bestlifeonline.com Open in urlscan Pro
2606:4700:10::ac43:d42 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bestlifeonline.com/charity-fraud-news/
Effective URL:
https://bestlifeonline.com/charity-fraud-news/
Submission: On December 15 via manual (December 15th 2022, 9:06:42 pm UTC) from US — Scanned from DE

Summary HTTP 188 Redirects Links 133 Behaviour Indicators

Summary

This website contacted 73 IPs in 9 countries across 49 domains to perform 188 HTTP transactions. The main IP is 2606:4700:10::ac43:d42, located in United States and belongs to CLOUDFLARENET, US. The main domain is bestlifeonline.com. The Cisco Umbrella rank of the primary domain is 70792.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 22nd 2022. Valid for: a year.

This is the only time bestlifeonline.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 17	2606:4700:10:... 2606:4700:10::ac43:d42	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.226.155.71 13.226.155.71	16509 (AMAZON-02) (AMAZON-02)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	54.236.68.181 54.236.68.181	14618 (AMAZON-AES) (AMAZON-AES)
1	54.155.18.159 54.155.18.159	16509 (AMAZON-02) (AMAZON-02)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2600:9000:224... 2600:9000:224a:7c00:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:224... 2600:9000:224a:e800:d:2820:3bc0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:400d:80e::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400d:803::2008	15169 (GOOGLE) (GOOGLE)
1 1	2600:1f18:730... 2600:1f18:730:b140:4517:6949:e1a8:7c3d	14618 (AMAZON-AES) (AMAZON-AES)
1	54.146.241.124 54.146.241.124	14618 (AMAZON-AES) (AMAZON-AES)
10	2606:4700::68... 2606:4700::6813:d383	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
1	2600:9000:206... 2600:9000:206e:ae00:19:bcbe:a700:21	16509 (AMAZON-02) (AMAZON-02)
2	172.64.151.162 172.64.151.162	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	108.156.255.76 108.156.255.76	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:231... 2600:9000:2315:ca00:11:e0c9:84c0:21	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:402... 2a00:1450:4025:401::9d	15169 (GOOGLE) (GOOGLE)
1	34.120.133.55 34.120.133.55	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	54.162.152.214 54.162.152.214	14618 (AMAZON-AES) (AMAZON-AES)
5	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	20.40.202.0 20.40.202.0	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	18.66.23.210 18.66.23.210	16509 (AMAZON-02) (AMAZON-02)
3	52.28.203.152 52.28.203.152	16509 (AMAZON-02) (AMAZON-02)
1	185.64.190.77 185.64.190.77	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	2602:803:c003... 2602:803:c003:200::31	26667 (RUBICONPR...) (RUBICONPROJECT)
2	172.64.154.237 172.64.154.237	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 7	185.83.142.19 185.83.142.19	29990 (ASN-APPNEX) (ASN-APPNEX)
1	18.194.114.29 18.194.114.29	16509 (AMAZON-02) (AMAZON-02)
2	108.157.4.38 108.157.4.38	16509 (AMAZON-02) (AMAZON-02)
3	104.18.33.19 104.18.33.19	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	108.156.253.53 108.156.253.53	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
18	2a00:1450:400... 2a00:1450:400d:80d::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:811::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
2	2a02:26f0:350... 2a02:26f0:3500:18::1724:a29a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 3	54.205.34.37 54.205.34.37	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:400d:80e::2003	15169 (GOOGLE) (GOOGLE)
15	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:350... 2a02:26f0:3500:887::f09	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	99.86.240.53 99.86.240.53	16509 (AMAZON-02) (AMAZON-02)
2 3	2a00:1450:400... 2a00:1450:400d:80c::2004	15169 (GOOGLE) (GOOGLE)
1	35.82.251.53 35.82.251.53	16509 (AMAZON-02) (AMAZON-02)
2 3	69.192.160.219 69.192.160.219	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	185.29.132.245 185.29.132.245	30419 (MEDIAMATH...) (MEDIAMATH-INC)
5 5	3.126.18.125 3.126.18.125	16509 (AMAZON-02) (AMAZON-02)
1 1	2a05:d018:d29... 2a05:d018:d29:3602:2c64:3412:9e4:7e3a	16509 (AMAZON-02) (AMAZON-02)
1	208.92.55.231 208.92.55.231	13360 (TRITONDIG...) (TRITONDIGITAL)
3	107.178.254.65 107.178.254.65	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:80e::2001	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400d:80c::2002	15169 (GOOGLE) (GOOGLE)
7 8	142.250.201.194 142.250.201.194	15169 (GOOGLE) (GOOGLE)
2 6	185.80.39.216 185.80.39.216	27381 (CASALE-MEDIA) (CASALE-MEDIA)
6	2a00:1450:400... 2a00:1450:4001:82b::2006	15169 (GOOGLE) (GOOGLE)
2	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:11a... 2a02:26f0:11a::6867:4830	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	23.37.42.132 23.37.42.132	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2.18.68.199 2.18.68.199	16625 (AKAMAI-AS) (AKAMAI-AS)
1	151.101.193.108 151.101.193.108	54113 (FASTLY) (FASTLY)
1 2	52.46.128.147 52.46.128.147	16509 (AMAZON-02) (AMAZON-02)
1 1	185.89.210.46 185.89.210.46	29990 (ASN-APPNEX) (ASN-APPNEX)
1 1	34.95.81.168 34.95.81.168	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2606:4700:20:... 2606:4700:20::681a:ad1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	54.76.69.248 54.76.69.248	16509 (AMAZON-02) (AMAZON-02)
1	104.18.36.94 104.18.36.94	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	185.64.190.78 185.64.190.78	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
4	185.64.189.110 185.64.189.110	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	2606:4700:10:... 2606:4700:10::6816:1857	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	63.32.97.75 63.32.97.75	16509 (AMAZON-02) (AMAZON-02)
2 2	34.111.129.221 34.111.129.221	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	34.111.131.239 34.111.131.239	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	35.204.158.49 35.204.158.49	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	37.157.6.254 37.157.6.254	198622 (ADFORM) (ADFORM)
1	198.47.127.20 198.47.127.20	() ()
188	73

17 2606:4700:10::ac43:d42 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

bestlifeonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.71 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-71.dus51.r.cloudfront.net

cdn.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.236.68.181 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-236-68-181.compute-1.amazonaws.com

api.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.155.18.159 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-155-18-159.eu-west-1.compute.amazonaws.com

p1.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:224a:7c00:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:224a:e800:d:2820:3bc0:93a1 (United States)

ASN16509 (AMAZON-02, US)

karma.mdpcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400d:80e::200e (Ireland)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:803::2008 (Ireland)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b140:4517:6949:e1a8:7c3d (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.146.241.124 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-146-241-124.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2606:4700::6813:d383 (United States)

ASN13335 (CLOUDFLARENET, US)

www.lightboxcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s3.lightboxcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206e:ae00:19:bcbe:a700:21 (United States)

ASN16509 (AMAZON-02, US)

d30qdagvt44524.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.64.151.162 (United States)

ASN13335 (CLOUDFLARENET, US)

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 108.156.255.76 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-156-255-76.dus51.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2315:ca00:11:e0c9:84c0:21 (United States)

ASN16509 (AMAZON-02, US)

d9jj3mjthpub.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4025:401::9d (Den Helder, Netherlands)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.133.55 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 55.133.120.34.bc.googleusercontent.com

api.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.162.152.214 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-162-152-214.compute-1.amazonaws.com

id.sv.rkdms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 15.197.193.217 (United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 20.40.202.0 (Des Moines, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

lightboxapi.azurewebsites.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.23.210 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-23-210.vie50.r.cloudfront.net

aax-dtb-cf.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.28.203.152 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com

c2shb.ssp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.190.77 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2602:803:c003:200::31 (Amsterdam, Netherlands)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.64.154.237 (United States)

ASN13335 (CLOUDFLARENET, US)

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dsum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 185.83.142.19 (Amsterdam, Netherlands) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.194.114.29 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-114-29.eu-central-1.compute.amazonaws.com

grid.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.157.4.38 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-4-38.dus51.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.33.19 (None, )

ASN13335 (CLOUDFLARENET, US)

as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.156.253.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-156-253-53.dus51.r.cloudfront.net

dc8xl0ndzn2cb.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:400d:80d::2002 (Ireland)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3500:18::1724:a29a (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

consent.cookiebot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.205.34.37 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-205-34-37.compute-1.amazonaws.com

i.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:80e::2003 (Ireland)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:887::f09 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

consentcdn.cookiebot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.240.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-240-53.vie50.r.cloudfront.net

d31qbv1cthcecs.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400d:80c::2004 (Ireland) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.82.251.53 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-82-251-53.us-west-2.compute.amazonaws.com

redirect.prod.experiment.routing.cloudfront.aws.a2z.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 69.192.160.219 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-160-219.deploy.static.akamaitechnologies.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.29.132.245 (United Kingdom) 2 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.126.18.125 (Frankfurt am Main, Germany) 5 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-18-125.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d018:d29:3602:2c64:3412:9e4:7e3a (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 208.92.55.231 (Canada)

ASN13360 (TRITONDIGITAL, CA)

yield-op-idsync.live.streamtheworld.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 107.178.254.65 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:80e::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:80c::2002 (Ireland)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.250.201.194 (United States) 7 redirects

ASN15169 (GOOGLE, US)
PTR: bud02s35-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 185.80.39.216 (Canada) 2 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:82b::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:11a::6867:4830 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

code.createjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.37.42.132 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-42-132.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.68.199 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-68-199.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.193.108 (United States)

ASN54113 (FASTLY, US)

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.46.128.147 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.89.210.46 (Frankfurt am Main, Germany) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.95.81.168 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 168.81.95.34.bc.googleusercontent.com

euexchangesync.digitaleast.mobi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:ad1 (United States)

ASN13335 (CLOUDFLARENET, US)

ad4m.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.76.69.248 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-76-69-248.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.36.94 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.190.78 (United Kingdom) 1 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:1857 (United States)

ASN13335 (CLOUDFLARENET, US)

mwzeom.zeotap.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.32.97.75 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-32-97-75.eu-west-1.compute.amazonaws.com

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.129.221 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 221.129.111.34.bc.googleusercontent.com

cr.frontend.weborama.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.111.131.239 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 239.131.111.34.bc.googleusercontent.com

idsync.frontend.weborama.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.204.158.49 (Groningen, Netherlands)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 49.158.204.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.6.254 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.47.127.20 (None, )

ASN- ()

simage4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
35	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 101 bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 139	320 KB
21	doubleclick.net 7 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 192 stats.g.doubleclick.net — Cisco Umbrella Rank: 77 googleads.g.doubleclick.net — Cisco Umbrella Rank: 34 cm.g.doubleclick.net — Cisco Umbrella Rank: 208 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 297	217 KB
17	bestlifeonline.com 1 redirects bestlifeonline.com — Cisco Umbrella Rank: 70792	165 KB
11	casalemedia.com 2 redirects htlb.casalemedia.com — Cisco Umbrella Rank: 482 as-sec.casalemedia.com — Cisco Umbrella Rank: 1488 dsum-sec.casalemedia.com — Cisco Umbrella Rank: 513 ssum-sec.casalemedia.com — Cisco Umbrella Rank: 419 dsum.casalemedia.com — Cisco Umbrella Rank: 1324	9 KB
10	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 374	217 KB
10	pubmatic.com 1 redirects hbopenbid.pubmatic.com — Cisco Umbrella Rank: 449 ads.pubmatic.com — Cisco Umbrella Rank: 481 image6.pubmatic.com — Cisco Umbrella Rank: 716 simage2.pubmatic.com — Cisco Umbrella Rank: 641 image2.pubmatic.com — Cisco Umbrella Rank: 852 simage4.pubmatic.com	25 KB
10	lightboxcdn.com www.lightboxcdn.com — Cisco Umbrella Rank: 5924 s3.lightboxcdn.com — Cisco Umbrella Rank: 15358	353 KB
9	adnxs.com 4 redirects ib.adnxs.com — Cisco Umbrella Rank: 210 acdn.adnxs.com — Cisco Umbrella Rank: 576 secure.adnxs.com — Cisco Umbrella Rank: 414	25 KB
8	amazon-adsystem.com 1 redirects c.amazon-adsystem.com — Cisco Umbrella Rank: 296 aax-dtb-cf.amazon-adsystem.com — Cisco Umbrella Rank: 503 s.amazon-adsystem.com — Cisco Umbrella Rank: 273	51 KB
7	liadm.com 2 redirects b-code.liadm.com — Cisco Umbrella Rank: 2626 rp.liadm.com — Cisco Umbrella Rank: 1530 rp4.liadm.com — Cisco Umbrella Rank: 7037 i.liadm.com — Cisco Umbrella Rank: 552	21 KB
6	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 267	250 KB
6	bidswitch.net 5 redirects grid.bidswitch.net — Cisco Umbrella Rank: 871 x.bidswitch.net — Cisco Umbrella Rank: 282	2 KB
5	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 315	1 KB
4	google.com 2 redirects adservice.google.com — Cisco Umbrella Rank: 72 www.google.com — Cisco Umbrella Rank: 2	2 KB
4	rubiconproject.com fastlane.rubiconproject.com — Cisco Umbrella Rank: 462 eus.rubiconproject.com — Cisco Umbrella Rank: 529 token.rubiconproject.com — Cisco Umbrella Rank: 563	12 KB
4	yahoo.com 1 redirects c2shb.ssp.yahoo.com — Cisco Umbrella Rank: 1139 pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 408	1 KB
4	cloudfront.net d30qdagvt44524.cloudfront.net d9jj3mjthpub.cloudfront.net dc8xl0ndzn2cb.cloudfront.net d31qbv1cthcecs.cloudfront.net	5 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 29 region1.google-analytics.com — Cisco Umbrella Rank: 2623	21 KB
3	weborama.fr 2 redirects cr.frontend.weborama.fr — Cisco Umbrella Rank: 24144 idsync.frontend.weborama.fr — Cisco Umbrella Rank: 26541	738 B
3	pippio.com pippio.com — Cisco Umbrella Rank: 705	182 B
3	cookiebot.com consent.cookiebot.com — Cisco Umbrella Rank: 4183 consentcdn.cookiebot.com — Cisco Umbrella Rank: 4785	108 KB
3	indexww.com js-sec.indexww.com — Cisco Umbrella Rank: 599 cdn.indexww.com — Cisco Umbrella Rank: 1485	15 KB
3	parsely.com cdn.parsely.com — Cisco Umbrella Rank: 2773 api.parsely.com — Cisco Umbrella Rank: 10244 p1.parsely.com — Cisco Umbrella Rank: 2076	22 KB
2	adform.net 2 redirects c1.adform.net — Cisco Umbrella Rank: 566	1 KB
2	mathtag.com 2 redirects sync.mathtag.com — Cisco Umbrella Rank: 434	1 KB
2	addthis.com 2 redirects e.dlx.addthis.com — Cisco Umbrella Rank: 1968	1 KB
2	scorecardresearch.com sb.scorecardresearch.com — Cisco Umbrella Rank: 154	2 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 51	130 KB
2	wp.com stats.wp.com — Cisco Umbrella Rank: 2897 pixel.wp.com — Cisco Umbrella Rank: 2717	3 KB
1	simpli.fi um.simpli.fi — Cisco Umbrella Rank: 759	610 B
1	crwdcntrl.net sync.crwdcntrl.net — Cisco Umbrella Rank: 719	266 B
1	zeotap.com mwzeom.zeotap.com — Cisco Umbrella Rank: 2401	382 B
1	bidr.io match.prod.bidr.io — Cisco Umbrella Rank: 480	433 B
1	ad4m.at ad4m.at — Cisco Umbrella Rank: 9760
1	digitaleast.mobi 1 redirects euexchangesync.digitaleast.mobi — Cisco Umbrella Rank: 21953	269 B
1	createjs.com code.createjs.com — Cisco Umbrella Rank: 1360	63 KB
1	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 188	47 KB
1	streamtheworld.com yield-op-idsync.live.streamtheworld.com — Cisco Umbrella Rank: 9253	542 B
1	bluekai.com stags.bluekai.com — Cisco Umbrella Rank: 504	227 B
1	a2z.com redirect.prod.experiment.routing.cloudfront.aws.a2z.com	48 B
1	gstatic.com fonts.gstatic.com	16 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 37	1 KB
1	google.de adservice.google.de — Cisco Umbrella Rank: 8549	792 B
1	azurewebsites.net lightboxapi.azurewebsites.net — Cisco Umbrella Rank: 12184	849 B
1	rkdms.com id.sv.rkdms.com — Cisco Umbrella Rank: 4413	168 B
1	rlcdn.com api.rlcdn.com — Cisco Umbrella Rank: 802	361 B
1	mdpcdn.com karma.mdpcdn.com — Cisco Umbrella Rank: 22558	109 KB
1	gravatar.com secure.gravatar.com — Cisco Umbrella Rank: 1827	414 B
0	alexametrics.com Failed certify.alexametrics.com Failed
188	49

	Domain	Requested by
18	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com pagead2.googlesyndication.com googleads.g.doubleclick.net s0.2mdn.net www.googletagservices.com
17	bestlifeonline.com	1 redirects bestlifeonline.com
15	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com bestlifeonline.com bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com s0.2mdn.net
10	cdn.ampproject.org	securepubads.g.doubleclick.net
8	cm.g.doubleclick.net	7 redirects googleads.g.doubleclick.net
8	www.lightboxcdn.com	bestlifeonline.com www.lightboxcdn.com
7	ib.adnxs.com	3 redirects karma.mdpcdn.com googleads.g.doubleclick.net acdn.adnxs.com
6	s0.2mdn.net	bestlifeonline.com s0.2mdn.net bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com
6	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net ssum-sec.casalemedia.com
6	securepubads.g.doubleclick.net	karma.mdpcdn.com securepubads.g.doubleclick.net bestlifeonline.com
5	x.bidswitch.net	5 redirects
5	match.adsrvr.org	js-sec.indexww.com i.liadm.com ssum-sec.casalemedia.com
5	c.amazon-adsystem.com	karma.mdpcdn.com c.amazon-adsystem.com
4	googleads.g.doubleclick.net	bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com pagead2.googlesyndication.com bestlifeonline.com
3	pippio.com	i.liadm.com
3	www.google.com	2 redirects tpc.googlesyndication.com
3	i.liadm.com	1 redirects b-code.liadm.com i.liadm.com
3	c2shb.ssp.yahoo.com	karma.mdpcdn.com
3	www.google-analytics.com	bestlifeonline.com
2	c1.adform.net	2 redirects
2	image2.pubmatic.com
2	cr.frontend.weborama.fr	2 redirects
2	simage2.pubmatic.com	ads.pubmatic.com
2	image6.pubmatic.com	1 redirects ads.pubmatic.com
2	s.amazon-adsystem.com	1 redirects ssum-sec.casalemedia.com
2	ssum-sec.casalemedia.com	js-sec.indexww.com ssum-sec.casalemedia.com
2	ads.pubmatic.com	karma.mdpcdn.com
2	eus.rubiconproject.com	karma.mdpcdn.com eus.rubiconproject.com
2	googleads4.g.doubleclick.net	bestlifeonline.com
2	sync.mathtag.com	2 redirects
2	e.dlx.addthis.com	2 redirects
2	consent.cookiebot.com	www.googletagmanager.com consent.cookiebot.com
2	s3.lightboxcdn.com	www.lightboxcdn.com s3.lightboxcdn.com
2	bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	sb.scorecardresearch.com	bestlifeonline.com
2	js-sec.indexww.com	karma.mdpcdn.com
2	www.googletagmanager.com	bestlifeonline.com
2	b-code.liadm.com	bestlifeonline.com b-code.liadm.com
1	simage4.pubmatic.com	ads.pubmatic.com
1	um.simpli.fi
1	idsync.frontend.weborama.fr
1	sync.crwdcntrl.net
1	mwzeom.zeotap.com
1	token.rubiconproject.com	eus.rubiconproject.com
1	cdn.indexww.com	ssum-sec.casalemedia.com
1	match.prod.bidr.io	ssum-sec.casalemedia.com
1	dsum.casalemedia.com	ssum-sec.casalemedia.com
1	ad4m.at	ssum-sec.casalemedia.com
1	euexchangesync.digitaleast.mobi	1 redirects
1	secure.adnxs.com	1 redirects
1	acdn.adnxs.com	karma.mdpcdn.com
1	code.createjs.com	s0.2mdn.net
1	www.googletagservices.com	bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com
1	yield-op-idsync.live.streamtheworld.com	i.liadm.com
1	pr-bh.ybp.yahoo.com	1 redirects
1	stags.bluekai.com	i.liadm.com
1	redirect.prod.experiment.routing.cloudfront.aws.a2z.com
1	d31qbv1cthcecs.cloudfront.net	bestlifeonline.com
1	consentcdn.cookiebot.com	consent.cookiebot.com
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	www.lightboxcdn.com
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	dc8xl0ndzn2cb.cloudfront.net	bestlifeonline.com
1	as-sec.casalemedia.com	js-sec.indexww.com
1	grid.bidswitch.net	karma.mdpcdn.com
1	htlb.casalemedia.com	karma.mdpcdn.com
1	fastlane.rubiconproject.com	karma.mdpcdn.com
1	hbopenbid.pubmatic.com	karma.mdpcdn.com
1	aax-dtb-cf.amazon-adsystem.com	c.amazon-adsystem.com
1	lightboxapi.azurewebsites.net	www.lightboxcdn.com
1	region1.google-analytics.com	www.googletagmanager.com
1	id.sv.rkdms.com	js-sec.indexww.com
1	api.rlcdn.com	js-sec.indexww.com karma.mdpcdn.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	d9jj3mjthpub.cloudfront.net
1	d30qdagvt44524.cloudfront.net	karma.mdpcdn.com
1	rp4.liadm.com
1	rp.liadm.com	1 redirects
1	karma.mdpcdn.com	bestlifeonline.com
1	secure.gravatar.com	bestlifeonline.com
1	pixel.wp.com	bestlifeonline.com
1	p1.parsely.com	bestlifeonline.com
1	api.parsely.com	bestlifeonline.com
1	stats.wp.com	bestlifeonline.com
1	cdn.parsely.com	bestlifeonline.com
0	certify.alexametrics.com Failed
188	87

This site contains links to these domains. Also see Links.

Domain
playground.xyz
integralads.com
www.stroeer.de
www.crazyegg.com
policies.google.com
www.cookiebot.com
www.parse.ly
www.beeswax.com
crimtan.com
www.dailymail.co.uk
www.sumologic.com
script.dotmetrics.net
www.id5.io
www.linkedin.com
www.sportradar.com
www.admedo.com
www.bidswitch.com
www.internedservices.nl
zeotap.com
www.outbrain.com
automattic.com
www.nativo.com
rubiconproject.com
smartadserver.com
www.amobee.com
www.cognitiv.ai
betweenx.com
www.jwplayer.com
www.appnexus.com
www.home.neustar
www.indexexchange.com
www.casalemedia.com
www.media.net
www.conversantmedia.com
pubmatic.com
www.quantcast.com
yandex.com
www.rhythmone.com
unruly.co
improvedigital.com
www.demandbase.com
triplelift.com
www.magnite.com
www.vidoomy.com
www.acuityads.com
www.oracle.com
site.adform.com
www.we-are-adot.com
www.criteo.com
adgear.com
www.adition.com
admanmedia.com
admixer.com
www.rockerbox.com
www.innovid.com
www.mediamath.com
www.pixalate.com
www.antvoice.com
travelaudience.com
www.thetradedesk.com
www.adswizz.com
policies.oath.com
www.amazon.com
www.wideorbit.com
www.scorecardresearch.com
www.freewheel.com
www.tiktok.com
liveintent.com
beachfrontmedia.com
www.bidtheatre.com
www.blis.com
brand-display.com
www.appier.com
www.geniussports.com
pulsepoint.com
www.adroll.com
www.deltaprojects.com
www.adobe.com
www.eqworks.com
www.nielsen.com
www.zypmedia.com
fifty.io
freewheel.tv
help.instagram.com
www.adelphic.com
www.salesforce.com
www.sovrn.com
www.melia.com
www.xaxis.com
narrative.io
privacy.nrich.ai
www.openx.com
datonics.com
zetaglobal.com
liveramp.com
pomoc.nazwa.pl
www.semasio.com
www.sizmek.com
simpli.fi
www.simpli.fi
smadex.com
supership.jp
www.taptapnetworks.com
sonobi.com
www.spotx.tv
www.stackadapt.com
www.tapad.com
tidaltv.com
exponential.com
twitter.com
www.dataxu.com
weborama.com
policies.yahoo.com
yieldmo.com
www.zemanta.com
www.trustarc.com
iprom.eu
www.tritondigital.com
www.facebook.com
www.pinterest.com
www.washingtonpost.com
www.fbi.gov
www.instagram.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-22` - `2023-08-22`	a year	crt.sh
*.parsely.com Amazon	`2022-06-05` - `2023-07-04`	a year	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-14` - `2023-12-15`	a year	crt.sh
*.gravatar.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-23` - `2023-12-24`	a year	crt.sh
*.liadm.com Amazon	`2022-01-31` - `2023-03-01`	a year	crt.sh
karma.mdpcdn.com Amazon	`2022-05-02` - `2023-05-31`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
c.amazon-adsystem.com Amazon	`2022-05-09` - `2023-04-18`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
securedvisit.com Amazon	`2022-10-29` - `2023-11-26`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2022-03-31` - `2023-05-02`	a year	crt.sh
*.azurewebsites.net Microsoft Azure TLS Issuing CA 01	`2022-03-14` - `2023-03-09`	a year	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon	`2022-06-15` - `2023-06-15`	a year	crt.sh
web.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-08-02` - `2023-01-25`	6 months	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2022-06-13` - `2023-07-14`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-04-04`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2022-02-11` - `2023-03-14`	a year	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2022-04-05` - `2023-05-04`	a year	crt.sh
*.scorecardresearch.com Amazon	`2022-01-29` - `2023-02-27`	a year	crt.sh
*.google.de GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
consent.cookiebot.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-04` - `2023-06-06`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.cookiebot.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-15` - `2023-06-17`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.prod.experiment.routing.cloudfront.aws.a2z.com Amazon	`2022-09-13` - `2023-10-12`	a year	crt.sh
pippio.com GTS CA 1D4	`2022-11-21` - `2023-02-19`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
tls.adobe.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-29` - `2023-05-30`	a year	crt.sh
cdn.adnxs.com GeoTrust TLS RSA CA G1	`2022-03-11` - `2023-04-11`	a year	crt.sh
*.match.prod.bidr.io Amazon	`2022-01-27` - `2023-02-25`	a year	crt.sh
*.crwdcntrl.net Go Daddy Secure Certificate Authority - G2	`2022-05-01` - `2023-06-02`	a year	crt.sh
*.simpli.fi DigiCert TLS RSA SHA256 2020 CA1	`2022-11-07` - `2023-12-08`	a year	crt.sh

This page contains 21 frames:

Primary Page: https://bestlifeonline.com/charity-fraud-news/
Frame ID: 179DBB3FA484D8CCE4BA49A90881112F
Requests: 85 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/lightbox.js?mb=1671138395858&lv=1
Frame ID: 0167E60A16CC38E45BD385C66F15EA01
Requests: 2 HTTP requests in this frame

Frame: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 232D959A13B66B0FFF30FD0374B169C4
Requests: 1 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/lightbox_builder.js?cb=637908759194514824
Frame ID: 498EC437AA2D5075962FAF8F9B5869B1
Requests: 5 HTTP requests in this frame

Frame: https://i.liadm.com/s/c/a-01ao?s=&cim=&ps=true&ls=true&duid=2baacde7071f--01gmbsrhey3f3n943dt525t6ry&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&
Frame ID: CD57B3D46802403F21EC293151809913
Requests: 8 HTTP requests in this frame

Frame: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Frame ID: 835BA8903270E6591A26A5E4149CAC32
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 12CF396132CE05942C2569CF628F0B73
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: ADC97EB82DA9319CEC5650A599C1A973
Requests: 2 HTTP requests in this frame

Frame: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: D2FDC4A6691D26FB3BB47B0D38B8E131
Requests: 20 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012211060024000/amp4ads-v0.mjs
Frame ID: E10698335D515E9BCD90B8E8F4A98750
Requests: 12 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012211060024000/amp4ads-v0.mjs
Frame ID: ECE4098E1CD3B6D58E0E1404CD364C74
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ28u5ARis5JC_ATAB&v=APEucNXEE3tNNceUhuTbXYFmhkBMbA5T4FBbN9RI0TDw9_5_ouXagN9miVtUhqz_FWTaUsLr-mXNPFzAjDuMcuPrsswP2cabLcynGS0McIoQc-rGQBFQ-_1Nc_m5uTAYSRuJU8ZQx1JQGgk7uavrJKe3C-i3aoPSYcJ2UoXOvQwXnlL7jnPLqEPvq8LTg6V7OXnrjb9baPEGWlGRqNqBnqrYvkaki-0ZSw
Frame ID: 2019AB7A21882B6B1554D877C6E3263E
Requests: 5 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/8094200031927599104/RTL_SF_DV360_SU_FRATBOYS_728x90/RTL_SF_DV360_SU_FRATBOYS_728x90.html?e=69&leftOffset=0&topOffset=0&c=DBChkrs48s&t=1&renderingType=2&ev=01_247
Frame ID: 6C497E6BE68943A784E2E47B1C6CD255
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 9558739281F37CC735D8AEF5D62F2B70
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js
Frame ID: 097E854708C3CB66322513358F712119
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: EE8C38FF6DB71E3AD02926A3BD35EB78
Requests: 3 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158139
Frame ID: A59AA7D897CF4EBAE23EBF6B54623FB9
Requests: 12 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 69A7177C92234DF31A7C888DA76B8DDA
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 3B451C5795BBE4B014006E41C0C488D4
Requests: 3 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fbestlifeonline.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Frame ID: 066A98148DC286004CE97C321352613A
Requests: 10 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:75bc639b-8c5d-4a00-bf20-6e274124519d&gdpr=0&gdpr_consent=
Frame ID: 67B12F1DA6D3F0092D4A53217E145ED9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

If You Get a Call From These Numbers, "Don't Believe Your Caller ID," FBI Says

Page URL History Show full URLs

http://bestlifeonline.com/charity-fraud-news/ HTTP 301
https://bestlifeonline.com/charity-fraud-news/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Cookiebot (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

consent\.cookiebot\.com

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Lightbox (JavaScript Libraries) Expand

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

comScore (Analytics) Expand

Overall confidence: 100%
Detected patterns

<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon
\.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon

Page Statistics

188
Requests

88 %
HTTPS

40 %
IPv6

49
Domains

87
Subdomains

73
IPs

9
Countries

2207 kB
Transfer

6221 kB
Size

66
Cookies

133 Outgoing links

These are links going to different origins than the main page.

