDZXaHFpaHRqUHo1MW1ZbDZ1UzQrQU5qUmdSYTZYdXRUYzlrcVAxdUVVNVpyZlROZ2FsY1dqWXlyRDJ4VHlXazZxbklRbFBzVnpSbmpHZjRQNGZKMktvSlV4Ym5PQlJxaWFWdEJZZVd3bmRxdzRhVFBqcjBmUG1FSWJ5Z00wT0MveHpVMExleU02dVE1RHJGL2xXYUhld1ZUMHdDZStKREpHQzJrNnhpci9aUzYxRTAybk5iZz09fA&cppv=2
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1675
content-length: 541
expires: 0

POST
H/1.1 200 692.json Show response
id5-sync.com/g/v2/ 1 KB
2 KB 416ms
104ms XHR
application/json 54.36.109.166
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/692.json

Requested by

Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.36.109.166 , France, ASN16276 (OVH, FR),

Reverse DNS

p10.id5-sync.com

Software

Resource Hash

6dbf736c52e5833a43c305ec3004d8cf8a2a4499d8f5bbac0e3e0abfebb61486

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 06 Dec 2021 18:47:02 GMT
Vary: Origin
P3P: CP="CAO PSA OUR"
Access-Control-Allow-Origin: https://kooora4lives.com:2096
Access-Control-Allow-Credentials: true
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Type: application/json;charset=UTF-8
Transfer-Encoding: chunked

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 70ms
24ms Preflight
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: null
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1219
date: Mon, 06 Dec 2021 18:47:10 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4882 42 B
64 B 59ms
58ms Fetch
image/gif 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstk56Q1kiIbzK3HcOSNz2j5zJHtvj2UCQ0Y0AKGvrSDKwxFLTQXU-8IZphvhXThkKPRBFzi17S64sfT4slP0z6yh2CWl7sDP5fN0JFhZn--UTCFEZU&sai=AMfl-YQLIqyzzDPMuNGbtTq_rHKwwd89ySJpg8EVm1X-2YSmA5eXiGiEOquJJ2OjHRkJWlEEGk0wrOeFNqK6bYSgcLKCf1EGzh6YvoORupfUE-9XLOp-dLWOxyCXSE0&sig=Cg0ArKJSzO18ceJM2dPPEAE&cid=CAASEuRoNhgO4JnUGpRR3Ix9gl__gw&id=lidar2&mcvt=1000&p=601,-300,1205,0&mtos=0,920,1000,1066,1066&tos=0,920,80,66,0&v=20211202&bin=7&avms=nio&bs=0,0&mc=0.76&if=1&app=0&itpl=20&adk=1771543664&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1638816429920&rpt=244&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://406de8267b5301082d0c30d298246daf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 18:47:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 140 B
982 B 21ms
20ms XHR
application/json 68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

b5eb04513e823d9e7ac6c685e2b5b969dbeea8c5c11f1b2afe9517e3aa2ed1da

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 06 Dec 2021 18:47:39 GMT
X-Proxy-Origin: 37.120.205.149; 37.120.205.149; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 06c33f5e-93a8-41eb-853e-a92823c694c7
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://kooora4lives.com:2096
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 140
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 cdb Show response
bidder.criteo.com/ 177 B
418 B 121ms
73ms XHR
application/json 74.119.119.129
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?ptv=113&profileId=185&av=34&wv=5.20.0&cb=37761789096
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.119.119.129 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS: bidder.va1.vip.prod.criteo.com
Software: Finatra /
Resource Hash: 289940488720871eb53e2499d3e7fd4a4b147311f3f0288e83861915336e6deb

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:38 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 171

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 119 B
197 B 82ms
82ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bX9srg4dmr64KsaKjGFx_2
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 2c289eb0df6bac59872dcc7db89202feedaefe52208cce73ee0e0ad98364c79c

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:39 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
183 B 304ms
103ms XHR
text/plain 185.184.8.65

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.65 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://kooora4lives.com:2096
date: Mon, 06 Dec 2021 18:47:39 GMT
access-control-allow-credentials: true
access-control-max-age: 3600
vary: Origin
access-control-allow-methods: POST

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 140 B
982 B 21ms
20ms XHR
application/json 68.67.160.132
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

