www.edocr.com Open in urlscan Pro
52.1.132.114 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.edocr.com/v/w6xgg6db
Effective URL:
https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god
Submission Tags: falconsandbox
Submission: On March 10 via api (March 10th 2021, 3:43:20 pm UTC) from US

Summary HTTP 61 Redirects Behaviour Indicators

Summary

This website contacted 15 IPs in 2 countries across 10 domains to perform 61 HTTP transactions. The main IP is 52.1.132.114, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.edocr.com.
TLS certificate: Issued by Amazon on May 26th 2020. Valid for: a year.

This is the only time www.edocr.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 15	52.1.132.114 52.1.132.114	14618 (AMAZON-AES) (AMAZON-AES)
13	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:801::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
1	172.217.18.98 172.217.18.98	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::2001	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:82b::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
2 2	2a00:1450:400... 2a00:1450:4001:80f::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
61	15

15 52.1.132.114 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

www.edocr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:82b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
25	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	224 KB
15	edocr.com 1 redirects www.edocr.com	741 KB
10	doubleclick.net googleads.g.doubleclick.net	40 KB
3	gstatic.com www.gstatic.com fonts.gstatic.com	42 KB
3	googletagservices.com www.googletagservices.com	94 KB
3	google.com 2 redirects adservice.google.com www.google.com	378 B
2	google-analytics.com www.google-analytics.com	19 KB
1	googleapis.com fonts.googleapis.com	726 B
1	google.de adservice.google.de	165 B
1	googleadservices.com partner.googleadservices.com	258 B
61	10

	Domain	Requested by
15	www.edocr.com	1 redirects www.edocr.com
13	pagead2.googlesyndication.com	www.edocr.com pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
12	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net
10	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
3	www.googletagservices.com	pagead2.googlesyndication.com googleads.g.doubleclick.net
2	fonts.gstatic.com	fonts.googleapis.com
2	www.google.com	2 redirects
2	www.google-analytics.com	www.edocr.com www.google-analytics.com
1	www.gstatic.com	googleads.g.doubleclick.net
1	fonts.googleapis.com	googleads.g.doubleclick.net
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
61	13

This site contains no links.

Subject Issuer	Validity	Valid
edocr.com Amazon	`2020-05-26` - `2021-06-26`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh

This page contains 9 frames:

Primary Page: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god
Frame ID: F83A9C2EF3DE888444BFE4EBEFD91093
Requests: 34 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210304/r20190131/zrt_lookup.html
Frame ID: A7D176EC1B6A5CBFECAC96ADA5E04E5C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=600&slotname=3952982610&adk=937441900&adf=750878660&pi=t.ma~as.3952982610&w=120&lmt=1615390970&psa=0&format=120x600&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&flash=0&wgl=1&dt=1615390970027&bpp=13&bdt=1404&idt=120&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=8265215402046&frm=20&pv=2&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=25&ady=295&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&xpc=t0areVCsci&p=https%3A//www.edocr.com&dtd=146
Frame ID: 17302D7B0C7C4F74AA628D7DFBE6C715
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=2030016460&pi=t.ma~as.4103433139&w=300&lmt=1615390970&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&flash=0&wgl=1&dt=1615390970040&bpp=4&bdt=1417&idt=140&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=120x600&correlator=8265215402046&frm=20&pv=1&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1270&ady=184&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=8192&bc=31&ifi=2&uci=a!2&fsb=1&xpc=1pekLlagJ9&p=https%3A//www.edocr.com&dtd=149
Frame ID: 238D0C63B42089A9430A7A7CFD131B0B
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&adk=1812271804&adf=3025194257&lmt=1615390970&plat=1%3A16809992%2C2%3A16809992%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&ea=0&flash=0&pra=7&wgl=1&dt=1615390970083&bpp=2&bdt=1460&idt=109&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=120x600%2C300x250&nras=1&correlator=8265215402046&frm=20&pv=1&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=3&uci=a!3&fsb=1&dtd=113
Frame ID: B28A53F87DA63E9BCFBA60A46BF7FCED
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Frame ID: 277AAEAA8F80FE7A33F743F896AC0C8B
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: EB529D8A95F29AF0FA9DA7A80C15E23A
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 310849721E71EA4CA8477AD878BFF97B
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/cBiyZrE2vwbFPBS6sT95jOp0NaMCoy8g5L57SNLHBl8.js
Frame ID: DC17C2E5C326DC83E4E168D57F8CE80E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.edocr.com/v/w6xgg6db HTTP 302
https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god Page URL

Page Statistics

61
Requests

100 %
HTTPS

87 %
IPv6

10
Domains

13
Subdomains

15
IPs

2
Countries

1167 kB
Transfer

3682 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.edocr.com/v/w6xgg6db HTTP 302
https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 42

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 55

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

61 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request the-one-page-magic-spell-proving-i-am-god Show response
www.edocr.com/v/w6xgg6db/zerubbabel112/
Redirect Chain

https://www.edocr.com/v/w6xgg6db
https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god

5 KB
2 KB

140ms
134ms

Document
text/html

52.1.132.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.132.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

/ Express

Resource Hash

40eed669386e62ee126d5aebfcfcac58eff28cc3a887c5fcba441f56610dcd56

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff

Request headers

Host: www.edocr.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

build-number: 1979
content-encoding: gzip
content-security-policy: frame-ancestors 'none'
content-type: text/html; charset=utf-8
date: Wed, 10 Mar 2021 15:42:48 GMT
etag: W/"1419-ReMv/c6JhNBZTkjyIidRDtCG3Pg"
vary: Accept-Encoding
X-Content-Type-Options: nosniff
x-powered-by: Express
Content-Length: 2029
Connection: keep-alive

Redirect headers

build-number: 1979
content-security-policy: frame-ancestors 'none'
content-type: text/html; charset=utf-8
date: Wed, 10 Mar 2021 15:42:48 GMT
location: /v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god
vary: Accept, Accept-Encoding
X-Content-Type-Options: nosniff
x-powered-by: Express
Content-Length: 178
Connection: keep-alive

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 141 KB
50 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

61efd432df76387dd163c58c1f91d3b8c238f7efccd5cb303c72d33ad7f86b9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 15:42:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50670
x-xss-protection: 0
server: cafe
etag: 3486479328048729290
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 10 Mar 2021 15:42:48 GMT

GET
H/1.1 200
OK main.00f291007fc7948c83c0.css
www.edocr.com/v/static/ 2 KB
1 KB 122ms
121ms Stylesheet
text/css 52.1.132.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/v/static/main.00f291007fc7948c83c0.css

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.132.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