URL: https://playground.xyz/privacy/privacy-policy.pdf
Title: Playground.xyz

Search URL Search Domain Scan URL

URL: https://integralads.com/privacy-policy/
Title: Mas Capital

Search URL Search Domain Scan URL

URL: https://www.stroeer.de/service/datenschutz.html
Title: Ströer Media Deutschland

Search URL Search Domain Scan URL

URL: https://www.crazyegg.com/privacy
Title: Crazyegg

Search URL Search Domain Scan URL

URL: https://policies.google.com/privacy
Title: Google

Search URL Search Domain Scan URL

URL: https://www.cookiebot.com/goto/privacy-policy/
Title: Cookiebot

Search URL Search Domain Scan URL

URL: https://www.parse.ly/privacy-policy/
Title: Parse.ly

Search URL Search Domain Scan URL

URL: https://www.beeswax.com/cookies/
Title: Beeswax

Search URL Search Domain Scan URL

URL: https://crimtan.com/privacy/
Title: Crimtan

Search URL Search Domain Scan URL

URL: https://www.dailymail.co.uk/home/article-7759273/Privacy-Cookies-Policy-Policy.html
Title: Dailymail.co.uk

Search URL Search Domain Scan URL

URL: https://www.sumologic.com/privacy-statement/
Title: Sumo Logic

Search URL Search Domain Scan URL

URL: http://script.dotmetrics.net/Privacy/PrivacyCenter.html
Title: Dotmetrics

Search URL Search Domain Scan URL

URL: https://www.id5.io/privacy
Title: ID5

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/legal/privacy-policy
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.sportradar.com/about-us/privacy/
Title: Sportradar

Search URL Search Domain Scan URL

URL: https://www.admedo.com/privacy-policy
Title: Admedo

Search URL Search Domain Scan URL

URL: https://www.bidswitch.com/privacy-policy/
Title: Bidswitch

Search URL Search Domain Scan URL

URL: https://www.internedservices.nl/disclaimer-privacy-policy/
Title: KPN

Search URL Search Domain Scan URL

URL: https://zeotap.com/website-privacy-policy
Title: Zeotap

Search URL Search Domain Scan URL

URL: https://www.outbrain.com/legal/privacy#privacy-policy
Title: Outbrain

Search URL Search Domain Scan URL

URL: https://automattic.com/privacy/
Title: WordPress.com

Search URL Search Domain Scan URL

URL: https://www.nativo.com/privacy-policy
Title: Nativo

Search URL Search Domain Scan URL

URL: https://rubiconproject.com/privacy-policy/
Title: Rubicon Project

Search URL Search Domain Scan URL

URL: https://smartadserver.com/corporate-privacy-policy/
Title: Smart

Search URL Search Domain Scan URL

URL: https://www.amobee.com/trust/privacy-guidelines/
Title: Amobee

Search URL Search Domain Scan URL

URL: http://www.cognitiv.ai/privacy-policy/
Title: Cognitiv

Search URL Search Domain Scan URL

URL: https://betweenx.com/pdata.pdf
Title: Between Exchange

Search URL Search Domain Scan URL

URL: https://www.jwplayer.com/privacy/
Title: JW Player

Search URL Search Domain Scan URL

URL: https://www.appnexus.com/corporate-privacy-policy
Title: Appnexus

Search URL Search Domain Scan URL

URL: https://www.home.neustar/privacy
Title: Neustar

Search URL Search Domain Scan URL

URL: https://www.indexexchange.com/privacy/
Title: Index Exchange

Search URL Search Domain Scan URL

URL: http://www.casalemedia.com/
Title: Casale Media

Search URL Search Domain Scan URL

URL: https://www.media.net/privacy-policy
Title: Media.net

Search URL Search Domain Scan URL

URL: https://www.conversantmedia.com/legal/privacy
Title: Conversant

Search URL Search Domain Scan URL

URL: https://pubmatic.com/legal/privacy/
Title: PubMatic

Search URL Search Domain Scan URL

URL: https://www.quantcast.com/privacy/
Title: Quantcast

Search URL Search Domain Scan URL

URL: https://yandex.com/legal/privacy/
Title: Yandex

Search URL Search Domain Scan URL

URL: https://www.rhythmone.com/privacy-policy
Title: RhythmOne

Search URL Search Domain Scan URL

URL: https://unruly.co/privacy/
Title: Unruly

Search URL Search Domain Scan URL

URL: https://improvedigital.com/privacy-policy/
Title: Improve Digital

Search URL Search Domain Scan URL

URL: https://www.demandbase.com/privacy-policy/
Title: DemandBase

Search URL Search Domain Scan URL

URL: https://triplelift.com/privacy/
Title: Triplelift

Search URL Search Domain Scan URL

URL: https://www.magnite.com/legal/advertising-technology-privacy-policy/
Title: Telaria

Search URL Search Domain Scan URL

URL: https://www.vidoomy.com/privacypolicy-en.html
Title: Vidoomy

Search URL Search Domain Scan URL

URL: https://www.acuityads.com/privacy-policy/
Title: Acuity

Search URL Search Domain Scan URL

URL: https://www.oracle.com/legal/privacy/addthis-privacy-policy.html
Title: Oracle

Search URL Search Domain Scan URL

URL: https://site.adform.com/privacy-center/platform-privacy/opt-out/
Title: Adform

Search URL Search Domain Scan URL

URL: https://www.we-are-adot.com/privacy-policy/
Title: Adotmob

Search URL Search Domain Scan URL

URL: https://www.criteo.com/privacy/corporate-privacy-policy/
Title: Criteo

Search URL Search Domain Scan URL

URL: https://adgear.com/en/privacy/
Title: Adgear

Search URL Search Domain Scan URL

URL: https://www.adition.com/en/privacy/
Title: Adition Technologies

Search URL Search Domain Scan URL

URL: https://admanmedia.com/politica.html
Title: Adman Media

Search URL Search Domain Scan URL

URL: https://admixer.com/privacy_site/
Title: Admixer

Search URL Search Domain Scan URL

URL: https://www.rockerbox.com/privacy
Title: Rockerbox

Search URL Search Domain Scan URL

URL: https://www.innovid.com/privacy-policy/
Title: Innovid

Search URL Search Domain Scan URL

URL: https://www.mediamath.com/privacy-policy/
Title: MediMath

Search URL Search Domain Scan URL

URL: http://www.pixalate.com/privacypolicy/
Title: Pixalate

Search URL Search Domain Scan URL

URL: https://www.antvoice.com/en/privacypolicy/
Title: AntVoice

Search URL Search Domain Scan URL

URL: https://travelaudience.com/website-privacy-policy/
Title: Travel Audience

Search URL Search Domain Scan URL

URL: https://www.thetradedesk.com/general/website-privacy-policy
Title: The Trade Desk

Search URL Search Domain Scan URL

URL: https://www.adswizz.com/our-privacy-policy/
Title: Adswizz

Search URL Search Domain Scan URL

URL: https://policies.oath.com/us/en/oath/privacy/index.html
Title: Oath.

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&nodeId=468496
Title: Amazon

Search URL Search Domain Scan URL

URL: https://www.wideorbit.com/privacy/
Title: Wideorbit

Search URL Search Domain Scan URL

URL: http://www.scorecardresearch.com/privacy.aspx?newlanguage=1
Title: ScorecardResearch

Search URL Search Domain Scan URL

URL: https://www.freewheel.com/privacy-policy
Title: Freewheel

Search URL Search Domain Scan URL

URL: https://www.tiktok.com/legal/privacy-policy?lang=en
Title: Tiktok

Search URL Search Domain Scan URL

URL: https://liveintent.com/privacy-policy/
Title: Liveintent

Search URL Search Domain Scan URL

URL: http://beachfrontmedia.com/privacy-policy/
Title: Beachfront

Search URL Search Domain Scan URL

URL: https://www.bidtheatre.com/privacy-policy
Title: Bidtheatre

Search URL Search Domain Scan URL

URL: http://www.blis.com/privacy/
Title: Blismedia.com

Search URL Search Domain Scan URL

URL: http://www.oracle.com/us/legal/privacy/
Title: Bluekai.com

Search URL Search Domain Scan URL

URL: http://brand-display.com/
Title: Brand-display.com

Search URL Search Domain Scan URL

URL: https://www.appier.com/privacy-policy/
Title: Appier

Search URL Search Domain Scan URL

URL: https://www.geniussports.com/privacy-policy/
Title: Genius Sports

Search URL Search Domain Scan URL

URL: https://pulsepoint.com/legal/platform-privacy-policy
Title: Pulsepoint

Search URL Search Domain Scan URL

URL: https://www.adroll.com/about/privacy
Title: Adroll

Search URL Search Domain Scan URL

URL: https://www.deltaprojects.com/privacy-policy/
Title: Delta Projects

Search URL Search Domain Scan URL

URL: https://www.adobe.com/uk/privacy.html
Title: Adobe

Search URL Search Domain Scan URL

URL: https://www.eqworks.com/privacy-policy/
Title: E Works

Search URL Search Domain Scan URL

URL: https://www.adobe.com/privacy.html
Title: Adobe Inc.

Search URL Search Domain Scan URL

URL: https://www.nielsen.com/us/en/legal/privacy-statement/
Title: The Nielsen Company

Search URL Search Domain Scan URL

URL: http://www.zypmedia.com/privacy-policy
Title: Zypmedia

Search URL Search Domain Scan URL

URL: https://fifty.io/privacy-policy.php
Title: Fifty

Search URL Search Domain Scan URL

URL: http://freewheel.tv/privacy-policy/
Title: Freewheel

Search URL Search Domain Scan URL

URL: https://help.instagram.com/519522125107875
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.adelphic.com/privacy-policy/
Title: Adelphic

Search URL Search Domain Scan URL

URL: https://www.salesforce.com/eu/company/privacy/
Title: Salesforce

Search URL Search Domain Scan URL

URL: https://www.sovrn.com/legal/privacy-policy/
Title: Sovrn

Search URL Search Domain Scan URL

URL: https://www.melia.com/en/privacy.htm
Title: Meliá

Search URL Search Domain Scan URL

URL: https://www.oracle.com/legal/privacy/services-privacy-policy.html
Title: Moat Analytics

Search URL Search Domain Scan URL

URL: https://www.xaxis.com/privacy-notice/
Title: Xaxis

Search URL Search Domain Scan URL

URL: https://narrative.io/privacy/
Title: Narrative I/O

Search URL Search Domain Scan URL

URL: https://privacy.nrich.ai/privacy-notice
Title: N.Rich

Search URL Search Domain Scan URL

URL: https://www.openx.com/legal/privacy-policy/
Title: Openx

Search URL Search Domain Scan URL

URL: http://datonics.com/website-privacy-policy/
Title: Datonics

Search URL Search Domain Scan URL

URL: https://pubmatic.com/legal/privacy-policy/
Title: Pubmatic

Search URL Search Domain Scan URL

URL: https://zetaglobal.com/privacy-policy/
Title: Zeta Global

Search URL Search Domain Scan URL

URL: https://liveramp.com/privacy/
Title: LiveRamp

Search URL Search Domain Scan URL

URL: https://pomoc.nazwa.pl/pomoc/konfiguracja/polityka-prywatnosci/
Title: Nazwa.pl

Search URL Search Domain Scan URL

URL: https://www.semasio.com/privacy
Title: Semasio

Search URL Search Domain Scan URL

URL: https://www.sizmek.com/privacy-policy/optedout/
Title: Sizmek

Search URL Search Domain Scan URL

URL: https://simpli.fi/site-privacy-policy/
Title: Simpli.fi

Search URL Search Domain Scan URL

URL: https://www.simpli.fi/site-privacy-policy2/
Title: Simpli.fi

Search URL Search Domain Scan URL

URL: http://smadex.com/index.html@p=3888.html
Title: Smadex

Search URL Search Domain Scan URL

URL: https://supership.jp/
Title: Supership

Search URL Search Domain Scan URL

URL: https://www.taptapnetworks.com/privacy_policy/
Title: TapTap

Search URL Search Domain Scan URL

URL: https://sonobi.com/privacy-policy/
Title: Sonobi

Search URL Search Domain Scan URL

URL: https://www.spotx.tv/privacy-policy/
Title: SpotX

Search URL Search Domain Scan URL

URL: https://www.stackadapt.com/privacy
Title: StackAdapt

Search URL Search Domain Scan URL

URL: https://www.tapad.com/privacy
Title: Tapad

Search URL Search Domain Scan URL

URL: http://tidaltv.com/
Title: Tidal

Search URL Search Domain Scan URL

URL: http://exponential.com/privacy/
Title: Exponential

Search URL Search Domain Scan URL

URL: https://twitter.com/en/privacy
Title: Twitter Inc.

Search URL Search Domain Scan URL

URL: https://www.dataxu.com/about-us/privacy/
Title: Dataxu

Search URL Search Domain Scan URL

URL: https://weborama.com/respect-de-la-vie-privee-2-2/
Title: Weborama

Search URL Search Domain Scan URL

URL: https://policies.yahoo.com/us/en/yahoo/privacy/index.htm
Title: Yahoo

Search URL Search Domain Scan URL

URL: http://yieldmo.com/privacy/
Title: Yieldmo

Search URL Search Domain Scan URL

URL: http://www.zemanta.com/legal#privacy-policy
Title: Zemanta

Search URL Search Domain Scan URL

URL: https://www.trustarc.com/privacy-policy/
Title: TrustArc

Search URL Search Domain Scan URL

URL: https://iprom.eu/cookies/
Title: Iprom

Search URL Search Domain Scan URL

URL: https://www.tritondigital.com/privacy-policy
Title: Triton

Search URL Search Domain Scan URL

URL: https://www.cookiebot.com/
Title: Cookiebot

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=If%20You%20Get%20a%20Call%20From%20These%20Numbers%2C%20%22Don%27t%20Believe%20Your%20Caller%20ID%2C%22%20FBI%20Says%20in%20New%20Warning&url=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/pin/create/button/?url=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&description=In%20the%20wake%20of%20Hurricane%20Ian%2C%20the%20FBI%20is%20warning%20the%20public%20to%20be%20wary%20of%20charity%20fraud%2C%20which%20increases%20after%20natural%20disasters.&media=https%3A%2F%2Fbestlifeonline.com%2Fwp-content%2Fuploads%2Fsites%2F3%2F2022%2F10%2Fshutterstock_1817766644.jpg%3Fquality%3D82%26strip%3Dall

Search URL Search Domain Scan URL

URL: https://www.washingtonpost.com/climate-environment/2022/10/04/hurricane-ian-statistics-deaths-winds-surge/
Title: ravaged the East Coast

Search URL Search Domain Scan URL

URL: https://www.fbi.gov/contact-us/field-offices/omaha/news/press-releases/charity-fraud-warning
Title: especially prevalent

Search URL Search Domain Scan URL

URL: https://www.fbi.gov/how-we-can-help-you/safety-resources/scams-and-safety/common-scams-and-crimes/charity-and-disaster-fraud
Title: issued a warning

Search URL Search Domain Scan URL

URL: https://www.facebook.com/BestLifeOnline
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/bestlifeonline
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.instagram.com/bestlifeonline/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/bestlifeonline/
Title: LinkedIn

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bestlifeonline.com/charity-fraud-news/ HTTP 301
https://bestlifeonline.com/charity-fraud-news/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 29

https://rp.liadm.com/j?dtstmp=1671138395728&aid=a-01ao&se=e30&duid=2baacde7071f--01gmbsrhey3f3n943dt525t6ry&tna=v2.5.1&pu=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&wpn=lc-bundle&c=PHRpdGxlPklmIFlvdSBHZXQgYSBDYWxsIEZyb20gVGhlc2UgTnVtYmVycywgIkRvbid0IEJlbGlldmUgWW91ciBDYWxsZXIgSUQsIiBGQkkgU2F5czwvdGl0bGU-PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IkluIHRoZSB3YWtlIG9mIEh1cnJpY2FuZSBJYW4sIHRoZSBGQkkgaXMgd2FybmluZyB0aGUgcHVibGljIHRvIGJlIHdhcnkgb2YgY2hhcml0eSBmcmF1ZCwgd2hpY2ggaW5jcmVhc2VzIGFmdGVyIG5hdHVyYWwgZGlzYXN0ZXJzLiI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vYmVzdGxpZmVvbmxpbmUuY29tL2NoYXJpdHktZnJhdWQtbmV3cy8iPjxoMSBjbGFzcz0icG9zdC10aXRsZSBjZW50ZXItYmxvY2siPklmIFlvdSBHZXQgYSBDYWxsIEZyb20gVGhlc2UgTnVtYmVycywgIkRvbid0IEJlbGlldmUgWW91ciBDYWxsZXIgSUQsIiBGQkkgU2F5cyBpbiBOZXcgV2FybmluZzwvaDE- HTTP 302
https://rp4.liadm.com/j?dtstmp=1671138395728&aid=a-01ao&se=e30&duid=2baacde7071f--01gmbsrhey3f3n943dt525t6ry&tna=v2.5.1&pu=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&wpn=lc-bundle&c=PHRpdGxlPklmIFlvdSBHZXQgYSBDYWxsIEZyb20gVGhlc2UgTnVtYmVycywgIkRvbid0IEJlbGlldmUgWW91ciBDYWxsZXIgSUQsIiBGQkkgU2F5czwvdGl0bGU-PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IkluIHRoZSB3YWtlIG9mIEh1cnJpY2FuZSBJYW4sIHRoZSBGQkkgaXMgd2FybmluZyB0aGUgcHVibGljIHRvIGJlIHdhcnkgb2YgY2hhcml0eSBmcmF1ZCwgd2hpY2ggaW5jcmVhc2VzIGFmdGVyIG5hdHVyYWwgZGlzYXN0ZXJzLiI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vYmVzdGxpZmVvbmxpbmUuY29tL2NoYXJpdHktZnJhdWQtbmV3cy8iPjxoMSBjbGFzcz0icG9zdC10aXRsZSBjZW50ZXItYmxvY2siPklmIFlvdSBHZXQgYSBDYWxsIEZyb20gVGhlc2UgTnVtYmVycywgIkRvbid0IEJlbGlldmUgWW91ciBDYWxsZXIgSUQsIiBGQkkgU2F5cyBpbiBOZXcgV2FybmluZzwvaDE-&i6=MmEwMDpjOTg6MjA1MDphMDA3OjI6OjEy&n3pc=true

Request Chain 96

https://e.dlx.addthis.com/e/a-3491/s-7601.xgi?ret=img&na_em=04e8f8825e07702d99acb9e453c592e1 HTTP 302
https://e.dlx.addthis.com/e/a-3491/s-7601.xgi?ret=img&na_em=04e8f8825e07702d99acb9e453c592e1&rd=Y HTTP 302
https://stags.bluekai.com/site/1407?partner=1&uhint=na_id=2022121521063800010532155224&redir=https%3A%2F%2Fx.dlx.addthis.com%2Fe%2Fbk_sync.xgi%3Fna_exid%3D%24_BK_UUID

Request Chain 97

https://sync.mathtag.com/sync/img?mt_exid=36&redir=https%3A%2F%2Fi.liadm.com%2Fs%2Fe%2Fa-01ao%2F0%2Fd177eb7fe50646c19b424e7962adadad%3Fmpid%3D7156%26muid%3D%5BMM_UUID%5D&4ba72a6d-0b6c-4b39-b0f3-c00c220ace13 HTTP 302
https://i.liadm.com/s/e/a-01ao/0/d177eb7fe50646c19b424e7962adadad?mpid=7156&muid=75bc639b-8c5d-4a00-bf20-6e274124519d

Request Chain 99

https://x.bidswitch.net/syncd?dsp_id=256&user_group=2&user_id=4ba72a6d-0b6c-4b39-b0f3-c00c220ace13&redir=%2F%2Fi.liadm.com%2Fs%2F52176%3Fbidder_id%3D5298%26bidder_uuid%3D%24%7BBSW_UID%7D HTTP 302
https://x.bidswitch.net/ul_cb/syncd?dsp_id=256&user_group=2&user_id=4ba72a6d-0b6c-4b39-b0f3-c00c220ace13&redir=%2F%2Fi.liadm.com%2Fs%2F52176%3Fbidder_id%3D5298%26bidder_uuid%3D%24%7BBSW_UID%7D HTTP 302
https://i.liadm.com/s/52176?bidder_id=5298&bidder_uuid=daa7bc4e-2fb8-4dbf-90f4-cc700820cf43 HTTP 303
https://x.bidswitch.net/sync?ssp=liveintent&user_id=4ba72a6d-0b6c-4b39-b0f3-c00c220ace13 HTTP 302
https://pr-bh.ybp.yahoo.com/sync/iponweb?bidswitch_ssp_id=liveintent&ssp_user_id=daa7bc4e-2fb8-4dbf-90f4-cc700820cf43&gdpr=&gdpr_consent= HTTP 302
https://x.bidswitch.net/sync?dsp_id=74&&user_id=y-PkrGdvJE2pmQHb4gpzVW8NCke71SyPgZsCL3_w--~A&expires=5 HTTP 302
https://yield-op-idsync.live.streamtheworld.com/pixel.gif?partner=bsw&uid=daa7bc4e-2fb8-4dbf-90f4-cc700820cf43&stn=

Request Chain 132

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBV6IqGq8g3WRcY9UX9K4EY&google_cver=1

Request Chain 133

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y5uMXX6E30vfq7BYGADl9wAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBV6IqGq8g3WRcY9UX9K4EY&google_cver=1

Request Chain 134

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEFJkftiI9UahWKxpJ11mGjo&google_cver=1

Request Chain 135

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg0MjI1MjE2NjIxNDkyMzU3Mg%3D%3D

Request Chain 139

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 140

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 169

https://x.bidswitch.net/sync?ssp=themediagrid HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch&ttd_tpi=1&ttd_puid=themediagrid&gdpr=&gdpr_consent=

Request Chain 171

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y5uMXX6E30vfq7BYGADl9wAADHgAAAIB HTTP 302
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y5uMXX6E30vfq7BYGADl9wAADHgAAAIB&dcc=t

Request Chain 172

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Y5uMXX6E30vfq7BYGADl9wAADHgAAAIB&gdpr_consent=&us_privacy=&gdpr= HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGDYr-REVgquEpAeMi_B29A&google_cver=1

Request Chain 174

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2842252166214923572

Request Chain 175

https://euexchangesync.digitaleast.mobi/usersync/index.gif?us_privacy=&gdpr=&gdpr_consent= HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=11&external_user_id=25642f6c-d399-4f75-8706-f1b61e6ed1fe

Request Chain 177

https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID HTTP 302
https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2842252166214923572

Request Chain 184

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:75bc639b-8c5d-4a00-bf20-6e274124519d&gdpr=0&gdpr_consent=

Request Chain 185

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=uy8inrGWQOSLQ1atpuauJg%3D%3D&gdpr=0&gdpr_consent= HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

Request Chain 188

https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent=&bounce=1&random=96204442 HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fidsync.frontend.weborama.fr%2Fids%3Fkey%3Dpubmatic%26value%3D%23PM_USER_ID&gdpr=0 HTTP 302
https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=BB2F229E-B196-40E4-8B43-56ADA6E6AE26

Request Chain 189

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QkIyRjIyOUUtQjE5Ni00MEU0LThCNDMtNTZBREE2RTZBRTI2&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 190

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEAiJ8N-wMM7jY70L4_BPXao&google_cver=1

Request Chain 192

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=7457261831399399941

188 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
bestlifeonline.com/charity-fraud-news/
Redirect Chain

http://bestlifeonline.com/charity-fraud-news/
https://bestlifeonline.com/charity-fraud-news/

132 KB
27 KB

628ms
603ms

Document
text/html

2606:4700:10::ac43:d42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:d42 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / WordPress VIP <https://wpvip.com>
Resource Hash: 13dadcc4b17d8faab90a508289241a4cf53c687ecbf36b44a1a494285b0650db

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=14400, must-revalidate
cf-apo-via: origin,miss
cf-cache-status: MISS
cf-edge-cache: cache,platform=wordpress
cf-ray: 77a224d4bac9bb74-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 15 Dec 2022 21:06:34 GMT
host-header: a9130478a60e5f9135f765b23f26593b
last-modified: Thu, 15 Dec 2022 21:06:34 GMT
link: <https://bestlifeonline.com/wp-json/>; rel="https://api.w.org/", <https://bestlifeonline.com/wp-json/wp/v2/posts/395871>; rel="alternate"; type="application/json", <https://bestlifeonline.com/?p=395871>; rel=shortlink
server: cloudflare
vary: Accept-Encoding
x-cache: miss
x-hacker: If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by: WordPress VIP <https://wpvip.com>
x-rq: hhn1 0 4 9980

Redirect headers

CF-Cache-Status: MISS
CF-Ray: 77a224d40cf09a2a-FRA
Cache-Control: max-age=14400
Connection: keep-alive
Content-Type: text/html
Date: Thu, 15 Dec 2022 21:06:34 GMT
Location: https://bestlifeonline.com/charity-fraud-news/
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
cf-apo-via: origin,resnok

GET
H2 200 shutterstock_1817766644.jpg
bestlifeonline.com/wp-content/uploads/sites/3/2022/10/ 20 KB
20 KB 69ms
65ms Image
image/webp 2606:4700:10::ac43:d42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bestlifeonline.com/wp-content/uploads/sites/3/2022/10/shutterstock_1817766644.jpg?quality=82&strip=1&resize=640%2C360
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:d42 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8a2f3c10a38d0ab4c01e9336bf0d3a25186007f84fb45f350af144e2a154f05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/charity-fraud-news/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
x-rq: hhn1 109 144 443
cf-cache-status: DYNAMIC
last-modified: Thu, 15 Dec 2022 03:16:59 GMT
server: cloudflare
etag: "f8ddc49e053359ef"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 77a224d89ababb74-FRA
content-length: 20198
expires: Fri, 15 Dec 2023 03:16:59 GMT

GET
H2 200 main-concat.css
bestlifeonline.com/wp-content/themes/bestlife/css/ 83 KB
16 KB 49ms
46ms Stylesheet
text/css 2606:4700:10::ac43:d42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bestlifeonline.com/wp-content/themes/bestlife/css/main-concat.css?ver=1670957010
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:d42 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1918118b0b9fffc0d63f9171303fff526faed55977a9bda890135f263253a663