27a964f56829587b5a677ab490c7e35e2e3304f30de06aeab9b63fa0404c2772

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 06 Dec 2021 18:47:39 GMT
X-Proxy-Origin: 37.120.205.149; 37.120.205.149; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 2f11af85-24e7-4038-b78e-d046e3069ee5
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://kooora4lives.com:2096
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 140
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
368 B 40ms
40ms XHR
application/json 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://kooora4lives.com:2096
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 25 B
527 B 98ms
34ms XHR
application/json 69.175.41.79
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_5.20.0
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.175.41.79 Downers Grove, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: sovrn-193627-chi03-placeholder
Software: /
Resource Hash: d889fa03c661ec9ef90bce3d78adb60399305d1bfdd48e26d4498ceb21c06cea

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 06 Dec 2021 18:47:39 GMT
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://kooora4lives.com:2096
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap5ord1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 25

GET
H2 200 ROS Show response
pbjs.e-planning.net/pbjs/1/2e43c/1/kooora4lives.com/ 2 B
162 B 94ms
29ms XHR
text/plain 172.98.26.125

General

Check archive.org

Show headers Download Go to

Full URL: https://pbjs.e-planning.net/pbjs/1/2e43c/1/kooora4lives.com/ROS?rnd=0.554523367265833&e=300x600_0%3A300x600&ur=https%3A%2F%2Fkooora4lives.com%3A2096%2Fm2%2F&pbv=5.20.0&ncb=1&vs=F&crs=UTF-8&fr=https%3A%2F%2Fkooora4lives.com%3A2096%2Fm2%2F&e_criteoId=bP28Vl9aNEFpZnJDeGNwaVpDRiUyRnYza1B0QUh3cFY2NG9BOW5MS2QwTVpEJTJGSW9nbWpwU094OFN3N05FOGwyMDFLNzVpd1YlMkJqdWtkMzBDcyUyQnNMNjI2NHElMkJDUHBCa3lZWXljZm5aJTJCeDJHVE5qS2t4WlRVRWJNZ2tSb3BaYkJKYVJ6ZEgwUw&e_id5id=%257B%2522uid%2522%253A%2522ID5*0LcWV3p48SGOc6n0yrnCEtdh2Yj2XH58ABV9TN5pvfgA7o2YaySK9en_L9M3DFyZAO9Pcz-imT_HFltPEboEwwDw2N3CM4GWfuULK-POXuYA8XZXe5f0zYeeYrSJmmYoAPIbgPuifhdIcJwJIIkH5wDzP3VShBmGyS3lR9n-WFEA9H9MXeUSSqAAcO3yekE6APUGvqv2f__Jcm8ye8A0jAD4fcavsh83m_PGNj9SP6EA_Hzj06KCOw2BmmavE9TaAP-kPUKqR6AhXsNHazQBEQECUImf41FZ7woUO72tQhwBBa7-s8YyjHXfH0XzHEkaAQZajg4P8a5yzOs6td4rLwEJm7tYmlZneORUR52wQZABDO01tMAl37ZeCwBHOkN6AQ8slzhG-ClRr8HHc9mxCQESAZxbp2D4fyvQAA84JfwBFQolm3PiTiB7sN4_3dejAUj45keGtCzTzDzRFwmI2wFPwgwnspMtj4gBfC1vzBs%2522%252C%2522ext%2522%253A%257B%2522linkType%2522%253A1%257D%257D&e_pubcid=2dfa3294-4dfb-4fd3-8170-e6db10ff0c29
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.125 -, , ASN (),
Reverse DNS
Software: openresty /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://kooora4lives.com:2096
date: Mon, 06 Dec 2021 18:47:39 GMT
access-control-allow-credentials: true
server: openresty
content-type: text/plain
content-length: 2
x-sid: IAD-1218

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
140 B 28ms
28ms XHR
text/plain 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://kooora4lives.com:2096
date: Mon, 06 Dec 2021 18:47:38 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
server: envoy
x-envoy-upstream-service-time: 2
vary: origin, Accept-Encoding

POST
H2 200 cdb Show response
bidder.criteo.com/ 177 B
418 B 98ms
60ms XHR
application/json 74.119.119.129
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?ptv=113&profileId=185&av=34&wv=5.20.0&cb=27361110622
Requested by: Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.119.119.129 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS: bidder.va1.vip.prod.criteo.com
Software: Finatra /
Resource Hash: ef0df34dcdc5dc0d48d9ff24d82988c19dcb8c318ab07afa10dd0559b8ea84a4