/ Express

Resource Hash

65e4e63638e9c69fe634cc25b595b20afe3e704f5eb8adf36a551e3c23a12ecf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
X-Content-Type-Options: nosniff
last-modified: Mon, 01 Mar 2021 23:04:20 GMT
x-powered-by: Express
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=0
date: Wed, 10 Mar 2021 15:42:48 GMT
Connection: keep-alive
accept-ranges: bytes
transfer-encoding: chunked
etag: W/"814-177f0090920"
build-number: 1979

GET
H/1.1 200
OK bundle.js Show response
www.edocr.com/v/static/ 2 MB
559 KB 248ms
125ms Script
application/javascript 52.1.132.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/v/static/bundle.js

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.132.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

/ Express

Resource Hash

1314ac7310108832e8196c0d48ba81a1e627df505f24d450137d77863bbdc00e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
X-Content-Type-Options: nosniff
last-modified: Tue, 02 Mar 2021 14:52:44 GMT
x-powered-by: Express
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0
date: Wed, 10 Mar 2021 15:42:48 GMT
Connection: keep-alive
accept-ranges: bytes
transfer-encoding: chunked
etag: W/"20101b-177f36d53c5"
build-number: 1979

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 05 Feb 2021 21:33:27 GMT
server: Golfe2
age: 863
date: Wed, 10 Mar 2021 15:28:25 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18980
expires: Wed, 10 Mar 2021 17:28:25 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
387 B 48ms
13ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j88&a=1994059489&t=pageview&_s=1&dl=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&ul=en-us&de=UTF-8&dt=THE%20ONE%20Page%20Magic%20Spell%20Proving%20I%20Am%20God%20%7C%20edocr&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1744777942&gjid=909377358&cid=1903151492.1615390969&tid=UA-160144-46&_gid=1990277312.1615390969&_r=1&_slc=1&z=902510182

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 10 Mar 2021 15:42:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.edocr.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK w6xgg6db Show response
www.edocr.com/api-user/viewingSession/ 2 KB
1 KB 251ms
219ms XHR
application/json 52.1.132.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/api-user/viewingSession/w6xgg6db?isEmbed=false

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.132.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

/ Express

Resource Hash

c44f8d8f097f005a511f32b7ad3b3149ab8d1b91d28f6cd9c29684564d0344cc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
X-Content-Type-Options: nosniff
x-powered-by: Express
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
date: Wed, 10 Mar 2021 15:42:49 GMT
Connection: keep-alive
transfer-encoding: chunked
etag: W/"803-IHJyQKGLJgVsfzWlsIhqJJRANzs"
build-number: 1979

GET
H3-Q050 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210304/r20190131/ 227 KB
86 KB 75ms
61ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210304/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-6933461940627641&plah=www.edocr.com&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0f26b5c09e88293e891c94046695af27a5d9a205216cd7cfe827bdafe94d9202

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 15:42:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87278
x-xss-protection: 0
server: cafe
etag: 9196193087333482560
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 10 Mar 2021 15:42:50 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210304/r20190131/ Frame A7D1 11 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210304/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e78c14aeb9435fd03f67ad2ee4c45e18bfcfc100a4c62c8bd886324ce6296f77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210304/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.edocr.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.edocr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 10 Mar 2021 06:55:33 GMT
expires: Wed, 24 Mar 2021 06:55:33 GMT
content-type: text/html; charset=UTF-8
etag: 14371272352318978350
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 5136
x-xss-protection: 0
age: 31637
cache-control: public, max-age=1209600
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
88 B 38ms
38ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama&lserr=1&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Mar 2021 15:42:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK restrictions Show response
www.edocr.com/pas/v2/ViewingSessions/Qgt3ju8jXg9Xad9NmQkytQ/ 226 B
617 B 266ms
265ms XHR
application/json 52.1.132.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/v2/ViewingSessions/Qgt3ju8jXg9Xad9NmQkytQ/restrictions

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.132.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx / Express

Resource Hash

b1ba9fa4ad8fdf667f000a62ef0aebcd3b169d9e70a0e7079072471016139c68

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff

Request headers

Accusoft-Parent-Name: ViewerControl
Referer: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god
Accusoft-Gid: hXwAB6BwbHHVNda4CIjbtg
Accusoft-Parent-Pid: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accusoft-Parent-Taskid: 0
Content-Type: application/json

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
X-Content-Type-Options: nosniff
server: nginx
access-control-allow-headers: *
x-powered-by: Express
transfer-encoding: chunked
access-control-allow-methods: GET
content-type: application/json;charset=utf-8
access-control-allow-origin: *
date: Wed, 10 Mar 2021 15:42:50 GMT
Connection: keep-alive
access-control-allow-credentials: true
vary: Accept-Encoding
build-number: 1979

GET
H/1.1 200
OK 0 Show response
www.edocr.com/pas/Page/q/ 92 KB
45 KB 290ms
289ms XHR
image/svg+xml 52.1.132.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Page/q/0?DocumentID=uQgt3ju8jXg9Xad9NmQkytQ&Scale=1&ContentType=svgb

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.132.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx / Express

Resource Hash

9001872c5b6a266523aec9fee9fdf1899d495b45bbd5f66c601370bbc2c75936

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff

Request headers

Accusoft-Parent-Name: ViewerControl
Referer: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god
Accusoft-Gid: 58GTeeu8rKd5TOG0Da7ejA
Accusoft-Parent-Pid: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accusoft-Parent-Taskid: 0

Response headers

date: Wed, 10 Mar 2021 15:42:50 GMT
content-encoding: gzip
X-Content-Type-Options: nosniff
x-powered-by: Express
transfer-encoding: chunked
Connection: keep-alive
accusoft-data-encrypted: false
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
access-control-allow-credentials: true
content-security-policy: frame-ancestors 'none'
access-control-allow-headers: *
build-number: 1979

GET
DATA 200
OK truncated
/ 1 KB
1 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b8657baaa6b95a17c934001c3338f3cdff05bf8ce67ffe25c3b7ab53cd580241

Request headers

Origin: https://www.edocr.com
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
23 B 38ms
38ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ins_no_ifr&sf=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Mar 2021 15:42:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
23 B 39ms
38ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=abg_host&host=www.edocr.com

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Mar 2021 15:42:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 199 B
258 B 77ms
77ms Script
text/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.edocr.com&callback=_gfp_s_&client=ca-pub-6933461940627641

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210304/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-6933461940627641&plah=www.edocr.com&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f2.1e100.net