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/charity-fraud-news/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 181258
x-cache: hit
content-length: 16059
x-rq: ams7 0 4 9980
last-modified: Tue, 13 Dec 2022 18:43:30 GMT
server: cloudflare
etag: W/"6398c7d2-14be2"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 77a224d89abdbb74-FRA
expires: Wed, 13 Dec 2023 18:45:37 GMT

GET
H2 200 roboto-condensed-v19-latin-regular.woff2
bestlifeonline.com/wp-content/themes/bestlife/fonts/ 15 KB
15 KB 37ms
34ms Font
font/woff2 2606:4700:10::ac43:d42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bestlifeonline.com/wp-content/themes/bestlife/fonts/roboto-condensed-v19-latin-regular.woff2
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:d42 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 53b907326f7c21a04f6d39cc32ff471aafec57d887feabfabb53394f378c659f

Request headers

Referer: https://bestlifeonline.com/charity-fraud-news/
Origin: https://bestlifeonline.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:34 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3033239
x-cache: hit
content-length: 15743
x-rq: hhn1 0 4 9980
last-modified: Tue, 08 Nov 2022 16:02:26 GMT
server: cloudflare
etag: W/"636a7d92-3d68"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 77a224d89ac3bb74-FRA
expires: Fri, 10 Nov 2023 18:32:35 GMT

GET
H2 200 roboto-v20-latin-700.woff2
bestlifeonline.com/wp-content/themes/bestlife/fonts/ 15 KB
16 KB 30ms
27ms Font
font/woff2 2606:4700:10::ac43:d42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bestlifeonline.com/wp-content/themes/bestlife/fonts/roboto-v20-latin-700.woff2
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:d42 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b4d07892cde715d50bb69c1982df496385d1dfd8f9d1867c31f19a3c8634cfae

Request headers

Referer: https://bestlifeonline.com/charity-fraud-news/
Origin: https://bestlifeonline.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:34 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3033239
x-cache: hit
content-length: 15839
x-rq: ams7 0 4 9980
last-modified: Tue, 08 Nov 2022 16:02:26 GMT
server: cloudflare
etag: W/"636a7d92-3dc8"
vary: X-Mobile-Class, Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 77a224d89ac4bb74-FRA
expires: Fri, 10 Nov 2023 18:32:35 GMT

GET
H2 200 classic-themes.min.css
bestlifeonline.com/wp-includes/css/ 217 B
289 B 42ms
39ms Stylesheet
text/css 2606:4700:10::ac43:d42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bestlifeonline.com/wp-includes/css/classic-themes.min.css?ver=1
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:d42 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/charity-fraud-news/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
x-rq: hhn1 0 4 9980
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 02 Nov 2022 01:44:18 GMT
server: cloudflare
age: 3033240
etag: W/"6361cb72-d9"
vary: Accept-Encoding
x-cache: hit
content-type: text/css
cache-control: max-age=31536000
cf-ray: 77a224d89abfbb74-FRA
expires: Fri, 10 Nov 2023 18:32:35 GMT

GET
H2 200 jetpack.css
bestlifeonline.com/wp-content/mu-plugins/jetpack-11.6/css/ 84 KB
16 KB 36ms
35ms Stylesheet
text/css 2606:4700:10::ac43:d42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bestlifeonline.com/wp-content/mu-plugins/jetpack-11.6/css/jetpack.css?ver=11.6
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:d42 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ce7613bb07f30b4dd77f51b62fcbd70bc15439a24b696ca06a694c2c8544ce6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/charity-fraud-news/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 609713
x-cache: hit
content-length: 16596
x-rq: hhn1 0 4 9980
last-modified: Thu, 08 Dec 2022 19:15:45 GMT
server: cloudflare
etag: W/"639237e1-1519b"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 77a224d89ac1bb74-FRA
expires: Fri, 08 Dec 2023 19:44:41 GMT

GET
H2 200 email-decode.min.js Show response
bestlifeonline.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
847 B 9ms
8ms Script
application/javascript 2606:4700:10::ac43:d42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bestlifeonline.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:d42 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/charity-fraud-news/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 12 Dec 2022 12:08:17 GMT
server: cloudflare
etag: W/"639719b1-4d7"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 77a224d8db48bb74-FRA
expires: Sat, 17 Dec 2022 21:06:35 GMT

GET
H2 200 regenerator-runtime.min.js Show response
bestlifeonline.com/wp-includes/js/dist/vendor/ 6 KB
3 KB 35ms
34ms Script
application/javascript 2606:4700:10::ac43:d42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bestlifeonline.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:d42 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f30769ea0b80a5d900c5f0de30b1aad1ab461195e69223d5ef63c2c5de8b6c1a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/charity-fraud-news/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3033239
x-cache: hit
content-length: 2457
x-rq: hhn1 0 4 9980
last-modified: Tue, 18 Oct 2022 13:30:39 GMT
server: cloudflare
etag: W/"634eaa7f-194b"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 77a224d8eb5bbb74-FRA
expires: Fri, 10 Nov 2023 18:32:36 GMT

GET
H2 200 wp-polyfill.min.js Show response
bestlifeonline.com/wp-includes/js/dist/vendor/ 17 KB
6 KB 36ms
35ms Script
application/javascript 2606:4700:10::ac43:d42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bestlifeonline.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:d42 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c1fef6e6b4f9832603850b9b6562e74d9a6a3700ba836efe88facc577121e8b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/charity-fraud-news/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3033239
x-cache: hit
content-length: 6532
x-rq: ams7 0 4 9980
last-modified: Wed, 02 Nov 2022 01:44:19 GMT
server: cloudflare
etag: W/"6361cb73-459f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 77a224d8eb5dbb74-FRA
expires: Fri, 10 Nov 2023 18:32:36 GMT

GET
H2 200 hooks.min.js Show response
bestlifeonline.com/wp-includes/js/dist/ 5 KB
2 KB 37ms
36ms Script
application/javascript 2606:4700:10::ac43:d42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bestlifeonline.com/wp-includes/js/dist/hooks.min.js?ver=4169d3cf8e8d95a3d6d5
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:d42 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9bd82960d99b3a76f4af77a88a346bd61f87bac5ff2f385ee28cd669d8f22134

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/charity-fraud-news/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3033240
x-cache: hit
content-length: 1661
x-rq: hhn1 0 4 9980
last-modified: Tue, 01 Nov 2022 19:35:11 GMT
server: cloudflare
etag: W/"636174ef-132e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 77a224d8eb5ebb74-FRA
expires: Fri, 10 Nov 2023 18:32:35 GMT

GET
H2 200 loader.js Show response
bestlifeonline.com/wp-content/plugins/wp-parsely/build/ 2 KB
1 KB 17ms
16ms Script
application/javascript 2606:4700:10::ac43:d42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bestlifeonline.com/wp-content/plugins/wp-parsely/build/loader.js?ver=eba15df5f79bd7d0de45
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:d42 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f832a3f9fb50dfb245accbfe1f55d83f4330332a2a1b1640888d253398b95bb9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/charity-fraud-news/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3033239
x-cache: hit
content-length: 1024
x-rq: ams7 0 4 9980
last-modified: Thu, 27 Oct 2022 19:23:36 GMT
server: cloudflare
etag: W/"635adab8-9c2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 77a224d8eb60bb74-FRA
expires: Fri, 10 Nov 2023 18:32:36 GMT

GET
H2 200 p.js Show response
cdn.parsely.com/keys/bestlifeonline.com/ 56 KB
21 KB 83ms
10ms Script
application/javascript 13.226.155.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.parsely.com/keys/bestlifeonline.com/p.js?ver=3.5.2
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.155.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-71.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 82fc7415ed2df389cb26bd29f6f73e4fb63677f3cc5f0b35a1a1ded5da17b5e0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: public
date: Thu, 15 Dec 2022 01:21:46 GMT
content-encoding: gzip
via: 1.1 58dd513f0a53b3e6851a071cb857a706.cloudfront.net (CloudFront)
last-modified: Wed, 24 Feb 2021 16:21:20 GMT
server: nginx
x-amz-cf-pop: DUS51-C1
age: 71089
etag: W/"60367d00-e166"
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400, public
x-amz-cf-id: FEDsQ2QBnU3h7bMhhNvQvM3msiVrsSlirniqeZSfpLjHe8pUOUPWOg==
expires: Fri, 16 Dec 2022 01:21:46 GMT

GET
H2 200 bundle.min.js Show response
bestlifeonline.com/wp-content/themes/bestlife/js/ 15 KB
6 KB 43ms
42ms Script
application/javascript 2606:4700:10::ac43:d42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bestlifeonline.com/wp-content/themes/bestlife/js/bundle.min.js?ver=1670957010
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:d42 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8436c7297967e0e046154bf4a7f2052169399e6c29089277906e6988bfb1d2d1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/charity-fraud-news/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 181258
x-cache: hit
content-length: 5946
x-rq: hhn1 0 4 9980
last-modified: Wed, 07 Dec 2022 16:57:12 GMT
server: cloudflare
etag: W/"6390c5e8-3cf3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 77a224d8eb62bb74-FRA
expires: Wed, 13 Dec 2023 18:45:37 GMT

GET
H2 200 e-202250.js Show response
stats.wp.com/ 9 KB
3 KB 28ms
6ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202250.js
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn
date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: br
server: nginx
etag: W/"62f6b688-3508"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Sun, 03 Dec 2023 23:57:16 GMT

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 95d4c35944949980c11b56c7abcd96d0632c3281a6ffd54bb236d501643558bc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fb5f765b9f99d9ea48a3777fa0d725ea4e402892d0195990764689a09bdd5d60

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dc2f03640c55d7361dc950b90f842e5e0f5d670d27bd10d750c6ba5dfea2e49d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 roboto-v20-latin-regular.woff2
bestlifeonline.com/wp-content/themes/bestlife/fonts/ 15 KB
16 KB 42ms
42ms Font
font/woff2 2606:4700:10::ac43:d42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bestlifeonline.com/wp-content/themes/bestlife/fonts/roboto-v20-latin-regular.woff2
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:d42 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3

Request headers

Referer: https://bestlifeonline.com/charity-fraud-news/
Origin: https://bestlifeonline.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3033239
x-cache: hit
content-length: 15759
x-rq: hhn1 0 4 9980
last-modified: Tue, 08 Nov 2022 16:02:26 GMT
server: cloudflare
etag: W/"636a7d92-3d78"
vary: X-Mobile-Class, Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 77a224d90b9bbb74-FRA
expires: Fri, 10 Nov 2023 18:32:36 GMT

GET
H2 200 roboto-v20-latin-300.woff2
bestlifeonline.com/wp-content/themes/bestlife/fonts/ 15 KB
16 KB 63ms
63ms Font
font/woff2 2606:4700:10::ac43:d42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bestlifeonline.com/wp-content/themes/bestlife/fonts/roboto-v20-latin-300.woff2
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:d42 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29f6da0a8c21c5681511bb9b08663d3fd2c5d09c9bd8054ec354c563b8c8b7c1

Request headers

Referer: https://bestlifeonline.com/charity-fraud-news/
Origin: https://bestlifeonline.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3032696
x-cache: hit
content-length: 15807
x-rq: ams7 0 4 9980
last-modified: Tue, 08 Nov 2022 16:02:26 GMT
server: cloudflare
etag: W/"636a7d92-3da8"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 77a224d90b9dbb74-FRA
expires: Fri, 10 Nov 2023 18:41:39 GMT

GET
H2 200 profile Show response
api.parsely.com/v2/ 264 B
370 B 315ms
108ms Fetch
application/json 54.236.68.181
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.parsely.com/v2/profile?apikey=bestlifeonline.com&uuid=pid%3D7bbe17d7f09bdaf8ccc3d51b596dcbe0&url=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/wp-content/plugins/wp-parsely/build/loader.js?ver=eba15df5f79bd7d0de45
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.236.68.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-236-68-181.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 28366b713c6c9430920cda17941e0986072ab055b66f7565851ab7062080e119

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 15 Dec 2022 21:06:35 GMT
server: nginx
content-length: 264
content-type: application/json

GET
H/1.1 200
OK /
p1.parsely.com/plogger/ 43 B
259 B 188ms
31ms Image
image/gif 54.155.18.159
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p1.parsely.com/plogger/?rand=1671138395121&plid=72651031&idsite=bestlifeonline.com&url=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&sref=&sts=1671138395118&slts=0&title=If+You+Get+a+Call+From+These+Numbers%2C+%22Don%27t+Believe+Your+Caller+ID%2C%22+FBI+Says&date=Thu+Dec+15+2022+21%3A06%3A35+GMT%2B0000+(GMT)&action=pageview&pvid=61625141&u=pid%3D7bbe17d7f09bdaf8ccc3d51b596dcbe0
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.155.18.159 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-155-18-159.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Thu, 15 Dec 2022 21:06:35 GMT
Cache-Control: no-cache
Last-Modified: Thursday, 15-Dec-2022 21:06:35 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
93 B 12ms
6ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=148740148&post=395871&tz=-5&srv=bestlifeonline.com&hp=vip&j=1%3A11.6&host=bestlifeonline.com&ref=&fcp=854&rand=0.3458639072955383
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 15 Dec 2022 21:06:35 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 75e743ccbfbef037470a05344433b941
secure.gravatar.com/avatar/ 146 B
414 B 87ms
6ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/75e743ccbfbef037470a05344433b941?s=96&d=blank&r=g
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 9891443922f3308f109272f30ac5e06397f084add2d14f4373fa718ceeb7c834

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 15 Dec 2022 21:06:35 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="75e743ccbfbef037470a05344433b941.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/75e743ccbfbef037470a05344433b941?s=96&d=blank&r=g>; rel="canonical"
content-length: 146
expires: Thu, 15 Dec 2022 21:11:35 GMT

GET
H2 200 shutterstock_2043933152.jpg
bestlifeonline.com/wp-content/uploads/sites/3/2022/12/ 4 KB
4 KB 25ms
24ms Image
image/webp 2606:4700:10::ac43:d42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bestlifeonline.com/wp-content/uploads/sites/3/2022/12/shutterstock_2043933152.jpg?resize=183,133&quality=82&strip=all
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:d42 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e184bf63ffa0a8b8d3a35a4d4ebb5ca024adaa700dae6547f11b5277b141a642

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/charity-fraud-news/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
x-rq: hhn1 109 195 443
cf-cache-status: DYNAMIC
last-modified: Thu, 15 Dec 2022 19:49:23 GMT
server: cloudflare
etag: "d29db4a62adc77ca"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 77a224da7e6dbb74-FRA
content-length: 4124
expires: Fri, 15 Dec 2023 19:49:23 GMT

GET
H2 200 a-01ao.min.js Show response
b-code.liadm.com/ 30 KB
11 KB 89ms
11ms Script
application/javascript 2600:9000:224a:7c00:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-01ao.min.js
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:7c00:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 59cb97a4e767151488e2ad56cddaa76f81ce07285d80a81be954314fd5285017

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 07:47:42 GMT
content-encoding: gzip
via: 1.1 acf8dc23ea92f292049638fbd5d718e2.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P1
age: 47933
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: "public, max-age=86400"
x-amz-cf-id: yVyVHIc1BSJl_Ly2xdg4RZ8UkJxVCFdeFED_N2OnnCeBCLujhh5B6g==

GET
H2 200 karma_revshare.bestlifeonline.com.js Show response
karma.mdpcdn.com/service/js-min/ 348 KB
109 KB 221ms
18ms Script
application/javascript 2600:9000:224a:e800:d:2820:3bc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:e800:d:2820:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: eff473cf679cd4f89c61f0f0889fc582be4fb30f9d980bb15ae2abe731ebfaaa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-amz-version-id: TtCe2.sie8eRr8UYM1xTFW4ffcunEOWd
content-encoding: gzip
via: 1.1 09211df9a08903bbbc04e39ab4e6f300.cloudfront.net (CloudFront)
date: Thu, 15 Dec 2022 21:06:35 GMT
last-modified: Mon, 01 Aug 2022 19:56:50 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P1
age: 201
etag: W/"218ae923f4c8e0d436af6b9cbdff5593"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=300
x-amz-cf-id: 0Rtgd6ouf8N1F5MciUT5AZnzpl3ZP9uoFPLjo_ezbgegm0hj_b6L3Q==

GET
H2 200 sync-container.js Show response
b-code.liadm.com/ 6 KB
6 KB 10ms
10ms Script
application/javascript 2600:9000:224a:7c00:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/sync-container.js
Requested by: Host: b-code.liadm.com
URL: https://b-code.liadm.com/a-01ao.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:7c00:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 58a07739b05fec4d319e4d5c6b1fa4ac79e2a625e08ab3f303929b77fde5bdf4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 09:51:30 GMT
x-amz-version-id: WIo1DFPCLgnYZuB8yv1dFIDWe1bYBj2G
via: 1.1 acf8dc23ea92f292049638fbd5d718e2.cloudfront.net (CloudFront)
last-modified: Tue, 10 May 2022 11:48:07 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P1
age: 1768506
etag: "ae5e94de938b0387eda6df8f20da811a"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 5904
x-amz-cf-id: AglpBTFY1i06FQGZHDY6wLmZ90WhRTs4z-HmhGsIkV0q5maCT4l74g==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 107ms
28ms Script
text/javascript 2a00:1450:400d:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 15 Dec 2022 20:27:24 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 2351
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Thu, 15 Dec 2022 22:27:24 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 213 KB
75 KB 130ms
51ms Script
application/javascript 2a00:1450:400d:803::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-NYD0HKHMHR

Requested by

Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:803::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f8f46a25b87be0a002b40f3ba60a28c580f75e3d8f625ffcc66c74d3b7ba6028

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 76262
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 15 Dec 2022 21:06:35 GMT

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1671138395728&aid=a-01ao&se=e30&duid=2baacde7071f--01gmbsrhey3f3n943dt525t6ry&tna=v2.5.1&pu=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&wpn=lc-bundle&c=PH...
https://rp4.liadm.com/j?dtstmp=1671138395728&aid=a-01ao&se=e30&duid=2baacde7071f--01gmbsrhey3f3n943dt525t6ry&tna=v2.5.1&pu=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&wpn=lc-bundle&c=P...

13 B
550 B

372ms
101ms

XHR
application/json

54.146.241.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rp4.liadm.com/j?dtstmp=1671138395728&aid=a-01ao&se=e30&duid=2baacde7071f--01gmbsrhey3f3n943dt525t6ry&tna=v2.5.1&pu=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&wpn=lc-bundle&c=PHRpdGxlPklmIFlvdSBHZXQgYSBDYWxsIEZyb20gVGhlc2UgTnVtYmVycywgIkRvbid0IEJlbGlldmUgWW91ciBDYWxsZXIgSUQsIiBGQkkgU2F5czwvdGl0bGU-PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IkluIHRoZSB3YWtlIG9mIEh1cnJpY2FuZSBJYW4sIHRoZSBGQkkgaXMgd2FybmluZyB0aGUgcHVibGljIHRvIGJlIHdhcnkgb2YgY2hhcml0eSBmcmF1ZCwgd2hpY2ggaW5jcmVhc2VzIGFmdGVyIG5hdHVyYWwgZGlzYXN0ZXJzLiI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vYmVzdGxpZmVvbmxpbmUuY29tL2NoYXJpdHktZnJhdWQtbmV3cy8iPjxoMSBjbGFzcz0icG9zdC10aXRsZSBjZW50ZXItYmxvY2siPklmIFlvdSBHZXQgYSBDYWxsIEZyb20gVGhlc2UgTnVtYmVycywgIkRvbid0IEJlbGlldmUgWW91ciBDYWxsZXIgSUQsIiBGQkkgU2F5cyBpbiBOZXcgV2FybmluZzwvaDE-&i6=MmEwMDpjOTg6MjA1MDphMDA3OjI6OjEy&n3pc=true

Protocol

Server

54.146.241.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-146-241-124.compute-1.amazonaws.com

Software

Resource Hash

efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:36 GMT
x-pixel-event-id: f36791da-8f5a-4f29-8a98-b4dceda77566
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
strict-transport-security: max-age=31536000; includeSubDomains
x-frame-options: DENY
vary: Origin
content-type: application/json
request-time: 0
access-control-allow-origin: null
access-control-allow-credentials: true
trace-id: 1cda0ad1640a0731
content-length: 13
x-xss-protection: 1; mode=block

Redirect headers

date: Thu, 15 Dec 2022 21:06:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-frame-options: DENY
vary: Origin
location: https://rp4.liadm.com/j?dtstmp=1671138395728&aid=a-01ao&se=e30&duid=2baacde7071f--01gmbsrhey3f3n943dt525t6ry&tna=v2.5.1&pu=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&wpn=lc-bundle&c=PHRpdGxlPklmIFlvdSBHZXQgYSBDYWxsIEZyb20gVGhlc2UgTnVtYmVycywgIkRvbid0IEJlbGlldmUgWW91ciBDYWxsZXIgSUQsIiBGQkkgU2F5czwvdGl0bGU-PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IkluIHRoZSB3YWtlIG9mIEh1cnJpY2FuZSBJYW4sIHRoZSBGQkkgaXMgd2FybmluZyB0aGUgcHVibGljIHRvIGJlIHdhcnkgb2YgY2hhcml0eSBmcmF1ZCwgd2hpY2ggaW5jcmVhc2VzIGFmdGVyIG5hdHVyYWwgZGlzYXN0ZXJzLiI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vYmVzdGxpZmVvbmxpbmUuY29tL2NoYXJpdHktZnJhdWQtbmV3cy8iPjxoMSBjbGFzcz0icG9zdC10aXRsZSBjZW50ZXItYmxvY2siPklmIFlvdSBHZXQgYSBDYWxsIEZyb20gVGhlc2UgTnVtYmVycywgIkRvbid0IEJlbGlldmUgWW91ciBDYWxsZXIgSUQsIiBGQkkgU2F5cyBpbiBOZXcgV2FybmluZzwvaDE-&i6=MmEwMDpjOTg6MjA1MDphMDA3OjI6OjEy&n3pc=true
access-control-allow-origin: https://bestlifeonline.com
request-time: 0
access-control-allow-credentials: true
trace-id: 9ca6c1b7582a8221
content-length: 0
x-xss-protection: 1; mode=block

GET
H2 200 lightbox_inline.js Show response
www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/ 2 KB
1 KB 115ms
40ms Script
application/javascript 2606:4700::6813:d383
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/lightbox_inline.js?mb=1671138395740
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:d383 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10559973b2df1031bb021dc84b6e06e835f639518dc6e47ecc07bcfa075c0ffe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: FBJEt5YGu86WgMIGAZuibA==
age: 120
cf-polished: origSize=2379
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Wed, 15 Jun 2022 07:45:19 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
x-ms-request-id: fdebd7a0-d01e-0066-1aac-c6aa6a000000
x-ms-version: 2009-09-19
cf-ray: 77a224dddfe85b4a-FRA

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 81 KB
28 KB 127ms
24ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: karma.mdpcdn.com
URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b5ef7861572324f3e9d49c9284d10e8e582e1bc44694394afdf5bdc0e6bd0cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27666
x-xss-protection: 0
server: sffe
etag: "1422 / 361 of 1000 / last-modified: 1670587582"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 15 Dec 2022 21:06:35 GMT

GET
H2 200 segments Show response
d30qdagvt44524.cloudfront.net/production/ 15 B
362 B 368ms
272ms Script
text/javascript 2600:9000:206e:ae00:19:bcbe:a700:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d30qdagvt44524.cloudfront.net/production/segments?muid=1c0b326f-9334-45dc-896d-c8762657f940
Requested by: Host: karma.mdpcdn.com
URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:ae00:19:bcbe:a700:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 727b3ff0c716fa8e38788e3dab83691b06edf37ca523b826f9ef67700021516b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:36 GMT
via: 1.1 89325178f4430fe7d65a260b33ed0234.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-C1
x-amzn-trace-id: Root=1-639b8c5b-1388dfa92fbf57337d04d613;Sampled=0
x-amzn-requestid: 21882f57-db11-4d41-976b-893d886f74bc
x-cache: Miss from cloudfront
content-type: text/javascript
x-amz-apigw-id: dNLeZGJoIAMFt8A=
content-length: 15
x-amz-cf-id: dgMF-MQy7qQv8GaBxIV1-lB4FdE4mzy5AGR3oDBHdwXqwLrbOKd7UQ==

GET
H2 200 184003-52190608802424.js Show response
js-sec.indexww.com/ht/p/ 39 KB
13 KB 87ms
28ms Script
text/javascript 172.64.151.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/ht/p/184003-52190608802424.js
Requested by: Host: karma.mdpcdn.com
URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5800f312944709b8d8e2e638a4c64704be610892c2fd06e962ac74b222615e19

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 15 Dec 2022 21:00:59 GMT
server: cloudflare
age: 46
etag: W/"761b05-9a4c-5efe4266544d2"
vary: Accept-Encoding
content-type: text/javascript
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=14400
cf-ray: 77a224dde8bc9ba4-FRA
expires: Fri, 16 Dec 2022 01:06:35 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 178 KB
45 KB 46ms
12ms Script
application/javascript 108.156.255.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: karma.mdpcdn.com
URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.156.255.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-156-255-76.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 20b9cd2a5e2125ece15cc0d11ae35586a1e9eb4bc90226eb3df789adf191be61

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 20:47:48 GMT
content-encoding: gzip
via: 1.1 c60125e7f3465aceafb0abd071a41a36.cloudfront.net (CloudFront), 1.1 021d8c03b9a9a9281489f9b9055209cc.cloudfront.net (CloudFront)
last-modified: Thu, 15 Dec 2022 17:02:44 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1, DUS51-P2
age: 1128
x-amz-server-side-encryption: AES256
etag: W/"9678e76b6e6295571547f8fe5df68b88"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: 4hzXvaWkBrPkrtaiTCgVNtDqF-3M0SHQ4fqOYuQpgqLQtxwseIi61g==

GET
H2 200 x.gif
d9jj3mjthpub.cloudfront.net/ 35 B
463 B 45ms
11ms Image
image/gif 2600:9000:2315:ca00:11:e0c9:84c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d9jj3mjthpub.cloudfront.net/x.gif?pulse=-1&v=l1.0.21&type=karma&globalTI_SID=1c0b326f-9334-45dc-896d-c8762657f940&request_id=21488a01-67aa-4275-b38c-1f3fe4229fa5&url=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&host=bestlifeonline.com&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F108.0.5359.124%20safari%2F537.36&muuid_origin=bestlifeonline.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:ca00:11:e0c9:84c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 19:27:10 GMT
via: 1.1 0247123ccdc6a2a86167d7f4de30885a.cloudfront.net (CloudFront)
last-modified: Sun, 24 Feb 2019 04:40:26 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P2
age: 5966
etag: "28d6814f309ea289f847c69cf91194c6"
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 35
x-amz-cf-id: 8aqEK0IDXWnQj9zbUDb7Hn96GE1sjjDscpvr1W6LwkD3WxwyXiEpMA==

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
311 B 12ms
11ms XHR
text/plain 108.156.255.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3446&u=https%3A%2F%2Fbestlifeonline.com
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.156.255.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-156-255-76.dus51.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 19:00:14 GMT
via: 1.1 021d8c03b9a9a9281489f9b9055209cc.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: DUS51-P2
age: 7580
x-cache: Hit from cloudfront
access-control-allow-origin: https://bestlifeonline.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-id: WY97ycQ8iSsOOx1hcwcEkmud1vLXM1yCQKQs5XHfAKuuM3D8-DZC8g==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 31ms
9ms XHR
application/javascript 108.156.255.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.156.255.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-156-255-76.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-amz-version-id: KO0V33_zzBQMkGMaMpLupHqINiAUum0D
content-encoding: gzip
via: 1.1 d45a8c6f9f33ed6e98c7762d0a4f951a.cloudfront.net (CloudFront)
date: Thu, 15 Dec 2022 05:34:11 GMT
x-amz-cf-pop: DUS51-P2
age: 55945
x-cache: Hit from cloudfront
last-modified: Wed, 07 Dec 2022 02:43:04 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: w9ipWo6XhA4YmOZc2w5LlxwHBKcviFAQ1dRcwDBTSbz72dm3Khw6VQ==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
440 B 51ms
18ms XHR
text/plain 2a00:1450:4025:401::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-72659260-1&cid=1762872910.1671138396&jid=1582275765&gjid=1793568525&_gid=1150022301.1671138396&_u=YGBAgUABAAAAAEAAI~&z=2077994775