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 06 Dec 2021 18:47:39 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 171

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
368 B 34ms
33ms XHR
application/json 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: player.adtelligent.com
URL: https://player.adtelligent.com/prebidlink/ex18968/hb_501006_12923.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://kooora4lives.com:2096
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 204 events
bidder.criteo.com/csm/ 0
194 B 25ms
25ms Ping
text/plain 74.119.119.129
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/csm/events
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.113.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.119.119.129 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS: bidder.va1.vip.prod.criteo.com
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://kooora4lives.com:2096
date: Mon, 06 Dec 2021 18:47:39 GMT
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Finatra
timing-allow-origin: *
vary: Origin

GET
H2 200 pixels Show response
3pd.criteo.com/user-sync/ 681 B
753 B 84ms
26ms XHR
application/json 74.119.119.70

General

Check archive.org

Show headers Download Go to

Full URL: https://3pd.criteo.com/user-sync/pixels?countrycode=CA
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.113.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.119.119.70 -, , ASN (),
Reverse DNS
Software: Kestrel /
Resource Hash: aa8d1a3f3fd4e904843f150900c29a77634fa29a8c012cfe812d463f048f9c9d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:39 GMT
content-encoding: gzip
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
cache-control: no-store,max-age=0
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin

POST
H2 204 events
bidder.criteo.com/csm/ 0
194 B 25ms
24ms Ping
text/plain 74.119.119.129
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/csm/events
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.113.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.119.119.129 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS: bidder.va1.vip.prod.criteo.com
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://kooora4lives.com:2096/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://kooora4lives.com:2096
date: Mon, 06 Dec 2021 18:47:38 GMT
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Finatra
timing-allow-origin: *
vary: Origin

GET
H2 200 pixels Show response
3pd.criteo.com/user-sync/ 13 B
307 B 204ms
158ms XHR
application/json 74.119.119.70

General

Check archive.org

Show headers Download Go to

Full URL: https://3pd.criteo.com/user-sync/pixels?countrycode=CA
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.113.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.119.119.70 -, , ASN (),
Reverse DNS
Software: Kestrel /
Resource Hash: 243fb9953e49b6005f6ae1772f507bb789a8893960a495850afe43fe34030311

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:38 GMT
content-encoding: gzip
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kooora4lives.com:2096
cache-control: public,max-age=300
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin

GET
H/1.1 200
OK cri
match.prod.bidr.io/cookie-sync/ 43 B
430 B 109ms
25ms Image
image/gif 52.206.214.238

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/cri?r=https%3a%2f%2f3pd.criteo.com%2fuser-sync%2fmatch%3fp%3dYE3JTF85QjlaYTVXcU8lMkJHdkxGYW8wYXM1eCUyRlBxaVpWSHI3N05PanZpZ0lRVEhBNCUzRA%26u%3d%24%7bUSER_ID%7d&gdpr=false&consent=&ccpa=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.214.238 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
Date: Mon, 06 Dec 2021 18:47:39 GMT
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
content-type: image/gif
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

match
3pd.criteo.com/user-sync/
Redirect Chain

https://x.bidswitch.net/sync?ssp=criteo&custom_data=PgapSl95dkRHJTJGZklnemUwSmVWdjd2RmUxVjdxR3VTSVZVd0p5SldZNjVXSnJPVlElM0Q&gdpr=false&gdpr_consent=&us_privacy=&cr_user_id=k-iXW1lc5KhICSjSPR42RlIzm...
https://x.bidswitch.net/ul_cb/sync?ssp=criteo&custom_data=PgapSl95dkRHJTJGZklnemUwSmVWdjd2RmUxVjdxR3VTSVZVd0p5SldZNjVXSnJPVlElM0Q&gdpr=false&gdpr_consent=&us_privacy=&cr_user_id=k-iXW1lc5KhICSjSPR4...
https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=criteo
https://x.bidswitch.net/sync?dsp_id=70&user_id=1597036168287045463&ssp=criteo
https://3pd.criteo.com/user-sync/match?p=PgapSl95dkRHJTJGZklnemUwSmVWdjd2RmUxVjdxR3VTSVZVd0p5SldZNjVXSnJPVlElM0Q&u=9f25a224-1a2b-4143-80c3-ffb7021beb45