Software

cafe /

Resource Hash

a0a8a6526b4a0f339fd2221193ddfc77f82ece499892776221831551918e9755

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 15:42:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 190
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 18ms
17ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.edocr.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 10 Mar 2021 15:42:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 18ms
18ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.edocr.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 10 Mar 2021 15:42:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1730 56 KB
20 KB 611ms
598ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=600&slotname=3952982610&adk=937441900&adf=750878660&pi=t.ma~as.3952982610&w=120&lmt=1615390970&psa=0&format=120x600&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&flash=0&wgl=1&dt=1615390970027&bpp=13&bdt=1404&idt=120&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=8265215402046&frm=20&pv=2&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=25&ady=295&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&xpc=t0areVCsci&p=https%3A//www.edocr.com&dtd=146

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

51632c0019116060520365170fe114d8801da7ea8e954c352816e53abf5703de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6933461940627641&output=html&h=600&slotname=3952982610&adk=937441900&adf=750878660&pi=t.ma~as.3952982610&w=120&lmt=1615390970&psa=0&format=120x600&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&flash=0&wgl=1&dt=1615390970027&bpp=13&bdt=1404&idt=120&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=8265215402046&frm=20&pv=2&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=25&ady=295&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&xpc=t0areVCsci&p=https%3A//www.edocr.com&dtd=146
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.edocr.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.edocr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 10 Mar 2021 15:42:50 GMT
server: cafe
content-length: 20750
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 10-Mar-2021 15:57:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 10 Mar 2021 15:42:50 GMT
cache-control: private

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 45ms
31ms XHR
application/json 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210304&st=env

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f43a8c59fde828314f3f621d0d453307bc212258250f0af7d8b2a0daa7cfa653

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 10 Mar 2021 15:42:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6552
x-xss-protection: 0

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b70bf12b0e8efbbe170ad998a31f97b2e96f42b4bb7cb46712ac222720fa65e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 15:42:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615244746949694"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28222
x-xss-protection: 0
expires: Wed, 10 Mar 2021 15:42:50 GMT

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 238D 50 KB
13 KB 495ms
495ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=2030016460&pi=t.ma~as.4103433139&w=300&lmt=1615390970&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&flash=0&wgl=1&dt=1615390970040&bpp=4&bdt=1417&idt=140&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=120x600&correlator=8265215402046&frm=20&pv=1&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1270&ady=184&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=8192&bc=31&ifi=2&uci=a!2&fsb=1&xpc=1pekLlagJ9&p=https%3A//www.edocr.com&dtd=149

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9288a1e8e6b25a81a0ebed0c2026d9271347797c070df70273acef4f36dde0bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=2030016460&pi=t.ma~as.4103433139&w=300&lmt=1615390970&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&flash=0&wgl=1&dt=1615390970040&bpp=4&bdt=1417&idt=140&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=120x600&correlator=8265215402046&frm=20&pv=1&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1270&ady=184&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=8192&bc=31&ifi=2&uci=a!2&fsb=1&xpc=1pekLlagJ9&p=https%3A//www.edocr.com&dtd=149
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.edocr.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.edocr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 10 Mar 2021 15:42:50 GMT
server: cafe
content-length: 13393
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 10-Mar-2021 15:57:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 10 Mar 2021 15:42:50 GMT
cache-control: private

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
23 B 39ms
38ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&tn=DIV&cls=overlay&ign=false

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Mar 2021 15:42:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
23 B 39ms
39ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&tn=HEADER&cls=MuiPaper-root%20MuiAppBar-root%20MuiAppBar-positionFixed%20MuiAppBar-colorPrimary%20jss2%20mui-fixed%20MuiPaper-elevation4&ign=false

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Mar 2021 15:42:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B28A 0
549 B 21ms
21ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&adk=1812271804&adf=3025194257&lmt=1615390970&plat=1%3A16809992%2C2%3A16809992%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&ea=0&flash=0&pra=7&wgl=1&dt=1615390970083&bpp=2&bdt=1460&idt=109&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=120x600%2C300x250&nras=1&correlator=8265215402046&frm=20&pv=1&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=3&uci=a!3&fsb=1&dtd=113

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6933461940627641&output=html&adk=1812271804&adf=3025194257&lmt=1615390970&plat=1%3A16809992%2C2%3A16809992%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&ea=0&flash=0&pra=7&wgl=1&dt=1615390970083&bpp=2&bdt=1460&idt=109&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=120x600%2C300x250&nras=1&correlator=8265215402046&frm=20&pv=1&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=3&uci=a!3&fsb=1&dtd=113
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.edocr.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.edocr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 10 Mar 2021 15:42:50 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 10-Mar-2021 15:57:50 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 10 Mar 2021 15:42:50 GMT
cache-control: private

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 15:42:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1611170586013198"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6403
x-xss-protection: 0
expires: Wed, 10 Mar 2021 15:42:50 GMT

GET
H3-Q050 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/221/ Frame 277A 12 KB
5 KB 35ms
21ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

49e1dcef611a905b866974d135554059ecd77a0ae022553178ec359ea0b64504

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/221/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.edocr.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.edocr.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 4984
date: Wed, 10 Mar 2021 15:41:50 GMT
expires: Thu, 10 Mar 2022 15:41:50 GMT
last-modified: Tue, 08 Dec 2020 21:41:15 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 60
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 cBiyZrE2vwbFPBS6sT95jOp0NaMCoy8g5L57SNLHBl8.js Show response
pagead2.googlesyndication.com/bg/ Frame 277A 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/cBiyZrE2vwbFPBS6sT95jOp0NaMCoy8g5L57SNLHBl8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7018b266b136bf06c53c14bab13f798cea7435a302a32f20e4be7b48d2c7065f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 09 Mar 2021 16:03:33 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 01 Mar 2021 10:45:00 GMT
server: sffe
age: 85157
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5702
x-xss-protection: 0
expires: Wed, 09 Mar 2022 16:03:33 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
23 B 41ms
40ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=221&t=2&li=gda_r20210304&jk=3241904969432064&bg=!Y2ClYCPNAAWsVXnBrDsAKQB2-DxaNGMK4B17IO6W7q0AaSSEx1pMnDvURuoD3W_Q4WM4ajtDz1yAAgAAAIlSAAAADmgBBwoALmYjt3IJFovNkj1_SmbJ1licawkxAHIkbBqIxThU7gy0B5C0vzfv0GbtHGYnNImZAf2Iha4rL8Si2oPWdhpN6i-OqhBJJ3g-Rct2tzvwApAYZXhYUTxcaE9nDWaqhpMhXOdoOYFXo67wRYlaN8DDwOxbN2yfLJ4msRkNw7-tdJlfz_RERqzSzX1f7hiqGW97oKPsw6ZlFSPMsU1BZDN-qt5mCVbtBo4FXwK7M1vyo8nPA3DszoO-1WRHDXPCDI0yBR6FeCn5lKU2jyKIcZpMCG6DrNuEI6ymnscm38qJ7xuqnSmyQWa4uNZ_O4B1FhkUqTjb3tSg0QQHXxf6Sndd7l6J8RxRDna6WiIFR5VlDKbXhwICIZjLak0fO71xI44q1P1pKTjOKL5Wbrdu2K6j66fpFEc1RbVTBckJhVYJp0wlarMg7wj0Wqjr6vyYZJOkFxH0ZBoJiwUXBRXBXxrxyOyWwpG3iYeUEoDNOz2xrvzpQSzqRFUdTFHhKXx-gHR3jxcEvMr_K2hLcctQDCXKKVQHhimlwua2F7e8VFvvdbAhbt1_RIg5O4Zu71vAeNqkr134vW-UtEqO_qJjDbXFaCVH5ZKHo8ciBm591tcH3bk5Q_dcflbwtXYi0Px8-jbks1jiH4kXctKHYcOwhHzi0n1bxc0zeeSxIIiGNDnV3Fr3eYA6Egdn20mIWkH0gMrKdCu6dktGioHSMGDag4HIlPIIXghu6sfHGs42j-TljA

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Mar 2021 15:42:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 51 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c9efd837ab5f5085f630a4ba3cf00dfa4bbbd5e3dd5e2ff01b0be7d530ae6b8b

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 16877ae26389cb608219529a5d6a4edec00b0f32c7307e437b67defef4af49f4

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 752d1ddb7acb4bfc9e9ec1f3aefd1e0677021845491500db4abae6610238c8b9

Request headers

Origin: https://www.edocr.com
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H/1.1 200
OK Attributes Show response
www.edocr.com/pas/Document/q/ 43 B
552 B 307ms
307ms XHR
application/json 52.1.132.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Document/q/Attributes?DocumentID=uQgt3ju8jXg9Xad9NmQkytQ&DesiredPageCountConfidence=50

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.132.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx / Express

Resource Hash

6f678301281e333f982dd7820ac839a0fe9eca2444cb9aa2f722bc13c804dc87

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff

Request headers

Accusoft-Parent-Name: ViewerControl
Referer: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god
Accusoft-Gid: dLZ7paKjJy129SzpikTmWg
Accusoft-Parent-Pid: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accusoft-Parent-Taskid: 0
Content-Type: application/json

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
X-Content-Type-Options: nosniff
server: nginx
access-control-allow-headers: *
x-powered-by: Express
transfer-encoding: chunked
access-control-allow-methods: GET
content-type: application/json;charset=utf-8
access-control-allow-origin: *
date: Wed, 10 Mar 2021 15:42:50 GMT
Connection: keep-alive
access-control-allow-credentials: true
vary: Accept-Encoding
build-number: 1979

GET
H2 200 css
fonts.googleapis.com/ Frame 238D 4 KB
726 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=2030016460&pi=t.ma~as.4103433139&w=300&lmt=1615390970&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&flash=0&wgl=1&dt=1615390970040&bpp=4&bdt=1417&idt=140&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=120x600&correlator=8265215402046&frm=20&pv=1&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1270&ady=184&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=8192&bc=31&ifi=2&uci=a!2&fsb=1&xpc=1pekLlagJ9&p=https%3A//www.edocr.com&dtd=149

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d344632c01d1ca55dc380216de660c9b8a5a3174e7d7afa6784aff50c945e1cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 15:26:23 GMT
server: ESF
date: Wed, 10 Mar 2021 15:42:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 10 Mar 2021 15:42:50 GMT

GET
H3-Q050 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210304/r20110914/client/ Frame 238D 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210304/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1e93f66cbe9b485135f0c8bbc9eaccf882ded6eb71daadde99a8426f6db7cb31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 15:40:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 152
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 896
x-xss-protection: 0
server: cafe
etag: 948078048762640732
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Mar 2021 15:40:18 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210304/r20110914/ Frame 238D 18 KB
7 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210304/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1a385d2a7b1395fcc2d979b175105a74cc4044edc0af5f73762fb24db351192

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 15:40:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 141
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7378
x-xss-protection: 0
server: cafe
etag: 16470405737963372266
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Mar 2021 15:40:29 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210304/r20110914/client/ Frame 238D 3 KB
2 KB 10ms
6ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210304/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

873aed697d352242a06cc0e1961d2503173d4cbe93713671731d6b8928961745

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 15:37:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 330
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1546
x-xss-protection: 0
server: cafe
etag: 8852521427838746165
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Mar 2021 15:37:20 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 238D 110 KB
34 KB 43ms
29ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc6bab98411c83d91fa616d425c9cf38eab127d28aabeada29aec364d1d71c22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 15:42:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615244735281138"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33987
x-xss-protection: 0
expires: Wed, 10 Mar 2021 15:42:50 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210304/r20110914/client/ Frame 238D 14 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210304/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

523f846901bad5ce921ac4ca7c5fb06d39658428a641c7ea496f8560b4cb517f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 15:40:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 135
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6140
x-xss-protection: 0
server: cafe
etag: 17031075750977984330
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Mar 2021 15:40:35 GMT

GET
H2 200 1e8eaeef6431cb6de349a68674062a29.js Show response
www.gstatic.com/mysidia/ Frame 238D 26 KB
11 KB 10ms
6ms Script
text/javascript 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/1e8eaeef6431cb6de349a68674062a29.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b0b572a90abb3fce27b9dc1f79145706c7bcc6cc3ac84c8f501d344132816d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 09 Mar 2021 13:02:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 09 Mar 2021 03:08:06 GMT
server: sffe
age: 96042
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10971
x-xss-protection: 0
expires: Mon, 07 Jun 2021 13:02:08 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/8707283083155467282/ Frame 238D 745 B
881 B 10ms
7ms Image
image/png 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8707283083155467282/downsize_200k_v1?w=100&h=100

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3fdd34ccebccd37331f8cb30443c913233ced5e6e0f0cf5f6a69635497ea540f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 11:01:55 GMT
x-content-type-options: nosniff
age: 535255
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 745
x-xss-protection: 0
last-modified: Thu, 30 Jul 2020 12:10:43 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 04 Mar 2022 11:01:55 GMT

GET
H3-Q050 200 adview
googleads.g.doubleclick.net/pagead/ Frame 238D 0
0 43ms
42ms Fetch
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C49u3-uhIYLGmDYSorATe-p3IB_KxqK5f0vaqj70M2tkeEAEguO-4PmCViriCyAegAeTCs-4DyAEBqQIJRThTGvWzPqgDAaoEoAJP0KU5YJlUvTdIkcslgfx6gAwcz5N-UaUe9TYlqaSplyIwzD3cF3Ecv--GV2JOXHzNyFaF_jsaZ12fxocO7fHZiLydntrlVT-1Ts01SYGbe2tEyGxdwZAPcVLfJUC6rkI9O-mi_Z0Zw8FaouYTEmLbZ7HoUuN5dKfaxQMOIn5e90S7bi3lRwJTD35ddOBG-L_ciJ356OpAiALbzxdT6GKu0ogHSkR5g_QTHJf4I3SThYyIcFk_1s_RdBNGk5R37P275U8uu9FpE4XISUbNWgd_YWIa3epVecpe7kqPJg6mVt4zAKmY8vThvDb7iTjYk2kDM-xobgNRJ4WncLAICK--Z4IN2EPWuepAlMiYpxOKiNg8Ic03TpfhQA_UxFiEmazABMm9272QA5IFBAgEGAGSBQQIBRgEgAeEvcwRqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEEN-qO9IICQiA4YAQEAEYH4AKAcgLAdgTDIgUAbIXGgoYCAASFHB1Yi02OTMzNDYxOTQwNjI3NjQx&sigh=O0OdxLaLnyI&template_id=5001&tpd=AGWhJmvd3-7p-fqjYBV7cQoDoFYQxeXgCUGX9BanVTBoxR2ktA

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=2030016460&pi=t.ma~as.4103433139&w=300&lmt=1615390970&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&flash=0&wgl=1&dt=1615390970040&bpp=4&bdt=1417&idt=140&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=120x600&correlator=8265215402046&frm=20&pv=1&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1270&ady=184&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=8192&bc=31&ifi=2&uci=a!2&fsb=1&xpc=1pekLlagJ9&p=https%3A//www.edocr.com&dtd=149
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 10 Mar 2021 15:42:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 10 Mar 2021 15:42:50 GMT

GET
H3-Q050 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame EB52 143 B
219 B 7ms
6ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=2030016460&pi=t.ma~as.4103433139&w=300&lmt=1615390970&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&flash=0&wgl=1&dt=1615390970040&bpp=4&bdt=1417&idt=140&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=120x600&correlator=8265215402046&frm=20&pv=1&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1270&ady=184&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=8192&bc=31&ifi=2&uci=a!2&fsb=1&xpc=1pekLlagJ9&p=https%3A//www.edocr.com&dtd=149
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=2030016460&pi=t.ma~as.4103433139&w=300&lmt=1615390970&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&flash=0&wgl=1&dt=1615390970040&bpp=4&bdt=1417&idt=140&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=120x600&correlator=8265215402046&frm=20&pv=1&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1270&ady=184&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=8192&bc=31&ifi=2&uci=a!2&fsb=1&xpc=1pekLlagJ9&p=https%3A//www.edocr.com&dtd=149

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 10 Mar 2021 15:41:24 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 86
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame EB52
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
110 B

42ms
42ms

Document
text/html

2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUm1ZqG8l_l1bNleM_1XBl9r6EXPbnLsJC44oKyTxlc4T0wDiL1YHArk27HP170
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 10 Mar 2021 15:42:50 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Wed, 10-Mar-2021 16:42:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 10 Mar 2021 15:42:50 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 10 Mar 2021 15:42:50 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 238D 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 31c619ba2f5e170ea5f23f788f81a495e0c9469b3e2f74858d478cd616bf1fa0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 238D 16 KB
16 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

24369e1b2461af9dcefecaf9cc93d64cf22a4c5bac32506100b9e21014507bcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 08 Mar 2021 18:27:39 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:37 GMT
server: sffe
age: 162911
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15872
x-xss-protection: 0
expires: Tue, 08 Mar 2022 18:27:39 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 238D 15 KB
15 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 08 Mar 2021 18:51:47 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:36 GMT
server: sffe
age: 161463
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15736
x-xss-protection: 0
expires: Tue, 08 Mar 2022 18:51:47 GMT

GET
H3-Q050 200 13973947279350376219
tpc.googlesyndication.com/simgad/ Frame 1730 16 KB
16 KB 8ms
7ms Image
image/png 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13973947279350376219?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qnX6IXy15Shq9wPJeAZe9WvtSvETg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=600&slotname=3952982610&adk=937441900&adf=750878660&pi=t.ma~as.3952982610&w=120&lmt=1615390970&psa=0&format=120x600&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&flash=0&wgl=1&dt=1615390970027&bpp=13&bdt=1404&idt=120&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=8265215402046&frm=20&pv=2&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=25&ady=295&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&xpc=t0areVCsci&p=https%3A//www.edocr.com&dtd=146

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e3f30ee85d420e6fff789172392143ca3cfc847d59e056c48011313272a4921

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 11:06:45 GMT
x-content-type-options: nosniff
last-modified: Wed, 06 Mar 2019 16:37:33 GMT
server: sffe
age: 534965
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15972
x-xss-protection: 0
expires: Fri, 04 Mar 2022 11:06:45 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210304/r20110914/ Frame 1730 18 KB
7 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210304/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1a385d2a7b1395fcc2d979b175105a74cc4044edc0af5f73762fb24db351192

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 15:40:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 141
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7378
x-xss-protection: 0
server: cafe
etag: 16470405737963372266
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Mar 2021 15:40:29 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210304/r20110914/client/ Frame 1730 3 KB
2 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210304/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

873aed697d352242a06cc0e1961d2503173d4cbe93713671731d6b8928961745

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 15:37:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 330
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1546
x-xss-protection: 0
server: cafe
etag: 8852521427838746165
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Mar 2021 15:37:20 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1730 110 KB
33 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc6bab98411c83d91fa616d425c9cf38eab127d28aabeada29aec364d1d71c22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 15:42:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615244735281138"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33987
x-xss-protection: 0
expires: Wed, 10 Mar 2021 15:42:50 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210304/r20110914/client/ Frame 1730 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210304/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

523f846901bad5ce921ac4ca7c5fb06d39658428a641c7ea496f8560b4cb517f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 15:40:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 135
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6140
x-xss-protection: 0
server: cafe
etag: 17031075750977984330
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Mar 2021 15:40:35 GMT

GET
H3-Q050 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210304/r20110914/client/ Frame 1730 26 KB
11 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210304/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

758608abf5c456ea8cb5515828cabb68f082df67c04d350d0519241841cbf9d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 12:40:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10923
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10963
x-xss-protection: 0
server: cafe
etag: 5048180228173261443
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 24 Mar 2021 12:40:47 GMT

GET
H3-Q050 200 adview
googleads.g.doubleclick.net/pagead/ Frame 1730 0
0 43ms
43ms Fetch
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CjCAW-uhIYIDMDd2x3gOYl6nwAdm9m7lc7JrvncIJ1eXGx4IXEAEguO-4PmCViriCyAegAbGsndQDyAECqQIJRThTGvWzPqgDAcgDyQSqBJQCT9AzzvXtnkvEPq1SgkrjvK86Of9foVpW4jvWH_9_cGDeqVB5cw694v1scblVb-tZRF4ojIGuF2ttBw6Lwza7uCHHicjX_Sft9NZqoyeXEXM4raFgLdcqJpHUJrLYo-SvDILsea31RkcQ42-PHGU5Q7Q3d7NCXLeI5-AKsfxsiJHta3LFmc6YqL3wONlPl_1c3g29p0Zkj6MNxg1aj2xl94OdIGQ-10gEkmgmTPHikGSJQYYMhdCWfM78MKclvaeBwT5YaRzgU8I1x0wQnT2xqkOvK8RG6Cd8GFWCX-QqvHAy9mdbzWPXmiEAWDouSxUS7-B50IWtRMcHQhv1mqp4qYzZgOi5FQ9sIyK2OVwQrdUVeyIZwASk5rPyogKSBQQIBBgBkgUECAUYBKAGAoAHt9PiK6gH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBRCStpQB0ggJCIDhgBAQARgfgAoByAsB2BMMshcaChgIABIUcHViLTY5MzM0NjE5NDA2Mjc2NDE&sigh=ZbcIOqft96c&tpd=AGWhJmvPJh98z5jc1Y6Uhf1jkLM0QEUwbY7k6zhRpDRDTLqyWA

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=600&slotname=3952982610&adk=937441900&adf=750878660&pi=t.ma~as.3952982610&w=120&lmt=1615390970&psa=0&format=120x600&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&flash=0&wgl=1&dt=1615390970027&bpp=13&bdt=1404&idt=120&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=8265215402046&frm=20&pv=2&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=25&ady=295&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&xpc=t0areVCsci&p=https%3A//www.edocr.com&dtd=146
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 10 Mar 2021 15:42:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 3108 143 B
165 B 6ms
6ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=600&slotname=3952982610&adk=937441900&adf=750878660&pi=t.ma~as.3952982610&w=120&lmt=1615390970&psa=0&format=120x600&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&flash=0&wgl=1&dt=1615390970027&bpp=13&bdt=1404&idt=120&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=8265215402046&frm=20&pv=2&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=25&ady=295&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&xpc=t0areVCsci&p=https%3A//www.edocr.com&dtd=146
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUm1ZqG8l_l1bNleM_1XBl9r6EXPbnLsJC44oKyTxlc4T0wDiL1YHArk27HP170; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=600&slotname=3952982610&adk=937441900&adf=750878660&pi=t.ma~as.3952982610&w=120&lmt=1615390970&psa=0&format=120x600&url=https%3A%2F%2Fwww.edocr.com%2Fv%2Fw6xgg6db%2Fzerubbabel112%2Fthe-one-page-magic-spell-proving-i-am-god&flash=0&wgl=1&dt=1615390970027&bpp=13&bdt=1404&idt=120&shv=r20210304&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=8265215402046&frm=20&pv=2&ga_vid=1903151492.1615390969&ga_sid=1615390970&ga_hid=1994059489&ga_fc=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=25&ady=295&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21066922%2C21068495%2C21068944%2C21069710&oid=3&pvsid=3241904969432064&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&xpc=t0areVCsci&p=https%3A//www.edocr.com&dtd=146

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 10 Mar 2021 15:41:24 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 86
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 1730 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04f7cae88b52f79a3ac27224403face9ef902d4eb6285dab8c057965fd08e4a7

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 3108
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
21 B

39ms
38ms

Document
text/html

2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUm1ZqG8l_l1bNleM_1XBl9r6EXPbnLsJC44oKyTxlc4T0wDiL1YHArk27HP170; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 10 Mar 2021 15:42:50 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Wed, 10-Mar-2021 16:42:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 10 Mar 2021 15:42:50 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 10 Mar 2021 15:42:50 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK 1 Show response
www.edocr.com/pas/Page/q/ 60 KB
31 KB 253ms
253ms XHR
image/svg+xml 52.1.132.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Page/q/1?DocumentID=uQgt3ju8jXg9Xad9NmQkytQ&Scale=1&ContentType=svgb

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.132.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx / Express

Resource Hash

843d222c78e5ac1835f645642c802c1a97dbb028fade15ef5826fbbbcdc3a6cd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff

Request headers

Accusoft-Parent-Name: ViewerControl
Referer: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god
Accusoft-Gid: uMvNm7NCjTPw9SKebxikGg
Accusoft-Parent-Pid: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accusoft-Parent-Taskid: 0

Response headers

date: Wed, 10 Mar 2021 15:42:51 GMT
content-encoding: gzip
X-Content-Type-Options: nosniff
x-powered-by: Express
transfer-encoding: chunked
Connection: keep-alive
accusoft-data-encrypted: false
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
access-control-allow-credentials: true
content-security-policy: frame-ancestors 'none'
access-control-allow-headers: *
build-number: 1979

GET
H/1.1 200
OK 2 Show response
www.edocr.com/pas/Page/q/ 36 KB
19 KB 250ms
250ms XHR
image/svg+xml 52.1.132.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Page/q/2?DocumentID=uQgt3ju8jXg9Xad9NmQkytQ&Scale=1&ContentType=svgb

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.132.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx / Express

Resource Hash

da6e9654ed74a15234b87d89e7057608c86311fad3fafc224b686290f996feb7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff

Request headers

Accusoft-Parent-Name: ViewerControl
Referer: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god
Accusoft-Gid: iec73WrQlce7m0IZ0z0W0A
Accusoft-Parent-Pid: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accusoft-Parent-Taskid: 0

Response headers

date: Wed, 10 Mar 2021 15:42:51 GMT
content-encoding: gzip
X-Content-Type-Options: nosniff
x-powered-by: Express
transfer-encoding: chunked
Connection: keep-alive
accusoft-data-encrypted: false
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
access-control-allow-credentials: true
content-security-policy: frame-ancestors 'none'
access-control-allow-headers: *
build-number: 1979

GET
H/1.1 200
OK 3 Show response
www.edocr.com/pas/Page/q/ 35 KB
19 KB 460ms
225ms XHR
image/svg+xml 52.1.132.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Page/q/3?DocumentID=uQgt3ju8jXg9Xad9NmQkytQ&Scale=1&ContentType=svgb

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.132.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx / Express

Resource Hash

ab7c5d8c3b634b86501856b4a32b0b0c5b79fda89df8a610b51592bdcd770f7e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff

Request headers

Accusoft-Parent-Name: ViewerControl
Referer: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god
Accusoft-Gid: GMCyGBzE9MFKECZcY3CoyQ
Accusoft-Parent-Pid: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accusoft-Parent-Taskid: 0

Response headers

date: Wed, 10 Mar 2021 15:42:51 GMT
content-encoding: gzip
X-Content-Type-Options: nosniff
x-powered-by: Express
transfer-encoding: chunked
Connection: keep-alive
accusoft-data-encrypted: false
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
access-control-allow-credentials: true
content-security-policy: frame-ancestors 'none'
access-control-allow-headers: *
build-number: 1979

GET
H3-Q050 200 cBiyZrE2vwbFPBS6sT95jOp0NaMCoy8g5L57SNLHBl8.js Show response
pagead2.googlesyndication.com/bg/ Frame DC17 14 KB
6 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/cBiyZrE2vwbFPBS6sT95jOp0NaMCoy8g5L57SNLHBl8.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7018b266b136bf06c53c14bab13f798cea7435a302a32f20e4be7b48d2c7065f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 09 Mar 2021 16:03:33 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 01 Mar 2021 10:45:00 GMT
server: sffe
age: 85158
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5702
x-xss-protection: 0
expires: Wed, 09 Mar 2022 16:03:33 GMT

GET
H/1.1 200
OK Text Show response
www.edocr.com/pas/Document/q/0-0/ 6 KB
2 KB 248ms
248ms XHR
application/json 52.1.132.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Document/q/0-0/Text?DocumentID=uQgt3ju8jXg9Xad9NmQkytQ

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.132.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx / Express

Resource Hash

67fd49447d885f8b057646aa295fab88ae8be26016899b28c7c564c6e6ffc579

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff

Request headers

accept: application/json
Referer: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god
Accusoft-Parent-Name: ViewerControl
Accusoft-Gid: F4jQQCXPMJeRnyaGWmce9w
Accusoft-Parent-Pid: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accusoft-Parent-Taskid: 0

Response headers

date: Wed, 10 Mar 2021 15:42:51 GMT
content-encoding: gzip
X-Content-Type-Options: nosniff
x-powered-by: Express
transfer-encoding: chunked
Connection: keep-alive
accusoft-data-encrypted: false
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-allow-credentials: true
content-security-policy: frame-ancestors 'none'
access-control-allow-headers: *
build-number: 1979

GET
H3-Q050 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 238D 42 B
155 B 44ms
41ms Fetch
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssVTah0raFu1HHBprdcvmiEiBKsAT1P6qGuYyiWpHDMGrZ-OMNRHZdkVZgvq_tb3gc8c5fkNl-oj4Ezd0Scvr806vfkx6DCXylLQ6RPDFDXo1bgSagYElhiK8TsUg&sai=AMfl-YQLeWXkpscC2mOlN8moyAUEcVBrFPdpOnTyVtJXwmXxovo8iBDZJUKkoCtxWcxrzlMi9Z6Jcppk7Uim&sig=Cg0ArKJSzKe4LpY2IR0oEAE&id=osdim&mcvt=1004&p=184,1270,434,1570&mtos=1004,1004,1004,1004,1004&tos=1004,0,0,0,0&v=20210308&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=402904232&rs=2&met=mue&la=0&cr=0&osd=1&vs=4&rst=1615390970190&dlt=501&rpt=30&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Mar 2021 15:42:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1730 42 B
66 B 40ms
39ms Fetch
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuab3kMEPceDQrjHDzZ0C1I5ptJERsqZ7sO383LxC5mEYm-KSvZ8zIUmR023vyfFAXvt75Fru4a_7V_usuiP3NLnZtFr2PoYznSEw6R4C9rwS08c7Q4ioIYUR0hwg&sai=AMfl-YQ4ehfuI6AkgQTku8fh9f-agIvbvCMDiF6hh44JUn0HPrLgi2gDJ_JQL5D--DBu52d71jrjImMwCUZX&sig=Cg0ArKJSzG1lNSH7kuUSEAE&id=osdim&mcvt=1000&p=295,25,895,145&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210308&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=4&adk=937441900&rs=2&met=mue&la=0&cr=0&osd=1&vs=4&rst=1615390970177&dlt=657&rpt=52&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Mar 2021 15:42:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK Text Show response
www.edocr.com/pas/Document/q/2-2/ 97 KB
22 KB 348ms
347ms XHR
application/json 52.1.132.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Document/q/2-2/Text?DocumentID=uQgt3ju8jXg9Xad9NmQkytQ

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.132.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx / Express

Resource Hash

54cc33d974fbc8e533a1de2dfea054b1fdb0c40156ee49084f49710ab716f49e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff

Request headers

accept: application/json
Referer: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god
Accusoft-Parent-Name: ViewerControl
Accusoft-Gid: oK2P9kwThQYv8tbwL8olRw
Accusoft-Parent-Pid: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accusoft-Parent-Taskid: 0

Response headers

date: Wed, 10 Mar 2021 15:42:52 GMT
content-encoding: gzip
X-Content-Type-Options: nosniff
x-powered-by: Express
transfer-encoding: chunked
Connection: keep-alive
accusoft-data-encrypted: false
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-allow-credentials: true
content-security-policy: frame-ancestors 'none'
access-control-allow-headers: *
build-number: 1979

GET
H/1.1 200
OK Text Show response
www.edocr.com/pas/Document/q/1-1/ 62 KB
15 KB 270ms
270ms XHR
application/json 52.1.132.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Document/q/1-1/Text?DocumentID=uQgt3ju8jXg9Xad9NmQkytQ

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.132.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx / Express

Resource Hash

0dca516a37b4e1da20a75a17241be5288767a8e474a8e2f5756a5953ef88dc99

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff

Request headers

accept: application/json
Referer: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god
Accusoft-Parent-Name: ViewerControl
Accusoft-Gid: vHv8ov7AFgYBrybPbxG3Pw
Accusoft-Parent-Pid: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accusoft-Parent-Taskid: 0

Response headers

date: Wed, 10 Mar 2021 15:42:52 GMT
content-encoding: gzip
X-Content-Type-Options: nosniff
x-powered-by: Express
transfer-encoding: chunked
Connection: keep-alive
accusoft-data-encrypted: false
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-allow-credentials: true
content-security-policy: frame-ancestors 'none'
access-control-allow-headers: *
build-number: 1979

GET
H/1.1 200
OK Text Show response
www.edocr.com/pas/Document/q/3-3/ 108 KB
24 KB 334ms
333ms XHR
application/json 52.1.132.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Document/q/3-3/Text?DocumentID=uQgt3ju8jXg9Xad9NmQkytQ

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.1.132.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx / Express

Resource Hash

46aad194aec3d4cc079ac3189e96b992f1d7a6aa51ee28c571e6e04b4ad0dac7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff

Request headers

accept: application/json
Referer: https://www.edocr.com/v/w6xgg6db/zerubbabel112/the-one-page-magic-spell-proving-i-am-god
Accusoft-Parent-Name: ViewerControl
Accusoft-Gid: cSztEq7aytjUxIC4kGAXeA
Accusoft-Parent-Pid: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accusoft-Parent-Taskid: 0

Response headers

date: Wed, 10 Mar 2021 15:42:52 GMT
content-encoding: gzip
X-Content-Type-Options: nosniff
x-powered-by: Express
transfer-encoding: chunked
Connection: keep-alive
accusoft-data-encrypted: false
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-allow-credentials: true
content-security-policy: frame-ancestors 'none'
access-control-allow-headers: *
build-number: 1979

Verdicts & Comments Add Verdict or Comment

72 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
pagead2.googlesyndication.com
partner.googleadservices.com
tpc.googlesyndication.com
www.edocr.com
www.google-analytics.com
www.google.com
www.googletagservices.com
www.gstatic.com
172.217.18.98
2a00:1450:4001:800::2001
2a00:1450:4001:800::2003
2a00:1450:4001:801::2002
2a00:1450:4001:801::200e
2a00:1450:4001:808::2002
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2004
2a00:1450:4001:812::2003
2a00:1450:4001:813::2002
2a00:1450:4001:827::200e
2a00:1450:4001:82b::2001
2a00:1450:4001:82b::2002
2a00:1450:4001:82b::200a
52.1.132.114
04f7cae88b52f79a3ac27224403face9ef902d4eb6285dab8c057965fd08e4a7
0b70bf12b0e8efbbe170ad998a31f97b2e96f42b4bb7cb46712ac222720fa65e
0dca516a37b4e1da20a75a17241be5288767a8e474a8e2f5756a5953ef88dc99
0f26b5c09e88293e891c94046695af27a5d9a205216cd7cfe827bdafe94d9202
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
1314ac7310108832e8196c0d48ba81a1e627df505f24d450137d77863bbdc00e
16877ae26389cb608219529a5d6a4edec00b0f32c7307e437b67defef4af49f4
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1e93f66cbe9b485135f0c8bbc9eaccf882ded6eb71daadde99a8426f6db7cb31
24369e1b2461af9dcefecaf9cc93d64cf22a4c5bac32506100b9e21014507bcf
31c619ba2f5e170ea5f23f788f81a495e0c9469b3e2f74858d478cd616bf1fa0
3fdd34ccebccd37331f8cb30443c913233ced5e6e0f0cf5f6a69635497ea540f
40eed669386e62ee126d5aebfcfcac58eff28cc3a887c5fcba441f56610dcd56
46aad194aec3d4cc079ac3189e96b992f1d7a6aa51ee28c571e6e04b4ad0dac7
48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3
49e1dcef611a905b866974d135554059ecd77a0ae022553178ec359ea0b64504
51632c0019116060520365170fe114d8801da7ea8e954c352816e53abf5703de
523f846901bad5ce921ac4ca7c5fb06d39658428a641c7ea496f8560b4cb517f
54cc33d974fbc8e533a1de2dfea054b1fdb0c40156ee49084f49710ab716f49e
61efd432df76387dd163c58c1f91d3b8c238f7efccd5cb303c72d33ad7f86b9c
65e4e63638e9c69fe634cc25b595b20afe3e704f5eb8adf36a551e3c23a12ecf
67fd49447d885f8b057646aa295fab88ae8be26016899b28c7c564c6e6ffc579
6f678301281e333f982dd7820ac839a0fe9eca2444cb9aa2f722bc13c804dc87
7018b266b136bf06c53c14bab13f798cea7435a302a32f20e4be7b48d2c7065f
752d1ddb7acb4bfc9e9ec1f3aefd1e0677021845491500db4abae6610238c8b9
758608abf5c456ea8cb5515828cabb68f082df67c04d350d0519241841cbf9d4
7b0b572a90abb3fce27b9dc1f79145706c7bcc6cc3ac84c8f501d344132816d8
843d222c78e5ac1835f645642c802c1a97dbb028fade15ef5826fbbbcdc3a6cd
873aed697d352242a06cc0e1961d2503173d4cbe93713671731d6b8928961745
8e3f30ee85d420e6fff789172392143ca3cfc847d59e056c48011313272a4921
9001872c5b6a266523aec9fee9fdf1899d495b45bbd5f66c601370bbc2c75936
9288a1e8e6b25a81a0ebed0c2026d9271347797c070df70273acef4f36dde0bb
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0a8a6526b4a0f339fd2221193ddfc77f82ece499892776221831551918e9755
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
ab7c5d8c3b634b86501856b4a32b0b0c5b79fda89df8a610b51592bdcd770f7e
b1a385d2a7b1395fcc2d979b175105a74cc4044edc0af5f73762fb24db351192
b1ba9fa4ad8fdf667f000a62ef0aebcd3b169d9e70a0e7079072471016139c68
b8657baaa6b95a17c934001c3338f3cdff05bf8ce67ffe25c3b7ab53cd580241
c44f8d8f097f005a511f32b7ad3b3149ab8d1b91d28f6cd9c29684564d0344cc
c9efd837ab5f5085f630a4ba3cf00dfa4bbbd5e3dd5e2ff01b0be7d530ae6b8b
d344632c01d1ca55dc380216de660c9b8a5a3174e7d7afa6784aff50c945e1cc
d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39
da6e9654ed74a15234b87d89e7057608c86311fad3fafc224b686290f996feb7
dc6bab98411c83d91fa616d425c9cf38eab127d28aabeada29aec364d1d71c22
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e78c14aeb9435fd03f67ad2ee4c45e18bfcfc100a4c62c8bd886324ce6296f77
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f43a8c59fde828314f3f621d0d453307bc212258250f0af7d8b2a0daa7cfa653

www.edocr.com Open in urlscan Pro 52.1.132.114 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

61 Requests

100 %HTTPS

87 %IPv6

10 Domains

13 Subdomains

15 IPs

2 Countries

1167 kBTransfer

3682 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

61 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.edocr.com Open in urlscan Pro
52.1.132.114 Public Scan

Screenshot
Live screenshot

Full Image

61
Requests

100 %
HTTPS

87 %
IPv6

10
Domains

13
Subdomains

15
IPs

2
Countries

1167 kB
Transfer

3682 kB
Size

0
Cookies

61 HTTP transactions
6 data transactions