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4025:401::9d Den Helder, Netherlands, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://bestlifeonline.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 15 Dec 2022 21:06:35 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://bestlifeonline.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
194 B 28ms
28ms Image
image/gif 2a00:1450:400d:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j98&aip=1&a=1156633042&t=pageview&_s=1&dl=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&ul=en-us&de=UTF-8&dt=If%20You%20Get%20a%20Call%20From%20These%20Numbers%2C%20%22Don%27t%20Believe%20Your%20Caller%20ID%2C%22%20FBI%20Says&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgUABAAAAAAAAI~&jid=1582275765&gjid=1793568525&cid=1762872910.1671138396&tid=UA-72659260-1&_gid=1150022301.1671138396&z=2020149588

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 16:42:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 15830
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lightbox.js Show response
www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/ Frame 0167 391 B
348 B 46ms
45ms Script
application/javascript 2606:4700::6813:d383
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/lightbox.js?mb=1671138395858&lv=1
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:d383 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 8e5112910e4cb17933a90d0f8f4aca7a924227dd7f722a152c6c734e1a0adf54

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Thu, 15 Dec 2022 21:06:01 GMT
server: cloudflare
age: 34
cf-polished: origSize=399
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 77a224de38945b4a-FRA

GET
H2 451 identity Show response
api.rlcdn.com/api/ 44 B
361 B 118ms
22ms XHR
text/plain 34.120.133.55
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://api.rlcdn.com/api/identity?pid=2&rt=envelope

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/184003-52190608802424.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.133.55 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

55.133.120.34.bc.googleusercontent.com

Software

Resource Hash

da45962a1fb4a049c9367ebe9b1b628f071d7a4c9997ee807c01d23f4866e19c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://bestlifeonline.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
via: 1.1 google
x-content-type-options: nosniff
access-control-allow-methods: GET, OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://bestlifeonline.com
access-control-allow-credentials: true
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length: 44
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 / Show response
id.sv.rkdms.com/identity/ 2 B
168 B 463ms
114ms XHR
application/json 54.162.152.214
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://id.sv.rkdms.com/identity/?vendor=idsv2&sv_cid=5274_04512&sv_pubid=MEREDITH&sv_domain=bestlifeonline.com
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/184003-52190608802424.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.162.152.214 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-162-152-214.compute-1.amazonaws.com
Software: nginx/1.22.0 /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://bestlifeonline.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: https://bestlifeonline.com
date: Thu, 15 Dec 2022 21:06:36 GMT
access-control-allow-credentials: true
server: nginx/1.22.0
content-length: 2
vary: Origin
content-type: application/json

GET
H2 200 rid Show response
match.adsrvr.org/track/ 63 B
391 B 101ms
31ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=184003
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/184003-52190608802424.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: f6d8c46b1a04accb2b0dc8fd7794d1f60efe4d5ba925ddf549468adf7a88ac9d

Request headers

Referer: https://bestlifeonline.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://bestlifeonline.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 63
expires: Sat, 14 Jan 2023 21:06:35 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
348 B 47ms
17ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-NYD0HKHMHR&gtm=2oebu0&_p=1156633042&cid=1762872910.1671138396&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1671138395&sct=1&seg=0&dl=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&dt=If%20You%20Get%20a%20Call%20From%20These%20Numbers%2C%20%22Don%27t%20Believe%20Your%20Caller%20ID%2C%22%20FBI%20Says&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-NYD0HKHMHR
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:35 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://bestlifeonline.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pubads_impl_2022120601.js Show response
securepubads.g.doubleclick.net/gpt/ 381 KB
129 KB 45ms
14ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

949ef00ce71e069fc69a6b829771726245072e18e56b264c536837c459b3febf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 19:13:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 93212
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132161
x-xss-protection: 0
last-modified: Tue, 06 Dec 2022 09:39:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 14 Dec 2023 19:13:03 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 145 B
103 B 76ms
47ms XHR
application/json 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=bestlifeonline.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

25f8f637daa99a551b158f2794034c771c83f2d448c7b0afc7d4165144efcf60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 78
x-xss-protection: 0
expires: Thu, 15 Dec 2022 21:06:35 GMT

GET
H2 200 user.js Show response
www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/ Frame 0167 706 KB
144 KB 57ms
57ms Script
application/javascript 2606:4700::6813:d383
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/user.js?cb=637908759194514824
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/lightbox.js?mb=1671138395858&lv=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:d383 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 956a243efde51c11758094189afe270cdc8bb79440e57f27874eecd06aa6663f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 15 Dec 2022 21:06:35 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: cNo+EYpNVxQnPn9S9Hs7Nw==
age: 261422
cf-polished: origSize=1196319
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Wed, 15 Jun 2022 07:45:19 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
x-ms-request-id: aec278ac-201e-0051-7ce5-fd06c5000000
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 77a224de99135b4a-FRA
expires: Fri, 15 Dec 2023 21:06:35 GMT

GET
H2 200 fb_lightbox.2.1.5.css
www.lightboxcdn.com/static/ 4 KB
1 KB 127ms
127ms Stylesheet
text/css 2606:4700::6813:d383
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/static/fb_lightbox.2.1.5.css?cb=637908759194514824
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/user.js?cb=637908759194514824
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:d383 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 15 Dec 2022 21:06:36 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: q4B4xYJoZwx9ikt94o1nCA==
age: 123286
cf-polished: origSize=6016
x-ms-meta-cbmodifiedtime: Wed, 10 Apr 2019 18:50:43 GMT
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Wed, 10 Apr 2019 19:06:17 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
x-ms-request-id: abc91a74-801e-0075-298b-809f8b000000
cache-control: public, max-age=2678400
x-ms-version: 2009-09-19
cf-ray: 77a224dfcacd5b4a-FRA
expires: Sun, 15 Jan 2023 21:06:36 GMT

GET
H/1.1 200
OK z Show response
lightboxapi.azurewebsites.net/z9gd/42151/bestlifeonline.com/jsonp/ 544 B
849 B 522ms
128ms Script
application/javascript 20.40.202.0
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://lightboxapi.azurewebsites.net/z9gd/42151/bestlifeonline.com/jsonp/z?cb=1671138396038&callback=jQuery171005867006396397323_1671138396022&_=1671138396039
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/user.js?cb=637908759194514824
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.40.202.0 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 2e9f3803edf6aaa92819369f28f4aa4e68b5e90d4af9d5fb650f2e8ab30086ec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Thu, 15 Dec 2022 21:06:36 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript

GET
H2 200 t.gif
www.lightboxcdn.com/z9g/ 35 B
258 B 126ms
126ms Image
image/gif 2606:4700::6813:d383
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lightboxcdn.com/z9g/t.gif?c=1671138396033&h=bestlifeonline.com&e=p&u=42151
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:d383 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 15 Dec 2022 21:06:36 GMT
cf-cache-status: HIT
content-md5: KNaBTzCeoon4R8ac+RGUxg==
age: 919526
cf-polished: status=not_needed
x-ms-meta-cbmodifiedtime: Tue, 26 Feb 2019 00:59:40 GMT
content-length: 35
x-ms-lease-status: unlocked
cf-bgj: imgq:85,h2pri
last-modified: Tue, 26 Feb 2019 01:15:02 GMT
server: cloudflare
etag: 0x8D69B87D5A1B25F
vary: Accept-Encoding
content-type: image/gif
x-ms-request-id: af63abe9-a01e-0081-2a45-a8f796000000
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 77a224dfcacf5b4a-FRA

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
311 B 61ms
61ms XHR
text/plain 108.156.255.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3446&u=https%3A%2F%2Fbestlifeonline.com
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.156.255.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-156-255-76.dus51.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 19:00:14 GMT
via: 1.1 021d8c03b9a9a9281489f9b9055209cc.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: DUS51-P2
age: 7581
x-cache: Hit from cloudfront
access-control-allow-origin: https://bestlifeonline.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-id: hSP-L2F8rsNk1KNUH4xRq9uTwgUKog6ywlG0AInKuQ6C2id73QC6Aw==

GET
H2 200 bid Show response
aax-dtb-cf.amazon-adsystem.com/e/dtb/ 64 B
504 B 240ms
67ms XHR
text/javascript 18.66.23.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax-dtb-cf.amazon-adsystem.com/e/dtb/bid?src=3446&u=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&pid=3EpMJvBLAcjA5&cb=0&ws=1600x1200&v=22.1212.1511&t=1250&slots=%5B%7B%22sd%22%3A%22div-gpt-leaderboard-flex-1%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%223865%2Frevshare.bestlifeonline.com%2Ftier1%2Fstructuredcontent%2Fdiv-gpt-leaderboard-flex-1%22%7D%2C%7B%22sd%22%3A%22div-gpt-square-flex-1%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%223865%2Frevshare.bestlifeonline.com%2Ftier1%2Fstructuredcontent%2Fdiv-gpt-square-flex-1%22%7D%2C%7B%22sd%22%3A%22div-gpt-square-fixed-1%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%223865%2Frevshare.bestlifeonline.com%2Ftier2%2Fstructuredcontent%2Fdiv-gpt-square-fixed-1%22%7D%5D&pj=%7B%22aps_privacy%22%3A%221--%22%2C%22si_pagegroup%22%3A%22smarter-living%22%2C%22adRefresh%22%3A0%7D&schain=1.0%2C1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.23.210 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-23-210.vie50.r.cloudfront.net

Software

Server /

Resource Hash

159bd804f3a207ce59088ef63f186ba5b3d906d5245b7bfa882a6a6c3f6a9314

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:36 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 a17242a6cf9be61e0412ecea1610cbde.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: VIE50-P1
x-amz-rid: 6P14C1W2ZJ20HGXGW5P2
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://bestlifeonline.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: erFaFSRgO7NEGKzlyKyr_2JXJV3kyyuZC93Qoi5jUkWRJlxdxt0NMA==

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 263ms
125ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96901a017a7ae786e2e89db828002f&pos=bestlife_leadrbrd_flex_tier1_728x90&cmd=bid&secure=1
Requested by: Host: karma.mdpcdn.com
URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 945cd9f50090db23f3e4e2c6d61a679a8439d5853b1ebd76f8bf66bc89ae46a8

Request headers

Referer: https://bestlifeonline.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 15 Dec 2022 21:06:36 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://bestlifeonline.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
294 B 244ms
107ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96901a017a7ae786e2e89db828002f&pos=bestlife_square_flex_tier1_300x250&cmd=bid&secure=1
Requested by: Host: karma.mdpcdn.com
URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: d5aba07282c2246aa5919849ee02168ffb085b7d3854e9f45e7c548fb22aa7df

Request headers

Referer: https://bestlifeonline.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 15 Dec 2022 21:06:36 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://bestlifeonline.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 247ms
110ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96901a017a7ae786e2e89db828002f&pos=bestlife_square_fixed_tier2_300x250&cmd=bid&secure=1
Requested by: Host: karma.mdpcdn.com
URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 2a883433360e32c70dcae5b696a8b8f278cf0e123d6c051a2c7959e77556c132

Request headers

Referer: https://bestlifeonline.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 15 Dec 2022 21:06:36 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://bestlifeonline.com
access-control-allow-credentials: true
content-length: 62

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
117 B 411ms
121ms XHR
text/plain 185.64.190.77
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: karma.mdpcdn.com
URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.77 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://bestlifeonline.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://bestlifeonline.com
date: Thu, 15 Dec 2022 21:06:36 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 575 B
838 B 331ms
212ms XHR
application/json 2602:803:c003:200::31
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=7499&site_id=426716&zone_id=2440886%3B2440898%3B2440892&size_id=2%3B15%3B15&alt_size_ids=57%3B10%2C54%3B&rf=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&tg_i.pbadslot=3865%2Frevshare.bestlifeonline.com%2Ftier1%2Fstructuredcontent%2Fdiv-gpt-leaderboard-flex-1%3B3865%2Frevshare.bestlifeonline.com%2Ftier1%2Fstructuredcontent%2Fdiv-gpt-square-flex-1%3B3865%2Frevshare.bestlifeonline.com%2Ftier2%2Fstructuredcontent%2Fdiv-gpt-square-fixed-1&tk_flint=pbjs_lite_v6.23.0&x_source.tid=f3c3c02c-1723-4a0d-bb9c-e15917c08623%3B24624c1a-6ce7-496e-ab19-57903072ae99%3B0c5a4464-44ba-43c2-90af-7d358daebe07&l_pb_bid_id=147645c37ea6ba1%3B15fd26f3a5d1728%3B168e57da0a695eb&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=3865%2Frevshare.bestlifeonline.com%2Ftier1%2Fstructuredcontent%2Fdiv-gpt-leaderboard-flex-1%3B3865%2Frevshare.bestlifeonline.com%2Ftier1%2Fstructuredcontent%2Fdiv-gpt-square-flex-1%3B3865%2Frevshare.bestlifeonline.com%2Ftier2%2Fstructuredcontent%2Fdiv-gpt-square-fixed-1&slots=3&rand=0.22999342841327386
Requested by: Host: karma.mdpcdn.com
URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::31 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 3259cbcfa99e2a96f773454a1d04f8bf60239cb9383e6f270eeed9941a78366f

Request headers

Referer: https://bestlifeonline.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:36 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://bestlifeonline.com
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 575
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 37 B
564 B 96ms
60ms XHR
application/json 172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=442128&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22175300f040e3c0e%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A6%2C%22msi%22%3A6%2C%22mfu%22%3A0%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A3%2C%22ren%22%3Afalse%2C%22version%22%3A%226.23.0%22%2C%22userIds%22%3A%5B%5D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22188b63e8ac6958b%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22442128%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A970%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22442128%22%2C%22sid%22%3A%22970x250%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22gpid%22%3A%223865%2Frevshare.bestlifeonline.com%2Ftier1%2Fstructuredcontent%2Fdiv-gpt-leaderboard-flex-1%22%7D%7D%2C%7B%22id%22%3A%2219c6b1ba3da59d8%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22442136%22%2C%22sid%22%3A%22300x250%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%2C%22ext%22%3A%7B%22siteID%22%3A%22442136%22%2C%22sid%22%3A%22300x600%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A1050%2C%22ext%22%3A%7B%22siteID%22%3A%22442136%22%2C%22sid%22%3A%22300x1050%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22gpid%22%3A%223865%2Frevshare.bestlifeonline.com%2Ftier1%2Fstructuredcontent%2Fdiv-gpt-square-flex-1%22%7D%7D%2C%7B%22id%22%3A%2220ac12b3c3818f1%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22442187%22%2C%22sid%22%3A%22300x250%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22gpid%22%3A%223865%2Frevshare.bestlifeonline.com%2Ftier2%2Fstructuredcontent%2Fdiv-gpt-square-fixed-1%22%7D%7D%5D%2C%22at%22%3A1%7D
Requested by: Host: karma.mdpcdn.com
URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 607cbdc76ef97516ae611ba207be56c5e1f1f6e325fbdcac258872ddd66ea333

Request headers

Referer: https://bestlifeonline.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:36 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Krg4rJVAMT%2BBEmN2DKnpsFxsvHncQXucD%2FMLqvW39BanaTou4GA1hlo6RH9Ucamtjqv34PL52TVK2ABJ72h7t7BjXZKHar4wnZwyFd3oiFyzFZnCGoJ190DXHAnONabOY3vrI7j4"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://bestlifeonline.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 77a224dfefd59137-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 361 B
1 KB 127ms
21ms XHR
application/json 185.83.142.19
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: karma.mdpcdn.com
URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.83.142.19 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

6244c1acdb39b05e040378e6bc6281f24b3d4380f868f553f4576fb2427dffe7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://bestlifeonline.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 15 Dec 2022 21:06:36 GMT
AN-X-Request-Uuid: d86c166d-024f-4698-abd2-629a58b1b2b2
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://bestlifeonline.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 178.162.209.140; 178.162.209.140; 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 361
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 24 B
241 B 423ms
59ms XHR
application/json 18.194.114.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://grid.bidswitch.net/hbjson?sp=trustx
Requested by: Host: karma.mdpcdn.com
URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.114.29 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-114-29.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 0db85c9dc967b752625788fabf92b0c44ac64cd359e2209a66e15f25974a1613

Request headers

Referer: https://bestlifeonline.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://bestlifeonline.com
date: Thu, 15 Dec 2022 21:06:36 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-encoding: gzip
content-length: 49
content-type: application/json

GET
H2 200 beacon.js Show response
sb.scorecardresearch.com/ 4 KB
2 KB 54ms
11ms Script
application/javascript 108.157.4.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-38.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ee54b51af15f1f68f707da981f3c135c249a25e9293871e1e0cbd2c24c7b6117

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 00:27:31 GMT
content-encoding: gzip
via: 1.1 e60c6ee10489538b535a3fc65e54d028.cloudfront.net (CloudFront)
last-modified: Tue, 28 Jun 2022 13:19:23 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P2
age: 74347
x-amz-server-side-encryption: AES256
etag: W/"eaf85c1c6758e84acfe134efd70e9373"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400
x-amz-cf-id: UNVgcn-sgzKENAYTNgIs0nbQYjWHjBEH-W4gXo5rj8B21614eGKNfA==

POST
H2 200 headerstats Show response
as-sec.casalemedia.com/ 0
502 B 64ms
33ms XHR
text/plain 104.18.33.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/headerstats?s=830104&u=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&v=3
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/184003-52190608802424.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.33.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://bestlifeonline.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:36 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3nYMwv7rcjYF%2FA34fouRMmXZG6bLCElAlYhlMxdyWMx5M6Y9HEIfPSQL1YxkCy7ZmXT9aZREpXlpg606Fmn7x5FFFthABzJSu2mj99ZfF%2F8MSpFJxK2GdTa5C1tmlycjlWDAaE8Q6tI%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://bestlifeonline.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 77a224e19d849bfe-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 204 b
sb.scorecardresearch.com/ 0
190 B 14ms
13ms Image
text/plain 108.157.4.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b?c1=2&c2=22434406&cs_it=b3&cv=3.8.0.210223&ns__t=1671138396379&ns_c=UTF-8&c7=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&c8=If%20You%20Get%20a%20Call%20From%20These%20Numbers%2C%20%22Don%27t%20Believe%20Your%20Caller%20ID%2C%22%20FBI%20Says&c9=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-38.dus51.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:36 GMT
via: 1.1 e60c6ee10489538b535a3fc65e54d028.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P2
x-amz-cf-id: SvovHiwILMXRp8daGrPiNhhp6icXEbpHLm1_8oqXUTc8ji6V4VhRXg==
x-cache: Miss from cloudfront

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 146 KB
55 KB 112ms
52ms Script
application/javascript 2a00:1450:400d:803::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WSJLVGT

Requested by

Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:803::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6b619934a6caa78018af1d52dd9af89c3816f34e7bc46f74d4ba430a3f49c017

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:36 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 55865
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 15 Dec 2022 21:06:36 GMT

GET
H/1.1 403
Forbidden keywee.min.js
dc8xl0ndzn2cb.cloudfront.net/js/bestlifeonline/v0/ 0
0 93ms
9ms Script
text/html 108.156.253.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dc8xl0ndzn2cb.cloudfront.net/js/bestlifeonline/v0/keywee.min.js
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.156.253.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-156-253-53.dus51.r.cloudfront.net
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
311 B 10ms
10ms XHR
text/plain 108.156.255.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3446&u=https%3A%2F%2Fbestlifeonline.com
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.156.255.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-156-255-76.dus51.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 19:00:14 GMT
via: 1.1 021d8c03b9a9a9281489f9b9055209cc.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: DUS51-P2
age: 7581
x-cache: Hit from cloudfront
access-control-allow-origin: https://bestlifeonline.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-id: yIgN0NwX6Tx4QtMzkgIGrcQHz88z3gQ2K192yZrHuk5JAd63bi8lgA==

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 76ms
23ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=bestlifeonline.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 74ms
23ms Script
application/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=bestlifeonline.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 128 KB
23 KB 619ms
618ms XHR
text/plain 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3075958559059825&correlator=3298801344028086&eid=31071222&output=ldjh&gdfp_req=1&vrg=2022120601&ptt=17&impl=fifs&iu_parts=3865%2Crevshare.bestlifeonline.com%2Ctier1%2Cstructuredcontent%2Csmarter-living%2Ctier2&enc_prev_ius=0%2F1%2F2%2F3%2F4%2C0%2F1%2F2%2F3%2F4%2C0%2F1%2F5%2F3%2F4%2C0%2F1%2F2%2F3%2F4%2C0%2F1%2F2%2F3%2F4&prev_iu_szs=728x90%7C970x90%7C970x250%2C300x250%7C299x251%7C300x600%7C300x1050%2C300x250%7C299x251%2C1x1%2C1x1&ifi=1&adks=2299363294%2C3738146460%2C3848872797%2C1315060974%2C2770564690&sfv=1-0-40&ists=3&prev_scp=slot%3Dleaderboard-flex-1%26refreshType%3Dhard%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26bz%3D000%26bzr%3D0%7Cslot%3Dsquare-flex-1%26refreshType%3Dhard%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26bz%3D000%26bzr%3D0%7Cslot%3Dsquare-fixed-1%26refreshType%3Dhard%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26bz%3D000%26bzr%3D0%7Cslot%3Dinterstitial%26refreshType%3Dhard%7Cslot%3Dwallpaper%26refreshType%3Dhard&eri=1&cust_params=path%3Dcharity-fraud-news%26id%3D395871-charity-fraud-news%26type%3Dstructuredcontent%26channel%3Dsmarter-living%26pv%3D1%26otabc%3D0%26amznbid%3D0%26amznp%3D0%26muid%3D1c0b326f-9334-45dc-896d-c8762657f940%26mrid%3D21488a01-67aa-4275-b38c-1f3fe4229fa5%26dockedleaderboard%3Dfalse%26dockedrail%3Dtrue&ppid=1c0b326f-9334-45dc-896d-c8762657f940&sc=1&cookie_enabled=1&abxe=1&dt=1671138396555&lmt=1671138394&dlt=1671138394967&idt=1082&adxs=436%2C982%2C982%2C0%2C0&adys=279%2C837%2C2439%2C6693%2C6693&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C1%7C2%7C3&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&frm=20&vis=1&psz=728x0%7C330x600%7C330x300%7C1600x6692%7C1600x6692&msz=728x0%7C330x250%7C330x0%7C1600x0%7C1600x0&fws=0%2C512%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0%2C0&ga_vid=1762872910.1671138396&ga_sid=1671138397&ga_hid=1156633042&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

caee9c990467048086ab44789b5ba0d701757932059854621ebd7c542be4f358

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:37 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23871
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,-1,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://bestlifeonline.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 197ms
76ms XHR
application/json 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022120601&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

746ae7f598a62be07b6a3f7d67c810fcd8ee9efc0e69ce119f912b02e400ed41

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11243
x-xss-protection: 0

GET
H2 200 container.html Show response
bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 232D 6 KB
3 KB 172ms
21ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bestlifeonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 15 Dec 2022 21:06:36 GMT
expires: Fri, 15 Dec 2023 21:06:36 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 settings.js Show response
www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/lightbox/7233ba71-618c-4b73-85f4-91b6c8ae2a5c/ 6 KB
5 KB 57ms
56ms Script
application/javascript 2606:4700::6813:d383
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/lightbox/7233ba71-618c-4b73-85f4-91b6c8ae2a5c/settings.js?cb=637908759194514824
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/user.js?cb=637908759194514824
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:d383 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d3732a091080d59e450e719fd7404449bd696e8e7b43ac2ac40d4aaebf5f0fbd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 15 Dec 2022 21:06:36 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: W99PYskj+CSjSOPqbOzfmg==
age: 122648
cf-polished: origSize=6526
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Thu, 11 Nov 2021 11:06:21 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
x-ms-request-id: 7ee7dcc9-901e-0007-1c8b-80eeb5000000
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 77a224e2bf025b4a-FRA
expires: Fri, 15 Dec 2023 21:06:36 GMT

GET
H2 200 lightbox_builder.js Show response
www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/ Frame 498E 253 KB
38 KB 42ms
42ms Script
application/javascript 2606:4700::6813:d383
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/lightbox_builder.js?cb=637908759194514824
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/user.js?cb=637908759194514824
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:d383 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b5f4af2ecfa8cbe2481e04b0bcb39b7c40ef2f97f04d29d253685111337755b2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 15 Dec 2022 21:06:36 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: Sy3R9FBWXcq6Cl1HiFEdNw==
age: 122648
cf-polished: origSize=435579
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Wed, 15 Jun 2022 07:45:19 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
x-ms-request-id: d5205b20-501e-0055-5e8b-80f347000000
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 77a224e2cf205b4a-FRA
expires: Fri, 15 Dec 2023 21:06:36 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 498E 2 KB
1 KB 57ms
22ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=fallback

Requested by

Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/lightbox_builder.js?cb=637908759194514824

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

46b60a64c27e555d9e1d416f2a22d50a078f8a7d9b906050efac3c60403e5375

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 15 Dec 2022 21:06:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 15 Dec 2022 20:49:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 15 Dec 2022 21:06:36 GMT

GET
H2 200 b1ec43e8-f365-4efa-adff-e1eb34ad1e89.css
s3.lightboxcdn.com/custom_fonts/ Frame 498E 213 B
395 B 109ms
48ms Stylesheet
text/css 2606:4700::6813:d383
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.lightboxcdn.com/custom_fonts/b1ec43e8-f365-4efa-adff-e1eb34ad1e89.css?cb=637908759194514824
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/7ff8b1cd-1d19-446f-83fc-08706559ea09/lightbox_builder.js?cb=637908759194514824
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:d383 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b84b27bd8f1dea53787ebe8a939fdb97b0da6acb90dd427697fe943c2c00baf5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:36 GMT
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: 1Q2C2NE6Y0FHPV5T
age: 1342666
cf-polished: origSize=232
x-amz-id-2: HE2vp1xXjIHCVlGmNz8zbEt4x3rvikUczbiUgg6CxioZ8la0N69DgzgTqudGfXAmsPTKr0537Bo=
cf-bgj: minify
last-modified: Thu, 23 May 2019 18:47:55 GMT
server: cloudflare
etag: W/"78319a65de69512ca765b08b08d9129b"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
cf-ray: 77a224e398685b4a-FRA
expires: Fri, 15 Dec 2023 21:06:36 GMT

GET
H2 200 t.gif
www.lightboxcdn.com/z9g/ 35 B
99 B 33ms
32ms Image
image/gif 2606:4700::6813:d383
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lightboxcdn.com/z9g/t.gif?c=1671138396692&h=bestlifeonline.com&e=i&u=42151&b=195282&v=empty&s=empty
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:d383 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 15 Dec 2022 21:06:36 GMT
cf-cache-status: HIT
content-md5: KNaBTzCeoon4R8ac+RGUxg==
age: 919526
cf-polished: status=not_needed
x-ms-meta-cbmodifiedtime: Tue, 26 Feb 2019 00:59:40 GMT
content-length: 35
x-ms-lease-status: unlocked
cf-bgj: imgq:85,h2pri
last-modified: Tue, 26 Feb 2019 01:15:02 GMT
server: cloudflare
etag: 0x8D69B87D5A1B25F
vary: Accept-Encoding
content-type: image/gif
x-ms-request-id: af63abe9-a01e-0081-2a45-a8f796000000
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 77a224e358105b4a-FRA

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 28ms
27ms Image
image/gif 2a00:1450:400d:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j98&aip=1&a=1156633042&t=event&ni=1&_s=2&dl=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&ul=en-us&de=UTF-8&dt=If%20You%20Get%20a%20Call%20From%20These%20Numbers%2C%20%22Don%27t%20Believe%20Your%20Caller%20ID%2C%22%20FBI%20Says&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Email%20Capture&ea=Lightbox%20Display&el=BestLife-HeaderBanner-Inline%20(Desktop)&ev=110&_u=aHBAgUABAAAAAEAAI~&jid=&gjid=&cid=1762872910.1671138396&tid=UA-72659260-1&_gid=1150022301.1671138396&z=1782207912

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 02:42:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 66245
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 uc.js Show response
consent.cookiebot.com/ 102 KB
32 KB 82ms
14ms Script
application/javascript 2a02:26f0:3500:18::1724:a29a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://consent.cookiebot.com/uc.js?cbid=39c82c11-fb7c-4dfa-9d2f-e9b47cfb6512
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WSJLVGT
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:18::1724:a29a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: ecea9fd901f0e775209188c51d1fce00cb090107eecf9ed05bc13757419eaac8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

request-context: appId=cid-v1:89f47f4b-bed0-4db8-956b-d6e6dfac3fef
date: Thu, 15 Dec 2022 21:06:36 GMT
content-encoding: gzip
last-modified: Tue, 13 Dec 2022 07:27:34 GMT
etag: "3cf18f5ec4ed91:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-expose-headers: Request-Context
cache-control: public, max-age=990
accept-ranges: bytes
content-length: 32025
expires: Thu, 15 Dec 2022 21:23:06 GMT

GET
H/1.1 200
OK a-01ao Show response
i.liadm.com/s/c/ Frame CD57 2 KB
1 KB 437ms
99ms Document
text/html 54.205.34.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://i.liadm.com/s/c/a-01ao?s=&cim=&ps=true&ls=true&duid=2baacde7071f--01gmbsrhey3f3n943dt525t6ry&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&

Requested by

Host: b-code.liadm.com
URL: https://b-code.liadm.com/sync-container.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.205.34.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-205-34-37.compute-1.amazonaws.com

Software

Resource Hash

5454348764a888ff1d88fd50e4af1a9527cbfe73694597651f407648829ff66b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://bestlifeonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, max-age=0
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 734
Content-Type: text/html; charset=UTF-8
Date: Thu, 15 Dec 2022 21:06:37 GMT
ETag: 1.61803398874
Request-Time: 3
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 498E 15 KB
16 KB 107ms
28ms Font
font/woff2 2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto&display=fallback

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://bestlifeonline.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 19:33:00 GMT
x-content-type-options: nosniff
age: 92016
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 14 Dec 2023 19:33:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 75ms
27ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 15 Dec 2022 21:06:36 GMT

GET
H2 200 RobotoBlack.ttf
s3.lightboxcdn.com/vendors/7ff8b1cd-1d19-446f-83fc-08706559ea09/uploads/b9f35bf9-7910-4f51-a964-4fdf73a9b21a/ Frame 498E 161 KB
162 KB 78ms
59ms Font
binary/octet-stream 2606:4700::6813:d383
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.lightboxcdn.com/vendors/7ff8b1cd-1d19-446f-83fc-08706559ea09/uploads/b9f35bf9-7910-4f51-a964-4fdf73a9b21a/RobotoBlack.ttf
Requested by: Host: s3.lightboxcdn.com
URL: https://s3.lightboxcdn.com/custom_fonts/b1ec43e8-f365-4efa-adff-e1eb34ad1e89.css?cb=637908759194514824
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:d383 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c78ce438e9d91ea8c16341aaf2c6cf07f9c347eb1130bd922796ad4fb78fe885

Request headers

Referer: https://s3.lightboxcdn.com/custom_fonts/b1ec43e8-f365-4efa-adff-e1eb34ad1e89.css?cb=637908759194514824
Origin: https://bestlifeonline.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:36 GMT
cf-cache-status: HIT
x-amz-request-id: JVXN6GDRY1FP9NK2
age: 645183
content-length: 164936
x-amz-id-2: Tzoib+p2DgYwBBOMUyGl0JGQqHt0ldehZiEHga3DdP24icXy9ve9rdalEloSE+QGqqP6mx0sK70=
last-modified: Thu, 23 May 2019 18:47:02 GMT
server: cloudflare
etag: "1a00134f7baf6a4783dc1135145a361b"
access-control-max-age: 86400
access-control-allow-methods: GET, POST
content-type: binary/octet-stream
access-control-allow-origin: *
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 77a224e40eabbba9-FRA
expires: Fri, 15 Dec 2023 21:06:36 GMT

GET
H2 200 bc-v4.min.html Show response
consentcdn.cookiebot.com/sdk/ Frame 835B 627 B
692 B 32ms
8ms Document
text/html 2a02:26f0:3500:887::f09
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Requested by: Host: consent.cookiebot.com
URL: https://consent.cookiebot.com/uc.js?cbid=39c82c11-fb7c-4dfa-9d2f-e9b47cfb6512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:887::f09 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 738e5435f2d18427d291a0d6289eee0ebbc87b596d6003919f255760ac293104

Request headers

Referer: https://bestlifeonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=31535935
content-encoding: gzip
content-length: 392
content-type: text/html
date: Thu, 15 Dec 2022 21:06:36 GMT
etag: "3d08665fa4c7bcf9fa2dcbbc7efe1d0f:1649057029.895163"
expires: Fri, 15 Dec 2023 21:05:31 GMT
last-modified: Mon, 04 Apr 2022 07:23:49 GMT
server: AkamaiNetStorage
server-timing: cdn-cache; desc=HIT edge; dur=1
vary: Accept-Encoding
x-akamai-transformed: 9 - 0 pmb=mRUM,1

GET
H2 200 cc.js Show response
consent.cookiebot.com/39c82c11-fb7c-4dfa-9d2f-e9b47cfb6512/ 316 KB
76 KB 66ms
66ms Script
application/x-javascript 2a02:26f0:3500:18::1724:a29a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://consent.cookiebot.com/39c82c11-fb7c-4dfa-9d2f-e9b47cfb6512/cc.js?renew=false&referer=bestlifeonline.com&dnt=false&init=false
Requested by: Host: consent.cookiebot.com
URL: https://consent.cookiebot.com/uc.js?cbid=39c82c11-fb7c-4dfa-9d2f-e9b47cfb6512
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:18::1724:a29a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 2fbe3a00a18fc9dfe8063f5c8d15423ef10d5441fe5ccf0220245cf87ff70579

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:36 GMT
content-encoding: gzip
last-modified: Thu, 15 Dec 2022 21:06:36 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-expose-headers: Request-Context
cache-control: private, max-age=1200
content-length: 77028
request-context: appId=cid-v1:89f47f4b-bed0-4db8-956b-d6e6dfac3fef

GET
H/1.1 200
OK atrk.js Show response
d31qbv1cthcecs.cloudfront.net/ 4 KB
5 KB 115ms
18ms Script
application/javascript 99.86.240.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d31qbv1cthcecs.cloudfront.net/atrk.js
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.240.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-240-53.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5e84ce936bc3e3844a5d9efb3ac7d28107fa17234fa2a6c2bf3491fc284f0d4f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Sat, 13 Aug 2022 04:02:04 GMT
Via: 1.1 cc6cd0f2b9d4d88785ea5a737059a4fe.cloudfront.net (CloudFront)
Last-Modified: Tue, 27 Apr 2021 18:03:54 GMT
Server: AmazonS3
X-Amz-Cf-Pop: VIE50-C1
Age: 10775073
ETag: "d89453438fbf10dcf4c13265c40d5160"
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Cache-Control: max-age=26920000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4255
X-Amz-Cf-Id: Ts9kyTwh-SLBuUYXeQCA4rxlICZDLpRA1rkLFWfUsCWnfgeuRNPJ5w==

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 12CF 13 KB
5 KB 43ms
14ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bestlifeonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1090
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 15 Dec 2022 20:48:26 GMT
expires: Fri, 15 Dec 2023 20:48:26 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame ADC9 783 B
1 KB 128ms
51ms Document
text/html 2a00:1450:400d:80c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

cbcc7311976a0ab1f2311045f55dd300bd583c1eba68f0c7e17b7c62cfcb1da4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-jJMwK0aeShBnSGFQ6_zlRQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://bestlifeonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-jJMwK0aeShBnSGFQ6_zlRQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 15 Dec 2022 21:06:36 GMT
expires: Thu, 15 Dec 2022 21:06:36 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js Show response
pagead2.googlesyndication.com/bg/ Frame 12CF 36 KB
16 KB 87ms
29ms Script
text/javascript 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd6a4d39482b37efe9c55c363401d536da1f7abff0e9a2dbdd91d718700ce386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 18:23:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 182573
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16071
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 13 Dec 2023 18:23:43 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4f29b4389a6e08bf3ffcdfb097597d5621b4abac31a74f89c3fa3537dc428e68

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 98ccd33e523985efa588344a13932892db38b1335243f989dd366450db8ea68d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 973 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: feeff1b73fc856bbaa909aecd74cd3918a41d2f0642b773831da45ad969317e9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/png

GET atrk.gif
certify.alexametrics.com/ 0
0

GET
H2 204 x.png
redirect.prod.experiment.routing.cloudfront.aws.a2z.com/ 0
48 B 686ms
172ms Image
text/plain 35.82.251.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redirect.prod.experiment.routing.cloudfront.aws.a2z.com/x.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.82.251.53 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-82-251-53.us-west-2.compute.amazonaws.com
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:37 GMT
server: Server

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame ADC9 0
0 60ms
60ms Image
text/html 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022120601&jk=3075958559059825&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 12CF 0
10 B 13ms
13ms Image
text/plain 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?fw916A
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:37 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2

200

1407
stags.bluekai.com/site/ Frame CD57
Redirect Chain

https://e.dlx.addthis.com/e/a-3491/s-7601.xgi?ret=img&na_em=04e8f8825e07702d99acb9e453c592e1
https://e.dlx.addthis.com/e/a-3491/s-7601.xgi?ret=img&na_em=04e8f8825e07702d99acb9e453c592e1&rd=Y
https://stags.bluekai.com/site/1407?partner=1&uhint=na_id=2022121521063800010532155224&redir=https%3A%2F%2Fx.dlx.addthis.com%2Fe%2Fbk_sync.xgi%3Fna_exid%3D%24_BK_UUID

62 B
227 B

196ms
187ms

Image
image/gif

69.192.160.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/1407?partner=1&uhint=na_id=2022121521063800010532155224&redir=https%3A%2F%2Fx.dlx.addthis.com%2Fe%2Fbk_sync.xgi%3Fna_exid%3D%24_BK_UUID
Requested by: Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-01ao?s=&cim=&ps=true&ls=true&duid=2baacde7071f--01gmbsrhey3f3n943dt525t6ry&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&
Protocol: H2
Server: 69.192.160.219 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-219.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Thu, 15 Dec 2022 21:06:38 GMT
content-length: 62
content-type: image/gif

Redirect headers

location: https://stags.bluekai.com/site/1407?partner=1&uhint=na_id=2022121521063800010532155224&redir=https%3A%2F%2Fx.dlx.addthis.com%2Fe%2Fbk_sync.xgi%3Fna_exid%3D%24_BK_UUID
pragma: no-cache
date: Thu, 15 Dec 2022 21:06:38 GMT
cache-control: max-age=0, no-cache, no-store
strict-transport-security: max-age=2628000
content-length: 0
expires: Thu, 15 Dec 2022 21:06:38 GMT

GET
H/1.1

200
OK

d177eb7fe50646c19b424e7962adadad
i.liadm.com/s/e/a-01ao/0/ Frame CD57
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=36&redir=https%3A%2F%2Fi.liadm.com%2Fs%2Fe%2Fa-01ao%2F0%2Fd177eb7fe50646c19b424e7962adadad%3Fmpid%3D7156%26muid%3D%5BMM_UUID%5D&4ba72a6d-0b6c-4b39-b0f3-c00...
https://i.liadm.com/s/e/a-01ao/0/d177eb7fe50646c19b424e7962adadad?mpid=7156&muid=75bc639b-8c5d-4a00-bf20-6e274124519d

43 B
274 B

97ms
96ms

Image
image/gif

54.205.34.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.liadm.com/s/e/a-01ao/0/d177eb7fe50646c19b424e7962adadad?mpid=7156&muid=75bc639b-8c5d-4a00-bf20-6e274124519d

Requested by

Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-01ao?s=&cim=&ps=true&ls=true&duid=2baacde7071f--01gmbsrhey3f3n943dt525t6ry&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&

Protocol

HTTP/1.1

Server

54.205.34.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-205-34-37.compute-1.amazonaws.com

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Thu, 15 Dec 2022 21:06:37 GMT
Cache-Control: no-store
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 43
Request-Time: 1
Content-Type: image/gif

Redirect headers

Date: Thu, 15 Dec 2022 21:06:37 GMT
Server: MT3 254 34fcae8 master zrh-pixel-x13 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://i.liadm.com/s/e/a-01ao/0/d177eb7fe50646c19b424e7962adadad?mpid=7156&muid=75bc639b-8c5d-4a00-bf20-6e274124519d
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 15 Dec 2022 21:06:36 GMT

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame CD57 70 B
264 B 33ms
31ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0
Requested by: Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-01ao?s=&cim=&ps=true&ls=true&duid=2baacde7071f--01gmbsrhey3f3n943dt525t6ry&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 15 Dec 2022 21:06:37 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

pixel.gif
yield-op-idsync.live.streamtheworld.com/ Frame CD57
Redirect Chain

https://x.bidswitch.net/syncd?dsp_id=256&user_group=2&user_id=4ba72a6d-0b6c-4b39-b0f3-c00c220ace13&redir=%2F%2Fi.liadm.com%2Fs%2F52176%3Fbidder_id%3D5298%26bidder_uuid%3D%24%7BBSW_UID%7D
https://x.bidswitch.net/ul_cb/syncd?dsp_id=256&user_group=2&user_id=4ba72a6d-0b6c-4b39-b0f3-c00c220ace13&redir=%2F%2Fi.liadm.com%2Fs%2F52176%3Fbidder_id%3D5298%26bidder_uuid%3D%24%7BBSW_UID%7D
https://i.liadm.com/s/52176?bidder_id=5298&bidder_uuid=daa7bc4e-2fb8-4dbf-90f4-cc700820cf43
https://x.bidswitch.net/sync?ssp=liveintent&user_id=4ba72a6d-0b6c-4b39-b0f3-c00c220ace13
https://pr-bh.ybp.yahoo.com/sync/iponweb?bidswitch_ssp_id=liveintent&ssp_user_id=daa7bc4e-2fb8-4dbf-90f4-cc700820cf43&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=74&&user_id=y-PkrGdvJE2pmQHb4gpzVW8NCke71SyPgZsCL3_w--~A&expires=5
https://yield-op-idsync.live.streamtheworld.com/pixel.gif?partner=bsw&uid=daa7bc4e-2fb8-4dbf-90f4-cc700820cf43&stn=

43 B
542 B

290ms
93ms

Image
image/gif

208.92.55.231
TRITONDIGITAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://yield-op-idsync.live.streamtheworld.com/pixel.gif?partner=bsw&uid=daa7bc4e-2fb8-4dbf-90f4-cc700820cf43&stn=
Requested by: Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-01ao?s=&cim=&ps=true&ls=true&duid=2baacde7071f--01gmbsrhey3f3n943dt525t6ry&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&
Protocol: HTTP/1.1
Server: 208.92.55.231 , Canada, ASN13360 (TRITONDIGITAL, CA),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:37 GMT
x-stw-server: ash-mesos01-node08
x-stw-site: ASH
content-length: 43
content-type: image/gif

Redirect headers

location: //yield-op-idsync.live.streamtheworld.com/pixel.gif?partner=bsw&uid=daa7bc4e-2fb8-4dbf-90f4-cc700820cf43&stn=
date: Thu, 15 Dec 2022 21:06:37 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2 451 sync
pippio.com/api/ Frame CD57 0
98 B 226ms
117ms Image
text/plain 107.178.254.65
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pippio.com/api/sync?pid=710914&_=1&it=4&iv=04e8f8825e07702d99acb9e453c592e1&it=4&iv=18668a8a902dfca4c2bd4d0ab72e02ba5d2a286e&it=4&iv=da3fd4f333b0e201a3ceb4fd1310e885118cf83d8c0237f99c1493705d6f9238
Requested by: Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-01ao?s=&cim=&ps=true&ls=true&duid=2baacde7071f--01gmbsrhey3f3n943dt525t6ry&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.254.65 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:37 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 451 sync
pippio.com/api/ Frame CD57 0
42 B 227ms
119ms Image
text/plain 107.178.254.65
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pippio.com/api/sync?pid=710914&_=2&it=4&iv=04e8f8825e07702d99acb9e453c592e1&it=4&iv=18668a8a902dfca4c2bd4d0ab72e02ba5d2a286e&it=4&iv=da3fd4f333b0e201a3ceb4fd1310e885118cf83d8c0237f99c1493705d6f9238
Requested by: Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-01ao?s=&cim=&ps=true&ls=true&duid=2baacde7071f--01gmbsrhey3f3n943dt525t6ry&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.254.65 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:37 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 451 sync
pippio.com/api/ Frame CD57 0
42 B 227ms
118ms Image
text/plain 107.178.254.65
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pippio.com/api/sync?pid=710914&_=3&it=4&iv=04e8f8825e07702d99acb9e453c592e1&it=4&iv=18668a8a902dfca4c2bd4d0ab72e02ba5d2a286e&it=4&iv=da3fd4f333b0e201a3ceb4fd1310e885118cf83d8c0237f99c1493705d6f9238
Requested by: Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-01ao?s=&cim=&ps=true&ls=true&duid=2baacde7071f--01gmbsrhey3f3n943dt525t6ry&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.254.65 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:37 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 container.html Show response
bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D2FD 6 KB
3 KB 43ms
14ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bestlifeonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 15 Dec 2022 21:06:36 GMT
expires: Fri, 15 Dec 2023 21:06:36 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012211060024000/ Frame E106 221 KB
61 KB 152ms
13ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01f9f2f5ba1812441a49f7f1dc0b04fb56a18b486005289b8df4212381f10ce

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Dec 2022 09:52:43 GMT
age: 299634
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61592
x-xss-protection: 0
server: sffe
etag: "a2fca7132416d151"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 12 Dec 2023 09:52:43 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame E106 14 KB
5 KB 192ms
53ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d89cb9800cc62dcc44a0ba866b4a080ad06f735f60a6afecbd6d691d2e8939dd

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Dec 2022 09:52:42 GMT
age: 299635
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5218
x-xss-protection: 0
server: sffe
etag: "abd4378f71571d78"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 12 Dec 2023 09:52:42 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame E106 94 KB
28 KB 193ms
55ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ee5f53d3752309af021002b2199a06523b1fd03f3ea1cdaf5d59e911d4d8178

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Dec 2022 09:52:43 GMT
age: 299634
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28809
x-xss-protection: 0
server: sffe
etag: "dd6615029de85e23"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 12 Dec 2023 09:52:43 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame E106 5 KB
2 KB 197ms
59ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3f73b989e0620a4d2e12ed57a0d538e4580b8fefaa1fefbad73e0abad6d227f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Dec 2022 09:52:43 GMT
age: 299634
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1913
x-xss-protection: 0
server: sffe
etag: "403438c4d550ee88"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 12 Dec 2023 09:52:43 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame E106 40 KB
13 KB 198ms
60ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b1c3ea8b3d9fec1913ac70c81c83f2172acc41988e747bd24d22bf779fd19a0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Dec 2022 09:52:42 GMT
age: 299635
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12946
x-xss-protection: 0
server: sffe
etag: "0bacd3f1ce38a7db"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 12 Dec 2023 09:52:42 GMT

GET
DATA 200
OK truncated
/ Frame E106 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c19a4370ad20f4dc3149b06f31fd137cd7e19042e1b8f0c82c99cd8c9d0667db

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012211060024000/ Frame ECE4 221 KB
60 KB 161ms
32ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01f9f2f5ba1812441a49f7f1dc0b04fb56a18b486005289b8df4212381f10ce

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Dec 2022 09:52:43 GMT
age: 299634
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61592
x-xss-protection: 0
server: sffe
etag: "a2fca7132416d151"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 12 Dec 2023 09:52:43 GMT

GET
H3 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame ECE4 14 KB
5 KB 54ms
25ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d89cb9800cc62dcc44a0ba866b4a080ad06f735f60a6afecbd6d691d2e8939dd

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Dec 2022 09:52:42 GMT
age: 299635
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5218
x-xss-protection: 0
server: sffe
etag: "abd4378f71571d78"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 12 Dec 2023 09:52:42 GMT

GET
H3 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame ECE4 94 KB
28 KB 43ms
15ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ee5f53d3752309af021002b2199a06523b1fd03f3ea1cdaf5d59e911d4d8178

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Dec 2022 09:52:43 GMT
age: 299634
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28809
x-xss-protection: 0
server: sffe
etag: "dd6615029de85e23"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 12 Dec 2023 09:52:43 GMT

GET
H3 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame ECE4 5 KB
2 KB 53ms
25ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3f73b989e0620a4d2e12ed57a0d538e4580b8fefaa1fefbad73e0abad6d227f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Dec 2022 09:52:43 GMT
age: 299634
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1913
x-xss-protection: 0
server: sffe
etag: "403438c4d550ee88"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 12 Dec 2023 09:52:43 GMT

GET
H3 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame ECE4 40 KB
13 KB 49ms
21ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120601.js?cb=31071222

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b1c3ea8b3d9fec1913ac70c81c83f2172acc41988e747bd24d22bf779fd19a0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Dec 2022 09:52:42 GMT
age: 299635
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12946
x-xss-protection: 0
server: sffe
etag: "0bacd3f1ce38a7db"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 12 Dec 2023 09:52:42 GMT

GET
DATA 200
OK truncated
/ Frame ECE4 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 513b2cab9e5d6b924fc802baf0c0934b37d8590c161ae885ab7b3244e3b73d7f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 15687820457063438743
tpc.googlesyndication.com/simgad/ Frame E106 99 KB
99 KB 16ms
15ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15687820457063438743?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qk_TgcLJptGssJgblmtZ0RZq-3Zzg

Requested by

Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8c088dfd8e193dd7acf512456d0afcd9acf412560096e8c4a51f6fb1022bfd80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 11:01:19 GMT
x-content-type-options: nosniff
age: 209118
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 101414
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 09:20:47 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 13 Dec 2023 11:01:19 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E106 2 KB
2 KB 20ms
19ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 09:39:53 GMT
x-content-type-options: nosniff
server: cafe
age: 41204
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Fri, 16 Dec 2022 09:39:53 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E106 295 B
319 B 16ms
14ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 11:55:19 GMT
x-content-type-options: nosniff
server: cafe
age: 33078
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 16 Dec 2022 11:55:19 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame E106 0
0 59ms
57ms Image
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CG7gwXIybY8SvJsevgQeD2YOQAp3b9vVtmO6arMkQ3NkeEAEgqP3AEmCVgoCAwAegAZyv-6gCyAEC4AIAqAMByAMIqgSJAk_Q_kXMGJHQvCMmpBhAFik3n9KXmF-dHIvdyf_sh7PLCAzX3gox5XtBPZ0iKGaJL7qzlh9Br_3WLdCAcVSO0ly7TBwdrdHNwtQUJLkzBjAUCVT2gB1dMXENTUhMImpbNNoAM9EdPH-e99U_kNYS-DIDnYvJbblue6iZaMHZG3QRaAvJgeV-uEA_F9ufEq5tH8WqEWnZDDzrhnqBK48FU19y0Px8KXr-mUBQPSYPW4cdOnMcCqJ4oYY7hAHU8bs4QoZtSXv3SOT7Lx7fBxrvu1JVkOAp2_wQSbLJkZV_TeKmML5Tik7aoW1tadEKybgI1hvgzijQdLu9DPmGQis9VGlZGjgmZ8OIQJDABO_irZGXBOAEAZIFBAgEGAGSBQQIBRgEoAYCgAfM0ITXAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEEOf_KtIIEQiA4YAQEAEYHTICqgI6AoBAgAoDyAsB2BMN0BUBmBYBgBcBshceChwIABIUcHViLTA5NzgwNjQ1MzIxNDIyMTUY2o4R&sigh=av6NeR11rP4&uach_m=[UACH]&cid=CAQSXgDq26N9k76okzX9Nb-LUx5pURIilEWzh4Oy4TLmmvYybTWOmiVuuwt2yJdaN0ac8IsZ2krbrMuB3rF8_LwRm9LBb6iXaAtpnI-xL-vTulc_AYNEijE-ZPoO7hLZOk8YASAT
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

GET
H3 200 14828492229214819266
tpc.googlesyndication.com/simgad/ Frame ECE4 46 KB
46 KB 21ms
19ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14828492229214819266?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qntK6diN12SXYqD1N1Z_zlXziQvPw

Requested by

Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90398d274e093821b066f9bc367d1ddb8e2fa9d18d7660c10cc3704c4d9f519f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Sat, 10 Dec 2022 06:11:20 GMT
x-content-type-options: nosniff
age: 485717
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46612
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 09:20:46 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 10 Dec 2023 06:11:20 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame ECE4 2 KB
2 KB 20ms
19ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 09:39:53 GMT
x-content-type-options: nosniff
server: cafe
age: 41204
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Fri, 16 Dec 2022 09:39:53 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame ECE4 295 B
319 B 16ms
14ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 11:55:19 GMT
x-content-type-options: nosniff
server: cafe
age: 33078
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 16 Dec 2022 11:55:19 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame ECE4 0
0 60ms
58ms Image
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CSiaoXIybY8WvJsevgQeD2YOQAp3b9vVt8O2arMkQ3NkeEAEgqP3AEmCVgoCAwAegAZyv-6gCyAEC4AIAqAMByAMIqgSMAk_QKmGUYpZurmvPZmuQQ10p1MHiKngC0ceL13S8ggbfpqJjXus06s_GwcDGLWVksqckilSXkRp8uXHUWrqHHylplAGWBAGWwpiLwWN8UmWZP8MHzBVV3u6ztgxNzGfcHyx6cTKDzPdu0cY0B_9D6O7bxEgM7a7XxSgQxsIyfjvjXRVoVHvC8OaIzbp_C4ESRMpwdu6VkUl02ANETQtnbJdF6g2nzTQHsUIu3IG_KEjppbL4b673sEqx3UD5WZ1gX6UDavtlugKwYvWKAZM6KsBWm-KkeZUGbaXfWUKP00Y-t62N4jiovYpaKRdN7FCBAYw3CPwMx5Dxr9z56Gi7t31vu3o-53v2ZuGvPP3ABO_irZGXBOAEAZIFBAgEGAGSBQQIBRgEoAYCgAfM0ITXAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEEIjTL9IIEQiA4YAQEAEYHTICqgI6AoBAgAoDyAsB2BMN0BUBmBYBgBcBshceChwIABIUcHViLTA5NzgwNjQ1MzIxNDIyMTUY2o4R&sigh=ySVfLS4Qp1E&uach_m=[UACH]&cid=CAQSXgDq26N9k76okzX9Nb-LUx5pURIilEWzh4Oy4TLmmvYybTWOmiVuuwt2yJdaN0ac8IsZ2krbrMuB3rF8_LwRm9LBb6iXaAtpnI-xL-vTulc_AYNEijE-ZPoO7hLZOk8YASAT
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2019 624 B
919 B 88ms
50ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ28u5ARis5JC_ATAB&v=APEucNXEE3tNNceUhuTbXYFmhkBMbA5T4FBbN9RI0TDw9_5_ouXagN9miVtUhqz_FWTaUsLr-mXNPFzAjDuMcuPrsswP2cabLcynGS0McIoQc-rGQBFQ-_1Nc_m5uTAYSRuJU8ZQx1JQGgk7uavrJKe3C-i3aoPSYcJ2UoXOvQwXnlL7jnPLqEPvq8LTg6V7OXnrjb9baPEGWlGRqNqBnqrYvkaki-0ZSw

Requested by

Host: bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com
URL: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 15 Dec 2022 21:06:37 GMT
expires: Thu, 15 Dec 2022 21:06:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame D2FD 76 KB
27 KB 145ms
144ms Script
text/javascript 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com
URL: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

def1424f4f259a4cf927fe1f7ea7ec24bdc2fc78edca55fdb593cc0c293dbec5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:37 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27387
x-xss-protection: 0
server: cafe
etag: 15442950961169408521
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 15 Dec 2022 21:06:37 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D2FD 42 B
63 B 63ms
60ms Image
image/gif 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cvt9HhXeR88A5XoENT4Bp4TDaNCnnYSZ8yGcbfj6IXFJi8RCiyX78nXep-OuJ3jL58oYDNUNmAJrqL92V5bnJPNgjAq4rUwuJh2Uz6R0XeSuoYfNo

Requested by

Host: bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com
URL: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D2FD 0
20 B 63ms
60ms Image
image/gif 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=3017572977498308032&x=1&ct=76

Requested by

Host: bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com
URL: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame D2FD 3 KB
1 KB 21ms
18ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/window_focus_fy2021.js

Requested by

Host: bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com
URL: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 18:25:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9665
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Dec 2022 18:25:32 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame D2FD 18 KB
7 KB 16ms
13ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com
URL: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 09:24:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 42115
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7480
x-xss-protection: 0
server: cafe
etag: 15631949847000551034
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Dec 2022 09:24:42 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D2FD 153 KB
47 KB 198ms
75ms Script
text/javascript 2a00:1450:400d:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com
URL: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 15 Dec 2022 21:06:37 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/ Frame D2FD 23 KB
9 KB 18ms
15ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/abg_lite_fy2021.js

Requested by

Host: bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com
URL: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86a2a3999c65a6ee0bbee35ac7515f04856e0fcbcebdffd56001c0dc924d887a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 09:24:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 42115
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9443
x-xss-protection: 0
server: cafe
etag: 9828741834572772835
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Dec 2022 09:24:42 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2019
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBV6IqGq8g3WRcY9UX9K4EY&google_cver=1

43 B
766 B

7ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBV6IqGq8g3WRcY9UX9K4EY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ28u5ARis5JC_ATAB&v=APEucNXEE3tNNceUhuTbXYFmhkBMbA5T4FBbN9RI0TDw9_5_ouXagN9miVtUhqz_FWTaUsLr-mXNPFzAjDuMcuPrsswP2cabLcynGS0McIoQc-rGQBFQ-_1Nc_m5uTAYSRuJU8ZQx1JQGgk7uavrJKe3C-i3aoPSYcJ2UoXOvQwXnlL7jnPLqEPvq8LTg6V7OXnrjb9baPEGWlGRqNqBnqrYvkaki-0ZSw
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 15 Dec 2022 21:06:37 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:37 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBV6IqGq8g3WRcY9UX9K4EY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2019
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y5uMXX6E30vfq7BYGADl9wAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBV6IqGq8g3WRcY9UX9K4EY&google_cver=1

43 B
766 B

7ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBV6IqGq8g3WRcY9UX9K4EY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ28u5ARis5JC_ATAB&v=APEucNXEE3tNNceUhuTbXYFmhkBMbA5T4FBbN9RI0TDw9_5_ouXagN9miVtUhqz_FWTaUsLr-mXNPFzAjDuMcuPrsswP2cabLcynGS0McIoQc-rGQBFQ-_1Nc_m5uTAYSRuJU8ZQx1JQGgk7uavrJKe3C-i3aoPSYcJ2UoXOvQwXnlL7jnPLqEPvq8LTg6V7OXnrjb9baPEGWlGRqNqBnqrYvkaki-0ZSw
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 15 Dec 2022 21:06:37 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:37 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBV6IqGq8g3WRcY9UX9K4EY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 2019
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFJkftiI9UahWKxpJ11mGjo&google_cver=1

43 B
1 KB

13ms
13ms

Image
image/gif

185.83.142.19
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFJkftiI9UahWKxpJ11mGjo&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ28u5ARis5JC_ATAB&v=APEucNXEE3tNNceUhuTbXYFmhkBMbA5T4FBbN9RI0TDw9_5_ouXagN9miVtUhqz_FWTaUsLr-mXNPFzAjDuMcuPrsswP2cabLcynGS0McIoQc-rGQBFQ-_1Nc_m5uTAYSRuJU8ZQx1JQGgk7uavrJKe3C-i3aoPSYcJ2UoXOvQwXnlL7jnPLqEPvq8LTg6V7OXnrjb9baPEGWlGRqNqBnqrYvkaki-0ZSw

Protocol

HTTP/1.1

Server

185.83.142.19 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 15 Dec 2022 21:06:37 GMT
AN-X-Request-Uuid: 10533a08-a886-474b-9c7c-742847d2304e
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 178.162.209.140; 178.162.209.140; 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:37 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFJkftiI9UahWKxpJ11mGjo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 2019
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg0MjI1MjE2NjIxNDkyMzU3Mg%3D%3D

170 B
243 B

139ms
56ms

Image
image/png

142.250.201.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg0MjI1MjE2NjIxNDkyMzU3Mg%3D%3D

Requested by

Protocol

Server

142.250.201.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s35-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 15 Dec 2022 21:06:37 GMT
AN-X-Request-Uuid: 912e9e34-0d06-494d-92ca-73c79430c344
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg0MjI1MjE2NjIxNDkyMzU3Mg%3D%3D
Connection: keep-alive
X-Proxy-Origin: 178.162.209.140; 178.162.209.140; 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D2FD 0
20 B 60ms
60ms Ping
image/gif 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1271505794157&version=m202209210101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D2FD 0
20 B 60ms
60ms Ping
image/gif 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1271505794157&version=m202209210101&ct=76&x=1&cor=3017572977498308000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D2FD 81 KB
34 KB 81ms
51ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BjfNac41ra7T3qdoeHgc1RS2czmtlbuFAdL4fgVXEgdigSu-m95SfWrCcq38jtePdsQ8-jTS_qcJUIxc_JeC0MEwiOiw&cry=1&dbm_d=AKAmf-BEEcVTrcbK0o5pY7Mgs4L2Q1kXph16e9BDDBff0clPQePgnJ4gpvFMhULPJcppfVwjJoOe1x_NYAU_Gr-lCsh8GjmA32ekn9zc819_d2y2Fbl9yvB9YY0dIFbQXOrYTscBxl6gRUPDfWfjhk-M7HU31PHSdKDJ0NcKeQCC-nDLo1pjNh1D8yYClFXUhQCmHF9SQXeBCs3tSaYCa9FjkIiKJ-MmpJmOjyDQg2avrBImTQk0h8cpvBpyZyfNrsAHuPTGjlAaT8Ip3x-0NZGiSYWLnFaa3kzkxQXX6QFD0CuGpLiHIksHcX3AsBnhQxGKzH51lFVdYA4Kmr8qS_f4rMvz03CybRrcFKnGGe8zR3Uk595sDhf-cugZSpXc5p0iIuziIsqa2egf8fsEHyyhjKFMa_wibHaMTpr5CX-TWqjt8HpfxT5LOLT22Yf83l_NR2K4pKVpbPyHh-O4cUGfBoH7Aau3GxbXmhrGAx_dHjg0qEDnkm8OA0fxLajJ7a9G8Klw5LfgI-0oV8mCQev5xQIrjPDF-45M1EsUIsD8UBeNhOKmvxEwCWFyJstG6wxJhC_i0aY1RM-ZpM77JHLZB0_bGGgCzwOzgoYmVwhwEO-pQMEG2IOG72UcOusHy0NI-bWMUK-jkNjFwKFyq4pIybrvdDk_L2-TSVm1JZHEoJtacKEZZLrPBTyTLA0Cf2yvV2QJroEeonLvmrmvk7nr5shiHtCp1hw7I5qr3-H21jJ9nD3qSvR5evNdtiNbdhIHDhMG1c35ShdTks2ssX410_Hh87FHnruBukcs8FZWv12L8Bn9aR6C7yTxzCES89gcLQNUl2ie1RKqc6eY7iV81VOV_zYqY5zd4ucRJSVLC7fTHZa2P55nEpaP-YWGGgw8NtZ16PAGakLdCT0m9BlfS1TqDwHxh441UaCPuBJG-IZVA3QaWTPKN_ab3T1Vf7cxRg6SC9kPvCzTOVYOMndK4HOmpEfW5My5VZCOA8_gUC0P_JTVdLk8DO3YOur56KXyw0guRukSliqMZxiY7zIGwVrgrkM1H4_YuTsZ33eqmiMmKc2Y__vP6uu_XjPzUjX8Vt1DfPujYPgl6NN8p8iMfFByBNKNFUyT1DVuDdBggrf_u3xzHnSWE1nOgpxryhTx84aK_F0djHkWEm4sCBiaAsE63dK0AiyHUaqeH-MfaBr6xgTiMdCZnuhE3sgaavBdB-_AO1Tx5r3BVoyspdMMK87qsPFf0N6BoHpTYi65d_6fZH7f5zlJJc4f-bcrHS0vR7N8D4JR0qUODBPyLxKyWdR3juazUfJXLTR_nyYi_E5W7qiWCagbZ5vjkDEuE-c6p4O13aaCFW5DBJXp4I-azZE0FI9ljxFIxjKeP-vspYgdnRTpthuAjnW_YUFf04ySPiXt3ti7H2UPBZT1hZ5fEaj6Bw33QFiQnR5XFJ07LhhoIzUaNnAXaU8qk8N7CJdVo8rJD9esYM4BAkLeiiJaEY5Oj4reIQPFO35FcSDk9vMWkOWQ6cNuhsmUe2ukGM0EmO1ypNJxtAu6raHC76rN1Onug4bEJflkoZBaA8LX4xaY0-jfmesQQdS5fLas9mrfBv3ooUnG75T7WnwhrZGOFvdfgratYymGX522_vMAUNJX8BRBHWYdQjsLP1VMVQXRhREwWoOL_MguNhxSFWm2IIGtkvc2B5UaaZOJp8eskcmRfz489_tVpCzXeWPEj4IltMGbmQlCRn3KdSDkKO-TRkLBgaqTmuEPYsDYl9_miM7g_UNY6xfQpxs9wglsb63UQQ_fAW_Z7nWUKMDebEdg3SKvBJkaQ7FUmIqx7juRJ7BVwZGfQhTCwE0a8iefCtfxM56ZwPfG3HUzeo9Pvm31ewrf7o2vi3WoDnNnNHKeW5ti1Gi4Vgq4Fj7j_e_QbB2C4xOqgbgDuudPJ2LAzlmRVpUR3cdWn6qEnhSJ-gr1sM1uv7l6-kznxPUQ23NEy_luQit-B0OyLn6uHlKgv9UNiWJhki_3L0Lynk3JBrxnXpMACagOX2UtM8bXZ8yAzSDXMjMXspldlRP7j2UiIfWpnHmdJr891cFbB2XihrbuCtyj1qfeme6WQaFS3UhRIOkVi2G35BS9zSBfL3CZVPbKRL2xsUUoswDKk4go-pQ_Q7w1LCIG6Cd6s-62wXrNtrFzqjKVW_xiPSAn4oPOxu0XwiCHhJcngJGBMJi1Y_e0A5cJsHENTIwHtN-F4kVRLlch7khXqZgBJ5gE_8Fn05xim1uIJMudX-72nMJNkvnIMT4q-3Dxt20ZeMSWuyqE5qmBgnSEIui3idL_R0fI2J01O81fXeBfKQLyr4aveO9NCrCTd8-xHfFKHCGqx4mh3xk7IFmqwZTztI5GEYGR6muYM2dwUj7J1AOBxs7iAaRi6_KNhbRFAAMyrevRKUm1VDv3pBW5UPGSga3R4BuI0smaz8ALX1_YRFQKJ3eCodxMMjO-ZAF5gxsZrrKhgAprUunNUaaNIYpXfHFIsqkowoN0lGleRm6CJIGDzWUh0_bZLHC9eXLHmPchUf6duq295sH1NVLExVIUN8bk8mTFpc9CAinHsm5bqjhJOGbEXILUjw5F5L4Wb_tlDB_s83NR8UqnwIWmPVLZImchYztV0PcjLjfhXK1a-mdqpc3q08k-bUniKe5nq_tHt4Ds-UeKnraSB2W_q626MSb-5AaB0bOvWeGxtQN8XT54adZpTLG1G7lSpedCDUXib-PVf-FaaHvIDCCU4qXoJmlop2hrswspfVsKdxkFfaJptxu1lvhCmHLflVmX3NE5325P2kyF6I483IbeAupKyKUUN_kLuMOGu5dJrR0y6O59T7mOfKgUaIT88XygshmRFC3HdQwGhkE8vOD3T4VVk6RgjX4aIVB8HugbXkCgyuDhwh8n8WkdAwxGvk8hnsUPT1nLhHzB0Rr2fIZGSu8FjQBarD9dZlZvO7avpF4sI3-DrRjaSz-X_0271SbiaFdmDfnKiSctBuzihheCKjBmriq2IpKcvqMgUF-kC2nppBYc_TYGa-a7X8YbCAeu3KNCFrKFEkUxjk72zD3fPqaUR97fbCXreW19d2m5RoP2IzHbwppXQtEXmiZ4atRxD5o6XdoxLC_B9rTiqtJfMm5-3YdO0kU3dXXXBubHjGBpielntKFJP0nfrnubxzQNQW0IAUAKXj-BqWkmE2rHtsmSIeMabyw8a9khD68C36dYML_lo4pMcvKZM8ZBOGRHERMZyXQ9Z8bFV9p6GDx27FHdUHsCRZLf1qb4jeiQupVdimK9XNe0Xl7UvGg1NKzMwBc0xwGEjhyuKcedFIEaPkrrDfFVfAJ5Pwl70u0Bs_SRpWsIaJJRv9YS60hbFnef6odz6EuyCRrD57BPLj3BmEUdWKsEcP086Cf40Az3Dyx1gA&cid=CAQSXgDq26N9k76okzX9Nb-LUx5pURIilEWzh4Oy4TLmmvYybTWOmiVuuwt2yJdaN0ac8IsZ2krbrMuB3rF8_LwRm9LBb6iXaAtpnI-xL-vTulc_AYNEijE-ZPoO7hLZOk8YASAT&dv3_ver=m202209210101&rfl=https%3A%2F%2Fbestlifeonline.com%2F&ds=l&xdt=1&iif=1&cor=3017572977498308000&adk=2086295851&idt=149&cac=0&dtd=7

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

002fbd336dd25524775a8a742584a335995f617fc604686b93ad523ed6116885

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35220
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame E106
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

43ms
42ms

Image
text/html

2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H3
Server: 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Redirect headers

date: Thu, 15 Dec 2022 21:06:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame ECE4
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

32ms
32ms

Image
text/html

2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/
Protocol: H3
Server: 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Redirect headers

date: Thu, 15 Dec 2022 21:06:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame D2FD 170 KB
59 KB 62ms
13ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Requested by

Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
Origin: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 12:48:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29886
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60311
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 16 Dec 2022 12:48:31 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/elements/html/ Frame D2FD 8 KB
3 KB 28ms
28ms Script
text/javascript 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BjfNac41ra7T3qdoeHgc1RS2czmtlbuFAdL4fgVXEgdigSu-m95SfWrCcq38jtePdsQ8-jTS_qcJUIxc_JeC0MEwiOiw&cry=1&dbm_d=AKAmf-BEEcVTrcbK0o5pY7Mgs4L2Q1kXph16e9BDDBff0clPQePgnJ4gpvFMhULPJcppfVwjJoOe1x_NYAU_Gr-lCsh8GjmA32ekn9zc819_d2y2Fbl9yvB9YY0dIFbQXOrYTscBxl6gRUPDfWfjhk-M7HU31PHSdKDJ0NcKeQCC-nDLo1pjNh1D8yYClFXUhQCmHF9SQXeBCs3tSaYCa9FjkIiKJ-MmpJmOjyDQg2avrBImTQk0h8cpvBpyZyfNrsAHuPTGjlAaT8Ip3x-0NZGiSYWLnFaa3kzkxQXX6QFD0CuGpLiHIksHcX3AsBnhQxGKzH51lFVdYA4Kmr8qS_f4rMvz03CybRrcFKnGGe8zR3Uk595sDhf-cugZSpXc5p0iIuziIsqa2egf8fsEHyyhjKFMa_wibHaMTpr5CX-TWqjt8HpfxT5LOLT22Yf83l_NR2K4pKVpbPyHh-O4cUGfBoH7Aau3GxbXmhrGAx_dHjg0qEDnkm8OA0fxLajJ7a9G8Klw5LfgI-0oV8mCQev5xQIrjPDF-45M1EsUIsD8UBeNhOKmvxEwCWFyJstG6wxJhC_i0aY1RM-ZpM77JHLZB0_bGGgCzwOzgoYmVwhwEO-pQMEG2IOG72UcOusHy0NI-bWMUK-jkNjFwKFyq4pIybrvdDk_L2-TSVm1JZHEoJtacKEZZLrPBTyTLA0Cf2yvV2QJroEeonLvmrmvk7nr5shiHtCp1hw7I5qr3-H21jJ9nD3qSvR5evNdtiNbdhIHDhMG1c35ShdTks2ssX410_Hh87FHnruBukcs8FZWv12L8Bn9aR6C7yTxzCES89gcLQNUl2ie1RKqc6eY7iV81VOV_zYqY5zd4ucRJSVLC7fTHZa2P55nEpaP-YWGGgw8NtZ16PAGakLdCT0m9BlfS1TqDwHxh441UaCPuBJG-IZVA3QaWTPKN_ab3T1Vf7cxRg6SC9kPvCzTOVYOMndK4HOmpEfW5My5VZCOA8_gUC0P_JTVdLk8DO3YOur56KXyw0guRukSliqMZxiY7zIGwVrgrkM1H4_YuTsZ33eqmiMmKc2Y__vP6uu_XjPzUjX8Vt1DfPujYPgl6NN8p8iMfFByBNKNFUyT1DVuDdBggrf_u3xzHnSWE1nOgpxryhTx84aK_F0djHkWEm4sCBiaAsE63dK0AiyHUaqeH-MfaBr6xgTiMdCZnuhE3sgaavBdB-_AO1Tx5r3BVoyspdMMK87qsPFf0N6BoHpTYi65d_6fZH7f5zlJJc4f-bcrHS0vR7N8D4JR0qUODBPyLxKyWdR3juazUfJXLTR_nyYi_E5W7qiWCagbZ5vjkDEuE-c6p4O13aaCFW5DBJXp4I-azZE0FI9ljxFIxjKeP-vspYgdnRTpthuAjnW_YUFf04ySPiXt3ti7H2UPBZT1hZ5fEaj6Bw33QFiQnR5XFJ07LhhoIzUaNnAXaU8qk8N7CJdVo8rJD9esYM4BAkLeiiJaEY5Oj4reIQPFO35FcSDk9vMWkOWQ6cNuhsmUe2ukGM0EmO1ypNJxtAu6raHC76rN1Onug4bEJflkoZBaA8LX4xaY0-jfmesQQdS5fLas9mrfBv3ooUnG75T7WnwhrZGOFvdfgratYymGX522_vMAUNJX8BRBHWYdQjsLP1VMVQXRhREwWoOL_MguNhxSFWm2IIGtkvc2B5UaaZOJp8eskcmRfz489_tVpCzXeWPEj4IltMGbmQlCRn3KdSDkKO-TRkLBgaqTmuEPYsDYl9_miM7g_UNY6xfQpxs9wglsb63UQQ_fAW_Z7nWUKMDebEdg3SKvBJkaQ7FUmIqx7juRJ7BVwZGfQhTCwE0a8iefCtfxM56ZwPfG3HUzeo9Pvm31ewrf7o2vi3WoDnNnNHKeW5ti1Gi4Vgq4Fj7j_e_QbB2C4xOqgbgDuudPJ2LAzlmRVpUR3cdWn6qEnhSJ-gr1sM1uv7l6-kznxPUQ23NEy_luQit-B0OyLn6uHlKgv9UNiWJhki_3L0Lynk3JBrxnXpMACagOX2UtM8bXZ8yAzSDXMjMXspldlRP7j2UiIfWpnHmdJr891cFbB2XihrbuCtyj1qfeme6WQaFS3UhRIOkVi2G35BS9zSBfL3CZVPbKRL2xsUUoswDKk4go-pQ_Q7w1LCIG6Cd6s-62wXrNtrFzqjKVW_xiPSAn4oPOxu0XwiCHhJcngJGBMJi1Y_e0A5cJsHENTIwHtN-F4kVRLlch7khXqZgBJ5gE_8Fn05xim1uIJMudX-72nMJNkvnIMT4q-3Dxt20ZeMSWuyqE5qmBgnSEIui3idL_R0fI2J01O81fXeBfKQLyr4aveO9NCrCTd8-xHfFKHCGqx4mh3xk7IFmqwZTztI5GEYGR6muYM2dwUj7J1AOBxs7iAaRi6_KNhbRFAAMyrevRKUm1VDv3pBW5UPGSga3R4BuI0smaz8ALX1_YRFQKJ3eCodxMMjO-ZAF5gxsZrrKhgAprUunNUaaNIYpXfHFIsqkowoN0lGleRm6CJIGDzWUh0_bZLHC9eXLHmPchUf6duq295sH1NVLExVIUN8bk8mTFpc9CAinHsm5bqjhJOGbEXILUjw5F5L4Wb_tlDB_s83NR8UqnwIWmPVLZImchYztV0PcjLjfhXK1a-mdqpc3q08k-bUniKe5nq_tHt4Ds-UeKnraSB2W_q626MSb-5AaB0bOvWeGxtQN8XT54adZpTLG1G7lSpedCDUXib-PVf-FaaHvIDCCU4qXoJmlop2hrswspfVsKdxkFfaJptxu1lvhCmHLflVmX3NE5325P2kyF6I483IbeAupKyKUUN_kLuMOGu5dJrR0y6O59T7mOfKgUaIT88XygshmRFC3HdQwGhkE8vOD3T4VVk6RgjX4aIVB8HugbXkCgyuDhwh8n8WkdAwxGvk8hnsUPT1nLhHzB0Rr2fIZGSu8FjQBarD9dZlZvO7avpF4sI3-DrRjaSz-X_0271SbiaFdmDfnKiSctBuzihheCKjBmriq2IpKcvqMgUF-kC2nppBYc_TYGa-a7X8YbCAeu3KNCFrKFEkUxjk72zD3fPqaUR97fbCXreW19d2m5RoP2IzHbwppXQtEXmiZ4atRxD5o6XdoxLC_B9rTiqtJfMm5-3YdO0kU3dXXXBubHjGBpielntKFJP0nfrnubxzQNQW0IAUAKXj-BqWkmE2rHtsmSIeMabyw8a9khD68C36dYML_lo4pMcvKZM8ZBOGRHERMZyXQ9Z8bFV9p6GDx27FHdUHsCRZLf1qb4jeiQupVdimK9XNe0Xl7UvGg1NKzMwBc0xwGEjhyuKcedFIEaPkrrDfFVfAJ5Pwl70u0Bs_SRpWsIaJJRv9YS60hbFnef6odz6EuyCRrD57BPLj3BmEUdWKsEcP086Cf40Az3Dyx1gA&cid=CAQSXgDq26N9k76okzX9Nb-LUx5pURIilEWzh4Oy4TLmmvYybTWOmiVuuwt2yJdaN0ac8IsZ2krbrMuB3rF8_LwRm9LBb6iXaAtpnI-xL-vTulc_AYNEijE-ZPoO7hLZOk8YASAT&dv3_ver=m202209210101&rfl=https%3A%2F%2Fbestlifeonline.com%2F&ds=l&xdt=1&iif=1&cor=3017572977498308000&adk=2086295851&idt=149&cac=0&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 20:51:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 934
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Dec 2022 20:51:03 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/ Frame D2FD 30 KB
11 KB 28ms
28ms Script
text/javascript 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221207/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4d60e53476012ab254ca2f3f479903a6be9ead3cb39a9ea353c51ec75c618c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 16:53:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15207
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11387
x-xss-protection: 0
server: cafe
etag: 8197878782792770439
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Dec 2022 16:53:10 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame D2FD 41 KB
15 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com
URL: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 09:24:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42113
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 09:24:44 GMT

GET
DATA 200
OK truncated
/ Frame D2FD 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ba7a1e00f852c92861bef58d26d0fe99b92245cfbfb188e79ca6c80f753431ed

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 RTL_SF_DV360_SU_FRATBOYS_728x90.html Show response
s0.2mdn.net/sadbundle/8094200031927599104/RTL_SF_DV360_SU_FRATBOYS_728x90/ Frame 6C49 22 KB
5 KB 74ms
23ms Document
text/html 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/8094200031927599104/RTL_SF_DV360_SU_FRATBOYS_728x90/RTL_SF_DV360_SU_FRATBOYS_728x90.html?e=69&leftOffset=0&topOffset=0&c=DBChkrs48s&t=1&renderingType=2&ev=01_247

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

368acf9286bb5cefa2badf934bc621ebb353fe2940acb196416755284cf84990

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 15 Dec 2022 21:06:37 GMT
expires: Fri, 15 Dec 2023 21:06:37 GMT
last-modified: Tue, 13 Sep 2022 11:59:29 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D2FD 0
0 143ms
60ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst2TPVR_7DyzGiHtHNuJa2Uqlt9XFUwbnnnPxDdHsmkeWzwef8FqD5YAYy0TVo_Yt2RbccoLIUFhoy2R7-2ISX9VMED-bXeajGCR1s6C6MpHOIi_Ax19Jn5y3NSufcRiWseTFDQeH9GXs6XFD1Y12CO22n_m0OQWmJqr_T24CFesu9BupL76pO8OI-Tg0aqM09ZDOUKi0eUarxke6RdJ526hDkBnAlLItYwp3nUEp_VxVysTr-5yCKzWVWdupg_cX-3wwevAFMV6FcP3tULgSxuA7DnkZne0x7MPhceFlbpMW9XVWzRvZCcCwpNf0afZpLAgfYZezP7_fz6rBQOvULEc-An5gR3sMo_d11F-rD-wIk06fSulW-0d3Q_8PPrqK5xTeN5dY0fDN9Yrkmo9wqO81Hk15D4JXXDLxuhoGZZq6wGfqQG_bt11M7QNLNvx3ZYF5R87qbraZEIoffpTs2QlVLWpccoHIqgBoX4RlOTgl4GdGNKOb2unnKOA9Y-DWj3FawbguYNlFeFYm-f9D0PesPQi6SLtEFrDfFntmBdB0nTsbL4PLUzW1E1EuywRfRFos3HliUh-Fj-dwggFL9xinqAQDni9IDVKNGA95Yki10N3HQnVtJTgV7vVprWCnZFaN0hbK_YB0nmNKsksxWqZxpXBGI0tsCVrGxp5mhDnQUXHEriXmDp6D1Lgaaja9a3sWGpaS4TExD11V0dhgnF_4bwrPKGLWEgl3NjL4d-Mhku4TZgKHdx0G13_ajbFqUjd_5FvK16fO-GSHYsI4kaM_sj_AFTZCha3Ly2rupiywVayFZgS1FSGJnG3Vwoz3-WELUEv8virell2H1leJJ5v4Fd1txrh1dkcXgNDyA58j51OVxqMfGJ_Jz3LNpdXJImyQhxlKGvhPRAEFttYmOttyrfSs3c48uascfIJ0o4oFLUfqMPw5mhuSKHF2O56HKq4uG42RFspHoCCjkvQg7IQ4aRCY-JSRtPCL6oHaDCuv-6vF3UjZfC9ajP-Xb3kU6pLFKU_Thf1CgHMyFc2qyhKgyYF6vVbMemi302O_L_JyqNcw5aecoFPRqO-c-tMNRyNh80kmRBzbfrOb-PeMzv6aGF-XidaXgz8Gxr1vNv4esjRcq_RaGEvzjShQFJ9NUawRcC72CZT7a-slLbQJLvKes2jKhVbjAd3vYs8SJMXxGOOmvQ-0KjiuZjU3DU4qdvJYRjKeUgiZj1j62YpbzKd6XDhtowhaPyBP-HRZDH1FT1cZijKyPCrhZ9OyN_ckVIuu54ny66I8vRtklsoPVjMHvHq8u8r6M&sai=AMfl-YRup2i4JadlLZlPvGTW-IVJiSXmFCTGYqUbxPmit-n3HWTa2flehpUTeR2hci9pvN6nXDNqsPLR4TgP6Cnk_ek4iwbwNG3ukUtF0jbgQiWLhSUpoEtAW4SG4vd3FLteoASu03sU6WCbv6MmqSmiOfisMUZYdAPZR3pmin10nASf5dekcKpXaS0XiQrUDE0rHF_ZrGzJRIipPwjqPeuFa-kDWSrttkJuuxHoKAutQDkmpSUNzHpT7wc8irl5cayQHqragZltZnluwV-4rWAftI8jl6gxnTLR98ESYlZ4__INakQ_vyso1y9vbYexgSxQ0Wo4G0sMiC_byfxGjoe0c1-sFsh3JleskOUPKzX8SeY1IbuUahcm-Q6z8m-oftw&sig=Cg0ArKJSzN-NiHZlNzP_EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=129&cbvp=1&cstd=123&cisv=r20221207.47061&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 15 Dec 2022 21:06:37 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 15 Dec 2022 21:06:37 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 9558 22 KB
8 KB 13ms
13ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 42113
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 15 Dec 2022 09:24:44 GMT
expires: Fri, 15 Dec 2023 09:24:44 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 66ms
66ms Image
text/html 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022120601&jk=3075958559059825&bg=!Dg2lDUnNAAYgquz3AKo7ACkAdvg8WuXTOXMPEjOieR6MP-t-mog62BiySVian8iwL0ry29K_JeERegIAAABEUgAAAAJoAQcKAK52RQ-WZRyDwD0iw1gY-pbDWhd9OfCgWIF9MEoogR2qcmyKkrgcsmAHmG26UrD6PmJTVInm9mek3HyaCY6IDbXW43l3rPMz2k6M4blg9ZMS1ve6r7Aw63ELraY79lMuZ6QrKyNGao6W943Q83x0N7za3Yp0gLY_LjmRJ6L1wqk09xlpYs5-tzg8updzMU2gIA4zoqKVkCAr4HU0OBpDmh7zzYb57HjEfirrnkNH2lyZAtol3yAWzKfIWbSj2qZBwZBKHknhDFigcGhDfmnFKWoqWOFDcF5sVrWWfNzlSdL3ME0WrI_AWWag0UAwFD1rLzTKqj6Y6YGTy33KgKouotYV3BjYBj4F09aBO31a6Z-IT_N1eZ72SoHXKZ3oo-uUc7ldDWREd0-g_mm9DcITPWc1J7HKnTInqGcS2N7qww7dcvMVmHuwpfz9dpcbNGri0PrbgsbTdRe_DgkQGrBhg84bzhchfrJfTOFbUm7yvdwDuYiXUOT7KEMWFyKJePjk9CGbd3QgKzs6aQ__RdYR5ndchUonqFcN4UaL4VNqrHEb8Y87YCBk8idIeLc0A-Dtis0LI9LyAxtr8yof4H3xIsTCi18ywjoWzmaAMU6wQQR0TlDjbK3fhQAkwQ7wPXd8TvuCNau6UJSEM8c8OmYntNPVGTHHDWJHNqjEwPQ_aezX63IoQP2ToteWv30ClLu-8fUGL-TJ5KOn4aNuPOZXnL-E6jJR1HsyduwXL0BdBWrCfRwdGKj4oy5YME92Yayfgr-Bt0BNT0ayW_XaYVLFSbULqdZXOnWJtMSEV9IM95Z4NCX43dlIg_NPeQYWPrV4vvsnKBEgHXfygQv3QNCJ5c3cSkX9OEZSvWuN6X1SKgFsYulgTtWVTODwt6zRRlm98rt6E80h6zrS9-6IL2-X9jNWY2CKk5CWLV5F3iZ0QW0oHTR4Tmq2xysO2PK_V1dVRbgzdWjoAYW5KTbxbZk_jo6defOKk1vO2rQ56207ORDFbIslZDPvF5SOSFVGSFAoSmDGSN_ugk5jNNRqFvzN0ZWHXzb744BhC4c2K4mV8S1unJkMoJkm9BeNiyZKgVRh-s6ifHwCRfzPLQoifwyqlr_mjCakS7Bv_qpgzhMCdnHHM2rmYyvCQeEbHn6ol1ArFyG6hrQFN6O7N5m-Ybt1whtrya7wpxB7H1dR2du_WOmT6pNB4Ih9mlO4z98g
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

GET
H3 200 3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js Show response
pagead2.googlesyndication.com/bg/ Frame 9558 36 KB
16 KB 29ms
28ms Script
text/javascript 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd6a4d39482b37efe9c55c363401d536da1f7abff0e9a2dbdd91d718700ce386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 18:23:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 182574
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16071
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 13 Dec 2023 18:23:43 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 6C49 236 KB
63 KB 34ms
33ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8094200031927599104/RTL_SF_DV360_SU_FRATBOYS_728x90/RTL_SF_DV360_SU_FRATBOYS_728x90.html?e=69&leftOffset=0&topOffset=0&c=DBChkrs48s&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8094200031927599104/RTL_SF_DV360_SU_FRATBOYS_728x90/RTL_SF_DV360_SU_FRATBOYS_728x90.html?e=69&leftOffset=0&topOffset=0&c=DBChkrs48s&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 15 Dec 2022 21:06:37 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 6C49 118 KB
40 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8094200031927599104/RTL_SF_DV360_SU_FRATBOYS_728x90/RTL_SF_DV360_SU_FRATBOYS_728x90.html?e=69&leftOffset=0&topOffset=0&c=DBChkrs48s&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 12:49:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29849
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 16 Dec 2022 12:49:08 GMT

GET
H2 200 createjs.min.js Show response
code.createjs.com/1.0.0/ Frame 6C49 236 KB
63 KB 217ms
30ms Script
text/javascript 2a02:26f0:11a::6867:4830
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://code.createjs.com/1.0.0/createjs.min.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8094200031927599104/RTL_SF_DV360_SU_FRATBOYS_728x90/RTL_SF_DV360_SU_FRATBOYS_728x90.html?e=69&leftOffset=0&topOffset=0&c=DBChkrs48s&t=1&renderingType=2&ev=01_247
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:11a::6867:4830 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Apache /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:37 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=900
x-n: S
accept-ranges: bytes
expires: Thu, 15 Dec 2022 21:21:37 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9558 0
20 B 65ms
65ms Image
image/gif 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BE_jkXYybY_-NHJSY-gbun6CoCQAAAAA4AeAEAg&bg=!q6ilqOzNAAYgquz3AKo7ACkAdvg8Wj6-VUAonESC2jhGRoS43AW_3Z-fELt_Mx_yTVgi-8Av0KZukQIAAABTUgAAAAJoAQeZAyQv0z64krwzr-u8QZ-HYgdoyZbhLi3fRcGHizEeFJt54wt6Cl0Oupkt2oOlBoJPvPuhoPyKYpJPKXBlU0AYfmR2w7Qf3VGSyVphv1IxFKeoQp-tZWNIkknTorAjoXjKVw_UtlzuNqJykIDsVpikm6dE64fx-Z9GYpHVfr-R6UVE2bW-eVjvTvPLiSjQMrWSbo4-lAmABsSr2YS3UeoMjqaq9H78ZGwfU9uthFVpfgIXbhdRDygDXJ_Dhs_OrrqGxOVkrsWgT4HF4BYSFDuOgQYCrsCjLfscPTDPSd5NqeYahyC8VZX6fbPKuTOjUniJxiJhPK2R62TXocWonn4axhJWzRNww7ZnWRvgu0aGlzktFjk2bkOdcMK_2U3xlwhjQxgnAP0q27T4j7bwtlgni03tJqWibRv-cSdwId0ksQCKru1GPo64j2aXJb_b77yS4O7rv3me3N3c6R4Yimqlh7RGFAWt7bu2Stcc77quo5_qlhSRJ5QW6pRoVD9sj7TWyRi6hHhK66nUV1N1LwRt1JWHOEzBonltavj2vutvdAOPeiMwLh4pxmqGYJA75n7jkRTfAg1iK6-BdKh_H6VYG62TCLD8_CoDqhXJC4KeWSgaFgq7KhUtyWj8CoyAVD0faBWO4fesjagEItoKsm-E6yvHf_HL0pBCdBg92q8QTiH9ijbBiM1Fp440u1K-5mPBp7L0OMiI4khjqMWzYi8wjYPWSCJDiU2_sOnQcsB5E472nurMO0PM_SdOC4sz2wutAO5Hp_NEd5pR9frHtjGuTC_o5OZgPgVikqJy1hLsBlpd_2-pLq7-Sq93KGnuvSR8joixcfSm81x9NnEQbDE4jcLJhssY9c7x1qbbnc40NJdBS6SKPkLfaWYta4WBosZ-AhbWM3IJ_ZrgTlJX9e0OwJbK-eRn9Mryg6arKi06mtEVk2Cd-H3-18ZCSpVSZBExQDQq9K02jEibuO-n--DB-3YzwR7iqBCJACjuaz_93feYGZYeZwqTQWVK5id0lyqdfPF_U5Vd6hadn4Sh-xpB8Htylhhz9nrDhhoTnCDfuyriW3VAeXc

Requested by

Host: bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com
URL: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 6C49 7 KB
6 KB 127ms
68ms XHR
application/json 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dbb7bcf7ad4eb3d78653945d12559eea2ea6c87981585c0665369259c0ac5829

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5674
x-xss-protection: 0

GET
H3 200 728x90_atlas_P_1.png
s0.2mdn.net/sadbundle/8094200031927599104/RTL_SF_DV360_SU_FRATBOYS_728x90/images/ Frame 6C49 23 KB
23 KB 14ms
14ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8094200031927599104/RTL_SF_DV360_SU_FRATBOYS_728x90/images/728x90_atlas_P_1.png

Requested by

Host: bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com
URL: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

278e0fb3e72de7f65c90c3f631678e0cb53eacf8f250d371804d4975b7bd24d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8094200031927599104/RTL_SF_DV360_SU_FRATBOYS_728x90/RTL_SF_DV360_SU_FRATBOYS_728x90.html?e=69&leftOffset=0&topOffset=0&c=DBChkrs48s&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 18:58:21 GMT
x-content-type-options: nosniff
age: 7696
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23643
x-xss-protection: 0
last-modified: Tue, 13 Sep 2022 11:59:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 15 Dec 2023 18:58:21 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame D2FD 0
0 80ms
52ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst2TPVR_7DyzGiHtHNuJa2Uqlt9XFUwbnnnPxDdHsmkeWzwef8FqD5YAYy0TVo_Yt2RbccoLIUFhoy2R7-2ISX9VMED-bXeajGCR1s6C6MpHOIi_Ax19Jn5y3NSufcRiWseTFDQeH9GXs6XFD1Y12CO22n_m0OQWmJqr_T24CFesu9BupL76pO8OI-Tg0aqM09ZDOUKi0eUarxke6RdJ526hDkBnAlLItYwp3nUEp_VxVysTr-5yCKzWVWdupg_cX-3wwevAFMV6FcP3tULgSxuA7DnkZne0x7MPhceFlbpMW9XVWzRvZCcCwpNf0afZpLAgfYZezP7_fz6rBQOvULEc-An5gR3sMo_d11F-rD-wIk06fSulW-0d3Q_8PPrqK5xTeN5dY0fDN9Yrkmo9wqO81Hk15D4JXXDLxuhoGZZq6wGfqQG_bt11M7QNLNvx3ZYF5R87qbraZEIoffpTs2QlVLWpccoHIqgBoX4RlOTgl4GdGNKOb2unnKOA9Y-DWj3FawbguYNlFeFYm-f9D0PesPQi6SLtEFrDfFntmBdB0nTsbL4PLUzW1E1EuywRfRFos3HliUh-Fj-dwggFL9xinqAQDni9IDVKNGA95Yki10N3HQnVtJTgV7vVprWCnZFaN0hbK_YB0nmNKsksxWqZxpXBGI0tsCVrGxp5mhDnQUXHEriXmDp6D1Lgaaja9a3sWGpaS4TExD11V0dhgnF_4bwrPKGLWEgl3NjL4d-Mhku4TZgKHdx0G13_ajbFqUjd_5FvK16fO-GSHYsI4kaM_sj_AFTZCha3Ly2rupiywVayFZgS1FSGJnG3Vwoz3-WELUEv8virell2H1leJJ5v4Fd1txrh1dkcXgNDyA58j51OVxqMfGJ_Jz3LNpdXJImyQhxlKGvhPRAEFttYmOttyrfSs3c48uascfIJ0o4oFLUfqMPw5mhuSKHF2O56HKq4uG42RFspHoCCjkvQg7IQ4aRCY-JSRtPCL6oHaDCuv-6vF3UjZfC9ajP-Xb3kU6pLFKU_Thf1CgHMyFc2qyhKgyYF6vVbMemi302O_L_JyqNcw5aecoFPRqO-c-tMNRyNh80kmRBzbfrOb-PeMzv6aGF-XidaXgz8Gxr1vNv4esjRcq_RaGEvzjShQFJ9NUawRcC72CZT7a-slLbQJLvKes2jKhVbjAd3vYs8SJMXxGOOmvQ-0KjiuZjU3DU4qdvJYRjKeUgiZj1j62YpbzKd6XDhtowhaPyBP-HRZDH1FT1cZijKyPCrhZ9OyN_ckVIuu54ny66I8vRtklsoPVjMHvHq8u8r6M&sai=AMfl-YRup2i4JadlLZlPvGTW-IVJiSXmFCTGYqUbxPmit-n3HWTa2flehpUTeR2hci9pvN6nXDNqsPLR4TgP6Cnk_ek4iwbwNG3ukUtF0jbgQiWLhSUpoEtAW4SG4vd3FLteoASu03sU6WCbv6MmqSmiOfisMUZYdAPZR3pmin10nASf5dekcKpXaS0XiQrUDE0rHF_ZrGzJRIipPwjqPeuFa-kDWSrttkJuuxHoKAutQDkmpSUNzHpT7wc8irl5cayQHqragZltZnluwV-4rWAftI8jl6gxnTLR98ESYlZ4__INakQ_vyso1y9vbYexgSxQ0Wo4G0sMiC_byfxGjoe0c1-sFsh3JleskOUPKzX8SeY1IbuUahcm-Q6z8m-oftw&sig=Cg0ArKJSzN-NiHZlNzP_EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=459&vt=11&dtpt=330&dett=3&cstd=123&cisv=r20221207.47061&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: bestlifeonline.com
URL: https://bestlifeonline.com/charity-fraud-news/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:38 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 15 Dec 2022 21:06:38 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 6C49 17 KB
6 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 15 Dec 2022 21:06:37 GMT

GET
H3 200 728x90_atlas_NP_1.jpg
s0.2mdn.net/sadbundle/8094200031927599104/RTL_SF_DV360_SU_FRATBOYS_728x90/images/ Frame 6C49 59 KB
59 KB 15ms
15ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8094200031927599104/RTL_SF_DV360_SU_FRATBOYS_728x90/images/728x90_atlas_NP_1.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fcccc1e9f4761af0f31b542efafbb9b3776d0068ac69ac6d3ecd77f474a1bcb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8094200031927599104/RTL_SF_DV360_SU_FRATBOYS_728x90/RTL_SF_DV360_SU_FRATBOYS_728x90.html?e=69&leftOffset=0&topOffset=0&c=DBChkrs48s&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 15:01:46 GMT
x-content-type-options: nosniff
age: 194691
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60799
x-xss-protection: 0
last-modified: Tue, 13 Sep 2022 11:59:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 13 Dec 2023 15:01:46 GMT

GET
H3 200 3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js Show response
pagead2.googlesyndication.com/bg/ Frame 097E 36 KB
16 KB 28ms
28ms Script
text/javascript 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3WpNOUgrN-_pxVw2NAHVNtofer_w6aLb3ZHXGHAM44Y.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd6a4d39482b37efe9c55c363401d536da1f7abff0e9a2dbdd91d718700ce386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 18:23:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 182575
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16071
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 13 Dec 2023 18:23:43 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame E106 42 B
64 B 65ms
64ms Image
image/gif 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsslnHYkO_vGzzKaNc1gQq5W9Wv4y5SsAds1lLNH_q4ONu2yFiH66fAjFS_F46xsVJtPeH-gkuihx_FPzqUQFk4sxIX_sqVLwNNNSGIgZs0hN8tOhX59uasUBpKey2UJg7WOo3UPQQ&sai=AMfl-YTbHS4muj0Sp8XAaTxgsdn-Gp1dYNmb8YG19jBQRfA7-wiUwkpMpbsrUPDUQdwU4dE5LRaSMeqF8sWVWHLImhqxUWq8loAhZYHGn2W8cLiU2-HU7hyLSFg5r5nz7yBUzDajv1t6qsYFQj3j6NVQta_7ch6A9VOafVNaDrS1lwRK&sig=Cg0ArKJSzF4YvL3qVmBCEAE&cid=CAQSXgDq26N9k76okzX9Nb-LUx5pURIilEWzh4Oy4TLmmvYybTWOmiVuuwt2yJdaN0ac8IsZ2krbrMuB3rF8_LwRm9LBb6iXaAtpnI-xL-vTulc_AYNEijE-ZPoO7hLZOk8YASAT&id=ampim&o=982,837&d=300,600&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=296&tls=1296&g=60.50000190734863&h=60.50000190734863&tt=1296&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D2FD 42 B
64 B 64ms
64ms Fetch
image/gif 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssYrC1Q8tu8TjrZ2Wr1r3Fg3MHpIReubN0cS4cMhyxVJxvSiNv7J6ioBc4JgWqtCJrxKmXtsx2fIo7LAHDxY7EP99jZwZLoRecodDTe04Qb-urDzhfgFQhpK0sbKKUCorN3Ea9Xxg&sai=AMfl-YQ-iNlWWH344tMNpgt3D2DAAY66AB_0nnq_MQfZT6N2oyo37bdtEpUm2mthCbUhW7s4Q7xjPv3qATE4CKbPADV3X8s3JcgWLJEN-mRWXiXs0Pccg-n_KbDgmXutGr5lAOXgNXP8g-9EHSp-SNiMt5Ly6DN5_QYCk9r1tgBIUCnZ&sig=Cg0ArKJSzPuieT4gvuUDEAE&cid=CAQSXgDq26N9k76okzX9Nb-LUx5pURIilEWzh4Oy4TLmmvYybTWOmiVuuwt2yJdaN0ac8IsZ2krbrMuB3rF8_LwRm9LBb6iXaAtpnI-xL-vTulc_AYNEijE-ZPoO7hLZOk8YASAT&id=lidar2&mcvt=1000&p=234,436,324,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221207&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2299363294&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1671138397195&rpt=392&isd=0&lsd=0&met=ce&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D2FD 0
20 B 61ms
61ms Ping
image/gif 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1271505794157&version=m202209210101&ct=76&x=1&cor=3017572977498308000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame EE8C 281 B
554 B 179ms
7ms Document
text/html 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: karma.mdpcdn.com
URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.42.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://bestlifeonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 15 Dec 2022 21:06:39 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame A59A 15 KB
6 KB 157ms
18ms Document
text/html 2.18.68.199
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158139

Requested by

Host: karma.mdpcdn.com
URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.68.199 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-68-199.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://bestlifeonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
cache-control: max-age=33170
content-encoding: gzip
content-length: 5549
content-type: text/html
date: Thu, 15 Dec 2022 21:06:39 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Fri, 16 Dec 2022 06:19:29 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 69A7 3 KB
2 KB 23ms
23ms Document
text/html 172.64.151.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: karma.mdpcdn.com
URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://bestlifeonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 368
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 77a224f52bb69ba4-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 15 Dec 2022 21:06:39 GMT
expires: Fri, 16 Dec 2022 01:06:39 GMT
last-modified: Mon, 25 Jul 2022 19:18:30 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 3B45 52 KB
17 KB 152ms
7ms Document
text/html 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: karma.mdpcdn.com
URL: https://karma.mdpcdn.com/service/js-min/karma_revshare.bestlifeonline.com.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://bestlifeonline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 6203
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 15 Dec 2022 21:06:39 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 15 Dec 2022 19:23:16 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 55, 60558
X-Served-By: cache-lga13626-LGA, cache-fra-eddf8230027-FRA
X-Timer: S1671138400.693321,VS0,VE0

GET
H2

200

generic
match.adsrvr.org/track/cmf/
Redirect Chain

https://x.bidswitch.net/sync?ssp=themediagrid
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch&ttd_tpi=1&ttd_puid=themediagrid&gdpr=&gdpr_consent=

70 B
264 B

32ms
32ms

Image
image/gif

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch&ttd_tpi=1&ttd_puid=themediagrid&gdpr=&gdpr_consent=
Protocol: H2
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bestlifeonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 15 Dec 2022 21:06:39 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

Redirect headers

location: //match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch&ttd_tpi=1&ttd_puid=themediagrid&gdpr=&gdpr_consent=
date: Thu, 15 Dec 2022 21:06:39 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame 066A 1 KB
1 KB 78ms
54ms Document
text/html 104.18.33.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fbestlifeonline.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.33.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e3652fb04cbf8a8eaff055a82db89b869367edddebd5bc276634f7e82a1fb97

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 77a224f58f2d925c-FRA
content-encoding: br
content-type: text/html
date: Thu, 15 Dec 2022 21:06:39 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FQlXXQ%2BDraHp8F4y5llWyDRHndIYqeUFfoJ7q8gTUpg%2FYtcAH3P3FQCbfBXmXW%2Fc%2FJoMbftjsyZi9hUUn7m3P2mktdWYoFZFC0fhawgQowOZ5R7uiUoWKSounlqiUilL5Y5OG7qfgcv9lQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 066A
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y5uMXX6E30vfq7BYGADl9wAADHgAAAIB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y5uMXX6E30vfq7BYGADl9wAADHgAAAIB&dcc=t

43 B
855 B

115ms
115ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y5uMXX6E30vfq7BYGADl9wAADHgAAAIB&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fbestlifeonline.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 15 Dec 2022 21:06:40 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 554HE7SVBYH31XEFSA4W
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 15 Dec 2022 21:06:40 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: TGS52MBBP9X840DZ2K3K
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y5uMXX6E30vfq7BYGADl9wAADHgAAAIB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 066A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Y5uMXX6E30vfq7BYGADl9wAADHgAAAIB&gdpr_consent=&us_privacy=&gdpr=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGDYr-REVgquEpAeMi_B29A&google_cver=1

43 B
888 B

75ms
64ms

Image
image/gif

104.18.33.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGDYr-REVgquEpAeMi_B29A&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fbestlifeonline.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H3
Server: 104.18.33.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:39 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hYzK8%2FHXgibAc%2BCXBAwPbNbLtLjBvYdYv8c5JTTEu%2B%2B%2Fh42yjc2gdzp9p%2FXBnyq6ywbHY5dDgtuD3RMP%2B1dBwGyMoGTgJQeYj2L8fRIK8rVO%2FPeL8IJRrNAAg0Pt6I0BCU2V7MSGRyHUdg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 77a224f6ce675ca4-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:39 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGDYr-REVgquEpAeMi_B29A&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 342
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame 066A 70 B
264 B 33ms
31ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fbestlifeonline.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 15 Dec 2022 21:06:39 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 066A
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2842252166214923572

43 B
766 B

24ms
10ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2842252166214923572
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fbestlifeonline.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 15 Dec 2022 21:06:39 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

Date: Thu, 15 Dec 2022 21:06:39 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 178.162.209.140; 178.162.209.140; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 71e20bbe-c4e4-4146-9542-b55353f493de
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2842252166214923572
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 066A
Redirect Chain

https://euexchangesync.digitaleast.mobi/usersync/index.gif?us_privacy=&gdpr=&gdpr_consent=
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=11&external_user_id=25642f6c-d399-4f75-8706-f1b61e6ed1fe

43 B
766 B

21ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=11&external_user_id=25642f6c-d399-4f75-8706-f1b61e6ed1fe
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fbestlifeonline.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 15 Dec 2022 21:06:39 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=11&external_user_id=25642f6c-d399-4f75-8706-f1b61e6ed1fe
date: Thu, 15 Dec 2022 21:06:39 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 131
content-type: text/html; charset=utf-8

GET
H2 200 ix
ad4m.at/ad/sim/ Frame 066A 0
0 89ms
23ms Image
text/html 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad4m.at/ad/sim/ix
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fbestlifeonline.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

GET
H2

200

crum
dsum.casalemedia.com/ Frame 066A
Redirect Chain

https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID
https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2842252166214923572

43 B
875 B

173ms
30ms

Image
image/gif

172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2842252166214923572
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fbestlifeonline.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:39 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qAdzNUh4gEwwp4Ugo1JOo%2FU7iAPWq7TzInhNXIMabHdrYgx%2FDtKZ0EQr2Far05NJZX4XCEyV%2FxiwBCj6hU6ZqHt1%2FUBgT67VjJKyhKjKz3gHXMcDH%2BEed8ePcCqZjoDm5i8JgrtF"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 77a224f6fc8d9b9e-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 15 Dec 2022 21:06:39 GMT
AN-X-Request-Uuid: 980c0c2c-c357-4fbe-86dc-5a51d2d8560f
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2842252166214923572
Connection: keep-alive
X-Proxy-Origin: 178.162.209.140; 178.162.209.140; 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK ie
match.prod.bidr.io/cookie-sync/ Frame 066A 43 B
433 B 183ms
31ms Image
image/gif 54.76.69.248
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/ie

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.76.69.248 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-76-69-248.eu-west-1.compute.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
Date: Thu, 15 Dec 2022 21:06:39 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame 066A 43 B
353 B 90ms
17ms Image
image/gif 104.18.36.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?Y5uMXX6E30vfq7BYGADl9wAA%263192
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fbestlifeonline.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.94 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:39 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 81258
etag: "902a3d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 77a224f66f4c915c-FRA
content-length: 43
expires: Fri, 16 Dec 2022 21:06:39 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 3B45 0
747 B 43ms
42ms Script
text/html 185.83.142.19
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.83.142.19 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 15 Dec 2022 21:06:39 GMT
AN-X-Request-Uuid: ee4385b9-9b10-488f-9720-fef453e3a0b3
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 178.162.209.140; 178.162.209.140; 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame A59A 2 KB
2 KB 123ms
18ms Script
text/html 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=52243490&p=158139&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158139
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: f9f95db7c5c73b120e85d4acb2d7fbfdaed9bc15e4bcf59afe518882484a4639

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 15 Dec 2022 21:06:38 GMT
content-length: 1721
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame EE8C 34 KB
10 KB 8ms
8ms Script
text/html 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.42.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 7cb76c118f71a8901748f5e7361ccf95dc92b60470dad6a56d925f61977c0b28

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Thu, 15 Dec 2022 21:06:39 GMT
Content-Encoding: gzip
Last-Modified: Thu, 15 Dec 2022 10:50:31 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=49452
Connection: keep-alive
Content-Length: 10066
Expires: Fri, 16 Dec 2022 10:50:51 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame EE8C 284 B
536 B 91ms
9ms Image
image/jpg 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?us_privacy=1---
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/jpg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 284
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 67B1
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:75bc639b-8c5d-4a00-bf20-6e274124519d&gdpr=0&gdpr_consent=

42 B
554 B

110ms
13ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:75bc639b-8c5d-4a00-bf20-6e274124519d&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158139
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 15 Dec 2022 21:06:39 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Thu, 15 Dec 2022 21:06:39 GMT
Expires: Thu, 15 Dec 2022 21:06:38 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 254 34fcae8 master zrh-pixel-x27 config:1.0.0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:75bc639b-8c5d-4a00-bf20-6e274124519d&gdpr=0&gdpr_consent=

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame A59A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=uy8inrGWQOSLQ1atpuauJg%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

15 KB
15 KB

18ms
18ms

Image
text/html

2.18.68.199
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

Protocol

Server

2.18.68.199 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-68-199.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:39 GMT
content-encoding: gzip
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
server: Apache
etag: "1300708-3de4-5d6ef246ef4cf"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
access-control-allow-origin: https://ci-va2qa-mgmt.pubmatic.com
content-type: text/html
cache-control: max-age=33170
accept-ranges: bytes
content-length: 5549
x-xss-protection: 1; mode=block
expires: Fri, 16 Dec 2022 06:19:29 GMT

Redirect headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:39 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 mw
mwzeom.zeotap.com/ Frame A59A 95 B
382 B 69ms
38ms Image
image/png 2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=1384&env=mWeb&gdpr=0&gdpr_consent=&cid=BB2F229E-B196-40E4-8B43-56ADA6E6AE26
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:39 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://ads.pubmatic.com
access-control-allow-credentials: true
cf-ray: 77a224f74e065c7a-FRA
access-control-allow-headers: *
content-length: 95

GET
H2 404 qmap
sync.crwdcntrl.net/ Frame A59A 49 B
266 B 139ms
30ms Image
image/gif 63.32.97.75
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=BB2F229E-B196-40E4-8B43-56ADA6E6AE26&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.32.97.75 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-32-97-75.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:39 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.13.216
content-length: 49
expires: 0

GET
H2

204

ids
idsync.frontend.weborama.fr/ Frame A59A
Redirect Chain

https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent=
https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent=&bounce=1&random=96204442
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fidsync.frontend.weborama.fr%2Fids%3Fkey%3Dpubmatic%26value%3D%23PM_USER_ID&gdpr=0
https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=BB2F229E-B196-40E4-8B43-56ADA6E6AE26

0
277 B

57ms
20ms

Image
text/plain

34.111.131.239
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=BB2F229E-B196-40E4-8B43-56ADA6E6AE26
Protocol: H2
Server: 34.111.131.239 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 239.131.111.34.bc.googleusercontent.com
Software: Weborama Collect Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:39 GMT
via: 1.1 google
last-modified: Thu, 15 Dec 2022 21:06:40 GMT
server: Weborama Collect Frontend
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 03 Jul 2001 06:00:00 GMT

Redirect headers

location: https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=BB2F229E-B196-40E4-8B43-56ADA6E6AE26
date: Thu, 15 Dec 2022 21:06:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame A59A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QkIyRjIyOUUtQjE5Ni00MEU0LThCNDMtNTZBREE2RTZBRTI2&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
95 B

154ms
13ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 15 Dec 2022 21:06:39 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:39 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame A59A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEAiJ8N-wMM7jY70L4_BPXao&google_cver=1

42 B
298 B

153ms
13ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEAiJ8N-wMM7jY70L4_BPXao&google_cver=1
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 15 Dec 2022 21:06:39 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:39 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEAiJ8N-wMM7jY70L4_BPXao&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubmatic
um.simpli.fi/ Frame A59A 43 B
610 B 63ms
17ms Image
image/gif 35.204.158.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.204.158.49 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

49.158.204.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:39 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Wed, 14 Dec 2022 21:06:39 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame A59A
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=7457261831399399941

42 B
298 B

27ms
14ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=7457261831399399941
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 15 Dec 2022 21:06:38 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 15 Dec 2022 21:06:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=7457261831399399941
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame A59A 70 B
264 B 32ms
31ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 15 Dec 2022 21:06:39 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 3B45 0
863 B 14ms
13ms Script
text/html 185.83.142.19
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.83.142.19 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 15 Dec 2022 21:06:40 GMT
AN-X-Request-Uuid: 5f72e185-f275-4216-ae67-a74606d64e61
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 178.162.209.140; 178.162.209.140; 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame A59A 0
260 B 194ms
13ms Script
text/plain 198.47.127.20

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=158139&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158139
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.20 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:06:41 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: certify.alexametrics.com
URL: https://certify.alexametrics.com/atrk.gif?frame_height=1200&frame_width=1600&iframe=0&title=If%20You%20Get%20a%20Call%20From%20These%20Numbers%2C%20%22Don%27t%20Believe%20Your%20Caller%20ID%2C%22%20FBI%20Says&time=1671138396965&time_zone_offset=0&screen_params=1600x1200x24&java_enabled=0&cookie_enabled=1&ref_url=&host_url=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&random_number=11019233218&sess_cookie=9b22cb9b185179c4b249c98f3c9&sess_cookie_flag=1&user_cookie=9b22cb9b185179c4b249c98f3c9&user_cookie_flag=1&dynamic=true&domain=bestlifeonline.com&account=OcS6o1QolK10Io&jsv=20130128&user_lang=en-US

Domain: api.rlcdn.com
URL: https://api.rlcdn.com/api/identity/envelope?pid=13435

Verdicts & Comments Add Verdict or Comment

108 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

66 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
bestlifeonline.com/charity-fraud-news	1969-12-31 23:59:59	Name: Value: test
bestlifeonline.com/charity-fraud-news	1970-01-20 08:12:18	Name: _liChk Value: 0.04890932924614222
i.liadm.com/s	1970-01-20 08:55:30	Name: _li_ss Value: KiUdAuaYwiIGCMcBEPsTIgYIxgEQ-xMiBgjFARD7EyIGCKsBEPsTMgUIBhD7EzIFCAoQ-xMyBQgLEPsTMgUIDBD7Ew
.bestlifeonline.com/	1970-01-20 08:12:20	Name: _parsely_session Value: {%22sid%22:1%2C%22surl%22:%22https://bestlifeonline.com/charity-fraud-news/%22%2C%22sref%22:%22%22%2C%22sts%22:1671138395118%2C%22slts%22:0}
.bestlifeonline.com/	1970-01-20 17:41:42	Name: _parsely_visitor Value: {%22id%22:%22pid=7bbe17d7f09bdaf8ccc3d51b596dcbe0%22%2C%22session_count%22:1%2C%22last_session_ts%22:1671138395118}
bestlifeonline.com/	1970-01-20 08:22:23	Name: isSlowHardware Value: 0
.bestlifeonline.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .bestlifeonline.com
.bestlifeonline.com/	1970-01-20 17:48:18	Name: _lc2_fpi Value: 2baacde7071f--01gmbsrhey3f3n943dt525t6ry
bestlifeonline.com/	1970-01-20 17:48:18	Name: muuid_origin Value: bestlifeonline.com
bestlifeonline.com/	1970-01-20 17:48:18	Name: muuid_source Value: CLIENT
bestlifeonline.com/	1970-01-20 17:48:18	Name: muuid_date Value: 1671138395765
bestlifeonline.com/	1970-01-20 17:48:18	Name: first_request_id Value: 21488a01-67aa-4275-b38c-1f3fe4229fa5
bestlifeonline.com/	1970-01-20 17:48:18	Name: globalTI_SID Value: 1c0b326f-9334-45dc-896d-c8762657f940
d9jj3mjthpub.cloudfront.net/	1970-01-20 17:48:18	Name: cross_site_muuid Value: d52e79ae-96a1-5d2a-a188-fb037d4e6cb8
.bestlifeonline.com/	1970-01-20 08:13:44	Name: _gid Value: GA1.2.1150022301.1671138396
.bestlifeonline.com/	1970-01-20 08:12:18	Name: _gat Value: 1
.bestlifeonline.com/	1970-01-20 17:48:18	Name: _ga_NYD0HKHMHR Value: GS1.1.1671138395.1.0.1671138395.0.0.0
.bestlifeonline.com/	1970-01-20 17:48:18	Name: _ga Value: GA1.1.1762872910.1671138396
bestlifeonline.com/	1970-01-20 08:55:30	Name: _pbjs_userid_consent_data Value: 3524755945110770
.liadm.com/	1970-01-20 17:48:18	Name: lidid Value: 4ba72a6d-0b6c-4b39-b0f3-c00c220ace13
.bestlifeonline.com/	1970-01-20 08:12:20	Name: __asc Value: 9b22cb9b185179c4b249c98f3c9
.bestlifeonline.com/	1970-01-20 16:59:20	Name: __auc Value: 9b22cb9b185179c4b249c98f3c9
.bestlifeonline.com/	1970-01-20 17:33:54	Name: __gads Value: ID=e2644c119fd48e94:T=1671138396:S=ALNI_MbLCWSrKrqvWI9uqZY2K9IT34RNpw
.bestlifeonline.com/	1970-01-20 17:33:54	Name: __gpi Value: UID=00000b92d5e6d62c:T=1671138396:RT=1671138396:S=ALNI_MauV_crun7NEpB8WaWdT3lp2prIMg
.mathtag.com/	1970-01-20 17:38:13	Name: uuid Value: 75bc639b-8c5d-4a00-bf20-6e274124519d
.bidswitch.net/	1970-01-20 16:57:54	Name: tuuid Value: daa7bc4e-2fb8-4dbf-90f4-cc700820cf43
.bidswitch.net/	1970-01-20 16:57:54	Name: c Value: 1671138397
.bidswitch.net/	1970-01-20 16:57:54	Name: tuuid_lu Value: 1671138397
.doubleclick.net/	1970-01-20 17:33:54	Name: IDE Value: AHWqTUkpHKqLK3wLL11P2r_EwYYRI1X-sVnoa47ekRREzEfC6PYLfTRojdemmOY7
.adnxs.com/	1970-01-20 10:21:54	Name: uuid2 Value: 2842252166214923572
.casalemedia.com/	1970-01-20 16:57:54	Name: CMID Value: Y5uMXX6E30vfq7BYGADl9wAA
.casalemedia.com/	1970-01-20 10:21:54	Name: CMPS Value: 3192
.casalemedia.com/	1970-01-20 10:21:54	Name: CMPRO Value: 3192
.adnxs.com/	1970-01-20 10:21:54	Name: anj Value: dTM7k!M41.D>6NRF']wIg2GU$o15e)!]tbPl1M>e)ZlrFUfJ+tGXxp2A-DgAZTj!ADVipS:Alk!DFSw]c?2TFs+lnK3If)y3KL9D3I?+O<Nb$C
.doubleclick.net/	1970-01-20 08:12:21	Name: DSID Value: NO_DATA
.yahoo.com/	1970-01-20 16:58:15	Name: A3 Value: d=AQABBF2Mm2MCEMYUak4bZX4Zy9oHzeFOslMFEgEBAQHdnGOlYwAAAAAA_eMAAA&S=AQAAAtYQ5WhziYUIpmKzdKC5k7Y
.e.dlx.addthis.com/	1970-01-20 17:42:32	Name: na_tc Value: Y
.live.streamtheworld.com/	1970-01-20 08:22:23	Name: idsync-bsw-uid-s Value: daa7bc4e-2fb8-4dbf-90f4-cc700820cf43
.addthis.com/	1970-01-20 17:42:32	Name: na_id Value: 2022121521063800010532155224
.addthis.com/	1970-01-20 17:42:32	Name: na_tc Value: Y
.addthis.com/	1970-01-20 17:42:32	Name: uid Value: 639b8c5e84914ce3
.addthis.com/	1970-01-20 17:42:32	Name: ouid Value: 639b8c5e000153779f422849df70f777caa653981cfa2729f9cb
.dlx.addthis.com/	1970-01-20 08:55:30	Name: na_rn Value: 0
.dlx.addthis.com/	1970-01-20 08:55:30	Name: na_sr Value: 20221215
.dlx.addthis.com/	1970-01-20 08:12:18	Name: na_srp Value: 7601
.dlx.addthis.com/	1970-01-20 08:55:30	Name: na_sc_e Value: 0
bestlifeonline.com/	1970-01-20 08:12:21	Name: _lr_retry_request Value: true
bestlifeonline.com/	1970-01-20 08:55:30	Name: _lr_env_src_ats Value: false
.ads.pubmatic.com/	1970-01-20 08:13:44	Name: KCCH Value: YES
.pubmatic.com/	1970-01-20 16:57:54	Name: KADUSERCOOKIE Value: BB2F229E-B196-40E4-8B43-56ADA6E6AE26
.pubmatic.com/	1970-01-20 10:21:54	Name: chkChromeAb67Sec Value: 1
.pubmatic.com/	1970-01-20 08:13:44	Name: pi Value: 158139:2
.pubmatic.com/	1970-01-20 10:21:54	Name: DPSync3 Value: 1672272000%3A245_241_201_227
.pubmatic.com/	1970-01-20 10:21:54	Name: SyncRTB3 Value: 1672272000%3A220_21_13_56_7_54
.casalemedia.com/	1970-01-20 10:21:54	Name: CMTS Value: 3343
.simpli.fi/	1970-01-20 16:59:20	Name: suid Value: 5BB6856304104A9BB0FECF05236700CB
.zeotap.com/	1970-01-20 16:57:54	Name: zc Value: 10adad4d-def2-4579-522f-d975bd90ec49
.adform.net/	1970-01-20 08:56:56	Name: C Value: 1
.adform.net/	1970-01-20 09:38:42	Name: uid Value: 7457261831399399941
.weborama.fr/	1970-01-20 17:38:13	Name: AFFICHE_W Value: 4rNUrENYoSbi86
.pubmatic.com/	1970-01-20 10:21:54	Name: KRTBCOOKIE_27 Value: 16735-uid:75bc639b-8c5d-4a00-bf20-6e274124519d&KRTB&16736-uid:75bc639b-8c5d-4a00-bf20-6e274124519d&KRTB&23019-uid:75bc639b-8c5d-4a00-bf20-6e274124519d&KRTB&23208-uid:75bc639b-8c5d-4a00-bf20-6e274124519d
.pubmatic.com/	1970-01-20 08:55:30	Name: KRTBCOOKIE_391 Value: 22924-7457261831399399941&KRTB&23263-7457261831399399941
.pubmatic.com/	1970-01-20 10:21:54	Name: KRTBCOOKIE_80 Value: 22987-CAESEAiJ8N-wMM7jY70L4_BPXao&KRTB&16514-CAESEAiJ8N-wMM7jY70L4_BPXao&KRTB&23025-CAESEAiJ8N-wMM7jY70L4_BPXao&KRTB&23386-CAESEAiJ8N-wMM7jY70L4_BPXao
.pubmatic.com/	1970-01-20 08:55:30	Name: PugT Value: 1671138399
.amazon-adsystem.com/	1970-01-20 12:57:25	Name: ad-id Value: AzaqbwUbLEAbpuNgKO0HrHg
.amazon-adsystem.com/	1970-01-20 17:48:18	Name: ad-privacy Value: 0

11 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://api.rlcdn.com/api/identity?pid=2&rt=envelope Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://dc8xl0ndzn2cb.cloudfront.net/js/bestlifeonline/v0/keywee.min.js Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
network	error	URL: https://certify.alexametrics.com/atrk.gif?frame_height=1200&frame_width=1600&iframe=0&title=If%20You%20Get%20a%20Call%20From%20These%20Numbers%2C%20%22Don%27t%20Believe%20Your%20Caller%20ID%2C%22%20FBI%20Says&time=1671138396965&time_zone_offset=0&screen_params=1600x1200x24&java_enabled=0&cookie_enabled=1&ref_url=&host_url=https%3A%2F%2Fbestlifeonline.com%2Fcharity-fraud-news%2F&random_number=11019233218&sess_cookie=9b22cb9b185179c4b249c98f3c9&sess_cookie_flag=1&user_cookie=9b22cb9b185179c4b249c98f3c9&user_cookie_flag=1&dynamic=true&domain=bestlifeonline.com&account=OcS6o1QolK10Io&jsv=20130128&user_lang=en-US Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://pippio.com/api/sync?pid=710914&_=1&it=4&iv=04e8f8825e07702d99acb9e453c592e1&it=4&iv=18668a8a902dfca4c2bd4d0ab72e02ba5d2a286e&it=4&iv=da3fd4f333b0e201a3ceb4fd1310e885118cf83d8c0237f99c1493705d6f9238 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://pippio.com/api/sync?pid=710914&_=3&it=4&iv=04e8f8825e07702d99acb9e453c592e1&it=4&iv=18668a8a902dfca4c2bd4d0ab72e02ba5d2a286e&it=4&iv=da3fd4f333b0e201a3ceb4fd1310e885118cf83d8c0237f99c1493705d6f9238 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://pippio.com/api/sync?pid=710914&_=2&it=4&iv=04e8f8825e07702d99acb9e453c592e1&it=4&iv=18668a8a902dfca4c2bd4d0ab72e02ba5d2a286e&it=4&iv=da3fd4f333b0e201a3ceb4fd1310e885118cf83d8c0237f99c1493705d6f9238 Message: Failed to load resource: the server responded with a status of 451 ()
other	warning	URL: https://cdn.ampproject.org/rtv/012211060024000/v0/amp-ad-exit-0.1.mjs(Line 1) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://cdn.ampproject.org/rtv/012211060024000/v0/amp-ad-exit-0.1.mjs(Line 1) Message: Unrecognized feature: 'attribution-reporting'.
javascript	error	URL: https://bestlifeonline.com/charity-fraud-news/ Message: Access to XMLHttpRequest at 'https://api.rlcdn.com/api/identity/envelope?pid=13435' from origin 'https://bestlifeonline.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://api.rlcdn.com/api/identity/envelope?pid=13435 Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=BB2F229E-B196-40E4-8B43-56ADA6E6AE26&gdpr=0&gdpr_consent= Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aax-dtb-cf.amazon-adsystem.com
acdn.adnxs.com
ad4m.at
ads.pubmatic.com
adservice.google.com
adservice.google.de
api.parsely.com
api.rlcdn.com
as-sec.casalemedia.com
b-code.liadm.com
bae1d3ab86c7a2b564b833f098e1df11.safeframe.googlesyndication.com
bestlifeonline.com
c.amazon-adsystem.com
c1.adform.net
c2shb.ssp.yahoo.com
cdn.ampproject.org
cdn.indexww.com
cdn.parsely.com
certify.alexametrics.com
cm.g.doubleclick.net
code.createjs.com
consent.cookiebot.com
consentcdn.cookiebot.com
cr.frontend.weborama.fr
d30qdagvt44524.cloudfront.net
d31qbv1cthcecs.cloudfront.net
d9jj3mjthpub.cloudfront.net
dc8xl0ndzn2cb.cloudfront.net
dsum-sec.casalemedia.com
dsum.casalemedia.com
e.dlx.addthis.com
euexchangesync.digitaleast.mobi
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
grid.bidswitch.net
hbopenbid.pubmatic.com
htlb.casalemedia.com
i.liadm.com
ib.adnxs.com
id.sv.rkdms.com
idsync.frontend.weborama.fr
image2.pubmatic.com
image6.pubmatic.com
js-sec.indexww.com
karma.mdpcdn.com
lightboxapi.azurewebsites.net
match.adsrvr.org
match.prod.bidr.io
mwzeom.zeotap.com
p1.parsely.com
pagead2.googlesyndication.com
pippio.com
pixel.wp.com
pr-bh.ybp.yahoo.com
redirect.prod.experiment.routing.cloudfront.aws.a2z.com
region1.google-analytics.com
rp.liadm.com
rp4.liadm.com
s.amazon-adsystem.com
s0.2mdn.net
s3.lightboxcdn.com
sb.scorecardresearch.com
secure.adnxs.com
secure.gravatar.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
simage4.pubmatic.com
ssum-sec.casalemedia.com
stags.bluekai.com
stats.g.doubleclick.net
stats.wp.com
sync.crwdcntrl.net
sync.mathtag.com
token.rubiconproject.com
tpc.googlesyndication.com
um.simpli.fi
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.lightboxcdn.com
x.bidswitch.net
yield-op-idsync.live.streamtheworld.com
api.rlcdn.com
certify.alexametrics.com
104.18.33.19
104.18.36.94
107.178.254.65
108.156.253.53
108.156.255.76
108.157.4.38
13.226.155.71
142.250.184.194
142.250.201.194
15.197.193.217
151.101.193.108
172.64.151.162
172.64.154.237
18.194.114.29
18.66.23.210
185.29.132.245
185.64.189.110
185.64.190.77
185.64.190.78
185.80.39.216
185.83.142.19
185.89.210.46
192.0.76.3
198.47.127.20
2.18.68.199
20.40.202.0
2001:4860:4802:32::36
208.92.55.231
23.37.42.132
2600:1f18:730:b140:4517:6949:e1a8:7c3d
2600:9000:206e:ae00:19:bcbe:a700:21
2600:9000:224a:7c00:8:8845:1500:93a1
2600:9000:224a:e800:d:2820:3bc0:93a1
2600:9000:2315:ca00:11:e0c9:84c0:21
2602:803:c003:200::31
2606:4700:10::6816:1857
2606:4700:10::ac43:d42
2606:4700:20::681a:ad1
2606:4700::6813:d383
2a00:1450:4001:80b::2002
2a00:1450:4001:80e::2001
2a00:1450:4001:80f::2002
2a00:1450:4001:810::2002
2a00:1450:4001:811::2001
2a00:1450:4001:828::2002
2a00:1450:4001:82b::2006
2a00:1450:4001:82f::2001
2a00:1450:4001:831::200a
2a00:1450:400d:803::2008
2a00:1450:400d:80c::2002
2a00:1450:400d:80c::2004
2a00:1450:400d:80d::2002
2a00:1450:400d:80e::2003
2a00:1450:400d:80e::200e
2a00:1450:4025:401::9d
2a02:26f0:11a::6867:4830
2a02:26f0:3500:18::1724:a29a
2a02:26f0:3500:887::f09
2a04:fa87:fffe::c000:4902
2a05:d018:d29:3602:2c64:3412:9e4:7e3a
3.126.18.125
34.111.129.221
34.111.131.239
34.120.133.55
34.95.81.168
35.204.158.49
35.82.251.53
37.157.6.254
52.28.203.152
52.46.128.147
54.146.241.124
54.155.18.159
54.162.152.214
54.205.34.37
54.236.68.181
54.76.69.248
63.32.97.75
69.173.144.138
69.192.160.219
99.86.240.53
000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c
002fbd336dd25524775a8a742584a335995f617fc604686b93ad523ed6116885
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b
0ce7613bb07f30b4dd77f51b62fcbd70bc15439a24b696ca06a694c2c8544ce6
0db85c9dc967b752625788fabf92b0c44ac64cd359e2209a66e15f25974a1613
10559973b2df1031bb021dc84b6e06e835f639518dc6e47ecc07bcfa075c0ffe
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
13dadcc4b17d8faab90a508289241a4cf53c687ecbf36b44a1a494285b0650db
159bd804f3a207ce59088ef63f186ba5b3d906d5245b7bfa882a6a6c3f6a9314
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
1918118b0b9fffc0d63f9171303fff526faed55977a9bda890135f263253a663
196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e
1b1c3ea8b3d9fec1913ac70c81c83f2172acc41988e747bd24d22bf779fd19a0
1c1fef6e6b4f9832603850b9b6562e74d9a6a3700ba836efe88facc577121e8b
1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87
1e3652fb04cbf8a8eaff055a82db89b869367edddebd5bc276634f7e82a1fb97
20b9cd2a5e2125ece15cc0d11ae35586a1e9eb4bc90226eb3df789adf191be61
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
25f8f637daa99a551b158f2794034c771c83f2d448c7b0afc7d4165144efcf60
278e0fb3e72de7f65c90c3f631678e0cb53eacf8f250d371804d4975b7bd24d0
28366b713c6c9430920cda17941e0986072ab055b66f7565851ab7062080e119
29f6da0a8c21c5681511bb9b08663d3fd2c5d09c9bd8054ec354c563b8c8b7c1
2a883433360e32c70dcae5b696a8b8f278cf0e123d6c051a2c7959e77556c132
2e9f3803edf6aaa92819369f28f4aa4e68b5e90d4af9d5fb650f2e8ab30086ec
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
2fbe3a00a18fc9dfe8063f5c8d15423ef10d5441fe5ccf0220245cf87ff70579
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
3259cbcfa99e2a96f773454a1d04f8bf60239cb9383e6f270eeed9941a78366f
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
368acf9286bb5cefa2badf934bc621ebb353fe2940acb196416755284cf84990
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
46b60a64c27e555d9e1d416f2a22d50a078f8a7d9b906050efac3c60403e5375
48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4f29b4389a6e08bf3ffcdfb097597d5621b4abac31a74f89c3fa3537dc428e68
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
513b2cab9e5d6b924fc802baf0c0934b37d8590c161ae885ab7b3244e3b73d7f
53b907326f7c21a04f6d39cc32ff471aafec57d887feabfabb53394f378c659f
5454348764a888ff1d88fd50e4af1a9527cbfe73694597651f407648829ff66b
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5800f312944709b8d8e2e638a4c64704be610892c2fd06e962ac74b222615e19
58a07739b05fec4d319e4d5c6b1fa4ac79e2a625e08ab3f303929b77fde5bdf4
59cb97a4e767151488e2ad56cddaa76f81ce07285d80a81be954314fd5285017
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5
5e84ce936bc3e3844a5d9efb3ac7d28107fa17234fa2a6c2bf3491fc284f0d4f
5fcccc1e9f4761af0f31b542efafbb9b3776d0068ac69ac6d3ecd77f474a1bcb
607cbdc76ef97516ae611ba207be56c5e1f1f6e325fbdcac258872ddd66ea333
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6244c1acdb39b05e040378e6bc6281f24b3d4380f868f553f4576fb2427dffe7
6b5ef7861572324f3e9d49c9284d10e8e582e1bc44694394afdf5bdc0e6bd0cd
6b619934a6caa78018af1d52dd9af89c3816f34e7bc46f74d4ba430a3f49c017
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
727b3ff0c716fa8e38788e3dab83691b06edf37ca523b826f9ef67700021516b
738e5435f2d18427d291a0d6289eee0ebbc87b596d6003919f255760ac293104
746ae7f598a62be07b6a3f7d67c810fcd8ee9efc0e69ce119f912b02e400ed41
7cb76c118f71a8901748f5e7361ccf95dc92b60470dad6a56d925f61977c0b28
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb
82fc7415ed2df389cb26bd29f6f73e4fb63677f3cc5f0b35a1a1ded5da17b5e0
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8436c7297967e0e046154bf4a7f2052169399e6c29089277906e6988bfb1d2d1
86a2a3999c65a6ee0bbee35ac7515f04856e0fcbcebdffd56001c0dc924d887a
8c088dfd8e193dd7acf512456d0afcd9acf412560096e8c4a51f6fb1022bfd80
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8e5112910e4cb17933a90d0f8f4aca7a924227dd7f722a152c6c734e1a0adf54
8ee5f53d3752309af021002b2199a06523b1fd03f3ea1cdaf5d59e911d4d8178
90398d274e093821b066f9bc367d1ddb8e2fa9d18d7660c10cc3704c4d9f519f
945cd9f50090db23f3e4e2c6d61a679a8439d5853b1ebd76f8bf66bc89ae46a8
949ef00ce71e069fc69a6b829771726245072e18e56b264c536837c459b3febf
956a243efde51c11758094189afe270cdc8bb79440e57f27874eecd06aa6663f
95d4c35944949980c11b56c7abcd96d0632c3281a6ffd54bb236d501643558bc
96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9
9891443922f3308f109272f30ac5e06397f084add2d14f4373fa718ceeb7c834
98ccd33e523985efa588344a13932892db38b1335243f989dd366450db8ea68d
9bd82960d99b3a76f4af77a88a346bd61f87bac5ff2f385ee28cd669d8f22134
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a01f9f2f5ba1812441a49f7f1dc0b04fb56a18b486005289b8df4212381f10ce
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
b4d07892cde715d50bb69c1982df496385d1dfd8f9d1867c31f19a3c8634cfae
b5f4af2ecfa8cbe2481e04b0bcb39b7c40ef2f97f04d29d253685111337755b2
b84b27bd8f1dea53787ebe8a939fdb97b0da6acb90dd427697fe943c2c00baf5
ba7a1e00f852c92861bef58d26d0fe99b92245cfbfb188e79ca6c80f753431ed
bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27
c19a4370ad20f4dc3149b06f31fd137cd7e19042e1b8f0c82c99cd8c9d0667db
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c3f73b989e0620a4d2e12ed57a0d538e4580b8fefaa1fefbad73e0abad6d227f
c4d60e53476012ab254ca2f3f479903a6be9ead3cb39a9ea353c51ec75c618c8
c78ce438e9d91ea8c16341aaf2c6cf07f9c347eb1130bd922796ad4fb78fe885
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
caee9c990467048086ab44789b5ba0d701757932059854621ebd7c542be4f358
cbcc7311976a0ab1f2311045f55dd300bd583c1eba68f0c7e17b7c62cfcb1da4
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d3732a091080d59e450e719fd7404449bd696e8e7b43ac2ac40d4aaebf5f0fbd
d5aba07282c2246aa5919849ee02168ffb085b7d3854e9f45e7c548fb22aa7df
d89cb9800cc62dcc44a0ba866b4a080ad06f735f60a6afecbd6d691d2e8939dd
da45962a1fb4a049c9367ebe9b1b628f071d7a4c9997ee807c01d23f4866e19c
dbb7bcf7ad4eb3d78653945d12559eea2ea6c87981585c0665369259c0ac5829
dc2f03640c55d7361dc950b90f842e5e0f5d670d27bd10d750c6ba5dfea2e49d
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd6a4d39482b37efe9c55c363401d536da1f7abff0e9a2dbdd91d718700ce386
def1424f4f259a4cf927fe1f7ea7ec24bdc2fc78edca55fdb593cc0c293dbec5
e184bf63ffa0a8b8d3a35a4d4ebb5ca024adaa700dae6547f11b5277b141a642
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5
e8a2f3c10a38d0ab4c01e9336bf0d3a25186007f84fb45f350af144e2a154f05
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152
ecea9fd901f0e775209188c51d1fce00cb090107eecf9ed05bc13757419eaac8
ee54b51af15f1f68f707da981f3c135c249a25e9293871e1e0cbd2c24c7b6117
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
eff473cf679cd4f89c61f0f0889fc582be4fb30f9d980bb15ae2abe731ebfaaa
f30769ea0b80a5d900c5f0de30b1aad1ab461195e69223d5ef63c2c5de8b6c1a
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f6d8c46b1a04accb2b0dc8fd7794d1f60efe4d5ba925ddf549468adf7a88ac9d
f832a3f9fb50dfb245accbfe1f55d83f4330332a2a1b1640888d253398b95bb9
f8f46a25b87be0a002b40f3ba60a28c580f75e3d8f625ffcc66c74d3b7ba6028
f9f95db7c5c73b120e85d4acb2d7fbfdaed9bc15e4bcf59afe518882484a4639
fb5f765b9f99d9ea48a3777fa0d725ea4e402892d0195990764689a09bdd5d60
feeff1b73fc856bbaa909aecd74cd3918a41d2f0642b773831da45ad969317e9

bestlifeonline.com Open in urlscan Pro 2606:4700:10::ac43:d42 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

188 Requests

88 %HTTPS

40 %IPv6

49 Domains

87 Subdomains

73 IPs

9 Countries

2207 kBTransfer

6221 kBSize

66 Cookies

133 Outgoing links

Page URL History

Redirected requests

188 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

bestlifeonline.com Open in urlscan Pro
2606:4700:10::ac43:d42 Public Scan

Screenshot
Live screenshot

Full Image

188
Requests

88 %
HTTPS

40 %
IPv6

49
Domains

87
Subdomains

73
IPs

9
Countries

2207 kB
Transfer

6221 kB
Size

66
Cookies

188 HTTP transactions
9 data transactions