0
113 B

26ms
26ms

Image
text/plain

74.119.119.70

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://3pd.criteo.com/user-sync/match?p=PgapSl95dkRHJTJGZklnemUwSmVWdjd2RmUxVjdxR3VTSVZVd0p5SldZNjVXSnJPVlElM0Q&u=9f25a224-1a2b-4143-80c3-ffb7021beb45
Protocol: H2
Server: 74.119.119.70 -, , ASN (),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:39 GMT
cache-control: no-store,max-age=0
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

Location: //3pd.criteo.com/user-sync/match?p=PgapSl95dkRHJTJGZklnemUwSmVWdjd2RmUxVjdxR3VTSVZVd0p5SldZNjVXSnJPVlElM0Q&u=9f25a224-1a2b-4143-80c3-ffb7021beb45
Date: Mon, 06 Dec 2021 18:47:39 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

204

match
3pd.criteo.com/user-sync/
Redirect Chain

https://sync.taboola.com/sg/criteoscod/1/cm?redirect=https%3a%2f%2f3pd.criteo.com%2fuser-sync%2fmatch%3fp%3dYUqup19XMmFveGthMkZJbGpKJTJGb2V1cGFsSHNCd1kwbGJETlVyR2RHdSUyRmFzbHRwQSUzRA%26u%3d%3cTUID%...
https://3pd.criteo.com/user-sync/match?p=YUqup19XMmFveGthMkZJbGpKJTJGb2V1cGFsSHNCd1kwbGJETlVyR2RHdSUyRmFzbHRwQSUzRA&u=7991099b-1bf7-4be7-9fa4-df73c2cbe037-tuct8a7e04b

0
113 B

24ms
24ms

Image
text/plain

74.119.119.70

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://3pd.criteo.com/user-sync/match?p=YUqup19XMmFveGthMkZJbGpKJTJGb2V1cGFsSHNCd1kwbGJETlVyR2RHdSUyRmFzbHRwQSUzRA&u=7991099b-1bf7-4be7-9fa4-df73c2cbe037-tuct8a7e04b
Protocol: H2
Server: 74.119.119.70 -, , ASN (),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 18:47:38 GMT
cache-control: no-store,max-age=0
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

location: https://3pd.criteo.com/user-sync/match?p=YUqup19XMmFveGthMkZJbGpKJTJGb2V1cGFsSHNCd1kwbGJETlVyR2RHdSUyRmFzbHRwQSUzRA&u=7991099b-1bf7-4be7-9fa4-df73c2cbe037-tuct8a7e04b
date: Mon, 06 Dec 2021 18:47:39 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 9004

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 66ms
65ms Script
application/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=kooora4lives.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 06 Dec 2021 18:47:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 53ms
51ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=kooora4lives.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://kooora4lives.com:2096/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 06 Dec 2021 18:47:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
9 KB 334ms
332ms XHR
text/plain 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=338030884393098&correlator=2978005147055188&output=ldjh&impl=fifs&eid=31060888&vrg=2021120201&ptt=17&sc=1&sfv=1-0-38&ecs=20211206&iu_parts=21939239661%3A202189885%2Capl%2Caplmcm%2Cdynamic&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x600&prev_scp=refresh%3Dtrue%26test%3Devent%26hb_rfBid%3D0%26excl_cat%3DPREPOST&eri=1&cookie=ID%3D289350c65ac41bf9%3AT%3D1638816427%3AS%3DALNI_MaKqi6ObFC2BpRvVSufLMRGjlrW9w&bc=31&abxe=1&lmt=1638816459&dt=1638816459628&dlt=1638816426508&idt=849&frm=20&biw=1600&bih=1200&oid=2&adxs=0&adys=1201&adks=693570886&ucis=f&ifi=17&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fkooora4lives.com%3A2096%2Fm2%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x-1&msz=300x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H82HzPzSnCWJ_0A7n-EerAZAgkAhIJHh7TzSwdJsG6ap6ogx1k_QDKKJoZB79SYzg03a_hadg7NR-m3Gl04GnwVB87btbRl%2CAGkb-H_NGuXEsD4JiPRU4ScoIdX-V2NHZPe3R0NInaY2MbwYXyRGNpfMmGz8lapB0PuL5nOGGt7tmHFiYwaXBSf0kWY5neBY7qSS&ga_vid=428231269.1638816427&ga_sid=1638816427&ga_hid=1502021003&ga_fc=true&fws=516&ohw=300&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&a3p=EhYKBmNyaXRlbxIAGJTvyIjZL0UAAAAA&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS