mohtawaa.com Open in urlscan Pro
192.64.117.114 Public Scan

672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 09 Nov 2022 03:54:38 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 5.181.234.158; 5.181.234.158; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 46087dde-df3d-4c04-8ded-4bf4882175ad
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY2NTAzNjg3MDY5MzU3Mzg%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 71D4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFBIbceJ2-Si2MC75scujhk&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFBIbceJ2-Si2MC75scujhk&google_cver=1&C=1

43 B
765 B

11ms
7ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFBIbceJ2-Si2MC75scujhk&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP-L8QIQ5O66_wMYpvCu1QEwAQ&v=APEucNWb3kW9cShIxOZCgrYGcHRD6COX89lSiucXOua5JnkBJtUCpX1FqVe5pCxHi0rhr1zUZqKeFmGuwzVJrNtc6KHM_i3xRQ
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Nov 2022 03:54:38 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Wed, 09 Nov 2022 03:54:38 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEFBIbceJ2-Si2MC75scujhk&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 71D4
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y2skfpmshHt4fR8E.PnH6QAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKvNAABjcw0Wz_aD7R8U2pc&google_cver=1&google_hm=2

43 B
765 B

6ms
6ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKvNAABjcw0Wz_aD7R8U2pc&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP-L8QIQ5O66_wMYpvCu1QEwAQ&v=APEucNWb3kW9cShIxOZCgrYGcHRD6COX89lSiucXOua5JnkBJtUCpX1FqVe5pCxHi0rhr1zUZqKeFmGuwzVJrNtc6KHM_i3xRQ
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Nov 2022 03:54:38 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKvNAABjcw0Wz_aD7R8U2pc&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 71D4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEP6IEPbzF9-WogYwFwudzQ8&google_cver=1

43 B
1 KB

33ms
32ms

Image
image/gif

68.67.160.114
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEP6IEPbzF9-WogYwFwudzQ8&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP-L8QIQ5O66_wMYpvCu1QEwAQ&v=APEucNWb3kW9cShIxOZCgrYGcHRD6COX89lSiucXOua5JnkBJtUCpX1FqVe5pCxHi0rhr1zUZqKeFmGuwzVJrNtc6KHM_i3xRQ

Protocol

HTTP/1.1

Server

68.67.160.114 Newark, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Nov 2022 03:54:38 GMT
AN-X-Request-Uuid: 656693c3-677f-4e4d-8fc8-324018838763
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 5.181.234.158; 5.181.234.158; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEP6IEPbzF9-WogYwFwudzQ8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 71D4
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY2NTAzNjg3MDY5MzU3Mzg%3D

170 B
188 B

21ms
20ms

Image
image/png

142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY2NTAzNjg3MDY5MzU3Mzg%3D

Requested by

Protocol

Server

142.250.80.34 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 09 Nov 2022 03:54:38 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 5.181.234.158; 5.181.234.158; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 269829c9-dba1-4dad-b2ff-bdd20e4c0aff
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY2NTAzNjg3MDY5MzU3Mzg%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 container.html Show response
7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/ Frame 7DD3 6 KB
3 KB 5ms
4ms Document
text/html 2607:f8b0:4006:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110701.js?cb=31070788

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mohtawaa.com/how-might-i-purchase-bitcoin/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 2988
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 03:54:37 GMT
expires: Thu, 09 Nov 2023 03:54:37 GMT
last-modified: Tue, 25 Oct 2022 18:59:17 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 182 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 476d8d8a5ee6c842a16e5ae6a58cec35ff7649729b77de0319644cdc128340eb

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 834 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0ea842ad92b2cb342a00d74293e6036981ec07854e082223080525efa9c88528

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type: image/svg+xml

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
299 B 22ms
20ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?gl=0.17&b=1&r=mohtawaa.com_auto_728x90_sticky_display_bottom&sy=7a801ae0-dc8a-4c58-86c6-a8fab334d80e&ts=89&cd=2&mlbr=ch&mlos=wi&mlla=en&mlco=us&mldo=mohtawaa.com&mlre=undefined&mlin=0&mlsi=728x90&mlbw=4g&mlcs=NaN&mltp=191e511b-91d0-45c2-b655-8d403b778259&e=lm&dsReferer=bW9odGF3YWEuY29tL2hvdy1taWdodC1pLXB1cmNoYXNlLWJpdGNvaW4v
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v16.1.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://mohtawaa.com/how-might-i-purchase-bitcoin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-nf-request-id: 01GHAR6CPWS8RF208HBJQK4CDC
date: Wed, 09 Nov 2022 03:54:37 GMT
cf-cache-status: HIT
age: 67015
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "8a9dc9c7d095d16caa762d82212746e7-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 76739bb35d588c5d-EWR

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 70AC 41 KB
15 KB 6ms
4ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DL3y9MMOfzTL6FvuQLEE6e0MrfCvSZdtkbb4DmcfVDbP_qN7vvllCdbscMJeq5W4HnhQGHLHR_dvpGoONVwMbTsg4xNXK3dP8EFEyEVhd33WrIhcbAvhA-3ZlAHXp11BMsCaUOVkBp3ABgGGCMyx4lLhmSweZPAjXYvp9AiCRUejnUBFw&cry=1&dbm_d=AKAmf-BK5m7FGqKXC1vibWnAEHr5C5rYmzgWAx0mqcSmu8CXzx89zGr0-ls7gKfDMOsGemCaasscmobrSlhWkAdbiC_C-UyBdAHNQWNUkk_0zs9aAg3dci4ZpJtMrKxh2lk2pF3Ia1ML1iOIAJwEugyIC8Z985sxELQ7nr4rZuNjqPGKRrW3QnLsSZ9RhGxWthCrfveKk8X99wI7iapKGV7EXu0Q2VFW1hl_J7AxI9z_jmuAGMYuZQaK6NtCZCGrY0bSMChLkmL3xIzfYbSTidTP82UuNiGgbMsg3PjuhA1GxAO2Wiys1t9b5Ki5ETt1uOF_xZMfxzd4lvGnY4G3n9pSUEux6gyTQSHYJDFSyXtViMS0KTTq4_mkO-LRMaLd55YdXC7eFZo3zfhJUZQLimYOp3MYJztWIJdXqsqoRAQ9kOFvUU0ZEXOs4YrGIoEPQcgBr0XfiXGSqABsPXQdd0VZs4bJ2XQqD-lpqKPFW3kWvbEIjsXo4-p3_3ElmVH9I-fUiCFDcbNQL4DJaZWu6B-Mpgtzt3hg3AvGmq1qYs4O_pYegTgf7cENMPUVZZsGyOn_OflGgpK0JU07rxW2DWVJqhM83zwKlEeibASll_GmB1iRFgikU9FeIguPB8YA-WQoIfvP6zgaxCi0TNWfLOjllLLl_fx8ecFbEV1K8MDUf383N-U42XkcEDElrNb74LpqgWBe7DfVth-XTadIwINSNtyUmOt_2bmmHoIpfVKz-5Ov8027LbYSei5anoSq1mwNQ52F-1IeV6JdwJqMxY8d3e1wIaUTNQ0ZjaA7q7M4NjBcqWEtX-f466UDCQYaqm25ozCV2iG8gHNwr6UMntuUJJhdlocm55aQWUL5zKJwJlRlHaPqOl-4BmYJ5Z2LUTMZXP4PBpy6sPtJU4pVQnDNFsGOwPEwMaudtZ44jYxCubkUyY-pTtEZrrGi09h8OhvUlTQbrF8svLzodtpq2-05GBnaOzEvz_H8X1EnWnfaGhHIPZ2QLrhg2Ntpd95I5ObVUwiIBWuxttQeRrNdtMpAM-xRDa0nUFxZJfQUF5wRz-I2WSf77KxyJpaDQ8UA1xmDGisvgAqBQc9mLhXg71RYlKiU0E0oNMW3LyaFbaJjZ9daHeu_pAbOacOjfieSwrOlLxCwVt0r_9IHCB1bv1ZuQcpNhBfxzTaNS0SwR4Il1dC57OmF-n5JDjwIdnmy9hS3uYAOfl8sOLI-quL3bfEhIQysthq_ulAtnXOa9rc-AutcUNBRttegI7hLra6qPPBhI06hmerljYU64Q36u9mhiL_QySJtWlm2G_RKQYk1N3HsP1c2GsF4E3O1hXL9asEY6d6aqE67cP_pLpxmhMMXTgIpmxxCv4aPObu32gc9d8uyFtKi2N8aKSMg8C-6WMz2buouMSXlV1l304_OyHSeAtIrqfrw7uyj13Vhku7qqRSDY76fvyJ_RhtkoYf39n4ydhPg3k5Qi0JRxlToVxevIR-MXpn2AVO2UE696r7yxWNHXq9su6H5ll3cTIjgJBMNqwgjBNN1ZtApZD-ONJJTCl4osbXHcEBy4Ok3TmB5rFfb-c7ZxNrrMsOZdab5JubIfq_-0Cj808Vv9oAWEcfPOCXdG-BJUuc-Q047HPKrOIrWsEdqWajHIkqH9Nl8L_a20b_itOVWzKMR-2Tfs596NePIlNz6anubskio4C-6snvce9MVGM4XsjSzdoqhqeFBviZWKOPVujwd102V7xopeid7blEoij3anQxyNdALxNzJZsLdzz6ggtUMozeo1vpt0RlPFMFxeVFm1e-dci-7YAnEJpmzlLwuDEjd_JKNgjvHKcYQMz33WpWeRXziOaH1OyfJ6qD50hMN61tiRArWHTrIyAEiVPmmDoQeO7jm0Qo8cHrvGPVBdAEzNPO1TV46wtpj_I0kdHN1boDUUVHMTt3QqWzlBEtce4zciARobU9E3o3Y53oxO-ilXER5u03eZpRuCVC4628-kh3KmeXPRmWDoCGHYq4oaYFxLzGqDbFfuaPbL0ZKpXCwakjq0N-N-WNxTkcWOZDU9g-z0AOSKJ_9c_VkXX0qzMfmCuYCKPxt7gs1300DVKgTY7HBeSXvuJq6lTNtT-7298jcWlnvdjGpZDygjbTVDTr6RP4vRdr7fnOWbuM8lZF5fyB8O4aZpwS5g4Rv7FxQnrCHFJfpRrMtLNZBqJ8WWQzIo0DSXlP7i5Mzlw3eKq2MPxpOgmWTy_FTKZOJ3ufdRffndf6pv2rzr0oqA0RhHJ5Mts3hJub54OOQyuORiQtevFAtp27HevNrhg8HYryp9F8hB0EHpwH3IZM0p-PnjpS2F15A7Q59N9E3iBYRRjq39EI7Txer_-sJhpm3ZYcl1rJhjvKBLNi7K_-hupoXmKGz-f-pqAO8ROfDJ_WoIKtnEUpdxq6-KWqmsupYiFkdXaTNp4z-yas4ubZl_CILSZAA4mHVtcFEY5ZsSi7P4qZcofvAH05jzLp4KrwtQsXudnMI-YNXoisfKLc3i_tZnOWfsvUeou-y87hKxndDLmfptysU9Hve5j4mxhpfWSXl9lyg2iVH6tkyGoCETWn3ml5H4E6vGVyEvPewlAAtJr2XZM-lgEMCJDeYFN-hEsdG0Q_jmzyxB9_UGYyVJwbZKMpnORXNec2fogyEWRaxxkCn59H0-MSwDrRKjPKFGyLN0qZKxnif20lT3--bgIXj9r4uaO9uG-2_JQLGphsw_D9FPRro0fYiMFp7aG_fWc9gsPLhgz3HTNXLxz2aWPBHoV-DQMY3YLuiu615U8KDmDuzQ0HjNJZSodysoi1W0GB8LrQdHL-djK1BFG_J0VqcfjcjqslTDFaEA2xRQgA&cid=CAQSPwDq26N9fc7f7MQyvzc_OYSzU9G3jX13yDxDh0nukl592-kXnleEzs9kRBxPWnfgmeShoGYK1yajbCQlQL_PDBgBIBM&rfl=2%2Chttps%253A%252F%252Fmohtawaa.com%252Fhow-might-i-purchase-bitcoin%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 04:43:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83447
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Nov 2023 04:43:51 GMT

GET
H2

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 70AC
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/1194052/66719900/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-C72Mh6XsRJomghtkvcf4z30irKzpSP9YUYvKSLHuV2iHvohcaawrk...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-C72Mh6XsRJomghtkvcf4z30irKzpSP9YUYvKSLHuV2iHvohcaawrkk7tVNLFPjVZHajzaQaiSbaRgZT...

51 KB
21 KB

88ms
46ms

Script
text/javascript

172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-C72Mh6XsRJomghtkvcf4z30irKzpSP9YUYvKSLHuV2iHvohcaawrkk7tVNLFPjVZHajzaQaiSbaRgZTowjZRpeeKU8HVVk-YyZVY3NXE2Yw2lu5GyPPG9yr8QZYyhhPUVQaKJjfJ87z7hELuHz3DLiW2_4oWngrnZrXLvbOvQEG3aoYxES6RMAoCZ_4H-SrTQJsVXrdtDv7nOqeMDlypIxkwXpBAOzVh4rofJXWQ891QjrScksvRxIbPIa6jr64BlOWabKSSFvj8vNc_oQxRhI6hRmCvmAVQaSMP6La2uneZ2zmDClFcNY1KHB1AxW7JwHMejOSGh5cQVCYh6AjaHUtU38qiNJLpc_h_k6AphbwFGFoCiWENhtCaNwDsu2lcUoCPMlBQ-6DsXoy87Fs69kgxC5QbUomikH6baeyjnx5STLvVzRukBQUCtw1dyDpA7dyQ_XhFceNIxxRew1BL35HEZ4Mzflu9_TYLWz_1_ZI_f_aFCnDsFqc02oDRG6DbrV-4izmncZKl8E6Vv9MZH2msBMgKqJznwE9kLnB0D5-VW_PuVopwk0O1kN4gGPLzfz_2BHGTVflWidOr1aq8UVvmP_tH9i2GL4Wss82VqgwVMuAWF4sj_v4G0sqb8D2Ow2wZhQNWpjXHY3YbnXwyVWradwhyLf9_mU72hWcjhFaC6U_kjwDsWaHc5vv69_XFnnb2PtQ01ip0c7Ourhg6CVoBXqy48L71iJnyQiSkDarQl28ac3xxQ8zTFdvbDPbF2b6tND5Wy7avBt763bsya0IDmwHM3YB0y4O7jH3qHjPhC5Oi9jkBy9qBQWzOHYC-Digt-YNUES9IEc4B7s_wjgyA1aMnqs6HBbJDRGZm-FO_re82ddjysWKcPaTHIZ7GfXAAKOUd7Apybe0Zf9phQybm-qvyyAidMJYszE-Hg2H5dt_Crf_-utzPNuoJ8VoEL412G85CNHgJIQBZTigiJxUarTTTAIv2b-jj6LxV54vBny1SpCzkY8qQf9944njc5TxflbA7qKv13lMR1-H3AAzgLT6Ys9QkOOQ0unJenqf2v8gv22UTj7Kx97P1pVAGlFnNlP2ig2fAY89iD9Vtx8ozg-SU-jGZhs8VV5hoE4nQUybzAnUhs-hjoWRFOdekPXW8IJfTr8TxS_1Bid6SLbzGnj5bVCmFmiL0EmpM2RrXCIB7J3HptZTbP597dhJAGrB2kJ9T7OI1JOQN_AwMgYUF3LLoReZosmuL17RWA8KX5YLzL6RYuEPRPwozYf8iwjWV2hQg2PfOsYBLuiQjm5sqzJVczvryB2ZKQYCIDdi-qPrFRi_eh17Yn_098LJlEP9sn7yYkunYXTRwhxH7hzFOqHT7Gp894XgzBXP-59V24zksUD2fVNSZ6LNDxDjI0yf_lPG18qPzuqRA0SrocGEntgaH_xcVVHA-Fe83WAJHEShlARyUYNY6K5V3WrBV_EsBfp-Z0tiz1e5DU9z5vEaIg_K5ygNPEhjnBRsAfQqOPLTeZZXLec1mZH-e987FvAuvBoxrbINii9q741dZaJu1awcGdYF15862lP5gWO5z_4hMSX-mpzEiTd7RPvrfo8e4c6DCuBWkCg7z765aide8f8218T3T01NSyaFGedVhR9_kTaJ6MIQhmm9EMqmT_TcHXzM09HRui4oZXQyAzrg8z-6-xfUfKRz9Zo8Ea_WNAuO_mxAW5_cTh2e8rsLFFr_h4KjV0dMz0Csv6K3H11_Za9KmhJmYcWlzLiwcwX-7MzsNh9z55YfRo-a7-hG6mwn2_06ZriS5y_h4laZ8oBHCXbrsVO87q6fCvaeMEpAi6ATx2htCXmQGnBqRxPFHacK9SfXmgz-sUWI23eZuJ6-4ndCv6Qm1eAEu1yC7GiCPdFfhZpd6u0ICCZpzImfBNWYyduAk8UQJFwSa-iI-h5T0-3Onb7t4aSpwA7GkCSi4u4UnNAq3YISqvD1WBjKVl4ml_r1tyF6gzTQ0PQsrxtZ-rdjsgF9fkUaqoGkNiZxJjlPDif-D0cnern5DF312Y-1vtdiOFbi152h2QAzjr-NoXRZHBO11518oghRvAaUCWWeMXYCXgzPwl73dvoF_lLEpsyCgqiLlW-td0UZI9cNTbltwG0a8aZTIk5sRWN1o7XHok8ErKIJzXs7qSph74oGwMNXirlOPzGcvuqIe7imsbjmeywaRG-CZnohHE1az_WWm-R7A8ldFkO37zh6gETkihq53NYHVB-S8J701IrhnC3h0C5ANXuJIQv2ogkXH94wQbA4hQ3x-y0wEvk3aRiN45I7xLmPiuduoCUo_lJct95VeFrfQDw4afejhP2KbbFK_6zBf3V6470zZc4m-naIpQ-f9orp8_0NGHkl-dnJKJczxWwqMifYcSAF_AoWCDTU1r9XX0BLZeVPv_1_m6uU4iFaGLnGGSpoZcZOpnJ9zDpxPQ3migLpsg4bdTNqXocP83B1RM8Zuwwdmt7MXNAGOMuY8VEPQYGhGXMDKlntm07A6RDYUrUxWQ4oW3FAxAqIrnKr4Lqa9WDxOBpJso_9-7eWP_N-y2jPzwKeE2Tatj1aIye6viHFD5Ha82jIA418GpH5GSkJ3zMCphYHRut_vLQkPMBvhiCtVKjTFaerXUouaT_0twfQdHDllB01gdgZVFgr6_Ra2pSr4n5NvTyqarj_INMCCic7QV9nhvPbuBDTWREwNKU17M-b_jfniHokhwGoUXkBC0nJdf0mUgcGVZNmrkzMw5d6lOS7IveZMJIuVTvkDiDvRxf84d9QugN6sCzKPkxlfKZ1nZNm1aV3O7GW6wuVhO2spvBVLlc1Zujfl0PwepmKr3nU14OGKFhLnvk3E93KPsJ-HmLWtqnZ86YvMwg8b1d1yLPWYMrngyKFS-3FFEt_XG6ps4RkXpHtAIlJFnc8UKLDUKOEGvQqXflpO9ZfzVMqllSCVU4O7NhneqhkUvLuzIVLbbPxTk8kWJGU1KDjWj-q3nIwVeedn2o8NU3ta5LdckU7LIHxCB7woU2mvNJgELpJp7YAoPYCeRLFuHYQc0n5Q0b1Qg2Q_UscISM00UpnOMEEFxxZ9HftAm9oRwJ01IH28bjr3M9sLgJtrg2p8Aj7OwounEcAPuNt74TFk4B4FrMo7Y50i9YJttz_5YLkpaZAbiXBcbDuet0UoPDlzW46hG_DCRIV3WA0Sw59Pnl0GDaeQmuWeG1IctRZXPt8fEW8aFoWHNryoAzgzKEyjRqWoqO5gx07eAdihb7Tesc9VsWKIOsbZXYlLYikmQ-uPsQIZ7PjgfzNIGhAasiVK1zO3iOqyr6Wu1O4zIini1HL40OP3f4zTUq6LCNGplpYuWPeiJJIF2iHkYdMCRCt3yUoDh9q0Prhi9R2qMn1Kmqj0IVayghU73uivq9XKnhZWOid3BcXiMO8c9_3zutUKUuM4YOoN950ZN8CvlwDtB98Zj_CNR95tIN8levIT4oabHqmTDQWVcNn7OvXcNrhdQQvNRfKfkYFATqjiQtnNBYDK529aJcvAkAPM1gJYf9V_T_WSezxRpHCAQSPwDq26N9fc7f7MQyvzc_OYSzU9G3jX13yDxDh0nukl592-kXnleEzs9kRBxPWnfgmeShoGYK1yajbCQlQL_PDBgBIBNgAQ&cry=1

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cc190b88c1acaaf674403e508c1ba263411a0dfc529efafbcfd5f7d3353974c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20784
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: nginx
x-server-name: app26.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-C72Mh6XsRJomghtkvcf4z30irKzpSP9YUYvKSLHuV2iHvohcaawrkk7tVNLFPjVZHajzaQaiSbaRgZTowjZRpeeKU8HVVk-YyZVY3NXE2Yw2lu5GyPPG9yr8QZYyhhPUVQaKJjfJ87z7hELuHz3DLiW2_4oWngrnZrXLvbOvQEG3aoYxES6RMAoCZ_4H-SrTQJsVXrdtDv7nOqeMDlypIxkwXpBAOzVh4rofJXWQ891QjrScksvRxIbPIa6jr64BlOWabKSSFvj8vNc_oQxRhI6hRmCvmAVQaSMP6La2uneZ2zmDClFcNY1KHB1AxW7JwHMejOSGh5cQVCYh6AjaHUtU38qiNJLpc_h_k6AphbwFGFoCiWENhtCaNwDsu2lcUoCPMlBQ-6DsXoy87Fs69kgxC5QbUomikH6baeyjnx5STLvVzRukBQUCtw1dyDpA7dyQ_XhFceNIxxRew1BL35HEZ4Mzflu9_TYLWz_1_ZI_f_aFCnDsFqc02oDRG6DbrV-4izmncZKl8E6Vv9MZH2msBMgKqJznwE9kLnB0D5-VW_PuVopwk0O1kN4gGPLzfz_2BHGTVflWidOr1aq8UVvmP_tH9i2GL4Wss82VqgwVMuAWF4sj_v4G0sqb8D2Ow2wZhQNWpjXHY3YbnXwyVWradwhyLf9_mU72hWcjhFaC6U_kjwDsWaHc5vv69_XFnnb2PtQ01ip0c7Ourhg6CVoBXqy48L71iJnyQiSkDarQl28ac3xxQ8zTFdvbDPbF2b6tND5Wy7avBt763bsya0IDmwHM3YB0y4O7jH3qHjPhC5Oi9jkBy9qBQWzOHYC-Digt-YNUES9IEc4B7s_wjgyA1aMnqs6HBbJDRGZm-FO_re82ddjysWKcPaTHIZ7GfXAAKOUd7Apybe0Zf9phQybm-qvyyAidMJYszE-Hg2H5dt_Crf_-utzPNuoJ8VoEL412G85CNHgJIQBZTigiJxUarTTTAIv2b-jj6LxV54vBny1SpCzkY8qQf9944njc5TxflbA7qKv13lMR1-H3AAzgLT6Ys9QkOOQ0unJenqf2v8gv22UTj7Kx97P1pVAGlFnNlP2ig2fAY89iD9Vtx8ozg-SU-jGZhs8VV5hoE4nQUybzAnUhs-hjoWRFOdekPXW8IJfTr8TxS_1Bid6SLbzGnj5bVCmFmiL0EmpM2RrXCIB7J3HptZTbP597dhJAGrB2kJ9T7OI1JOQN_AwMgYUF3LLoReZosmuL17RWA8KX5YLzL6RYuEPRPwozYf8iwjWV2hQg2PfOsYBLuiQjm5sqzJVczvryB2ZKQYCIDdi-qPrFRi_eh17Yn_098LJlEP9sn7yYkunYXTRwhxH7hzFOqHT7Gp894XgzBXP-59V24zksUD2fVNSZ6LNDxDjI0yf_lPG18qPzuqRA0SrocGEntgaH_xcVVHA-Fe83WAJHEShlARyUYNY6K5V3WrBV_EsBfp-Z0tiz1e5DU9z5vEaIg_K5ygNPEhjnBRsAfQqOPLTeZZXLec1mZH-e987FvAuvBoxrbINii9q741dZaJu1awcGdYF15862lP5gWO5z_4hMSX-mpzEiTd7RPvrfo8e4c6DCuBWkCg7z765aide8f8218T3T01NSyaFGedVhR9_kTaJ6MIQhmm9EMqmT_TcHXzM09HRui4oZXQyAzrg8z-6-xfUfKRz9Zo8Ea_WNAuO_mxAW5_cTh2e8rsLFFr_h4KjV0dMz0Csv6K3H11_Za9KmhJmYcWlzLiwcwX-7MzsNh9z55YfRo-a7-hG6mwn2_06ZriS5y_h4laZ8oBHCXbrsVO87q6fCvaeMEpAi6ATx2htCXmQGnBqRxPFHacK9SfXmgz-sUWI23eZuJ6-4ndCv6Qm1eAEu1yC7GiCPdFfhZpd6u0ICCZpzImfBNWYyduAk8UQJFwSa-iI-h5T0-3Onb7t4aSpwA7GkCSi4u4UnNAq3YISqvD1WBjKVl4ml_r1tyF6gzTQ0PQsrxtZ-rdjsgF9fkUaqoGkNiZxJjlPDif-D0cnern5DF312Y-1vtdiOFbi152h2QAzjr-NoXRZHBO11518oghRvAaUCWWeMXYCXgzPwl73dvoF_lLEpsyCgqiLlW-td0UZI9cNTbltwG0a8aZTIk5sRWN1o7XHok8ErKIJzXs7qSph74oGwMNXirlOPzGcvuqIe7imsbjmeywaRG-CZnohHE1az_WWm-R7A8ldFkO37zh6gETkihq53NYHVB-S8J701IrhnC3h0C5ANXuJIQv2ogkXH94wQbA4hQ3x-y0wEvk3aRiN45I7xLmPiuduoCUo_lJct95VeFrfQDw4afejhP2KbbFK_6zBf3V6470zZc4m-naIpQ-f9orp8_0NGHkl-dnJKJczxWwqMifYcSAF_AoWCDTU1r9XX0BLZeVPv_1_m6uU4iFaGLnGGSpoZcZOpnJ9zDpxPQ3migLpsg4bdTNqXocP83B1RM8Zuwwdmt7MXNAGOMuY8VEPQYGhGXMDKlntm07A6RDYUrUxWQ4oW3FAxAqIrnKr4Lqa9WDxOBpJso_9-7eWP_N-y2jPzwKeE2Tatj1aIye6viHFD5Ha82jIA418GpH5GSkJ3zMCphYHRut_vLQkPMBvhiCtVKjTFaerXUouaT_0twfQdHDllB01gdgZVFgr6_Ra2pSr4n5NvTyqarj_INMCCic7QV9nhvPbuBDTWREwNKU17M-b_jfniHokhwGoUXkBC0nJdf0mUgcGVZNmrkzMw5d6lOS7IveZMJIuVTvkDiDvRxf84d9QugN6sCzKPkxlfKZ1nZNm1aV3O7GW6wuVhO2spvBVLlc1Zujfl0PwepmKr3nU14OGKFhLnvk3E93KPsJ-HmLWtqnZ86YvMwg8b1d1yLPWYMrngyKFS-3FFEt_XG6ps4RkXpHtAIlJFnc8UKLDUKOEGvQqXflpO9ZfzVMqllSCVU4O7NhneqhkUvLuzIVLbbPxTk8kWJGU1KDjWj-q3nIwVeedn2o8NU3ta5LdckU7LIHxCB7woU2mvNJgELpJp7YAoPYCeRLFuHYQc0n5Q0b1Qg2Q_UscISM00UpnOMEEFxxZ9HftAm9oRwJ01IH28bjr3M9sLgJtrg2p8Aj7OwounEcAPuNt74TFk4B4FrMo7Y50i9YJttz_5YLkpaZAbiXBcbDuet0UoPDlzW46hG_DCRIV3WA0Sw59Pnl0GDaeQmuWeG1IctRZXPt8fEW8aFoWHNryoAzgzKEyjRqWoqO5gx07eAdihb7Tesc9VsWKIOsbZXYlLYikmQ-uPsQIZ7PjgfzNIGhAasiVK1zO3iOqyr6Wu1O4zIini1HL40OP3f4zTUq6LCNGplpYuWPeiJJIF2iHkYdMCRCt3yUoDh9q0Prhi9R2qMn1Kmqj0IVayghU73uivq9XKnhZWOid3BcXiMO8c9_3zutUKUuM4YOoN950ZN8CvlwDtB98Zj_CNR95tIN8levIT4oabHqmTDQWVcNn7OvXcNrhdQQvNRfKfkYFATqjiQtnNBYDK529aJcvAkAPM1gJYf9V_T_WSezxRpHCAQSPwDq26N9fc7f7MQyvzc_OYSzU9G3jX13yDxDh0nukl592-kXnleEzs9kRBxPWnfgmeShoGYK1yajbCQlQL_PDBgBIBNgAQ&cry=1
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 7E20 91 KB
23 KB 97ms
14ms Script
application/javascript 2600:9000:2105:c00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2105:c00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:25:35 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 db82ddc02f317cd7d03bb2c60ec7cd58.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-C3
age: 4264144
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: SOiXvfHmb-yfMWuLR9Wq5tSvfuSXqskb1rRapqiaHd7xRc-NdEOnzA==

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 1596 41 KB
15 KB 5ms
5ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BeDpU-qqRGg2iQ9BUj5IdPPg-1N8MvJPhzwmAfCOF_W90lh5-GGgxgBS97kU_I735ExOgD18N3rs-cIiysj661_DukQnTAzlA_1zYvkSrAFRgPp9gdGNLCVMvwUi2f6TfbuH929fILsGn_vBpDyPtkMG-G1i845f-r-Nc7ZoakKbSin28&cry=1&dbm_d=AKAmf-Aq93u2FCwSriHZGp2dy2rIA9LUphHwCGpE-cCzpDUGikB29c-_D1ktocbgdmiHS7kGV7Xt3lUgQSHKE32bixBTw0P2GO2tjDtFehu9JUECKOTdr57iw3Xf2NB7UfkFaXSmjcEF0C5jrfJF6SLBtH0MB56XcKj6YAoVxMQrDePFUqlNZSlXzOGT-VA5rdK20FJZpR9lDIafZLqaJQ2BXpvZKn74XfL9q_42oBHOrYRNiuVnrRVTBnmHR5uZlrdZwp7iVgsluhFHsmk8oXrieUWR4nId1eWXv_ny7qH_kKaaffASNVF3ZgWHKBSpPWrFzpDAPdn0cxK_J-wOxrs4Bta9L_XR78p8JyOQPj30AvQTbfTsa2Ie6zbTLTptoskqtMY-SsM1pV-iKBKvTJO9HQKPHcJ57rGTR1Ecns3c-PJG7SDsBo-yfzSs2rKdkEPh_K5ozxTAHgA9Pr0DwIRyVxyj3bxLqyl8pS9hrIQezW73n_Q8fIS0q9bYpvGaIuSQ0i2p2xOm8jDm_L5t0gKHqtlha_J_x9TRE2KCrklxJh1hxDgBMZ6UbeBG1u0nrwYdFyRsfNl5l5dNI1YGXjsTmxGGBv6pUrEDJw1AF2ZbbzsWlzM5quMI8vQyV-8o-3us_Sby8jZV26WqqykIRkvy2big1l-GIPwwAFQTbzCyK5-44uFLI_MCLklB2elTiVzB0R8ArfUqx9mZ2mQHluSyC7eDIHCBs1H6k5-x0iM_zKx81jknTF9l3LqqbpdI3IsX6_RPjZeKVxvfQGreUctfeD4jPRrCQLMn-fGL_Dw0_TqZth8ohyPrHIqTOLBwwL4jqAs_FYw0AmMSTnnTCqjlbaUyyH7AenNymdfaumIHl6Smhwu2pUvPY9-B8HVfLlfTed5T4LehJzTCsSkm4dRMR_Z6bKDOWVjcYYVmkwnwSYtUbNBFJ80VV81zXdvDOpdo-gEsBd498qnRUZOAyj4RuRcum37zRnUg7KjznH0RmAyaiRh9tknUF7dddM4joejjMoRAhceMGnYpGpt2Zay-nj5CcO5c474v5tccsQHzXhBI-gcnNykeyi-L9SgM7Xmjm9oZHQF8UNJFPYgjBZrv3RMez9rELxiSgs3xrLA9IRToyxMKcQzzXpdweHT0UTOjO85aV_4EoSdmBMN2VVA4Vc8dnV-WgplodUAQU2tTU1_4bXjB5qEXprD157E4g_aRGkpvRWwx2tTg936F0a3lGWIIFYhWU7whh4Nn6nPNghalMlqqWYXc8rB0n721BhtOeMCzTSyR2IglrDFzcjzRtvVCiRLofXPp1jLy5WUJ-IELntXDfO0Iaml9ZpQjRYIgHVhhCw_hY8LWFILuldkZ849jUjBhP9rRnfaP7AGMrbA3I0C3mCVueu79kmR8szny6__UTY46r3Co9Z7W0MXPCbMj9mI7U0K0IH9DCGbabpVT2vW4lSka-iUPkntCg0ROGiaZzvPBDxC5rdWHHCruxa3zt4jGjAA5yQ8w4JfKP--dhDh6qOP9CAOK34yGYQRi6Y3Fj9x5f26DNaPkC2V_nmVEO8tjaqb8L_Ktbxcg0wS1W6QxNbXlYZV_uIon7Tyyo9gilCyz1b-DpxCwKa0CnQ9DcqMkkcajvYNoCk2-n6zbrjbLSwvHj8gIFaP2DUdl-bW0VBrVQEak3OMgKKKrARA9WRjp7yA_oTLoYdzFpDM88CLaHoUebwwujFg9QANPEYWwWXuHeCvCNyjWm30mpBcdbs0H-btFJ9d8bvjU-hHeVWv32FgLsQlgFx50y_2nQpUQks0E4g2VLZJ90veGZaUD_HIfaT_yJl0koCo5nqSF3kqaheVJ4mBmEJ9YpRvhZlpYUbhl5D3PAVbjRqacurVthgmNRm8Yk9oh-ZlRVOONTQ2KWsWPJw5dXmrr906rWh_jNSvH6Atcfcs1bDbUdvtfsXVxyg60Qj01XjUgbGOrKkHBqxYVQZJPaM5AP2siZSqPCY10bmf_Zb49EmKGipImUwYwAEMHEqY0WojoSwWQi6CcSYWWXY5nrLnqA5YUV2r37VlvQj1hheJgoDeMk5zPzpGayxpGu76aLfEGADy-EndKWtGDc1IJaeZ9kLsjnPg191YjMNYBv6YeDDQwcJSPiqNCuWAWzN9R-4fcNdliyaf9NP0aRm_b7sGgKzmJXIp1e8LB5LVeHjqqI1NWG6qdxVt-U2ToAraHWGoOGlC-ui5Kgt1m6qFSzPInZD3uSQm0kW8TBRyUbXkoRTBeYT4RuBUGPVwmqk2zA9Q0pwJly7ncyyJK3byTWDYTLTBysMB3Ee_46-SYLmJDRjphzSbZceoRoehUDgFK_nS75OEqrFPXxntaiIi-BIbPKQQE7ZaGSiGESWKtdlKzVowPpLl3RqQeea2DniTJjBdRthjMKoB7B4qO_X-z-dmV9Ow89zzJDBiz78Nty37EhKnDa6ePae_PKqxJqZWg_n_2Y_dR64hRjDIclzOZz5SgvlDSoK81RN6WGOB6PwirJmKBWlFLEMN6zXO0PQ1pLnDKLtSqkVRKvGauoGtTOP1HvQALCO2r6ShPwGjeqyq6nlI6wfaGjkZw0BEE6W7LO-DIC6gypHUP_swhSUIdP2-r1zr8B_SZKzb2fbv8MZNOiaT8r79oQbhlUic5gbS-5DklbQDQ1Vts-vAQO00kq_NaGzGtfW4rj4wf13-yA9XimDjj3OjXSvDA0ojgEjVy8nFNLvfYRzbpM9c9yns7SPVeClb015ZFzCrU2-ZBgsYushwrmoVDka4exy4_QsfWhzDmZGQfJNrnE0QLg0j93ArtfUJf74FCHbhVp8AyAk-gHLZagaDXovIVsg&cid=CAQSPwDq26N9fLHOV93KpFXHv79BqFCtZ5p1x-aelpat9KJJLD6g9OuV384gMemuQsiqBfceb57a3Fi2mBdbfDBZpxgBIBM&rfl=2%2Chttps%253A%252F%252Fmohtawaa.com%252Fhow-might-i-purchase-bitcoin%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 04:43:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83447
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Nov 2023 04:43:51 GMT

GET
H2

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 1596
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/1194052/66719900/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-B63GjD0SAznr7Y6-9tQqwhqRVFoR_L1ec15Rz9Yg3WmuxXSI3ASYC...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-B63GjD0SAznr7Y6-9tQqwhqRVFoR_L1ec15Rz9Yg3WmuxXSI3ASYC1GGhBUAClsHI5-amlo1MqR2wPA...

51 KB
20 KB

86ms
53ms

Script
text/javascript

172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-B63GjD0SAznr7Y6-9tQqwhqRVFoR_L1ec15Rz9Yg3WmuxXSI3ASYC1GGhBUAClsHI5-amlo1MqR2wPA3QhClwkm6_76yZl8Op5CAWAuX-0ofdRyNElpqUREGNBwSeeF0Qwd1DkJR4nKKeKRcrXyks5tmic7GfrbHV9To6rrjSs_8dDZeAS2RMAoCZ_4O5T7a_Nw3J1vOFEIG-dtd21_PYOub9zbd6eerrfelGsAR_kAUBnlMR1uZNUBRcBMPKnk64qn3ekCTi-uCaYEfEJhC9umpAxaldTfvUSyFkPJKymdIahMiXo8wjhDLf8X4CKMmoGoVhaCBu6_PsV3zvyD9r0DRFCPJj8PMmEoTQ1ccvhKtoKAIOnziPPR_Kqmpk9D064-DWoEAwH-ERwZ62TQUWhsloR88Ur689Ughg0sWfzor-J3n4yFgVRkuyVtGITzDcqyO8R6YU8mwS8E9kAlkxBNKm0o9sK6RUIaFyRJj7PTVOEzXjqDeH6x1PxXq2PTXqESRNmdvYEXJVfq1G1JkrjiHWT6rIwufUZkK-RPbxbBUXTP4Cljq6XOj-WrVxr7fT10Gj43_6H0dlMFuV2JaB5AaqAbR1lLci-_dhwIygbaicBg3ANlG5AXMSbAVdjBPaF8ZptLnGRHqrqoR3lFefCDlhuyBAHH_Uz_HNbHISExkG6q-Okf9xBq8uRAbjhjBA3oHCWKfUI_wutje_Cl9M5bwlYa3XNE5Q8wItXYtt1HN0BdT8CcPeTnadWYjb9413PmGBR6ht1orv5drGy5fzF0_okFnD2WZhgtKAiuVDl5kEOnR9ZV9eCGLh7L-YHENPscOGdJYByPbN7iOIHBzuieBCxQPsH6s0mCehRvNYYKQ7jNycYCX1wKSrdMCSUhcgsraeMVO50ZB_iFjmbhIe4jjp1DApe6D2eNThIRALC87c2yWF-g41YDXbWOwtx38IttytWv-jHL47H8LGpz-rXP1ZzIuywA5t8hEYj27SDcZHlwqFJfunPhacBEy--5AOYjY9q-uMh4kjQP-b-vPvYsFd6EwjUOVJwP8iCDo9i816DOz_rb8nqOD90WRf9FBqnMOndk0Ipr3dPLjUDr-uqsJiWNH7FXDymbLo0tVLwYDdKcyO_7LRwFw9YKOOL5gopmkcr73QEdc3LmQoSdZws2pTBRlNBLS0gmW76h6TZXeQYiVK7dX8TYpwSBuNBjgRSj6n3WJFEcNL6EdH-QPgp4WRWuTVuiglUNWrdobK3N1rr-lMeGO-TyL09Nxia2BVB2oB5rcs3RWi85uzpx2Wlr6yd3VtS__cDhx7BJ7gjvU1VazvikmpCnlbofPpveTYVg4RrFyu8TqPvL9-byEioLBXKlYmsMlhRGESwCggCoirdY9ixt3BHSxrfUfGNGhlC0wbFIVxHGwDB1G7zLPqpcDvidMBo6mv8tMCVaJPhyPwZRdadvDO0HoF_AKJSLj7_reN2XO10dyXQPBhVFfc5LbVsHbmRgf3ESdw_q86tMcBlxLoO9NBxP7za-GKZve9hZUhbCGmJD9HsQCIrFEIFSmf9yKoPJWLeuLiSE4gOZgGDbwIS7adzcvcXCadgYeb_tf5XuY_Ta9kW3pno-K8MNBzGUV4nkodi1rrN0nfd4ovzNYjd09LwITaBhuSdhw1N4OOGkOmKHCg8jgf3tVN7QMmvTak-IgWzyyJGWgrdg2ypxfwTMjH7OFGnLDQ5maquPuhr82EmcVH1hAjCl6Tv0eYwvsFNu3B9_LVObXOT9pw-KIjHCPyblfnHiy_pZjV2eWRljzWsiBold52vYeDpjtMethODuHzasp3bLwGU6D4KorvvGSFQi2Fcvq_myCKOlRq5SKGh4rpc7pMi8yeKC8knW6dvZ0q3vl82Wo6hDkaGLCLgvwykKOtGviop1KAcuyZ_rbP9QrKRnspXU4umioLfHptWvvgyNAJ6S3PtiCJDN8pNAOcbweX5zBBMINnNiivdWBRxiUzNHQ-wXXEAoqjUhux8g6-LGtoO7z7xZ55A3w809IG7GKo1UnRYyAGNFyzYWyhepgdk08El6KC_pD0smHZZ8veJzZSqKPEdBIxhyavgv3tWmSNXG7I9jhWI-7rbR0kgbcfAkYCiIggS6Ku-TYWJWR65ftT-rw0XyoR2Bq9IbarCAvj9ssWaFl9_2i_DluTJeHBcR5xe04D5KTJoDmkAw6bqB1k6GiGac7sio3HBVXk7buPWHsdwkHJ54HfgPM8R8FZfpBg7hzHRSbL7JDCxxdAIqUcykDcFxY1TyydW9x5Ko6WIMMq9QqjW3hA26BFMMmdL16DC1QFgKNhOT7PBYtcKPOZG7k5zCNOcCETmG61gvaJMui6X4df0gFy-kk9PgWhDvBeFUUCrac2UMk1RDJqYa_4Moc57Ey83KTVG8pd8m9YWzLgYON4n2QvtoEAIe3xb_kxUYAl7qq0YUtam4zqdcdp1WT4wPqHJfPyznQpBd8F9h8pcEAEWgj7E277cLYPoT67CMRdr_1VKD1Wf2TmderZcOIDu-qSTlaJ3P9I6qgQ1WSG45kH_zY-_6VGetc0mWRVRPbpBZWl1FEr42wIzAdSFVuyuxz1a-GFODE5tdM9pwzPaueWbUA7dqnaC9FOrDoYCDKTSuQDcFC7M2L1BQvRy_zAIux4lP_qW5S1nxaU_2Hm8R562FoL2YgLWO381_bR0tvgikdIiqKZyQ2CeXxJSzn5NErVGdc1Wn3ET3WB1ocA41sDZv64J8Q3H2Ch9O_Vam5B2OJLacWWweEUBIXIVTpyKeD2YQsCtE34wEWV-N85hhuppj7jzjlYy2JmttcX6n7gZd4jtmJEbDJUsRncnraI59eCzqmRzAxs2M-2HUJoZCiKPmOtofSoZ_MYgTBaAxMXJ_NqPWnB2r7PC9pK80gQP98EEhgmRmXD5-Eih8XrrugnzoLcJToIb_N4_vhLNYgT0pqbEjy6kGjgx8h_elnaL4TRErCWnaQXVF3So3PeYRdhHe1SUoNBrXRLyymjKiW9MTUNrReR407doVipIX4lJF-4YpZvXNjvjEazs-m_CxBium6OPKlvluNdbnsUxdh1MSwKzaJfbZVuK_mRBgzj5jnbMiXR1dNwdw-FpJAFcAt0rphOw5cUKJTBlCG5oDQHiOC8MezTlsnh2HUzvFhI94ROK5qMv82dI-xVcZXWj9aqTmtaKL4EV2zm6UDs0RjcjGDgLSkOD8h30JXgSePhcsrDMSTVOPUAlguxOOBajhQ6EUG31gpQdRBINduVEX1O4rFsPyCFiJN50NqJjkA1xAipC-eav7QnbJvUZ7vJtGngwg1lxcb3KDlV1ysjAksHMMyPKfr90hNL3uSQhnbDtZJfDntwMzzoc8lbY-JCBtKZeFjnXOfPVkXjcUbofrqbUR9WqmZG3l3YY_fwKfbfBr0_PzxKpOf0d7C912ezv-9WjO_xSZ9z4TPcRIHqrdC1aZ_TmyKyVEmrBNr_Talmw0xvYnpojC3WKdrlyrGQProxuAreO0mdf_QyC7qlbPWZ6GkcIBBI_AOrbo318sc5X3cqkVce_v0GoUK1nmnXH5p6Wlq30okksPqD065XfziAx6a5CyKoF9x5vntrcWLaYF1t8MFmnGAEgE2AB&cry=1

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcc28d3049b2e6955d41b9d02e50f6d1308d6095eb82d1c9ce36dace2304c315

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20700
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: nginx
x-server-name: app12.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-B63GjD0SAznr7Y6-9tQqwhqRVFoR_L1ec15Rz9Yg3WmuxXSI3ASYC1GGhBUAClsHI5-amlo1MqR2wPA3QhClwkm6_76yZl8Op5CAWAuX-0ofdRyNElpqUREGNBwSeeF0Qwd1DkJR4nKKeKRcrXyks5tmic7GfrbHV9To6rrjSs_8dDZeAS2RMAoCZ_4O5T7a_Nw3J1vOFEIG-dtd21_PYOub9zbd6eerrfelGsAR_kAUBnlMR1uZNUBRcBMPKnk64qn3ekCTi-uCaYEfEJhC9umpAxaldTfvUSyFkPJKymdIahMiXo8wjhDLf8X4CKMmoGoVhaCBu6_PsV3zvyD9r0DRFCPJj8PMmEoTQ1ccvhKtoKAIOnziPPR_Kqmpk9D064-DWoEAwH-ERwZ62TQUWhsloR88Ur689Ughg0sWfzor-J3n4yFgVRkuyVtGITzDcqyO8R6YU8mwS8E9kAlkxBNKm0o9sK6RUIaFyRJj7PTVOEzXjqDeH6x1PxXq2PTXqESRNmdvYEXJVfq1G1JkrjiHWT6rIwufUZkK-RPbxbBUXTP4Cljq6XOj-WrVxr7fT10Gj43_6H0dlMFuV2JaB5AaqAbR1lLci-_dhwIygbaicBg3ANlG5AXMSbAVdjBPaF8ZptLnGRHqrqoR3lFefCDlhuyBAHH_Uz_HNbHISExkG6q-Okf9xBq8uRAbjhjBA3oHCWKfUI_wutje_Cl9M5bwlYa3XNE5Q8wItXYtt1HN0BdT8CcPeTnadWYjb9413PmGBR6ht1orv5drGy5fzF0_okFnD2WZhgtKAiuVDl5kEOnR9ZV9eCGLh7L-YHENPscOGdJYByPbN7iOIHBzuieBCxQPsH6s0mCehRvNYYKQ7jNycYCX1wKSrdMCSUhcgsraeMVO50ZB_iFjmbhIe4jjp1DApe6D2eNThIRALC87c2yWF-g41YDXbWOwtx38IttytWv-jHL47H8LGpz-rXP1ZzIuywA5t8hEYj27SDcZHlwqFJfunPhacBEy--5AOYjY9q-uMh4kjQP-b-vPvYsFd6EwjUOVJwP8iCDo9i816DOz_rb8nqOD90WRf9FBqnMOndk0Ipr3dPLjUDr-uqsJiWNH7FXDymbLo0tVLwYDdKcyO_7LRwFw9YKOOL5gopmkcr73QEdc3LmQoSdZws2pTBRlNBLS0gmW76h6TZXeQYiVK7dX8TYpwSBuNBjgRSj6n3WJFEcNL6EdH-QPgp4WRWuTVuiglUNWrdobK3N1rr-lMeGO-TyL09Nxia2BVB2oB5rcs3RWi85uzpx2Wlr6yd3VtS__cDhx7BJ7gjvU1VazvikmpCnlbofPpveTYVg4RrFyu8TqPvL9-byEioLBXKlYmsMlhRGESwCggCoirdY9ixt3BHSxrfUfGNGhlC0wbFIVxHGwDB1G7zLPqpcDvidMBo6mv8tMCVaJPhyPwZRdadvDO0HoF_AKJSLj7_reN2XO10dyXQPBhVFfc5LbVsHbmRgf3ESdw_q86tMcBlxLoO9NBxP7za-GKZve9hZUhbCGmJD9HsQCIrFEIFSmf9yKoPJWLeuLiSE4gOZgGDbwIS7adzcvcXCadgYeb_tf5XuY_Ta9kW3pno-K8MNBzGUV4nkodi1rrN0nfd4ovzNYjd09LwITaBhuSdhw1N4OOGkOmKHCg8jgf3tVN7QMmvTak-IgWzyyJGWgrdg2ypxfwTMjH7OFGnLDQ5maquPuhr82EmcVH1hAjCl6Tv0eYwvsFNu3B9_LVObXOT9pw-KIjHCPyblfnHiy_pZjV2eWRljzWsiBold52vYeDpjtMethODuHzasp3bLwGU6D4KorvvGSFQi2Fcvq_myCKOlRq5SKGh4rpc7pMi8yeKC8knW6dvZ0q3vl82Wo6hDkaGLCLgvwykKOtGviop1KAcuyZ_rbP9QrKRnspXU4umioLfHptWvvgyNAJ6S3PtiCJDN8pNAOcbweX5zBBMINnNiivdWBRxiUzNHQ-wXXEAoqjUhux8g6-LGtoO7z7xZ55A3w809IG7GKo1UnRYyAGNFyzYWyhepgdk08El6KC_pD0smHZZ8veJzZSqKPEdBIxhyavgv3tWmSNXG7I9jhWI-7rbR0kgbcfAkYCiIggS6Ku-TYWJWR65ftT-rw0XyoR2Bq9IbarCAvj9ssWaFl9_2i_DluTJeHBcR5xe04D5KTJoDmkAw6bqB1k6GiGac7sio3HBVXk7buPWHsdwkHJ54HfgPM8R8FZfpBg7hzHRSbL7JDCxxdAIqUcykDcFxY1TyydW9x5Ko6WIMMq9QqjW3hA26BFMMmdL16DC1QFgKNhOT7PBYtcKPOZG7k5zCNOcCETmG61gvaJMui6X4df0gFy-kk9PgWhDvBeFUUCrac2UMk1RDJqYa_4Moc57Ey83KTVG8pd8m9YWzLgYON4n2QvtoEAIe3xb_kxUYAl7qq0YUtam4zqdcdp1WT4wPqHJfPyznQpBd8F9h8pcEAEWgj7E277cLYPoT67CMRdr_1VKD1Wf2TmderZcOIDu-qSTlaJ3P9I6qgQ1WSG45kH_zY-_6VGetc0mWRVRPbpBZWl1FEr42wIzAdSFVuyuxz1a-GFODE5tdM9pwzPaueWbUA7dqnaC9FOrDoYCDKTSuQDcFC7M2L1BQvRy_zAIux4lP_qW5S1nxaU_2Hm8R562FoL2YgLWO381_bR0tvgikdIiqKZyQ2CeXxJSzn5NErVGdc1Wn3ET3WB1ocA41sDZv64J8Q3H2Ch9O_Vam5B2OJLacWWweEUBIXIVTpyKeD2YQsCtE34wEWV-N85hhuppj7jzjlYy2JmttcX6n7gZd4jtmJEbDJUsRncnraI59eCzqmRzAxs2M-2HUJoZCiKPmOtofSoZ_MYgTBaAxMXJ_NqPWnB2r7PC9pK80gQP98EEhgmRmXD5-Eih8XrrugnzoLcJToIb_N4_vhLNYgT0pqbEjy6kGjgx8h_elnaL4TRErCWnaQXVF3So3PeYRdhHe1SUoNBrXRLyymjKiW9MTUNrReR407doVipIX4lJF-4YpZvXNjvjEazs-m_CxBium6OPKlvluNdbnsUxdh1MSwKzaJfbZVuK_mRBgzj5jnbMiXR1dNwdw-FpJAFcAt0rphOw5cUKJTBlCG5oDQHiOC8MezTlsnh2HUzvFhI94ROK5qMv82dI-xVcZXWj9aqTmtaKL4EV2zm6UDs0RjcjGDgLSkOD8h30JXgSePhcsrDMSTVOPUAlguxOOBajhQ6EUG31gpQdRBINduVEX1O4rFsPyCFiJN50NqJjkA1xAipC-eav7QnbJvUZ7vJtGngwg1lxcb3KDlV1ysjAksHMMyPKfr90hNL3uSQhnbDtZJfDntwMzzoc8lbY-JCBtKZeFjnXOfPVkXjcUbofrqbUR9WqmZG3l3YY_fwKfbfBr0_PzxKpOf0d7C912ezv-9WjO_xSZ9z4TPcRIHqrdC1aZ_TmyKyVEmrBNr_Talmw0xvYnpojC3WKdrlyrGQProxuAreO0mdf_QyC7qlbPWZ6GkcIBBI_AOrbo318sc5X3cqkVce_v0GoUK1nmnXH5p6Wlq30okksPqD065XfziAx6a5CyKoF9x5vntrcWLaYF1t8MFmnGAEgE2AB&cry=1
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 6381 91 KB
23 KB 61ms
22ms Script
application/javascript 2600:9000:2105:c00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2105:c00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:25:35 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 db82ddc02f317cd7d03bb2c60ec7cd58.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-C3
age: 4264144
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: _OI38QWjSbfhtinmp5feGmNyjaErh1AoV_hqhuOf-NLg6WtsTuhSBQ==

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D6A3 468 B
198 B 34ms
20ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CIkCEIrXrIEEGKaa7tYBMAE&v=APEucNXAC1SZ6ODc8TNAOoAj46fDkcDTR_e9LMwG6J4V8HVS9S6cBgZ6tM-Ph9AynM84IcMFDJ2LCHievqrhuueWuNmNT9SmWg

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1a81c00b02e9a797e6e8cfce706577e8eb14c66fc4ab38ed71f09508d9222c72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 178
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 03:54:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7DD3 15 KB
11 KB 59ms
46ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Df9x963IL5eEtj6AZd2F6u-JChd3TYJN4RbqDoSSxyN1nZaOfSrroGXF6rUX62nAQdunBJyl9ATL-KeMvKBvJSnSCCv_S226-oo20ZXF2d7wLgXKNgl26_h5SXyjFL3sx9UiiGmHE5MusQ59ijoPYO09E0xm9Dt_EQC5k2DRYkzZXQqvY&cry=1&dbm_d=AKAmf-DC0m9svILCvlWzg3HQO9WHjsIzTSdKon05No1LeJEbnPZaRWGx4GSLJPZlCv_MlWyiTnMgvfvLwfAtNKftqypJiZS1YXzaauQcohEDNqAkjfxvNhkUur-Ei2t1Gn3Guz3n2ZCpw2G57NbALFrsbpilKrFLWtCaAZ3ajxC3FhdiJmaG5Vuge49VNZHDtKAHFrmYiXYdpvnLfg1ewfEFPbhylmpsyN0Q0jEgYUE9E_LICJ3HDebHCzliGobIg5MhPwusuW4Lg_1H_4ShlHKC6nbLNhOnsXf20u2q6sqid2x_XM5-4cGUi7NA_9XwmB1dRmEq019_6WtyffAT9_iT3VJLmJNghBhsZAfz2pS2yvPLoE7ufStRzdxzkNj-Zt3VSc8QCJmjRQQ8Kp5QD6DRm879RN8m9i0B36Pwj2WlWcYXnLwRcvinjwhLcaEutbb-NUcg3P3_5EVI5NkfERC6nk9Ge0FxSRJtVpUXbpIfa0S48Z0zFNljOoKycMPHtBXT18yptCyes_PcESvCRtEb18YWXIvKrzNSycAyuzSUGY-xBAkLb8dlFl-ma1EFHybcF5V5v_75fclzmJX50hffrXpgM_-ZoMdyxkGCXvh6KWyd79QaSti3Vg1Qy38ymxcRZKaTxVvuoz7fxwMDfsuss10TylM66SHkypkVkK2u1KmIAy9bhK2gTRSV3SjWgLMGEq1pCMgv3XygABEjje-XmrPe6lW2-X4Gc3q8EGnMs9AJTFX7sm-m-Ch95ICJHbqqzykiSzC6Ye-ycMtpLqphGz9sa61F9NsOCyFw1jgD7dzEmXXc7flQueRQsGIE6cunP_awKFO1HgTvhiETieov2-ZMyQp7QMV9R3NqAc7OTmPLRvkMtGpcoevLIYhXq5mtgLdyEQcLH4XpB9wwibGsdyZdUw-qrHe1M0F2TkbfCnzsZ-Zov0s_AgFsOS4pv1yTOIQO52AeTM1SyFvyRszgHhcPR5p8gS-bCmbtSGTk_TRSg4aQsL46-KwG0M1IHSACYFdgXii9TQQZC6A7pc-mx2KQdOpOFOihsHMgHOjvcSUXwZ02kl0kQwovGJFOttMNOK5X3zY0y3SdiiCFi3mJEBzM50rr8i5sT-8sNlEK3diavO_pqZqQM5QTaEuutiKEbrd9dOyMwvV8-yUae_h6MjNWNc6N_oDb-YHtsFHBMnapCjf8HP9dh4hSTTNgbZAgiVbdMgt2lpjGPPLrMv0WVGcdaRllFENwiIBXM4qneXjRKlrIOugE5SI6NhPKY11zrKjIDogG9AvINR1qHz-uWisPWkyV8KCC779gaV8d__PgyhteCrtE0F1RsecngNgeTZx70hqvTCPEqpLhQnv0d8r0mYqNDKRMwFgZZQrR7TdG2S1pWTC1SMwbfrM2ygZRlvuKHxW47JAlLPShqqnCHw_23G4JOQE4GfpuOWfCz-zMjZal6WJszf3U75NcRIkvUfab8YA273njyZIWr0Yr6cZZHE_Mrd_KIfc-AN7mpsC5--H9YpZrOBoDKw6W9B1e0yYuHuvGgxPsgYjH_0AvI5Kke4xgkASPZ6wSV-v3PCvLu7WRU2z8JgECH_7Hrb9bKXBt5yIZc0c6F3QAKMhepEryC0_9kV4Eav7AzUCBjucgWmqOc0Z1dArQ8nr3i129P9wReTciOitw3BBmvTWfJaKm3kKhdJTEyn7_s_hvPdLb9oGB8lBz-d1o1ciNOx3qn41U-sq2Ymmt0Zu3mja965UuEz6U1zbmjiKHG3LR0YZPkfUqef-4jp_jN11OP0gkYKlIEncmDibv5bCTX4b2NPO4XjKTYINB-qepqbxmsWT7UWpcg8RMbiqOcDbSeSoJrmBDt1jzkG0-JmZP-W02adUdPXTsA4yHe6hfY6uzUGYCdjLE9dlVm2Fuk5EpZk-ZFELa_C-nBB29hU6ROiHLAzH5wDcW0XpyjiinwktCDI7dCLTJv0h9T1mKTD9Fkllc3Hjr4AsN3wrLVqHHlNyhfydxYx3Y37djjqRMPW1l4pb7nnDhPXWXJ3zgb-8w0a3mBrH4aSsiEIbfzBHWR_D2aYeie9O7h-L6ru2si8Yw0D6enwyLC7exsmLMJeddtBT2yNVwXyfVbYw8UI8p1gYlgtr_C6S61K2z3efaIjxZ8-Jog-JqHg-H2XxQeyhJdrUhJhgBumeDOK8-Kq99gXnJpGcJ5dWK-Tp1nXrw6_MOfPuAt5PYF7PJXvrKuFRM1GmJBlH-LmNT_PVxtq176ZeTpaXQcq9NitRz0w848cKZ0JrhV72fd0zPPvt6W4q6vYu2AmF_tloFaT3feRaa11arEptSHsT31qlw66kMxNMbxeuwEp5mDQtokyWA5jXRRSEo1KAifJPf73eXZjQvU-hjrwtX-dYPNr_UXAFVwK56clz4kScBZVabD-ilq4YVOcBPH-VwDGxKeuYkIihIiUGe0gdWp2VouA-LT0ZdpcxewgXwt4N33OFw9LANryMMZPwZ-T6qqJBaCW7cDmIxKrSEdfc4loqu8-29XCFsF22FnRO5yT1Z7-omBAXlH46vfEqqkO_L95LA4OjvchO20BgB6Dmuf5eqARbL_qPiry99xcu6GM-_X_1LKiV5G26zYxfUEO2QphQxbapB2TQsLwYroqXSmcSW9g-wUenr1mxzouteYA1feJTZJ0uCUsHkH_R8_OIyJnDhgTVwsSBopn7ZQbe2I15JLlQ90ZNlZQoMSyoHksWoV4HZI1_5cIoojsMUgV4vTF0bCA8fE1mr4O5zTXzJ6vxA25k_qwex7UIXRkfgIVeS07ISwEIQ3SHgUqGGew6G3Bt1&cid=CAQSPgDq26N9bKKP3zMMv9KQPVRGsvO8u2FdTVA0adMi35UzNhjLf8zRX3QVxd7S-Z6Wf2avG2CZpuWhSmNGw-WqGAEgEw&rfl=1%2Chttps%253A%252F%252Fmohtawaa.com%252Fhow-might-i-purchase-bitcoin%252F%240

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

be90b50f06bed596292b6f755f122913dbd2816d7366ed89d0f04e75a965fb69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11211
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7DD3 42 B
63 B 28ms
25ms Image
image/gif 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Bo4KtKIpu682QzetQ-i4EPWTwF__YV0ajigY75H-_Kf96L2ycszpLWpdcMNz0LLGM5NzsZ9XtTkNMUKLOGeviIaN-shYxrf4tJXVEPdaMDbbtdSMc

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/1224441/66655758/xbbe/creative/ Frame 7DD3 245 KB
74 KB 17ms
13ms Script
application/javascript 35.153.63.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/1224441/66655758/xbbe/creative/adj?p=APEucNX93xuAyhr8_sR7oHiwxXCB5PvA_QcvkCZ9Ze4baFSq5qhXra4&d=CokBAKAmf-BB8r78UPJ_D-dhtu4Y4r8crNbw-H68HBzmykwSrbEf_5ES0kq4624I6_mC81sNGKSgc962c1OUYFFwvvXQ-4HUYV8zUQp_T8fIjBByGm8WMLg8ZCTL7XmwJQWdhXmf3kXb1AYbi4tysLlQG27gBhY5ZfWcl2VRAikHb7Imj4O7kzbUqWYS6RMAoCZ_4Gwk45EJpo90V_tb590rnqwFpT_u24tgWpZn4A4HrhxjPHw9pALWz8Op-U8pEMlnXjDJvW8-Nz7v13uGXsHL9qVV79bcSoOBWsVWuM2oKcpGbAc2mXxtm4rY6H98R_pGg1C2T6ylTgWqO8W5Ki-hl8lcLMbKWJxNM-LeS4QSRccmftTKmZ0-dhdVTI2g1ucf7iJ0GMCl-yEmZruOiN9jlJTbRzg9HRSxcH2979iPds4mEASC6iUuvy3u8RFzNnxHD9PnTV0F4H7mHxKmtXI-Ffy0Efky-m0o7FnFaIL3AYR-kVgE48OxqE-wXueRWe2NDsNxVp_pW_Q2NceLYJnnzfiTDh5Ur-gaXcnhkU813aiSChVvxUGCmYM5QW5_4PKLPpdPMH4Q6FKtjsSizVZk0HZsNd7FT3IZhD9mTNuN30GSBrIqHOV1pcP7KI3DQKCBKiR9Uh-o-84ehi1KTu57FJODjPArBO8wVFA1QVjXFoNSw6VOdDINQASTXP2W7r4Om0cwtLSsOE_URy6JIyK4KSBdAdzy_hG9qbQNzSn2TDbV6CVq3Hml-7lJTACbEw4pKMmJWMKISqZzNv7LVbDZ6qY7oogr8OumSRaRm2aspBEOtoUikLv8hI0WlklGnheD7OAY5PCuZDZ2YvsSCvkVkbh_7ZaOc3gOn3fpIpJxGtSPrthDhGh5HxpmUZ_j1H1wQQviQgaEMop-mLVDtIyLh0EC3NdvboBdWvRX0mUk5ZH3RO2flTCZ-wmEI2LKXLpckX_9QI3P7sj9_id-id1iAR0vcTU1zDNYSlMt-H4cHZTByi78Wn6d-AXZn3gwFxMiRFPOqfOAzcAPD7dY04IgFBANz4W-GX0rb3Vdh_OQ29LNuH9n7vY7_7zqFujTxh-eE59TDGpCANKJsOVsP-nFOtfuUWRHZAFPUymSzrdkDYUl6ey9Y-0SieO2ZesfLMWAnRawgpzwDlsm46Mrt0J1KfpYmCcNpKrsas5JO-OltZGpj7Z-reIEXQXEv4rMnImOAbDkjvt4pwaKi_mD5Q_Cjph_SBGo8o6XAD09A1WeNFphQYH02bF6QNozeIreCAbZkY_rwFR3WkEjlPqh7BlPNYnvvOfJ0ypR6K9BdZGwvsH2WfLEedZ7d5dS_WAGhQ3bqzLHd-Qiqt6aM6PXzOY_viQYeCfvjBxXWXRJLfTbR8c-pcI8noabNEQjlyUaru8DEdaLRpgYyHuZD6jGddbjhzjYhAP3P61GFhGgCCyFsOsYThSLNPKh9eIIGRJ9LEJ8NDFGt4-xkpyZa4XHakM7C-997ysN68FjLxZBfyESHtCOM0iqAE_bhhoijHNn9YUkIhoGQ4_dFpLS8kZChds8HiHZukGQjAYEB4F2G5UnVUZ0DVCEn2fMaaPB0-OvMS4f8d3pcI6p1Vaws9GyOmVKP5q97aExPzDdSahOW_FuJQXcuqV3wa-YWcF8H8gzENza4YUuXQPEKLXwku6tlK4ZU0_mcV5lxHwLfPlHfni7KXr4NXh4ScfYulLvf23sWu8CXCR5v1x7ZCONDWjL_RlkYmqil0drS5vfKSQzsBZsjEhM4UDEtM0okMANxWUauQnc_E7TU7htN6jE9Gs7oQkyHZMOGz5tfbCjz-bUwXNexPRwf5LaWCbYrBmGON7r3D0x5TOmZAb1mAqYrPI7pCHURE79WM_Bt5th778ZWvOdIfb4MlgJShE2amr3Bw8r2bUXnH5lT38ViO0W2EJAE0fot10_KVM1CHK_oov3mZZx9Xajxj8IO8w0WddlRjRSLb38paJ1CtPdToYhAzO6hDMw5ANywIqOHM3AukrEwxWlKbWEMBtBDRd-ElOHiea1EOAuMnkuW2Vl0AUMwia7jIpEu8TMbRdQ0snXtU5YDSoaxcXI5FOX2FlHNySJShz9LNbW549krFw0Tl1cu_0sg6UdAE3rQ3o5kFpUhv75XUzETEjpd6Y6m50qiQ-A5v828Qu2hC6x6ahlpuTkzGWONG4CeDDI9Ib-rg6nbpCstTvHe3Q0l0QjBneI9CINXI_bGs9krkOqzDoc1iOXOJoZD9GU4RsPs_-cWzWSH2hHFJcsQm3UtH2p-UoUyzbLjVjzp2u7m5d59A-xKN2StoKoOIvGxEQHTyFTFI24l1_bvwT25kMXudIwTvXaVkR_RJL8UwIBc2crAF-4LOWZ32i6QlNNPLI4LqUavvPyr1NoY_B0xqlPSEHzvKM-QaeP70fvV7HFnt9VGiBdDRaXCWC09xtthhfYybdov3UqrBPvUmfQqho-OO_JKm--_T_dDcr-B_U9O_AIuw2QNZXy8rH8nGtdXCKZFo7fP957RuaCvVMzf9mue409wUrgfDRpQYkf_7fAkQ6opzWWpAP-Em36bNIxZMg8jznPhcQJrK07cMf6_0iw4nUIBsK2SaSB4yms0cnk1BeSkJh2NAyvEkj8qBBJ98Y7w9EBOggg_w_5uUL0XUHAyB_-1Y8qIl2tnT1l_jHHAd3pjZHttxdit1a1GfCxJ4xHi3GfhXof036cuuLK6CxiYE6Evmijgs_i5fHKFH7sUKdPeJmxY7_pZkpAu5aRCoUIyPhxO-Sf4wG2SURyE2LTnquAKmXhHoxPrAvaXrCd69UvKUTDXhIU7IJMXeJOSW8IAq3Fn6w8kXE-WFSZ5n1Y_B94qNyvvL9NXHKb3lGbW2Mar_0yANPMAmkT8ymdSoWoGC6XObWr1DpXdjFmpaGIpNrIn5sEPFTfmKuQhEfEKNhkNF1S1k0wxgW2Iz2S3nFubClIznbgt7nXN11RSm3uQfqLuwYwTz88vWIzTYCqOD9ASbRqG1SHLueMLsUwtadjuJh1XzOiFwzJnD6a9z2lWduQhFmQwrQB5NUXAv6drriVYSjaKl8on-IQDRN8NyBvPLiF0su_b0h7to10ar7PYRBYmrQ81eEbpSz-EBau0e81OdAa5e20UejKg8guy-pGHuBZN64W2wJIyNj_Tr00WoAmyAoHqx_lGTiVpwLHll7KhzTw0RV53rHdATa_WBmufIwmoBebvhUstWPogwQGZEa__eBnrf_2YzidG-YPelOxnYNLais_vvWb04XoaoGc4hkq-M10v3WAHuUDkWa07VDGImxknjBmRNIBXrxur0qgVVy0R4lJ7LLByfTmSbC9kQW8gji_Jbnn5QCWkw5v8ZezFO81AfUbxa27G45XICc748rx84LBLRKqd-F9JXUZ5xerAoOMnfijEOSyozRg99UN_y16soAPvQXwPeZ_mPO7QwE6D9Q19vGCDYbsvysgW7Ok50msJkHMQGWJ_cO0l3JqdKeRtPNh_iCRqVjRRadQ6mMxAuGMgLpBUcmmSTypfC_Kz25eVY_peWR2dHpgwnM23xpGCAQSPgDq26N9bKKP3zMMv9KQPVRGsvO8u2FdTVA0adMi35UzNhjLf8zRX3QVxd7S-Z6Wf2avG2CZpuWhSmNGw-WqGAEgE2AB&bundleId=&ias_dspID=3&ias_campId=1009169364&ias_pubId=pub-3831894559014614&ias_chanId=1&ias_placementId=18473376445&bidurl=https://mohtawaa.com/how-might-i-purchase-bitcoin/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0ipoaA63ag0v7ZvSBUVd1hS
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.153.63.133 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-153-63-133.compute-1.amazonaws.com
Software: /
Resource Hash: 5ddde76ee4fb2a58a7cc4c39c05e220950d63fe98d7d3b9741cbcc0b76acb5a1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221101/r20110914/client/ Frame 7DD3 3 KB
1 KB 8ms
5ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221101/r20110914/client/window_focus_fy2021.js

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:28:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37549
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:28:49 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221101/r20110914/client/ Frame 7DD3 17 KB
7 KB 8ms
5ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221101/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

71d49d865114d9bb25bfdfc0272b738cdfd771749b21360ce5fb40eee3b4d986

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:28:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37549
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7305
x-xss-protection: 0
server: cafe
etag: 12747696668401323709
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:28:49 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 7DD3 0
0 27ms
25ms Image
text/html 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR0x0v1u1qQxHTYGoP2hVjJwgap6MkOf4_TDRnt2euTQ8Sx8L0oo9A8ruYI2kyLmuzpqLr2jdojEPz7gkhmS1LC8KaYfw
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7DD3 154 KB
47 KB 75ms
62ms Script
text/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6080610ed8ad1ec28b32a16cd5fb8be853a45dc27de0757acad068588e067a45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48209
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1667824238049716"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 09 Nov 2022 03:54:38 GMT

GET view
securepubads.g.doubleclick.net/pcs/ Frame 7C39 0
0

GET rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 7C39 0
0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 26ms
25ms Script
application/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=mohtawaa.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110701.js?cb=31070788

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://mohtawaa.com/how-might-i-purchase-bitcoin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 32 KB
13 KB 505ms
503ms XHR
text/plain 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=61531431411988&correlator=2043902975206938&eid=31060439%2C31070743%2C31070788&output=ldjh&gdfp_req=1&vrg=2022110701&ptt=17&impl=fif&iu_parts=44890869%3A22645638667%2Cca-pub-3831894559014614-tag%2Cc53706aa-1a91-40dc-98c0-0345d0c7cc7f&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=800x280&ifi=7&adks=4183199663&sfv=1-0-39&prev_scp=ti%3D191e511b-91d0-45c2-b655-8d403b778259%26pof%3D0%26bid%3D0.01%26bid-p%3Dgoogle%26bsc%3D89&eri=1&sc=1&cookie=ID%3D4eb650108937147e-22cf23870fd800ca%3AT%3D1667966077%3AS%3DALNI_MY8BUDKExszlN4nY8owVQADfeupyg&gpic=UID%3D000008a4e2a05b5e%3AT%3D1667966077%3ART%3D1667966077%3AS%3DALNI_MZq43aJbH2hk77WML2PpUTWiyBAlg&abxe=1&dt=1667966078124&lmt=1667966078&dlt=1667966076892&idt=352&adxs=400&adys=972&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fmohtawaa.com%2Fhow-might-i-purchase-bitcoin%2F&frm=20&vis=1&psz=800x296&msz=800x296&fws=4&ohw=1600&ga_vid=682496734.1667966077&ga_sid=1667966077&ga_hid=1463707462&ga_fc=false&a3p=EhsKDGlkNS1zeW5jLmNvbRiVmZrUxTBIAFICCGo.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110701.js?cb=31070788

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eaa7384a40abc4debf771d985b69973289cbe45a43ab2f99c2c43d3271badd55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://mohtawaa.com/how-might-i-purchase-bitcoin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12947
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://mohtawaa.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 70AC 43 B
216 B 293ms
104ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1194052&asId=1bf87a7f-2f53-806b-c13c-aeadc9381d19&tv=%7Bc:trh3to,pingTime:-3,time:130,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:20%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:130,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B123~0%5D,as:%5B123~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tmETGdq+11%7C12%7C13%7C14%7C1511%7C161*.1194052-66719900%7C1611%7C17,idMap:161*,rmeas:1,rend:0,renddet:IMG.us,siq:22%7D&br=c
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: nginx
x-server-name: dt03.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 70AC 43 B
215 B 290ms
105ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1194052&asId=1bf87a7f-2f53-806b-c13c-aeadc9381d19&tv=%7Bc:trh3tp,pingTime:-6,time:131,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:131,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B124~0%5D,as:%5B124~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tmETGdq+11%7C12%7C13%7C14%7C1511%7C161*.1194052-66719900%7C1611%7C17,idMap:161*,rmeas:1,rend:0,renddet:IMG.us,siq:22%7D&tpiLookup=ao:mohtawaa.com*%2C7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com*&br=c
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: nginx
x-server-name: dt11.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1596 43 B
215 B 366ms
189ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1194052&asId=6a6b6091-30d8-78db-10f0-ec65e1bf9f43&tv=%7Bc:trh3tz,pingTime:-3,time:92,type:v,im:%7BpBlk:43%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:19%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:92,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:19,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B86~0%5D,as:%5B86~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tmETGdq+11%7C12%7C13%7C14%7C151*.1194052-66719900%7C1511%7C161.1194052-66719900%7C1611%7C1612%7C17,idMap:151*,rmeas:1,rend:0,renddet:IMG.us,siq:20%7D&br=c
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: nginx
x-server-name: dt13.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1596 43 B
215 B 364ms
190ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1194052&asId=6a6b6091-30d8-78db-10f0-ec65e1bf9f43&tv=%7Bc:trh3tA,pingTime:-6,time:93,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:93,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:19,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B87~0%5D,as:%5B87~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tmETGdq+11%7C12%7C13%7C14%7C151*.1194052-66719900%7C1511%7C161.1194052-66719900%7C1611%7C1612%7C17,idMap:151*,rmeas:1,rend:0,renddet:IMG.us,siq:20%7D&tpiLookup=ao:mohtawaa.com*%2C7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com*&br=c
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: nginx
x-server-name: dt16.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 /
almu7asib.blogspot.com/ Frame 72F8 225 KB
225 KB 110ms
98ms Image
text/html 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://almu7asib.blogspot.com/

Requested by

Host: almu7asib.blogspot.com
URL: https://almu7asib.blogspot.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://almu7asib.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 07 Nov 2022 13:44:37 GMT
server: GSE
etag: W/"0fcac2e5702867ad7961aabf2a2921cdfd386b7ef411a6adb95f489c46a95560"
content-type: text/html; charset=UTF-8
cache-control: private, max-age=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59509
x-xss-protection: 1; mode=block
expires: Wed, 09 Nov 2022 03:54:38 GMT

GET
H3 200 fa-solid-900.woff2
use.fontawesome.com/releases/v5.0.10/webfonts/ Frame 72F8 43 KB
44 KB 32ms
20ms Font
font/woff2 2606:4700:e2::ac40:850f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.0.10/webfonts/fa-solid-900.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.0.10/css/all.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:850f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb7aa6b06aa5a8eea3670662c4b0c37104041c14575fc170dc48677a0506a33a

Request headers

Referer: https://use.fontawesome.com/releases/v5.0.10/css/all.css
Origin: https://almu7asib.blogspot.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: E2YGAZWEMEWY7YDB
age: 791888
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44068
x-amz-id-2: hh0aVSSdiBzuAQY1ewObTC1jKlIXpWqpvYkaKkDIDAWG7FJdItMPQ3uvN6+3dxAGm0BpqRxUIXw=
last-modified: Wed, 30 Jun 2021 15:27:03 GMT
server: cloudflare
etag: "84f351b3972185aed620f78489e48b2d"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zwEAgDsVKZnd30%2BYuoUKa0RSZ33sq3ZDamneH1HBmZVFwXSWhmIqg%2FUAfKi98b0R8ZX6GNe%2Be5fdUtZ%2FGYw3oExiNWiteOvVZEFWb3RgDQKDfupV7G8U9GSqdpk04z23BDKtwO4rJ0Yhlc%2BL3ZImbt3Y"}],"group":"cf-nel","max_age":604800}
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 76739bb49c8a8c4e-EWR

GET
H2

200

/
d.turn.com/r/du/id/L2NzaWQvMS9tcGlkLzI0MTMwODU4/rnd/ Frame D6A3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=turn_dmp&google_cm
https://d.turn.com/r/du/id/L2NzaWQvMS9tcGlkLzI0MTMwODU4/rnd/?mpuid=CAESEHnerDLD81MD-gA-AmmLyaQ&google_cver=1

43 B
398 B

81ms
22ms

Image
image/gif

2620:112:f002:bbbb::23
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.turn.com/r/du/id/L2NzaWQvMS9tcGlkLzI0MTMwODU4/rnd/?mpuid=CAESEHnerDLD81MD-gA-AmmLyaQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIkCEIrXrIEEGKaa7tYBMAE&v=APEucNXAC1SZ6ODc8TNAOoAj46fDkcDTR_e9LMwG6J4V8HVS9S6cBgZ6tM-Ph9AynM84IcMFDJ2LCHievqrhuueWuNmNT9SmWg
Protocol: H2
Server: 2620:112:f002:bbbb::23 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 09 Nov 2022 03:54:37 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://d.turn.com/r/du/id/L2NzaWQvMS9tcGlkLzI0MTMwODU4/rnd/?mpuid=CAESEHnerDLD81MD-gA-AmmLyaQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 309
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D6A3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKvNAABjcw0Wz_aD7R8U2pc&google_cver=1

43 B
765 B

6ms
6ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKvNAABjcw0Wz_aD7R8U2pc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIkCEIrXrIEEGKaa7tYBMAE&v=APEucNXAC1SZ6ODc8TNAOoAj46fDkcDTR_e9LMwG6J4V8HVS9S6cBgZ6tM-Ph9AynM84IcMFDJ2LCHievqrhuueWuNmNT9SmWg
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Nov 2022 03:54:38 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKvNAABjcw0Wz_aD7R8U2pc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D6A3
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y2skfpmshHt4fR8E.PnH6QAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKvNAABjcw0Wz_aD7R8U2pc&google_cver=1&google_hm=2

43 B
765 B

23ms
23ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKvNAABjcw0Wz_aD7R8U2pc&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIkCEIrXrIEEGKaa7tYBMAE&v=APEucNXAC1SZ6ODc8TNAOoAj46fDkcDTR_e9LMwG6J4V8HVS9S6cBgZ6tM-Ph9AynM84IcMFDJ2LCHievqrhuueWuNmNT9SmWg
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Nov 2022 03:54:38 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=495
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKvNAABjcw0Wz_aD7R8U2pc&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 70AC 43 B
215 B 243ms
107ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1194052&asId=1bf87a7f-2f53-806b-c13c-aeadc9381d19&tv=%7Bc:trh3uf,pingTime:-2,time:183,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:149,beZ:150,mfA:152,cmA:153,inA:153,inZ:157,prA:158,prZ:163,si:170,poA:171,poZ:195,cmZ:195,mfZ:195,loA:280,loZ:283,ltA:331,ltZ:331%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:20%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:183,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B176~0%5D,as:%5B176~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tmETGdq+11%7C12%7C13%7C14%7C151.1194052-66719900%7C1511%7C161*.1194052-66719900%7C1611%7C17,idMap:161*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:IMG.us,siq:22,sinceFw:160,readyFired:false%7D&br=c
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: nginx
x-server-name: dt09.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1596 43 B
215 B 239ms
106ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1194052&asId=6a6b6091-30d8-78db-10f0-ec65e1bf9f43&tv=%7Bc:trh3ui,pingTime:-2,time:137,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:214,beZ:215,mfA:216,cmA:218,inA:218,inZ:222,prA:222,prZ:227,si:233,poA:235,bl:256,poZ:256,cmZ:256,mfZ:256,loA:306,loZ:309,ltA:350,ltZ:350%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:19%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:137,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:19,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B131~0%5D,as:%5B131~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tmETGdq+11%7C12%7C13%7C14%7C151*.1194052-66719900%7C1511%7C161.1194052-66719900%7C1611%7C1612%7C17,idMap:151*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:IMG.us,siq:20,sinceFw:116,readyFired:false%7D&br=c
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: nginx
x-server-name: dt15.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame 72F8 49 KB
20 KB 24ms
5ms Script
text/javascript 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-92273966-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://almu7asib.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 09 Nov 2022 02:34:58 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 4780
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Wed, 09 Nov 2022 04:34:58 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 66B8 22 KB
8 KB 5ms
4ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 83447
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 08 Nov 2022 04:43:51 GMT
expires: Wed, 08 Nov 2023 04:43:51 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FE04 22 KB
8 KB 8ms
4ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 83447
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 08 Nov 2022 04:43:51 GMT
expires: Wed, 08 Nov 2023 04:43:51 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 7DD3 41 KB
15 KB 7ms
7ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Df9x963IL5eEtj6AZd2F6u-JChd3TYJN4RbqDoSSxyN1nZaOfSrroGXF6rUX62nAQdunBJyl9ATL-KeMvKBvJSnSCCv_S226-oo20ZXF2d7wLgXKNgl26_h5SXyjFL3sx9UiiGmHE5MusQ59ijoPYO09E0xm9Dt_EQC5k2DRYkzZXQqvY&cry=1&dbm_d=AKAmf-DC0m9svILCvlWzg3HQO9WHjsIzTSdKon05No1LeJEbnPZaRWGx4GSLJPZlCv_MlWyiTnMgvfvLwfAtNKftqypJiZS1YXzaauQcohEDNqAkjfxvNhkUur-Ei2t1Gn3Guz3n2ZCpw2G57NbALFrsbpilKrFLWtCaAZ3ajxC3FhdiJmaG5Vuge49VNZHDtKAHFrmYiXYdpvnLfg1ewfEFPbhylmpsyN0Q0jEgYUE9E_LICJ3HDebHCzliGobIg5MhPwusuW4Lg_1H_4ShlHKC6nbLNhOnsXf20u2q6sqid2x_XM5-4cGUi7NA_9XwmB1dRmEq019_6WtyffAT9_iT3VJLmJNghBhsZAfz2pS2yvPLoE7ufStRzdxzkNj-Zt3VSc8QCJmjRQQ8Kp5QD6DRm879RN8m9i0B36Pwj2WlWcYXnLwRcvinjwhLcaEutbb-NUcg3P3_5EVI5NkfERC6nk9Ge0FxSRJtVpUXbpIfa0S48Z0zFNljOoKycMPHtBXT18yptCyes_PcESvCRtEb18YWXIvKrzNSycAyuzSUGY-xBAkLb8dlFl-ma1EFHybcF5V5v_75fclzmJX50hffrXpgM_-ZoMdyxkGCXvh6KWyd79QaSti3Vg1Qy38ymxcRZKaTxVvuoz7fxwMDfsuss10TylM66SHkypkVkK2u1KmIAy9bhK2gTRSV3SjWgLMGEq1pCMgv3XygABEjje-XmrPe6lW2-X4Gc3q8EGnMs9AJTFX7sm-m-Ch95ICJHbqqzykiSzC6Ye-ycMtpLqphGz9sa61F9NsOCyFw1jgD7dzEmXXc7flQueRQsGIE6cunP_awKFO1HgTvhiETieov2-ZMyQp7QMV9R3NqAc7OTmPLRvkMtGpcoevLIYhXq5mtgLdyEQcLH4XpB9wwibGsdyZdUw-qrHe1M0F2TkbfCnzsZ-Zov0s_AgFsOS4pv1yTOIQO52AeTM1SyFvyRszgHhcPR5p8gS-bCmbtSGTk_TRSg4aQsL46-KwG0M1IHSACYFdgXii9TQQZC6A7pc-mx2KQdOpOFOihsHMgHOjvcSUXwZ02kl0kQwovGJFOttMNOK5X3zY0y3SdiiCFi3mJEBzM50rr8i5sT-8sNlEK3diavO_pqZqQM5QTaEuutiKEbrd9dOyMwvV8-yUae_h6MjNWNc6N_oDb-YHtsFHBMnapCjf8HP9dh4hSTTNgbZAgiVbdMgt2lpjGPPLrMv0WVGcdaRllFENwiIBXM4qneXjRKlrIOugE5SI6NhPKY11zrKjIDogG9AvINR1qHz-uWisPWkyV8KCC779gaV8d__PgyhteCrtE0F1RsecngNgeTZx70hqvTCPEqpLhQnv0d8r0mYqNDKRMwFgZZQrR7TdG2S1pWTC1SMwbfrM2ygZRlvuKHxW47JAlLPShqqnCHw_23G4JOQE4GfpuOWfCz-zMjZal6WJszf3U75NcRIkvUfab8YA273njyZIWr0Yr6cZZHE_Mrd_KIfc-AN7mpsC5--H9YpZrOBoDKw6W9B1e0yYuHuvGgxPsgYjH_0AvI5Kke4xgkASPZ6wSV-v3PCvLu7WRU2z8JgECH_7Hrb9bKXBt5yIZc0c6F3QAKMhepEryC0_9kV4Eav7AzUCBjucgWmqOc0Z1dArQ8nr3i129P9wReTciOitw3BBmvTWfJaKm3kKhdJTEyn7_s_hvPdLb9oGB8lBz-d1o1ciNOx3qn41U-sq2Ymmt0Zu3mja965UuEz6U1zbmjiKHG3LR0YZPkfUqef-4jp_jN11OP0gkYKlIEncmDibv5bCTX4b2NPO4XjKTYINB-qepqbxmsWT7UWpcg8RMbiqOcDbSeSoJrmBDt1jzkG0-JmZP-W02adUdPXTsA4yHe6hfY6uzUGYCdjLE9dlVm2Fuk5EpZk-ZFELa_C-nBB29hU6ROiHLAzH5wDcW0XpyjiinwktCDI7dCLTJv0h9T1mKTD9Fkllc3Hjr4AsN3wrLVqHHlNyhfydxYx3Y37djjqRMPW1l4pb7nnDhPXWXJ3zgb-8w0a3mBrH4aSsiEIbfzBHWR_D2aYeie9O7h-L6ru2si8Yw0D6enwyLC7exsmLMJeddtBT2yNVwXyfVbYw8UI8p1gYlgtr_C6S61K2z3efaIjxZ8-Jog-JqHg-H2XxQeyhJdrUhJhgBumeDOK8-Kq99gXnJpGcJ5dWK-Tp1nXrw6_MOfPuAt5PYF7PJXvrKuFRM1GmJBlH-LmNT_PVxtq176ZeTpaXQcq9NitRz0w848cKZ0JrhV72fd0zPPvt6W4q6vYu2AmF_tloFaT3feRaa11arEptSHsT31qlw66kMxNMbxeuwEp5mDQtokyWA5jXRRSEo1KAifJPf73eXZjQvU-hjrwtX-dYPNr_UXAFVwK56clz4kScBZVabD-ilq4YVOcBPH-VwDGxKeuYkIihIiUGe0gdWp2VouA-LT0ZdpcxewgXwt4N33OFw9LANryMMZPwZ-T6qqJBaCW7cDmIxKrSEdfc4loqu8-29XCFsF22FnRO5yT1Z7-omBAXlH46vfEqqkO_L95LA4OjvchO20BgB6Dmuf5eqARbL_qPiry99xcu6GM-_X_1LKiV5G26zYxfUEO2QphQxbapB2TQsLwYroqXSmcSW9g-wUenr1mxzouteYA1feJTZJ0uCUsHkH_R8_OIyJnDhgTVwsSBopn7ZQbe2I15JLlQ90ZNlZQoMSyoHksWoV4HZI1_5cIoojsMUgV4vTF0bCA8fE1mr4O5zTXzJ6vxA25k_qwex7UIXRkfgIVeS07ISwEIQ3SHgUqGGew6G3Bt1&cid=CAQSPgDq26N9bKKP3zMMv9KQPVRGsvO8u2FdTVA0adMi35UzNhjLf8zRX3QVxd7S-Z6Wf2avG2CZpuWhSmNGw-WqGAEgEw&rfl=1%2Chttps%253A%252F%252Fmohtawaa.com%252Fhow-might-i-purchase-bitcoin%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 04:43:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83447
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Nov 2023 04:43:51 GMT

GET
H3 200 cse_element__en.js Show response
www.google.com/cse/static/element/f275a300093f201a/ Frame 72F8 302 KB
101 KB 5ms
4ms Script
text/javascript 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/element/f275a300093f201a/cse_element__en.js?usqp=CAI%3D

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=f4c8f9775e910cbe2

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec1555fc2430d7bf9eaccf108a229ebddd5522f8cdce5663ece904ec011da578

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://almu7asib.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:35:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1125
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 103180
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 14:37:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
expires: Thu, 09 Nov 2023 03:35:53 GMT

GET
H3 200 default+en.css
www.google.com/cse/static/element/f275a300093f201a/ Frame 72F8 41 KB
9 KB 6ms
5ms Stylesheet
text/css 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/element/f275a300093f201a/default+en.css

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=f4c8f9775e910cbe2

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b0789c3ab7df1f2580e95bb47eb5bb6dc19b4fc5a91b1f1ae1d9484dab534a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://almu7asib.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:35:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1141
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9086
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 14:37:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
expires: Thu, 09 Nov 2023 03:35:37 GMT

GET
H3 200 default.css
www.google.com/cse/static/style/look/v4/ Frame 72F8 4 KB
1 KB 8ms
7ms Stylesheet
text/css 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/style/look/v4/default.css

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=f4c8f9775e910cbe2

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dcec22bbcb68119d6c7d6d5e088fb82183a9826d0c9e3403f1386fd837f06a89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://almu7asib.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:28:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1587
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1345
x-xss-protection: 0
last-modified: Wed, 17 Jun 2020 00:00:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type: text/css
cache-control: public, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
expires: Wed, 09 Nov 2022 04:18:11 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211020101/ Frame 72F8 353 KB
116 KB 58ms
58ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211020101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6910583905428044

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7093ebb2ac00aac12424fcfe97d696ccc7ed1841ea212f248ce92511249edbe9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://almu7asib.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119042
x-xss-protection: 0
server: cafe
etag: 81176051727259689
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Nov 2022 03:54:38 GMT

GET
H2 200 ANbyha1X5QRFN7gqXaCevYVJuxQMaIOqI7UNjQvQYDsY-wUC-wabXRNtBgRs0uLOIVmMt9iimlHEdCg6obHh-uRxOhEgTgILxq4iE-nlCCHK=w35
lh3.googleusercontent.com/blogger_img_proxy/ Frame 72F8 43 B
422 B 52ms
24ms Image
image/gif 2607:f8b0:4006:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/blogger_img_proxy/ANbyha1X5QRFN7gqXaCevYVJuxQMaIOqI7UNjQvQYDsY-wUC-wabXRNtBgRs0uLOIVmMt9iimlHEdCg6obHh-uRxOhEgTgILxq4iE-nlCCHK=w35

Requested by

Host: almu7asib.blogspot.com
URL: https://almu7asib.blogspot.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

e1da5cd02d74bb5ba944e3ce44037860ac9f42392eec6c99b9543910e1a3a5fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://almu7asib.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
x-content-type-options: nosniff
server: fife
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="unnamed.gif"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
expires: Thu, 10 Nov 2022 03:54:38 GMT

GET
H3 200 fa-regular-400.woff2
use.fontawesome.com/releases/v5.0.10/webfonts/ Frame 72F8 12 KB
13 KB 14ms
14ms Font
font/woff2 2606:4700:e2::ac40:850f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.0.10/webfonts/fa-regular-400.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.0.10/css/all.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:850f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d2cdb4f2ed4b585d772068df75c01d0a360d45d27294188fccf5ceb4255fdc83

Request headers

Referer: https://use.fontawesome.com/releases/v5.0.10/css/all.css
Origin: https://almu7asib.blogspot.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: E2YPB2ESZ975502E
age: 791888
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 12216
x-amz-id-2: yWAEYU/3D0bZ8IkFOvhdyJDnwwXfp/0V8lo6bna1kTYryIWMs2lLd7GoBcckdsPhYviaXSxN8hZ6Q+bvu416sw==
last-modified: Wed, 30 Jun 2021 15:27:03 GMT
server: cloudflare
etag: "12717b4a013de862452c4ffcf4e1c264"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aNSK0Tvq5X4hm9wqfnV8jRoyPog8a7ccQOYImKNUk%2BxiTClRKxOCxQrTPwHlH9%2BGQXsWlIg76kFNadfnnvsWf5IkJA%2FLEovY2CNP3Hr5Mfcev0Yq%2FENy9SmPAFVcExhEq4eZo7q6wKDGEHboEzy3fYOT"}],"group":"cf-nel","max_age":604800}
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 76739bb52ddd8c4e-EWR

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221108/r20190131/ Frame E5CF 10 KB
4 KB 5ms
4ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221108/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6910583905428044

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://almu7asib.blogspot.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 31874
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 08 Nov 2022 19:03:24 GMT
etag: 10353107486223812946
expires: Tue, 22 Nov 2022 19:03:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 7DD3
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/1224441/66655758/xbbe/creative/adj?p=APEucNX93xuAyhr8_sR7oHiwxXCB5PvA_QcvkCZ9Ze4baFSq5qhXra4&d=CokBAKAmf-BB8r78UPJ_D-dhtu4Y4r8crNbw-H68HBzmykwSrbEf_5ES0kq4624...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNX93xuAyhr8_sR7oHiwxXCB5PvA_QcvkCZ9Ze4baFSq5qhXra4&d=CokBAKAmf-BB8r78UPJ_D-dhtu4Y4r8crNbw-H68HBzmykwSrbEf_5ES0kq4624I6_mC81sNGKSgc962c1OUYFFwv...

64 KB
22 KB

81ms
55ms

Script
text/javascript

172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNX93xuAyhr8_sR7oHiwxXCB5PvA_QcvkCZ9Ze4baFSq5qhXra4&d=CokBAKAmf-BB8r78UPJ_D-dhtu4Y4r8crNbw-H68HBzmykwSrbEf_5ES0kq4624I6_mC81sNGKSgc962c1OUYFFwvvXQ-4HUYV8zUQp_T8fIjBByGm8WMLg8ZCTL7XmwJQWdhXmf3kXb1AYbi4tysLlQG27gBhY5ZfWcl2VRAikHb7Imj4O7kzbUqWYS6RMAoCZ_4Gwk45EJpo90V_tb590rnqwFpT_u24tgWpZn4A4HrhxjPHw9pALWz8Op-U8pEMlnXjDJvW8-Nz7v13uGXsHL9qVV79bcSoOBWsVWuM2oKcpGbAc2mXxtm4rY6H98R_pGg1C2T6ylTgWqO8W5Ki-hl8lcLMbKWJxNM-LeS4QSRccmftTKmZ0-dhdVTI2g1ucf7iJ0GMCl-yEmZruOiN9jlJTbRzg9HRSxcH2979iPds4mEASC6iUuvy3u8RFzNnxHD9PnTV0F4H7mHxKmtXI-Ffy0Efky-m0o7FnFaIL3AYR-kVgE48OxqE-wXueRWe2NDsNxVp_pW_Q2NceLYJnnzfiTDh5Ur-gaXcnhkU813aiSChVvxUGCmYM5QW5_4PKLPpdPMH4Q6FKtjsSizVZk0HZsNd7FT3IZhD9mTNuN30GSBrIqHOV1pcP7KI3DQKCBKiR9Uh-o-84ehi1KTu57FJODjPArBO8wVFA1QVjXFoNSw6VOdDINQASTXP2W7r4Om0cwtLSsOE_URy6JIyK4KSBdAdzy_hG9qbQNzSn2TDbV6CVq3Hml-7lJTACbEw4pKMmJWMKISqZzNv7LVbDZ6qY7oogr8OumSRaRm2aspBEOtoUikLv8hI0WlklGnheD7OAY5PCuZDZ2YvsSCvkVkbh_7ZaOc3gOn3fpIpJxGtSPrthDhGh5HxpmUZ_j1H1wQQviQgaEMop-mLVDtIyLh0EC3NdvboBdWvRX0mUk5ZH3RO2flTCZ-wmEI2LKXLpckX_9QI3P7sj9_id-id1iAR0vcTU1zDNYSlMt-H4cHZTByi78Wn6d-AXZn3gwFxMiRFPOqfOAzcAPD7dY04IgFBANz4W-GX0rb3Vdh_OQ29LNuH9n7vY7_7zqFujTxh-eE59TDGpCANKJsOVsP-nFOtfuUWRHZAFPUymSzrdkDYUl6ey9Y-0SieO2ZesfLMWAnRawgpzwDlsm46Mrt0J1KfpYmCcNpKrsas5JO-OltZGpj7Z-reIEXQXEv4rMnImOAbDkjvt4pwaKi_mD5Q_Cjph_SBGo8o6XAD09A1WeNFphQYH02bF6QNozeIreCAbZkY_rwFR3WkEjlPqh7BlPNYnvvOfJ0ypR6K9BdZGwvsH2WfLEedZ7d5dS_WAGhQ3bqzLHd-Qiqt6aM6PXzOY_viQYeCfvjBxXWXRJLfTbR8c-pcI8noabNEQjlyUaru8DEdaLRpgYyHuZD6jGddbjhzjYhAP3P61GFhGgCCyFsOsYThSLNPKh9eIIGRJ9LEJ8NDFGt4-xkpyZa4XHakM7C-997ysN68FjLxZBfyESHtCOM0iqAE_bhhoijHNn9YUkIhoGQ4_dFpLS8kZChds8HiHZukGQjAYEB4F2G5UnVUZ0DVCEn2fMaaPB0-OvMS4f8d3pcI6p1Vaws9GyOmVKP5q97aExPzDdSahOW_FuJQXcuqV3wa-YWcF8H8gzENza4YUuXQPEKLXwku6tlK4ZU0_mcV5lxHwLfPlHfni7KXr4NXh4ScfYulLvf23sWu8CXCR5v1x7ZCONDWjL_RlkYmqil0drS5vfKSQzsBZsjEhM4UDEtM0okMANxWUauQnc_E7TU7htN6jE9Gs7oQkyHZMOGz5tfbCjz-bUwXNexPRwf5LaWCbYrBmGON7r3D0x5TOmZAb1mAqYrPI7pCHURE79WM_Bt5th778ZWvOdIfb4MlgJShE2amr3Bw8r2bUXnH5lT38ViO0W2EJAE0fot10_KVM1CHK_oov3mZZx9Xajxj8IO8w0WddlRjRSLb38paJ1CtPdToYhAzO6hDMw5ANywIqOHM3AukrEwxWlKbWEMBtBDRd-ElOHiea1EOAuMnkuW2Vl0AUMwia7jIpEu8TMbRdQ0snXtU5YDSoaxcXI5FOX2FlHNySJShz9LNbW549krFw0Tl1cu_0sg6UdAE3rQ3o5kFpUhv75XUzETEjpd6Y6m50qiQ-A5v828Qu2hC6x6ahlpuTkzGWONG4CeDDI9Ib-rg6nbpCstTvHe3Q0l0QjBneI9CINXI_bGs9krkOqzDoc1iOXOJoZD9GU4RsPs_-cWzWSH2hHFJcsQm3UtH2p-UoUyzbLjVjzp2u7m5d59A-xKN2StoKoOIvGxEQHTyFTFI24l1_bvwT25kMXudIwTvXaVkR_RJL8UwIBc2crAF-4LOWZ32i6QlNNPLI4LqUavvPyr1NoY_B0xqlPSEHzvKM-QaeP70fvV7HFnt9VGiBdDRaXCWC09xtthhfYybdov3UqrBPvUmfQqho-OO_JKm--_T_dDcr-B_U9O_AIuw2QNZXy8rH8nGtdXCKZFo7fP957RuaCvVMzf9mue409wUrgfDRpQYkf_7fAkQ6opzWWpAP-Em36bNIxZMg8jznPhcQJrK07cMf6_0iw4nUIBsK2SaSB4yms0cnk1BeSkJh2NAyvEkj8qBBJ98Y7w9EBOggg_w_5uUL0XUHAyB_-1Y8qIl2tnT1l_jHHAd3pjZHttxdit1a1GfCxJ4xHi3GfhXof036cuuLK6CxiYE6Evmijgs_i5fHKFH7sUKdPeJmxY7_pZkpAu5aRCoUIyPhxO-Sf4wG2SURyE2LTnquAKmXhHoxPrAvaXrCd69UvKUTDXhIU7IJMXeJOSW8IAq3Fn6w8kXE-WFSZ5n1Y_B94qNyvvL9NXHKb3lGbW2Mar_0yANPMAmkT8ymdSoWoGC6XObWr1DpXdjFmpaGIpNrIn5sEPFTfmKuQhEfEKNhkNF1S1k0wxgW2Iz2S3nFubClIznbgt7nXN11RSm3uQfqLuwYwTz88vWIzTYCqOD9ASbRqG1SHLueMLsUwtadjuJh1XzOiFwzJnD6a9z2lWduQhFmQwrQB5NUXAv6drriVYSjaKl8on-IQDRN8NyBvPLiF0su_b0h7to10ar7PYRBYmrQ81eEbpSz-EBau0e81OdAa5e20UejKg8guy-pGHuBZN64W2wJIyNj_Tr00WoAmyAoHqx_lGTiVpwLHll7KhzTw0RV53rHdATa_WBmufIwmoBebvhUstWPogwQGZEa__eBnrf_2YzidG-YPelOxnYNLais_vvWb04XoaoGc4hkq-M10v3WAHuUDkWa07VDGImxknjBmRNIBXrxur0qgVVy0R4lJ7LLByfTmSbC9kQW8gji_Jbnn5QCWkw5v8ZezFO81AfUbxa27G45XICc748rx84LBLRKqd-F9JXUZ5xerAoOMnfijEOSyozRg99UN_y16soAPvQXwPeZ_mPO7QwE6D9Q19vGCDYbsvysgW7Ok50msJkHMQGWJ_cO0l3JqdKeRtPNh_iCRqVjRRadQ6mMxAuGMgLpBUcmmSTypfC_Kz25eVY_peWR2dHpgwnM23xpGCAQSPgDq26N9bKKP3zMMv9KQPVRGsvO8u2FdTVA0adMi35UzNhjLf8zRX3QVxd7S-Z6Wf2avG2CZpuWhSmNGw-WqGAEgE2AB&bundleId=

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03154bb5d34fbaad56250bdd8765ed1ac7ab26543dc0858494bc4d8b20e47627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22612
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: nginx
x-server-name: app04.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNX93xuAyhr8_sR7oHiwxXCB5PvA_QcvkCZ9Ze4baFSq5qhXra4&d=CokBAKAmf-BB8r78UPJ_D-dhtu4Y4r8crNbw-H68HBzmykwSrbEf_5ES0kq4624I6_mC81sNGKSgc962c1OUYFFwvvXQ-4HUYV8zUQp_T8fIjBByGm8WMLg8ZCTL7XmwJQWdhXmf3kXb1AYbi4tysLlQG27gBhY5ZfWcl2VRAikHb7Imj4O7kzbUqWYS6RMAoCZ_4Gwk45EJpo90V_tb590rnqwFpT_u24tgWpZn4A4HrhxjPHw9pALWz8Op-U8pEMlnXjDJvW8-Nz7v13uGXsHL9qVV79bcSoOBWsVWuM2oKcpGbAc2mXxtm4rY6H98R_pGg1C2T6ylTgWqO8W5Ki-hl8lcLMbKWJxNM-LeS4QSRccmftTKmZ0-dhdVTI2g1ucf7iJ0GMCl-yEmZruOiN9jlJTbRzg9HRSxcH2979iPds4mEASC6iUuvy3u8RFzNnxHD9PnTV0F4H7mHxKmtXI-Ffy0Efky-m0o7FnFaIL3AYR-kVgE48OxqE-wXueRWe2NDsNxVp_pW_Q2NceLYJnnzfiTDh5Ur-gaXcnhkU813aiSChVvxUGCmYM5QW5_4PKLPpdPMH4Q6FKtjsSizVZk0HZsNd7FT3IZhD9mTNuN30GSBrIqHOV1pcP7KI3DQKCBKiR9Uh-o-84ehi1KTu57FJODjPArBO8wVFA1QVjXFoNSw6VOdDINQASTXP2W7r4Om0cwtLSsOE_URy6JIyK4KSBdAdzy_hG9qbQNzSn2TDbV6CVq3Hml-7lJTACbEw4pKMmJWMKISqZzNv7LVbDZ6qY7oogr8OumSRaRm2aspBEOtoUikLv8hI0WlklGnheD7OAY5PCuZDZ2YvsSCvkVkbh_7ZaOc3gOn3fpIpJxGtSPrthDhGh5HxpmUZ_j1H1wQQviQgaEMop-mLVDtIyLh0EC3NdvboBdWvRX0mUk5ZH3RO2flTCZ-wmEI2LKXLpckX_9QI3P7sj9_id-id1iAR0vcTU1zDNYSlMt-H4cHZTByi78Wn6d-AXZn3gwFxMiRFPOqfOAzcAPD7dY04IgFBANz4W-GX0rb3Vdh_OQ29LNuH9n7vY7_7zqFujTxh-eE59TDGpCANKJsOVsP-nFOtfuUWRHZAFPUymSzrdkDYUl6ey9Y-0SieO2ZesfLMWAnRawgpzwDlsm46Mrt0J1KfpYmCcNpKrsas5JO-OltZGpj7Z-reIEXQXEv4rMnImOAbDkjvt4pwaKi_mD5Q_Cjph_SBGo8o6XAD09A1WeNFphQYH02bF6QNozeIreCAbZkY_rwFR3WkEjlPqh7BlPNYnvvOfJ0ypR6K9BdZGwvsH2WfLEedZ7d5dS_WAGhQ3bqzLHd-Qiqt6aM6PXzOY_viQYeCfvjBxXWXRJLfTbR8c-pcI8noabNEQjlyUaru8DEdaLRpgYyHuZD6jGddbjhzjYhAP3P61GFhGgCCyFsOsYThSLNPKh9eIIGRJ9LEJ8NDFGt4-xkpyZa4XHakM7C-997ysN68FjLxZBfyESHtCOM0iqAE_bhhoijHNn9YUkIhoGQ4_dFpLS8kZChds8HiHZukGQjAYEB4F2G5UnVUZ0DVCEn2fMaaPB0-OvMS4f8d3pcI6p1Vaws9GyOmVKP5q97aExPzDdSahOW_FuJQXcuqV3wa-YWcF8H8gzENza4YUuXQPEKLXwku6tlK4ZU0_mcV5lxHwLfPlHfni7KXr4NXh4ScfYulLvf23sWu8CXCR5v1x7ZCONDWjL_RlkYmqil0drS5vfKSQzsBZsjEhM4UDEtM0okMANxWUauQnc_E7TU7htN6jE9Gs7oQkyHZMOGz5tfbCjz-bUwXNexPRwf5LaWCbYrBmGON7r3D0x5TOmZAb1mAqYrPI7pCHURE79WM_Bt5th778ZWvOdIfb4MlgJShE2amr3Bw8r2bUXnH5lT38ViO0W2EJAE0fot10_KVM1CHK_oov3mZZx9Xajxj8IO8w0WddlRjRSLb38paJ1CtPdToYhAzO6hDMw5ANywIqOHM3AukrEwxWlKbWEMBtBDRd-ElOHiea1EOAuMnkuW2Vl0AUMwia7jIpEu8TMbRdQ0snXtU5YDSoaxcXI5FOX2FlHNySJShz9LNbW549krFw0Tl1cu_0sg6UdAE3rQ3o5kFpUhv75XUzETEjpd6Y6m50qiQ-A5v828Qu2hC6x6ahlpuTkzGWONG4CeDDI9Ib-rg6nbpCstTvHe3Q0l0QjBneI9CINXI_bGs9krkOqzDoc1iOXOJoZD9GU4RsPs_-cWzWSH2hHFJcsQm3UtH2p-UoUyzbLjVjzp2u7m5d59A-xKN2StoKoOIvGxEQHTyFTFI24l1_bvwT25kMXudIwTvXaVkR_RJL8UwIBc2crAF-4LOWZ32i6QlNNPLI4LqUavvPyr1NoY_B0xqlPSEHzvKM-QaeP70fvV7HFnt9VGiBdDRaXCWC09xtthhfYybdov3UqrBPvUmfQqho-OO_JKm--_T_dDcr-B_U9O_AIuw2QNZXy8rH8nGtdXCKZFo7fP957RuaCvVMzf9mue409wUrgfDRpQYkf_7fAkQ6opzWWpAP-Em36bNIxZMg8jznPhcQJrK07cMf6_0iw4nUIBsK2SaSB4yms0cnk1BeSkJh2NAyvEkj8qBBJ98Y7w9EBOggg_w_5uUL0XUHAyB_-1Y8qIl2tnT1l_jHHAd3pjZHttxdit1a1GfCxJ4xHi3GfhXof036cuuLK6CxiYE6Evmijgs_i5fHKFH7sUKdPeJmxY7_pZkpAu5aRCoUIyPhxO-Sf4wG2SURyE2LTnquAKmXhHoxPrAvaXrCd69UvKUTDXhIU7IJMXeJOSW8IAq3Fn6w8kXE-WFSZ5n1Y_B94qNyvvL9NXHKb3lGbW2Mar_0yANPMAmkT8ymdSoWoGC6XObWr1DpXdjFmpaGIpNrIn5sEPFTfmKuQhEfEKNhkNF1S1k0wxgW2Iz2S3nFubClIznbgt7nXN11RSm3uQfqLuwYwTz88vWIzTYCqOD9ASbRqG1SHLueMLsUwtadjuJh1XzOiFwzJnD6a9z2lWduQhFmQwrQB5NUXAv6drriVYSjaKl8on-IQDRN8NyBvPLiF0su_b0h7to10ar7PYRBYmrQ81eEbpSz-EBau0e81OdAa5e20UejKg8guy-pGHuBZN64W2wJIyNj_Tr00WoAmyAoHqx_lGTiVpwLHll7KhzTw0RV53rHdATa_WBmufIwmoBebvhUstWPogwQGZEa__eBnrf_2YzidG-YPelOxnYNLais_vvWb04XoaoGc4hkq-M10v3WAHuUDkWa07VDGImxknjBmRNIBXrxur0qgVVy0R4lJ7LLByfTmSbC9kQW8gji_Jbnn5QCWkw5v8ZezFO81AfUbxa27G45XICc748rx84LBLRKqd-F9JXUZ5xerAoOMnfijEOSyozRg99UN_y16soAPvQXwPeZ_mPO7QwE6D9Q19vGCDYbsvysgW7Ok50msJkHMQGWJ_cO0l3JqdKeRtPNh_iCRqVjRRadQ6mMxAuGMgLpBUcmmSTypfC_Kz25eVY_peWR2dHpgwnM23xpGCAQSPgDq26N9bKKP3zMMv9KQPVRGsvO8u2FdTVA0adMi35UzNhjLf8zRX3QVxd7S-Z6Wf2avG2CZpuWhSmNGw-WqGAEgE2AB&bundleId=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame CB33 91 KB
23 KB 13ms
12ms Script
application/javascript 2600:9000:2105:c00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2105:c00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:25:35 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 db82ddc02f317cd7d03bb2c60ec7cd58.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-C3
age: 4264144
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: xGBK3SDbBea62up9dVImvNgXCuxgZH6msAblzJ-AsbD2z5wUrU4K6Q==

GET
H3 200 summary Show response
almu7asib.blogspot.com/feeds/posts/ Frame 72F8 4 KB
1 KB 169ms
169ms Script
text/javascript 2607:f8b0:4006:822::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://almu7asib.blogspot.com/feeds/posts/summary?max-results=1&alt=json&callback=dataFeed

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

blogger-renderd /

Resource Hash

d418e7bfe28af64dd190aa877315db534c95f61020c20655fd65e04c473d01ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://almu7asib.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 07 Nov 2022 13:44:37 GMT
server: blogger-renderd
etag: W/"ff23646e20e0f39194a9f82552921d501c2f810802454f927bb7e1363428f8df"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, must-revalidate, proxy-revalidate, max-age=1
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1280
x-xss-protection: 0
expires: Wed, 09 Nov 2022 03:54:39 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7DD3 43 B
215 B 86ms
85ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1224441&asId=863b7a53-5a44-3163-ca25-2d25c1757990&tv=%7Bc:trh3yb,pingTime:-3,time:116,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:23%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:116,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:23,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B109~0%5D,as:%5B109~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tmETGir+11%7C12%7C13%7C141%7C1511%7C1512%7C1513%7C1611%7C1612%7C1613%7C17*.1224441-66655758%7C171,idMap:17*,rmeas:1,rend:0,renddet:IMG.us,siq:27%7D&br=c
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: nginx
x-server-name: dt13.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7DD3 43 B
215 B 85ms
84ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1224441&asId=863b7a53-5a44-3163-ca25-2d25c1757990&tv=%7Bc:trh3yd,pingTime:-6,time:118,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:118,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:23,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B111~0%5D,as:%5B111~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tmETGir+11%7C12%7C13%7C141%7C1511%7C1512%7C1513%7C1611%7C1612%7C1613%7C17*.1224441-66655758%7C171,idMap:17*,rmeas:1,rend:0,renddet:IMG.us,siq:27%7D&tpiLookup=ao:mohtawaa.com*&br=c
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: nginx
x-server-name: dt17.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 container.html Show response
7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/ Frame E1D2 6 KB
3 KB 5ms
4ms Document
text/html 2607:f8b0:4006:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110701.js?cb=31070788

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mohtawaa.com/how-might-i-purchase-bitcoin/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 2988
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 03:54:37 GMT
expires: Thu, 09 Nov 2023 03:54:37 GMT
last-modified: Tue, 25 Oct 2022 18:59:17 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
299 B 29ms
29ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?gl=0.2&b=3&r=mohtawaa.com_auto_interstitial_desktop&sy=7a801ae0-dc8a-4c58-86c6-a8fab334d80e&ts=89&cd=2&mlbr=ch&mlos=wi&mlla=en&mlco=us&mldo=mohtawaa.com&mlre=undefined&mlin=1&mlsi=undefinedxundefined&mlbw=4g&mlcs=NaN&mltp=191e511b-91d0-45c2-b655-8d403b778259&e=lm&dsReferer=bW9odGF3YWEuY29tL2hvdy1taWdodC1pLXB1cmNoYXNlLWJpdGNvaW4v
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v16.1.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://mohtawaa.com/how-might-i-purchase-bitcoin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-nf-request-id: 01GHAR6CPWS8RF208HBJQK4CDC
date: Wed, 09 Nov 2022 03:54:38 GMT
cf-cache-status: HIT
age: 67016
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "8a9dc9c7d095d16caa762d82212746e7-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 76739bb65b5c8c5d-EWR

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 25ms
24ms Image
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022110701&jk=61531431411988&bg=!5-Sl5KDNAAbvMpMzzzI7ACkAdvg8Wi89_MZXG9a_j6azpMuiSkRbKgYRIvI_MhSwuiACNvHVsO_JagIAAAB_UgAAAAJoAQeZApSiRU12L_KHdO0QXuzJTPayv8dzfbx3bXBKKByupc7GCEqsIh_HXkpI0LwMoxoOus2YRsbgdSLH2C5_F7oPrY0zI2Grm1G2920o1dlzamw0qx-1jkxAZAvUNAE3DnNLbERx7Z8pFkQKsbD7j-aldoRi26VdDXJvRtVO1mq9UOCRyN6rRPBCFTblDz033mIuGzG2w0S2QIt1VYgwL-Ao4khcYXgpNyyVdgbc5dXjFIr0lUIreyrRlJb7W4RvBhLvlFVpgqKfeZ7Llw1fQbVPUcrqGdiy657_NCmAJQGaRZm7USFn9SlNQHiq65n7NGTU8-Kk9nEbNkhhLqkbsJp7HnQAv7u3SEFJ0H0oSUKCVdLftmNEfTPezAVqOEpfcwhxDwOQ5fQWgBs6AXkpLzsIyaPW6SMw1Np5j6MTXmojIeGSw2caZDfVBkdFqfJBh0ezlKFU1oD8cA2OCuLcI3dERSWxgq84LNpIG-FTO_3GBeIZGVHQJCoaosajHmdyh5Br9k_-R3WYyQspWjBAcFTK94-_Nr0iCdh6OtrSt4-rhmnxTwUjj1U1rwpl79PLLqOyghXFt8VBXpiZjN1ZjaEZpeIKbCFM8oJdVfXoEHp-u-iVvXLnEJFECzR_fdcyQSiFFiTFPwKPyQNE5NO4Uvc7JILAzTDOZDF0jT-bapUOgKN7Ynct1QSzRd3X6oqXFLcA4GsQd05KRl8xvkjrzPPDHqa3ShboYhJatouufUoxmOHzLVLBtiZoMFloENltNDpN4TNYChX9WfN6n7UyjcXYsmsVzqpipUda61QJ2Mlgg8yYFHkXJgnmqOEK4F_iYjfZifqSxVuV3HbuSmNOuOVJSjJj9efckmAlQfo0yKK61aRuisz_iXY
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://mohtawaa.com/how-might-i-purchase-bitcoin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221108/r20110914/ Frame 70AC 29 KB
11 KB 6ms
5ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221108/r20110914/abg_lite.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1194052/66719900/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-C72Mh6XsRJomghtkvcf4z30irKzpSP9YUYvKSLHuV2iHvohcaawrkk7tVNLFPjVZHajzaQaiSbaRgZTowjZRpeeKU8HVVk-YyZVY3NXE2Yw2lu5GyPPG9yr8QZYyhhPUVQaKJjfJ87z7hELuHz3DLiW2_4oWngrnZrXLvbOvQEG3aoYxES6RMAoCZ_4H-SrTQJsVXrdtDv7nOqeMDlypIxkwXpBAOzVh4rofJXWQ891QjrScksvRxIbPIa6jr64BlOWabKSSFvj8vNc_oQxRhI6hRmCvmAVQaSMP6La2uneZ2zmDClFcNY1KHB1AxW7JwHMejOSGh5cQVCYh6AjaHUtU38qiNJLpc_h_k6AphbwFGFoCiWENhtCaNwDsu2lcUoCPMlBQ-6DsXoy87Fs69kgxC5QbUomikH6baeyjnx5STLvVzRukBQUCtw1dyDpA7dyQ_XhFceNIxxRew1BL35HEZ4Mzflu9_TYLWz_1_ZI_f_aFCnDsFqc02oDRG6DbrV-4izmncZKl8E6Vv9MZH2msBMgKqJznwE9kLnB0D5-VW_PuVopwk0O1kN4gGPLzfz_2BHGTVflWidOr1aq8UVvmP_tH9i2GL4Wss82VqgwVMuAWF4sj_v4G0sqb8D2Ow2wZhQNWpjXHY3YbnXwyVWradwhyLf9_mU72hWcjhFaC6U_kjwDsWaHc5vv69_XFnnb2PtQ01ip0c7Ourhg6CVoBXqy48L71iJnyQiSkDarQl28ac3xxQ8zTFdvbDPbF2b6tND5Wy7avBt763bsya0IDmwHM3YB0y4O7jH3qHjPhC5Oi9jkBy9qBQWzOHYC-Digt-YNUES9IEc4B7s_wjgyA1aMnqs6HBbJDRGZm-FO_re82ddjysWKcPaTHIZ7GfXAAKOUd7Apybe0Zf9phQybm-qvyyAidMJYszE-Hg2H5dt_Crf_-utzPNuoJ8VoEL412G85CNHgJIQBZTigiJxUarTTTAIv2b-jj6LxV54vBny1SpCzkY8qQf9944njc5TxflbA7qKv13lMR1-H3AAzgLT6Ys9QkOOQ0unJenqf2v8gv22UTj7Kx97P1pVAGlFnNlP2ig2fAY89iD9Vtx8ozg-SU-jGZhs8VV5hoE4nQUybzAnUhs-hjoWRFOdekPXW8IJfTr8TxS_1Bid6SLbzGnj5bVCmFmiL0EmpM2RrXCIB7J3HptZTbP597dhJAGrB2kJ9T7OI1JOQN_AwMgYUF3LLoReZosmuL17RWA8KX5YLzL6RYuEPRPwozYf8iwjWV2hQg2PfOsYBLuiQjm5sqzJVczvryB2ZKQYCIDdi-qPrFRi_eh17Yn_098LJlEP9sn7yYkunYXTRwhxH7hzFOqHT7Gp894XgzBXP-59V24zksUD2fVNSZ6LNDxDjI0yf_lPG18qPzuqRA0SrocGEntgaH_xcVVHA-Fe83WAJHEShlARyUYNY6K5V3WrBV_EsBfp-Z0tiz1e5DU9z5vEaIg_K5ygNPEhjnBRsAfQqOPLTeZZXLec1mZH-e987FvAuvBoxrbINii9q741dZaJu1awcGdYF15862lP5gWO5z_4hMSX-mpzEiTd7RPvrfo8e4c6DCuBWkCg7z765aide8f8218T3T01NSyaFGedVhR9_kTaJ6MIQhmm9EMqmT_TcHXzM09HRui4oZXQyAzrg8z-6-xfUfKRz9Zo8Ea_WNAuO_mxAW5_cTh2e8rsLFFr_h4KjV0dMz0Csv6K3H11_Za9KmhJmYcWlzLiwcwX-7MzsNh9z55YfRo-a7-hG6mwn2_06ZriS5y_h4laZ8oBHCXbrsVO87q6fCvaeMEpAi6ATx2htCXmQGnBqRxPFHacK9SfXmgz-sUWI23eZuJ6-4ndCv6Qm1eAEu1yC7GiCPdFfhZpd6u0ICCZpzImfBNWYyduAk8UQJFwSa-iI-h5T0-3Onb7t4aSpwA7GkCSi4u4UnNAq3YISqvD1WBjKVl4ml_r1tyF6gzTQ0PQsrxtZ-rdjsgF9fkUaqoGkNiZxJjlPDif-D0cnern5DF312Y-1vtdiOFbi152h2QAzjr-NoXRZHBO11518oghRvAaUCWWeMXYCXgzPwl73dvoF_lLEpsyCgqiLlW-td0UZI9cNTbltwG0a8aZTIk5sRWN1o7XHok8ErKIJzXs7qSph74oGwMNXirlOPzGcvuqIe7imsbjmeywaRG-CZnohHE1az_WWm-R7A8ldFkO37zh6gETkihq53NYHVB-S8J701IrhnC3h0C5ANXuJIQv2ogkXH94wQbA4hQ3x-y0wEvk3aRiN45I7xLmPiuduoCUo_lJct95VeFrfQDw4afejhP2KbbFK_6zBf3V6470zZc4m-naIpQ-f9orp8_0NGHkl-dnJKJczxWwqMifYcSAF_AoWCDTU1r9XX0BLZeVPv_1_m6uU4iFaGLnGGSpoZcZOpnJ9zDpxPQ3migLpsg4bdTNqXocP83B1RM8Zuwwdmt7MXNAGOMuY8VEPQYGhGXMDKlntm07A6RDYUrUxWQ4oW3FAxAqIrnKr4Lqa9WDxOBpJso_9-7eWP_N-y2jPzwKeE2Tatj1aIye6viHFD5Ha82jIA418GpH5GSkJ3zMCphYHRut_vLQkPMBvhiCtVKjTFaerXUouaT_0twfQdHDllB01gdgZVFgr6_Ra2pSr4n5NvTyqarj_INMCCic7QV9nhvPbuBDTWREwNKU17M-b_jfniHokhwGoUXkBC0nJdf0mUgcGVZNmrkzMw5d6lOS7IveZMJIuVTvkDiDvRxf84d9QugN6sCzKPkxlfKZ1nZNm1aV3O7GW6wuVhO2spvBVLlc1Zujfl0PwepmKr3nU14OGKFhLnvk3E93KPsJ-HmLWtqnZ86YvMwg8b1d1yLPWYMrngyKFS-3FFEt_XG6ps4RkXpHtAIlJFnc8UKLDUKOEGvQqXflpO9ZfzVMqllSCVU4O7NhneqhkUvLuzIVLbbPxTk8kWJGU1KDjWj-q3nIwVeedn2o8NU3ta5LdckU7LIHxCB7woU2mvNJgELpJp7YAoPYCeRLFuHYQc0n5Q0b1Qg2Q_UscISM00UpnOMEEFxxZ9HftAm9oRwJ01IH28bjr3M9sLgJtrg2p8Aj7OwounEcAPuNt74TFk4B4FrMo7Y50i9YJttz_5YLkpaZAbiXBcbDuet0UoPDlzW46hG_DCRIV3WA0Sw59Pnl0GDaeQmuWeG1IctRZXPt8fEW8aFoWHNryoAzgzKEyjRqWoqO5gx07eAdihb7Tesc9VsWKIOsbZXYlLYikmQ-uPsQIZ7PjgfzNIGhAasiVK1zO3iOqyr6Wu1O4zIini1HL40OP3f4zTUq6LCNGplpYuWPeiJJIF2iHkYdMCRCt3yUoDh9q0Prhi9R2qMn1Kmqj0IVayghU73uivq9XKnhZWOid3BcXiMO8c9_3zutUKUuM4YOoN950ZN8CvlwDtB98Zj_CNR95tIN8levIT4oabHqmTDQWVcNn7OvXcNrhdQQvNRfKfkYFATqjiQtnNBYDK529aJcvAkAPM1gJYf9V_T_WSezxRpHCAQSPwDq26N9fc7f7MQyvzc_OYSzU9G3jX13yDxDh0nukl592-kXnleEzs9kRBxPWnfgmeShoGYK1yajbCQlQL_PDBgBIBNgAQ&cry=1&adsafe_url=https%3A%2F%2Fmohtawaa.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fmohtawaa.com%2Fhow-might-i-purchase-bitcoin%2F&adsafe_type=c&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-39%2Fhtml%2Fcontainer.html&adsafe_type=bed&adsafe_jsinfo=,id:1bf87a7f-2f53-806b-c13c-aeadc9381d19,c:trh3rC,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-75cd96f6cf-d9bzx,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tmETGdq+11%7C12%7C13%7C14%7C1511%7C161*.1194052-66719900%7C1611%7C17,idMap:161*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:21,oid:3b346361-5fe2-11ed-8921-a2dbbc7697ff,v:19.8.360,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddd61ecebf36941bd6d1aa20ca07868d826fd9eb6f3a5e660e0afbb703ae6793

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:57:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35844
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11141
x-xss-protection: 0
server: cafe
etag: 7611781198975194673
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:57:14 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221108/r20110914/elements/html/ Frame 70AC 8 KB
3 KB 8ms
7ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221108/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:57:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35844
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:57:14 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 70AC 0
0 60ms
31ms Fetch
image/gif 142.250.65.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu3PwxVdfwjcy54nO4dhx_kdHB-ZpOxb4tU6VBlVXkHmPs6TNmFkq67iNiyb6mEzz4rEbKuRjek_5Qk5emh2_9h4nIlZhPOiynQ65oS_M2d6GIONkHebsAVFc-uWxZ-BFQKmnOUDz5F4ZfV_I6bZw&sai=AMfl-YScn6_GacGXoDkBOpjy0sxgehn5HwVmSM4ASkvYiysxTSmQgvg5ZZS63aYFEo-9KnPWmlO5mDlwgQNohc93jTr9IETpvHPSb5TCnMJ85X3ZNtY33n7zAen2XuRvdFqA1hHpXQ&sig=Cg0ArKJSzJgqyx8Km2_QEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20221108.34297&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.226 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 09 Nov 2022 03:54:38 GMT

GET
H2 200 11490417459626673180
s0.2mdn.net/simgad/ Frame 70AC 21 KB
21 KB 46ms
9ms Image
image/jpeg 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/11490417459626673180

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1dbf39e32568470be782dd27be072e15e6ede45351e4f90fac04558baa4cf3b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Fri, 04 Nov 2022 02:07:54 GMT
x-content-type-options: nosniff
age: 438404
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21836
x-xss-protection: 0
last-modified: Fri, 30 Sep 2022 19:58:35 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 04 Nov 2023 02:07:54 GMT

GET
H2 200 11490417459626673180
s0.2mdn.net/simgad/ Frame 1596 21 KB
22 KB 40ms
6ms Image
image/jpeg 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/11490417459626673180

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1194052/66719900/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-B63GjD0SAznr7Y6-9tQqwhqRVFoR_L1ec15Rz9Yg3WmuxXSI3ASYC1GGhBUAClsHI5-amlo1MqR2wPA3QhClwkm6_76yZl8Op5CAWAuX-0ofdRyNElpqUREGNBwSeeF0Qwd1DkJR4nKKeKRcrXyks5tmic7GfrbHV9To6rrjSs_8dDZeAS2RMAoCZ_4O5T7a_Nw3J1vOFEIG-dtd21_PYOub9zbd6eerrfelGsAR_kAUBnlMR1uZNUBRcBMPKnk64qn3ekCTi-uCaYEfEJhC9umpAxaldTfvUSyFkPJKymdIahMiXo8wjhDLf8X4CKMmoGoVhaCBu6_PsV3zvyD9r0DRFCPJj8PMmEoTQ1ccvhKtoKAIOnziPPR_Kqmpk9D064-DWoEAwH-ERwZ62TQUWhsloR88Ur689Ughg0sWfzor-J3n4yFgVRkuyVtGITzDcqyO8R6YU8mwS8E9kAlkxBNKm0o9sK6RUIaFyRJj7PTVOEzXjqDeH6x1PxXq2PTXqESRNmdvYEXJVfq1G1JkrjiHWT6rIwufUZkK-RPbxbBUXTP4Cljq6XOj-WrVxr7fT10Gj43_6H0dlMFuV2JaB5AaqAbR1lLci-_dhwIygbaicBg3ANlG5AXMSbAVdjBPaF8ZptLnGRHqrqoR3lFefCDlhuyBAHH_Uz_HNbHISExkG6q-Okf9xBq8uRAbjhjBA3oHCWKfUI_wutje_Cl9M5bwlYa3XNE5Q8wItXYtt1HN0BdT8CcPeTnadWYjb9413PmGBR6ht1orv5drGy5fzF0_okFnD2WZhgtKAiuVDl5kEOnR9ZV9eCGLh7L-YHENPscOGdJYByPbN7iOIHBzuieBCxQPsH6s0mCehRvNYYKQ7jNycYCX1wKSrdMCSUhcgsraeMVO50ZB_iFjmbhIe4jjp1DApe6D2eNThIRALC87c2yWF-g41YDXbWOwtx38IttytWv-jHL47H8LGpz-rXP1ZzIuywA5t8hEYj27SDcZHlwqFJfunPhacBEy--5AOYjY9q-uMh4kjQP-b-vPvYsFd6EwjUOVJwP8iCDo9i816DOz_rb8nqOD90WRf9FBqnMOndk0Ipr3dPLjUDr-uqsJiWNH7FXDymbLo0tVLwYDdKcyO_7LRwFw9YKOOL5gopmkcr73QEdc3LmQoSdZws2pTBRlNBLS0gmW76h6TZXeQYiVK7dX8TYpwSBuNBjgRSj6n3WJFEcNL6EdH-QPgp4WRWuTVuiglUNWrdobK3N1rr-lMeGO-TyL09Nxia2BVB2oB5rcs3RWi85uzpx2Wlr6yd3VtS__cDhx7BJ7gjvU1VazvikmpCnlbofPpveTYVg4RrFyu8TqPvL9-byEioLBXKlYmsMlhRGESwCggCoirdY9ixt3BHSxrfUfGNGhlC0wbFIVxHGwDB1G7zLPqpcDvidMBo6mv8tMCVaJPhyPwZRdadvDO0HoF_AKJSLj7_reN2XO10dyXQPBhVFfc5LbVsHbmRgf3ESdw_q86tMcBlxLoO9NBxP7za-GKZve9hZUhbCGmJD9HsQCIrFEIFSmf9yKoPJWLeuLiSE4gOZgGDbwIS7adzcvcXCadgYeb_tf5XuY_Ta9kW3pno-K8MNBzGUV4nkodi1rrN0nfd4ovzNYjd09LwITaBhuSdhw1N4OOGkOmKHCg8jgf3tVN7QMmvTak-IgWzyyJGWgrdg2ypxfwTMjH7OFGnLDQ5maquPuhr82EmcVH1hAjCl6Tv0eYwvsFNu3B9_LVObXOT9pw-KIjHCPyblfnHiy_pZjV2eWRljzWsiBold52vYeDpjtMethODuHzasp3bLwGU6D4KorvvGSFQi2Fcvq_myCKOlRq5SKGh4rpc7pMi8yeKC8knW6dvZ0q3vl82Wo6hDkaGLCLgvwykKOtGviop1KAcuyZ_rbP9QrKRnspXU4umioLfHptWvvgyNAJ6S3PtiCJDN8pNAOcbweX5zBBMINnNiivdWBRxiUzNHQ-wXXEAoqjUhux8g6-LGtoO7z7xZ55A3w809IG7GKo1UnRYyAGNFyzYWyhepgdk08El6KC_pD0smHZZ8veJzZSqKPEdBIxhyavgv3tWmSNXG7I9jhWI-7rbR0kgbcfAkYCiIggS6Ku-TYWJWR65ftT-rw0XyoR2Bq9IbarCAvj9ssWaFl9_2i_DluTJeHBcR5xe04D5KTJoDmkAw6bqB1k6GiGac7sio3HBVXk7buPWHsdwkHJ54HfgPM8R8FZfpBg7hzHRSbL7JDCxxdAIqUcykDcFxY1TyydW9x5Ko6WIMMq9QqjW3hA26BFMMmdL16DC1QFgKNhOT7PBYtcKPOZG7k5zCNOcCETmG61gvaJMui6X4df0gFy-kk9PgWhDvBeFUUCrac2UMk1RDJqYa_4Moc57Ey83KTVG8pd8m9YWzLgYON4n2QvtoEAIe3xb_kxUYAl7qq0YUtam4zqdcdp1WT4wPqHJfPyznQpBd8F9h8pcEAEWgj7E277cLYPoT67CMRdr_1VKD1Wf2TmderZcOIDu-qSTlaJ3P9I6qgQ1WSG45kH_zY-_6VGetc0mWRVRPbpBZWl1FEr42wIzAdSFVuyuxz1a-GFODE5tdM9pwzPaueWbUA7dqnaC9FOrDoYCDKTSuQDcFC7M2L1BQvRy_zAIux4lP_qW5S1nxaU_2Hm8R562FoL2YgLWO381_bR0tvgikdIiqKZyQ2CeXxJSzn5NErVGdc1Wn3ET3WB1ocA41sDZv64J8Q3H2Ch9O_Vam5B2OJLacWWweEUBIXIVTpyKeD2YQsCtE34wEWV-N85hhuppj7jzjlYy2JmttcX6n7gZd4jtmJEbDJUsRncnraI59eCzqmRzAxs2M-2HUJoZCiKPmOtofSoZ_MYgTBaAxMXJ_NqPWnB2r7PC9pK80gQP98EEhgmRmXD5-Eih8XrrugnzoLcJToIb_N4_vhLNYgT0pqbEjy6kGjgx8h_elnaL4TRErCWnaQXVF3So3PeYRdhHe1SUoNBrXRLyymjKiW9MTUNrReR407doVipIX4lJF-4YpZvXNjvjEazs-m_CxBium6OPKlvluNdbnsUxdh1MSwKzaJfbZVuK_mRBgzj5jnbMiXR1dNwdw-FpJAFcAt0rphOw5cUKJTBlCG5oDQHiOC8MezTlsnh2HUzvFhI94ROK5qMv82dI-xVcZXWj9aqTmtaKL4EV2zm6UDs0RjcjGDgLSkOD8h30JXgSePhcsrDMSTVOPUAlguxOOBajhQ6EUG31gpQdRBINduVEX1O4rFsPyCFiJN50NqJjkA1xAipC-eav7QnbJvUZ7vJtGngwg1lxcb3KDlV1ysjAksHMMyPKfr90hNL3uSQhnbDtZJfDntwMzzoc8lbY-JCBtKZeFjnXOfPVkXjcUbofrqbUR9WqmZG3l3YY_fwKfbfBr0_PzxKpOf0d7C912ezv-9WjO_xSZ9z4TPcRIHqrdC1aZ_TmyKyVEmrBNr_Talmw0xvYnpojC3WKdrlyrGQProxuAreO0mdf_QyC7qlbPWZ6GkcIBBI_AOrbo318sc5X3cqkVce_v0GoUK1nmnXH5p6Wlq30okksPqD065XfziAx6a5CyKoF9x5vntrcWLaYF1t8MFmnGAEgE2AB&cry=1&adsafe_url=https%3A%2F%2Fmohtawaa.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fmohtawaa.com%2Fhow-might-i-purchase-bitcoin%2F&adsafe_type=c&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-39%2Fhtml%2Fcontainer.html&adsafe_type=bed&adsafe_jsinfo=,id:6a6b6091-30d8-78db-10f0-ec65e1bf9f43,c:trh3so,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-75cd96f6cf-vvm2v,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tmETGed+11%7C12%7C13%7C14%7C151*.1194052-66719900%7C1511%7C1611%7C1612%7C17,idMap:151*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:20,oid:3b34632d-5fe2-11ed-b1e3-ba37930ba475,v:19.8.360,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1dbf39e32568470be782dd27be072e15e6ede45351e4f90fac04558baa4cf3b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Fri, 04 Nov 2022 02:07:54 GMT
x-content-type-options: nosniff
age: 438404
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21836
x-xss-protection: 0
last-modified: Fri, 30 Sep 2022 19:58:35 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 04 Nov 2023 02:07:54 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221108/r20110914/ Frame 1596 29 KB
11 KB 7ms
4ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221108/r20110914/abg_lite.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1194052/66719900/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-B63GjD0SAznr7Y6-9tQqwhqRVFoR_L1ec15Rz9Yg3WmuxXSI3ASYC1GGhBUAClsHI5-amlo1MqR2wPA3QhClwkm6_76yZl8Op5CAWAuX-0ofdRyNElpqUREGNBwSeeF0Qwd1DkJR4nKKeKRcrXyks5tmic7GfrbHV9To6rrjSs_8dDZeAS2RMAoCZ_4O5T7a_Nw3J1vOFEIG-dtd21_PYOub9zbd6eerrfelGsAR_kAUBnlMR1uZNUBRcBMPKnk64qn3ekCTi-uCaYEfEJhC9umpAxaldTfvUSyFkPJKymdIahMiXo8wjhDLf8X4CKMmoGoVhaCBu6_PsV3zvyD9r0DRFCPJj8PMmEoTQ1ccvhKtoKAIOnziPPR_Kqmpk9D064-DWoEAwH-ERwZ62TQUWhsloR88Ur689Ughg0sWfzor-J3n4yFgVRkuyVtGITzDcqyO8R6YU8mwS8E9kAlkxBNKm0o9sK6RUIaFyRJj7PTVOEzXjqDeH6x1PxXq2PTXqESRNmdvYEXJVfq1G1JkrjiHWT6rIwufUZkK-RPbxbBUXTP4Cljq6XOj-WrVxr7fT10Gj43_6H0dlMFuV2JaB5AaqAbR1lLci-_dhwIygbaicBg3ANlG5AXMSbAVdjBPaF8ZptLnGRHqrqoR3lFefCDlhuyBAHH_Uz_HNbHISExkG6q-Okf9xBq8uRAbjhjBA3oHCWKfUI_wutje_Cl9M5bwlYa3XNE5Q8wItXYtt1HN0BdT8CcPeTnadWYjb9413PmGBR6ht1orv5drGy5fzF0_okFnD2WZhgtKAiuVDl5kEOnR9ZV9eCGLh7L-YHENPscOGdJYByPbN7iOIHBzuieBCxQPsH6s0mCehRvNYYKQ7jNycYCX1wKSrdMCSUhcgsraeMVO50ZB_iFjmbhIe4jjp1DApe6D2eNThIRALC87c2yWF-g41YDXbWOwtx38IttytWv-jHL47H8LGpz-rXP1ZzIuywA5t8hEYj27SDcZHlwqFJfunPhacBEy--5AOYjY9q-uMh4kjQP-b-vPvYsFd6EwjUOVJwP8iCDo9i816DOz_rb8nqOD90WRf9FBqnMOndk0Ipr3dPLjUDr-uqsJiWNH7FXDymbLo0tVLwYDdKcyO_7LRwFw9YKOOL5gopmkcr73QEdc3LmQoSdZws2pTBRlNBLS0gmW76h6TZXeQYiVK7dX8TYpwSBuNBjgRSj6n3WJFEcNL6EdH-QPgp4WRWuTVuiglUNWrdobK3N1rr-lMeGO-TyL09Nxia2BVB2oB5rcs3RWi85uzpx2Wlr6yd3VtS__cDhx7BJ7gjvU1VazvikmpCnlbofPpveTYVg4RrFyu8TqPvL9-byEioLBXKlYmsMlhRGESwCggCoirdY9ixt3BHSxrfUfGNGhlC0wbFIVxHGwDB1G7zLPqpcDvidMBo6mv8tMCVaJPhyPwZRdadvDO0HoF_AKJSLj7_reN2XO10dyXQPBhVFfc5LbVsHbmRgf3ESdw_q86tMcBlxLoO9NBxP7za-GKZve9hZUhbCGmJD9HsQCIrFEIFSmf9yKoPJWLeuLiSE4gOZgGDbwIS7adzcvcXCadgYeb_tf5XuY_Ta9kW3pno-K8MNBzGUV4nkodi1rrN0nfd4ovzNYjd09LwITaBhuSdhw1N4OOGkOmKHCg8jgf3tVN7QMmvTak-IgWzyyJGWgrdg2ypxfwTMjH7OFGnLDQ5maquPuhr82EmcVH1hAjCl6Tv0eYwvsFNu3B9_LVObXOT9pw-KIjHCPyblfnHiy_pZjV2eWRljzWsiBold52vYeDpjtMethODuHzasp3bLwGU6D4KorvvGSFQi2Fcvq_myCKOlRq5SKGh4rpc7pMi8yeKC8knW6dvZ0q3vl82Wo6hDkaGLCLgvwykKOtGviop1KAcuyZ_rbP9QrKRnspXU4umioLfHptWvvgyNAJ6S3PtiCJDN8pNAOcbweX5zBBMINnNiivdWBRxiUzNHQ-wXXEAoqjUhux8g6-LGtoO7z7xZ55A3w809IG7GKo1UnRYyAGNFyzYWyhepgdk08El6KC_pD0smHZZ8veJzZSqKPEdBIxhyavgv3tWmSNXG7I9jhWI-7rbR0kgbcfAkYCiIggS6Ku-TYWJWR65ftT-rw0XyoR2Bq9IbarCAvj9ssWaFl9_2i_DluTJeHBcR5xe04D5KTJoDmkAw6bqB1k6GiGac7sio3HBVXk7buPWHsdwkHJ54HfgPM8R8FZfpBg7hzHRSbL7JDCxxdAIqUcykDcFxY1TyydW9x5Ko6WIMMq9QqjW3hA26BFMMmdL16DC1QFgKNhOT7PBYtcKPOZG7k5zCNOcCETmG61gvaJMui6X4df0gFy-kk9PgWhDvBeFUUCrac2UMk1RDJqYa_4Moc57Ey83KTVG8pd8m9YWzLgYON4n2QvtoEAIe3xb_kxUYAl7qq0YUtam4zqdcdp1WT4wPqHJfPyznQpBd8F9h8pcEAEWgj7E277cLYPoT67CMRdr_1VKD1Wf2TmderZcOIDu-qSTlaJ3P9I6qgQ1WSG45kH_zY-_6VGetc0mWRVRPbpBZWl1FEr42wIzAdSFVuyuxz1a-GFODE5tdM9pwzPaueWbUA7dqnaC9FOrDoYCDKTSuQDcFC7M2L1BQvRy_zAIux4lP_qW5S1nxaU_2Hm8R562FoL2YgLWO381_bR0tvgikdIiqKZyQ2CeXxJSzn5NErVGdc1Wn3ET3WB1ocA41sDZv64J8Q3H2Ch9O_Vam5B2OJLacWWweEUBIXIVTpyKeD2YQsCtE34wEWV-N85hhuppj7jzjlYy2JmttcX6n7gZd4jtmJEbDJUsRncnraI59eCzqmRzAxs2M-2HUJoZCiKPmOtofSoZ_MYgTBaAxMXJ_NqPWnB2r7PC9pK80gQP98EEhgmRmXD5-Eih8XrrugnzoLcJToIb_N4_vhLNYgT0pqbEjy6kGjgx8h_elnaL4TRErCWnaQXVF3So3PeYRdhHe1SUoNBrXRLyymjKiW9MTUNrReR407doVipIX4lJF-4YpZvXNjvjEazs-m_CxBium6OPKlvluNdbnsUxdh1MSwKzaJfbZVuK_mRBgzj5jnbMiXR1dNwdw-FpJAFcAt0rphOw5cUKJTBlCG5oDQHiOC8MezTlsnh2HUzvFhI94ROK5qMv82dI-xVcZXWj9aqTmtaKL4EV2zm6UDs0RjcjGDgLSkOD8h30JXgSePhcsrDMSTVOPUAlguxOOBajhQ6EUG31gpQdRBINduVEX1O4rFsPyCFiJN50NqJjkA1xAipC-eav7QnbJvUZ7vJtGngwg1lxcb3KDlV1ysjAksHMMyPKfr90hNL3uSQhnbDtZJfDntwMzzoc8lbY-JCBtKZeFjnXOfPVkXjcUbofrqbUR9WqmZG3l3YY_fwKfbfBr0_PzxKpOf0d7C912ezv-9WjO_xSZ9z4TPcRIHqrdC1aZ_TmyKyVEmrBNr_Talmw0xvYnpojC3WKdrlyrGQProxuAreO0mdf_QyC7qlbPWZ6GkcIBBI_AOrbo318sc5X3cqkVce_v0GoUK1nmnXH5p6Wlq30okksPqD065XfziAx6a5CyKoF9x5vntrcWLaYF1t8MFmnGAEgE2AB&cry=1&adsafe_url=https%3A%2F%2Fmohtawaa.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fmohtawaa.com%2Fhow-might-i-purchase-bitcoin%2F&adsafe_type=c&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-39%2Fhtml%2Fcontainer.html&adsafe_type=bed&adsafe_jsinfo=,id:6a6b6091-30d8-78db-10f0-ec65e1bf9f43,c:trh3so,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-75cd96f6cf-vvm2v,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tmETGed+11%7C12%7C13%7C14%7C151*.1194052-66719900%7C1511%7C1611%7C1612%7C17,idMap:151*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:20,oid:3b34632d-5fe2-11ed-b1e3-ba37930ba475,v:19.8.360,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddd61ecebf36941bd6d1aa20ca07868d826fd9eb6f3a5e660e0afbb703ae6793

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:57:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35844
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11141
x-xss-protection: 0
server: cafe
etag: 7611781198975194673
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:57:14 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221108/r20110914/elements/html/ Frame 1596 8 KB
3 KB 8ms
5ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221108/r20110914/elements/html/omrhp.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1194052/66719900/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-B63GjD0SAznr7Y6-9tQqwhqRVFoR_L1ec15Rz9Yg3WmuxXSI3ASYC1GGhBUAClsHI5-amlo1MqR2wPA3QhClwkm6_76yZl8Op5CAWAuX-0ofdRyNElpqUREGNBwSeeF0Qwd1DkJR4nKKeKRcrXyks5tmic7GfrbHV9To6rrjSs_8dDZeAS2RMAoCZ_4O5T7a_Nw3J1vOFEIG-dtd21_PYOub9zbd6eerrfelGsAR_kAUBnlMR1uZNUBRcBMPKnk64qn3ekCTi-uCaYEfEJhC9umpAxaldTfvUSyFkPJKymdIahMiXo8wjhDLf8X4CKMmoGoVhaCBu6_PsV3zvyD9r0DRFCPJj8PMmEoTQ1ccvhKtoKAIOnziPPR_Kqmpk9D064-DWoEAwH-ERwZ62TQUWhsloR88Ur689Ughg0sWfzor-J3n4yFgVRkuyVtGITzDcqyO8R6YU8mwS8E9kAlkxBNKm0o9sK6RUIaFyRJj7PTVOEzXjqDeH6x1PxXq2PTXqESRNmdvYEXJVfq1G1JkrjiHWT6rIwufUZkK-RPbxbBUXTP4Cljq6XOj-WrVxr7fT10Gj43_6H0dlMFuV2JaB5AaqAbR1lLci-_dhwIygbaicBg3ANlG5AXMSbAVdjBPaF8ZptLnGRHqrqoR3lFefCDlhuyBAHH_Uz_HNbHISExkG6q-Okf9xBq8uRAbjhjBA3oHCWKfUI_wutje_Cl9M5bwlYa3XNE5Q8wItXYtt1HN0BdT8CcPeTnadWYjb9413PmGBR6ht1orv5drGy5fzF0_okFnD2WZhgtKAiuVDl5kEOnR9ZV9eCGLh7L-YHENPscOGdJYByPbN7iOIHBzuieBCxQPsH6s0mCehRvNYYKQ7jNycYCX1wKSrdMCSUhcgsraeMVO50ZB_iFjmbhIe4jjp1DApe6D2eNThIRALC87c2yWF-g41YDXbWOwtx38IttytWv-jHL47H8LGpz-rXP1ZzIuywA5t8hEYj27SDcZHlwqFJfunPhacBEy--5AOYjY9q-uMh4kjQP-b-vPvYsFd6EwjUOVJwP8iCDo9i816DOz_rb8nqOD90WRf9FBqnMOndk0Ipr3dPLjUDr-uqsJiWNH7FXDymbLo0tVLwYDdKcyO_7LRwFw9YKOOL5gopmkcr73QEdc3LmQoSdZws2pTBRlNBLS0gmW76h6TZXeQYiVK7dX8TYpwSBuNBjgRSj6n3WJFEcNL6EdH-QPgp4WRWuTVuiglUNWrdobK3N1rr-lMeGO-TyL09Nxia2BVB2oB5rcs3RWi85uzpx2Wlr6yd3VtS__cDhx7BJ7gjvU1VazvikmpCnlbofPpveTYVg4RrFyu8TqPvL9-byEioLBXKlYmsMlhRGESwCggCoirdY9ixt3BHSxrfUfGNGhlC0wbFIVxHGwDB1G7zLPqpcDvidMBo6mv8tMCVaJPhyPwZRdadvDO0HoF_AKJSLj7_reN2XO10dyXQPBhVFfc5LbVsHbmRgf3ESdw_q86tMcBlxLoO9NBxP7za-GKZve9hZUhbCGmJD9HsQCIrFEIFSmf9yKoPJWLeuLiSE4gOZgGDbwIS7adzcvcXCadgYeb_tf5XuY_Ta9kW3pno-K8MNBzGUV4nkodi1rrN0nfd4ovzNYjd09LwITaBhuSdhw1N4OOGkOmKHCg8jgf3tVN7QMmvTak-IgWzyyJGWgrdg2ypxfwTMjH7OFGnLDQ5maquPuhr82EmcVH1hAjCl6Tv0eYwvsFNu3B9_LVObXOT9pw-KIjHCPyblfnHiy_pZjV2eWRljzWsiBold52vYeDpjtMethODuHzasp3bLwGU6D4KorvvGSFQi2Fcvq_myCKOlRq5SKGh4rpc7pMi8yeKC8knW6dvZ0q3vl82Wo6hDkaGLCLgvwykKOtGviop1KAcuyZ_rbP9QrKRnspXU4umioLfHptWvvgyNAJ6S3PtiCJDN8pNAOcbweX5zBBMINnNiivdWBRxiUzNHQ-wXXEAoqjUhux8g6-LGtoO7z7xZ55A3w809IG7GKo1UnRYyAGNFyzYWyhepgdk08El6KC_pD0smHZZ8veJzZSqKPEdBIxhyavgv3tWmSNXG7I9jhWI-7rbR0kgbcfAkYCiIggS6Ku-TYWJWR65ftT-rw0XyoR2Bq9IbarCAvj9ssWaFl9_2i_DluTJeHBcR5xe04D5KTJoDmkAw6bqB1k6GiGac7sio3HBVXk7buPWHsdwkHJ54HfgPM8R8FZfpBg7hzHRSbL7JDCxxdAIqUcykDcFxY1TyydW9x5Ko6WIMMq9QqjW3hA26BFMMmdL16DC1QFgKNhOT7PBYtcKPOZG7k5zCNOcCETmG61gvaJMui6X4df0gFy-kk9PgWhDvBeFUUCrac2UMk1RDJqYa_4Moc57Ey83KTVG8pd8m9YWzLgYON4n2QvtoEAIe3xb_kxUYAl7qq0YUtam4zqdcdp1WT4wPqHJfPyznQpBd8F9h8pcEAEWgj7E277cLYPoT67CMRdr_1VKD1Wf2TmderZcOIDu-qSTlaJ3P9I6qgQ1WSG45kH_zY-_6VGetc0mWRVRPbpBZWl1FEr42wIzAdSFVuyuxz1a-GFODE5tdM9pwzPaueWbUA7dqnaC9FOrDoYCDKTSuQDcFC7M2L1BQvRy_zAIux4lP_qW5S1nxaU_2Hm8R562FoL2YgLWO381_bR0tvgikdIiqKZyQ2CeXxJSzn5NErVGdc1Wn3ET3WB1ocA41sDZv64J8Q3H2Ch9O_Vam5B2OJLacWWweEUBIXIVTpyKeD2YQsCtE34wEWV-N85hhuppj7jzjlYy2JmttcX6n7gZd4jtmJEbDJUsRncnraI59eCzqmRzAxs2M-2HUJoZCiKPmOtofSoZ_MYgTBaAxMXJ_NqPWnB2r7PC9pK80gQP98EEhgmRmXD5-Eih8XrrugnzoLcJToIb_N4_vhLNYgT0pqbEjy6kGjgx8h_elnaL4TRErCWnaQXVF3So3PeYRdhHe1SUoNBrXRLyymjKiW9MTUNrReR407doVipIX4lJF-4YpZvXNjvjEazs-m_CxBium6OPKlvluNdbnsUxdh1MSwKzaJfbZVuK_mRBgzj5jnbMiXR1dNwdw-FpJAFcAt0rphOw5cUKJTBlCG5oDQHiOC8MezTlsnh2HUzvFhI94ROK5qMv82dI-xVcZXWj9aqTmtaKL4EV2zm6UDs0RjcjGDgLSkOD8h30JXgSePhcsrDMSTVOPUAlguxOOBajhQ6EUG31gpQdRBINduVEX1O4rFsPyCFiJN50NqJjkA1xAipC-eav7QnbJvUZ7vJtGngwg1lxcb3KDlV1ysjAksHMMyPKfr90hNL3uSQhnbDtZJfDntwMzzoc8lbY-JCBtKZeFjnXOfPVkXjcUbofrqbUR9WqmZG3l3YY_fwKfbfBr0_PzxKpOf0d7C912ezv-9WjO_xSZ9z4TPcRIHqrdC1aZ_TmyKyVEmrBNr_Talmw0xvYnpojC3WKdrlyrGQProxuAreO0mdf_QyC7qlbPWZ6GkcIBBI_AOrbo318sc5X3cqkVce_v0GoUK1nmnXH5p6Wlq30okksPqD065XfziAx6a5CyKoF9x5vntrcWLaYF1t8MFmnGAEgE2AB&cry=1&adsafe_url=https%3A%2F%2Fmohtawaa.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fmohtawaa.com%2Fhow-might-i-purchase-bitcoin%2F&adsafe_type=c&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-39%2Fhtml%2Fcontainer.html&adsafe_type=bed&adsafe_jsinfo=,id:6a6b6091-30d8-78db-10f0-ec65e1bf9f43,c:trh3so,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-75cd96f6cf-vvm2v,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tmETGed+11%7C12%7C13%7C14%7C151*.1194052-66719900%7C1511%7C1611%7C1612%7C17,idMap:151*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:20,oid:3b34632d-5fe2-11ed-b1e3-ba37930ba475,v:19.8.360,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:57:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35844
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:57:14 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1596 0
0 51ms
31ms Fetch
image/gif 142.250.65.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuj9nVI1d5Iy2MKhbJ7GV9MqE8ffhxTXmtP1SH0UWMg5N1g-WJqhAXcQrLn0qlN5X1pX5DFDH-Mo7r61QR93lC4deEEvBt2nmMYjtSmjPtBUoWf9xj_Wc3WQcY3hpP-job6I-U9XJI9f4EolE1K2A&sai=AMfl-YRsfpQItaSnt_jx-bjcSTAKkjIQPxrZ8uWWmyEBS0IiTIQZ7kFTwwMBiOspbvy6GrAmL6aByjuhzuBYdduBgBuF4uwZSSwr1LzdKLEQSoFRhF4p4dbltceY7jtaMENWmGHB5A&sig=Cg0ArKJSzDYx_thS0t_tEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20221108.51302&arae=0&ftch=1&adurl=

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1194052/66719900/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-B63GjD0SAznr7Y6-9tQqwhqRVFoR_L1ec15Rz9Yg3WmuxXSI3ASYC1GGhBUAClsHI5-amlo1MqR2wPA3QhClwkm6_76yZl8Op5CAWAuX-0ofdRyNElpqUREGNBwSeeF0Qwd1DkJR4nKKeKRcrXyks5tmic7GfrbHV9To6rrjSs_8dDZeAS2RMAoCZ_4O5T7a_Nw3J1vOFEIG-dtd21_PYOub9zbd6eerrfelGsAR_kAUBnlMR1uZNUBRcBMPKnk64qn3ekCTi-uCaYEfEJhC9umpAxaldTfvUSyFkPJKymdIahMiXo8wjhDLf8X4CKMmoGoVhaCBu6_PsV3zvyD9r0DRFCPJj8PMmEoTQ1ccvhKtoKAIOnziPPR_Kqmpk9D064-DWoEAwH-ERwZ62TQUWhsloR88Ur689Ughg0sWfzor-J3n4yFgVRkuyVtGITzDcqyO8R6YU8mwS8E9kAlkxBNKm0o9sK6RUIaFyRJj7PTVOEzXjqDeH6x1PxXq2PTXqESRNmdvYEXJVfq1G1JkrjiHWT6rIwufUZkK-RPbxbBUXTP4Cljq6XOj-WrVxr7fT10Gj43_6H0dlMFuV2JaB5AaqAbR1lLci-_dhwIygbaicBg3ANlG5AXMSbAVdjBPaF8ZptLnGRHqrqoR3lFefCDlhuyBAHH_Uz_HNbHISExkG6q-Okf9xBq8uRAbjhjBA3oHCWKfUI_wutje_Cl9M5bwlYa3XNE5Q8wItXYtt1HN0BdT8CcPeTnadWYjb9413PmGBR6ht1orv5drGy5fzF0_okFnD2WZhgtKAiuVDl5kEOnR9ZV9eCGLh7L-YHENPscOGdJYByPbN7iOIHBzuieBCxQPsH6s0mCehRvNYYKQ7jNycYCX1wKSrdMCSUhcgsraeMVO50ZB_iFjmbhIe4jjp1DApe6D2eNThIRALC87c2yWF-g41YDXbWOwtx38IttytWv-jHL47H8LGpz-rXP1ZzIuywA5t8hEYj27SDcZHlwqFJfunPhacBEy--5AOYjY9q-uMh4kjQP-b-vPvYsFd6EwjUOVJwP8iCDo9i816DOz_rb8nqOD90WRf9FBqnMOndk0Ipr3dPLjUDr-uqsJiWNH7FXDymbLo0tVLwYDdKcyO_7LRwFw9YKOOL5gopmkcr73QEdc3LmQoSdZws2pTBRlNBLS0gmW76h6TZXeQYiVK7dX8TYpwSBuNBjgRSj6n3WJFEcNL6EdH-QPgp4WRWuTVuiglUNWrdobK3N1rr-lMeGO-TyL09Nxia2BVB2oB5rcs3RWi85uzpx2Wlr6yd3VtS__cDhx7BJ7gjvU1VazvikmpCnlbofPpveTYVg4RrFyu8TqPvL9-byEioLBXKlYmsMlhRGESwCggCoirdY9ixt3BHSxrfUfGNGhlC0wbFIVxHGwDB1G7zLPqpcDvidMBo6mv8tMCVaJPhyPwZRdadvDO0HoF_AKJSLj7_reN2XO10dyXQPBhVFfc5LbVsHbmRgf3ESdw_q86tMcBlxLoO9NBxP7za-GKZve9hZUhbCGmJD9HsQCIrFEIFSmf9yKoPJWLeuLiSE4gOZgGDbwIS7adzcvcXCadgYeb_tf5XuY_Ta9kW3pno-K8MNBzGUV4nkodi1rrN0nfd4ovzNYjd09LwITaBhuSdhw1N4OOGkOmKHCg8jgf3tVN7QMmvTak-IgWzyyJGWgrdg2ypxfwTMjH7OFGnLDQ5maquPuhr82EmcVH1hAjCl6Tv0eYwvsFNu3B9_LVObXOT9pw-KIjHCPyblfnHiy_pZjV2eWRljzWsiBold52vYeDpjtMethODuHzasp3bLwGU6D4KorvvGSFQi2Fcvq_myCKOlRq5SKGh4rpc7pMi8yeKC8knW6dvZ0q3vl82Wo6hDkaGLCLgvwykKOtGviop1KAcuyZ_rbP9QrKRnspXU4umioLfHptWvvgyNAJ6S3PtiCJDN8pNAOcbweX5zBBMINnNiivdWBRxiUzNHQ-wXXEAoqjUhux8g6-LGtoO7z7xZ55A3w809IG7GKo1UnRYyAGNFyzYWyhepgdk08El6KC_pD0smHZZ8veJzZSqKPEdBIxhyavgv3tWmSNXG7I9jhWI-7rbR0kgbcfAkYCiIggS6Ku-TYWJWR65ftT-rw0XyoR2Bq9IbarCAvj9ssWaFl9_2i_DluTJeHBcR5xe04D5KTJoDmkAw6bqB1k6GiGac7sio3HBVXk7buPWHsdwkHJ54HfgPM8R8FZfpBg7hzHRSbL7JDCxxdAIqUcykDcFxY1TyydW9x5Ko6WIMMq9QqjW3hA26BFMMmdL16DC1QFgKNhOT7PBYtcKPOZG7k5zCNOcCETmG61gvaJMui6X4df0gFy-kk9PgWhDvBeFUUCrac2UMk1RDJqYa_4Moc57Ey83KTVG8pd8m9YWzLgYON4n2QvtoEAIe3xb_kxUYAl7qq0YUtam4zqdcdp1WT4wPqHJfPyznQpBd8F9h8pcEAEWgj7E277cLYPoT67CMRdr_1VKD1Wf2TmderZcOIDu-qSTlaJ3P9I6qgQ1WSG45kH_zY-_6VGetc0mWRVRPbpBZWl1FEr42wIzAdSFVuyuxz1a-GFODE5tdM9pwzPaueWbUA7dqnaC9FOrDoYCDKTSuQDcFC7M2L1BQvRy_zAIux4lP_qW5S1nxaU_2Hm8R562FoL2YgLWO381_bR0tvgikdIiqKZyQ2CeXxJSzn5NErVGdc1Wn3ET3WB1ocA41sDZv64J8Q3H2Ch9O_Vam5B2OJLacWWweEUBIXIVTpyKeD2YQsCtE34wEWV-N85hhuppj7jzjlYy2JmttcX6n7gZd4jtmJEbDJUsRncnraI59eCzqmRzAxs2M-2HUJoZCiKPmOtofSoZ_MYgTBaAxMXJ_NqPWnB2r7PC9pK80gQP98EEhgmRmXD5-Eih8XrrugnzoLcJToIb_N4_vhLNYgT0pqbEjy6kGjgx8h_elnaL4TRErCWnaQXVF3So3PeYRdhHe1SUoNBrXRLyymjKiW9MTUNrReR407doVipIX4lJF-4YpZvXNjvjEazs-m_CxBium6OPKlvluNdbnsUxdh1MSwKzaJfbZVuK_mRBgzj5jnbMiXR1dNwdw-FpJAFcAt0rphOw5cUKJTBlCG5oDQHiOC8MezTlsnh2HUzvFhI94ROK5qMv82dI-xVcZXWj9aqTmtaKL4EV2zm6UDs0RjcjGDgLSkOD8h30JXgSePhcsrDMSTVOPUAlguxOOBajhQ6EUG31gpQdRBINduVEX1O4rFsPyCFiJN50NqJjkA1xAipC-eav7QnbJvUZ7vJtGngwg1lxcb3KDlV1ysjAksHMMyPKfr90hNL3uSQhnbDtZJfDntwMzzoc8lbY-JCBtKZeFjnXOfPVkXjcUbofrqbUR9WqmZG3l3YY_fwKfbfBr0_PzxKpOf0d7C912ezv-9WjO_xSZ9z4TPcRIHqrdC1aZ_TmyKyVEmrBNr_Talmw0xvYnpojC3WKdrlyrGQProxuAreO0mdf_QyC7qlbPWZ6GkcIBBI_AOrbo318sc5X3cqkVce_v0GoUK1nmnXH5p6Wlq30okksPqD065XfziAx6a5CyKoF9x5vntrcWLaYF1t8MFmnGAEgE2AB&cry=1&adsafe_url=https%3A%2F%2Fmohtawaa.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fmohtawaa.com%2Fhow-might-i-purchase-bitcoin%2F&adsafe_type=c&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-39%2Fhtml%2Fcontainer.html&adsafe_type=bed&adsafe_jsinfo=,id:6a6b6091-30d8-78db-10f0-ec65e1bf9f43,c:trh3so,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-75cd96f6cf-vvm2v,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tmETGed+11%7C12%7C13%7C14%7C151*.1194052-66719900%7C1511%7C1611%7C1612%7C17,idMap:151*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:20,oid:3b34632d-5fe2-11ed-b1e3-ba37930ba475,v:19.8.360,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.226 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 09 Nov 2022 03:54:38 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7DD3 43 B
215 B 86ms
85ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1224441&asId=863b7a53-5a44-3163-ca25-2d25c1757990&tv=%7Bc:trh3zb,pingTime:-2,time:178,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:346,beZ:348,mfA:350,cmA:351,inA:351,inZ:355,prA:356,prZ:363,si:372,poA:374,poZ:399,cmZ:399,mfZ:399,loA:463,loZ:466,ltA:524,ltZ:524%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:23%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:178,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:23,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B171~0%5D,as:%5B171~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tmETGdq+11%7C12%7C13%7C141%7C151.1194052-66719900%7C1511%7C1512%7C1513%7C161.1194052-66719900%7C1611%7C1612%7C1613%7C17*.1224441-66655758%7C171,idMap:17*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:IMG.us,siq:27,sinceFw:149,readyFired:false%7D&br=c
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: nginx
x-server-name: dt04.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 0D49 22 KB
8 KB 8ms
7ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 83447
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 08 Nov 2022 04:43:51 GMT
expires: Wed, 08 Nov 2023 04:43:51 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame 66B8 36 KB
16 KB 5ms
5ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Fri, 04 Nov 2022 19:56:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 374309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Nov 2023 19:56:09 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame E1D2 4 KB
636 B 30ms
19ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 09 Nov 2022 02:56:55 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 09 Nov 2022 03:54:38 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 1473 466 B
307 B 21ms
21ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Noto%20Sans%20JP%3A400%2C500&text=%E3%82%8B%E3%81%98%E9%96%89

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

85caa4d3cc6269b39ec71fb6518ff888452553ecd35ea7377d1a3e22a5d2d54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 09 Nov 2022 03:54:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 09 Nov 2022 03:54:38 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221101/r20110914/client/ Frame 1473 2 KB
765 B 5ms
5ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221101/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:27:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37617
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 738
x-xss-protection: 0
server: cafe
etag: 1394486882873449110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:27:41 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221101/r20110914/ Frame 1473 23 KB
9 KB 5ms
5ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221101/r20110914/abg_lite_fy2021.js

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b5fa761ba024f252dbb252611630bf622e64e2312acc77d184fc05f2ab7ed4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:27:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37617
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9180
x-xss-protection: 0
server: cafe
etag: 12585499704757265805
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:27:41 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221101/r20110914/client/ Frame 1473 3 KB
1 KB 7ms
6ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221101/r20110914/client/window_focus_fy2021.js

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:28:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37549
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:28:49 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221101/r20110914/client/ Frame 1473 17 KB
7 KB 8ms
7ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221101/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

71d49d865114d9bb25bfdfc0272b738cdfd771749b21360ce5fb40eee3b4d986

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:28:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37549
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7305
x-xss-protection: 0
server: cafe
etag: 12747696668401323709
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:28:49 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1473 154 KB
47 KB 36ms
35ms Script
text/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6080610ed8ad1ec28b32a16cd5fb8be853a45dc27de0757acad068588e067a45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48209
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1667824238049716"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 09 Nov 2022 03:54:38 GMT

GET
H2 200 f7733d2b54a65c984752ab0a98c7def9.js Show response
www.gstatic.com/mysidia/ Frame 1473 34 KB
14 KB 26ms
7ms Script
text/javascript 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f7733d2b54a65c984752ab0a98c7def9.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d028ff06991dab0e77014a91995a9c0d6672a90e68edc339cd62a566fe361ace

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 04:43:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83450
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14118
x-xss-protection: 0
last-modified: Fri, 04 Nov 2022 08:03:27 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 06 Feb 2023 04:43:48 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221101/r20110914/elements/html/ Frame E1D2 19 KB
8 KB 9ms
5ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221101/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

349544eac2a5e347ebc6e23a6ca44ab6531e59c40f5d337ddddf1270608ce257

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:27:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37616
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7963
x-xss-protection: 0
server: cafe
etag: 15183902602499586604
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:27:42 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame E1D2 205 B
744 B 19ms
6ms Image
image/png 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sun, 06 Nov 2022 22:50:11 GMT
x-content-type-options: nosniff
age: 191067
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 06 Nov 2023 22:50:11 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame E1D2 604 B
698 B 20ms
7ms Image
image/png 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sun, 06 Nov 2022 14:59:54 GMT
x-content-type-options: nosniff
age: 219284
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 06 Nov 2023 14:59:54 GMT

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame FE04 36 KB
16 KB 6ms
4ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Fri, 04 Nov 2022 19:56:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 374309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Nov 2023 19:56:09 GMT

GET
DATA 200
OK truncated
/ Frame 70AC 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7c847a10034b20d2e641b712b07774037a61b58ad40b2c8f81e6afeefe7bb30

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 1596 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: afe51cd07006f6c725d60d7e7544c7e44ac51cf1eda1107eec34d63a3d4f3ed3

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1596 0
0 41ms
29ms Fetch
image/gif 142.250.65.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuj9nVI1d5Iy2MKhbJ7GV9MqE8ffhxTXmtP1SH0UWMg5N1g-WJqhAXcQrLn0qlN5X1pX5DFDH-Mo7r61QR93lC4deEEvBt2nmMYjtSmjPtBUoWf9xj_Wc3WQcY3hpP-job6I-U9XJI9f4EolE1K2A&sai=AMfl-YRsfpQItaSnt_jx-bjcSTAKkjIQPxrZ8uWWmyEBS0IiTIQZ7kFTwwMBiOspbvy6GrAmL6aByjuhzuBYdduBgBuF4uwZSSwr1LzdKLEQSoFRhF4p4dbltceY7jtaMENWmGHB5A&sig=Cg0ArKJSzDYx_thS0t_tEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=242&vt=11&dtpt=241&dett=2&cstd=0&cisv=r20221108.51302&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1194052/66719900/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-B63GjD0SAznr7Y6-9tQqwhqRVFoR_L1ec15Rz9Yg3WmuxXSI3ASYC1GGhBUAClsHI5-amlo1MqR2wPA3QhClwkm6_76yZl8Op5CAWAuX-0ofdRyNElpqUREGNBwSeeF0Qwd1DkJR4nKKeKRcrXyks5tmic7GfrbHV9To6rrjSs_8dDZeAS2RMAoCZ_4O5T7a_Nw3J1vOFEIG-dtd21_PYOub9zbd6eerrfelGsAR_kAUBnlMR1uZNUBRcBMPKnk64qn3ekCTi-uCaYEfEJhC9umpAxaldTfvUSyFkPJKymdIahMiXo8wjhDLf8X4CKMmoGoVhaCBu6_PsV3zvyD9r0DRFCPJj8PMmEoTQ1ccvhKtoKAIOnziPPR_Kqmpk9D064-DWoEAwH-ERwZ62TQUWhsloR88Ur689Ughg0sWfzor-J3n4yFgVRkuyVtGITzDcqyO8R6YU8mwS8E9kAlkxBNKm0o9sK6RUIaFyRJj7PTVOEzXjqDeH6x1PxXq2PTXqESRNmdvYEXJVfq1G1JkrjiHWT6rIwufUZkK-RPbxbBUXTP4Cljq6XOj-WrVxr7fT10Gj43_6H0dlMFuV2JaB5AaqAbR1lLci-_dhwIygbaicBg3ANlG5AXMSbAVdjBPaF8ZptLnGRHqrqoR3lFefCDlhuyBAHH_Uz_HNbHISExkG6q-Okf9xBq8uRAbjhjBA3oHCWKfUI_wutje_Cl9M5bwlYa3XNE5Q8wItXYtt1HN0BdT8CcPeTnadWYjb9413PmGBR6ht1orv5drGy5fzF0_okFnD2WZhgtKAiuVDl5kEOnR9ZV9eCGLh7L-YHENPscOGdJYByPbN7iOIHBzuieBCxQPsH6s0mCehRvNYYKQ7jNycYCX1wKSrdMCSUhcgsraeMVO50ZB_iFjmbhIe4jjp1DApe6D2eNThIRALC87c2yWF-g41YDXbWOwtx38IttytWv-jHL47H8LGpz-rXP1ZzIuywA5t8hEYj27SDcZHlwqFJfunPhacBEy--5AOYjY9q-uMh4kjQP-b-vPvYsFd6EwjUOVJwP8iCDo9i816DOz_rb8nqOD90WRf9FBqnMOndk0Ipr3dPLjUDr-uqsJiWNH7FXDymbLo0tVLwYDdKcyO_7LRwFw9YKOOL5gopmkcr73QEdc3LmQoSdZws2pTBRlNBLS0gmW76h6TZXeQYiVK7dX8TYpwSBuNBjgRSj6n3WJFEcNL6EdH-QPgp4WRWuTVuiglUNWrdobK3N1rr-lMeGO-TyL09Nxia2BVB2oB5rcs3RWi85uzpx2Wlr6yd3VtS__cDhx7BJ7gjvU1VazvikmpCnlbofPpveTYVg4RrFyu8TqPvL9-byEioLBXKlYmsMlhRGESwCggCoirdY9ixt3BHSxrfUfGNGhlC0wbFIVxHGwDB1G7zLPqpcDvidMBo6mv8tMCVaJPhyPwZRdadvDO0HoF_AKJSLj7_reN2XO10dyXQPBhVFfc5LbVsHbmRgf3ESdw_q86tMcBlxLoO9NBxP7za-GKZve9hZUhbCGmJD9HsQCIrFEIFSmf9yKoPJWLeuLiSE4gOZgGDbwIS7adzcvcXCadgYeb_tf5XuY_Ta9kW3pno-K8MNBzGUV4nkodi1rrN0nfd4ovzNYjd09LwITaBhuSdhw1N4OOGkOmKHCg8jgf3tVN7QMmvTak-IgWzyyJGWgrdg2ypxfwTMjH7OFGnLDQ5maquPuhr82EmcVH1hAjCl6Tv0eYwvsFNu3B9_LVObXOT9pw-KIjHCPyblfnHiy_pZjV2eWRljzWsiBold52vYeDpjtMethODuHzasp3bLwGU6D4KorvvGSFQi2Fcvq_myCKOlRq5SKGh4rpc7pMi8yeKC8knW6dvZ0q3vl82Wo6hDkaGLCLgvwykKOtGviop1KAcuyZ_rbP9QrKRnspXU4umioLfHptWvvgyNAJ6S3PtiCJDN8pNAOcbweX5zBBMINnNiivdWBRxiUzNHQ-wXXEAoqjUhux8g6-LGtoO7z7xZ55A3w809IG7GKo1UnRYyAGNFyzYWyhepgdk08El6KC_pD0smHZZ8veJzZSqKPEdBIxhyavgv3tWmSNXG7I9jhWI-7rbR0kgbcfAkYCiIggS6Ku-TYWJWR65ftT-rw0XyoR2Bq9IbarCAvj9ssWaFl9_2i_DluTJeHBcR5xe04D5KTJoDmkAw6bqB1k6GiGac7sio3HBVXk7buPWHsdwkHJ54HfgPM8R8FZfpBg7hzHRSbL7JDCxxdAIqUcykDcFxY1TyydW9x5Ko6WIMMq9QqjW3hA26BFMMmdL16DC1QFgKNhOT7PBYtcKPOZG7k5zCNOcCETmG61gvaJMui6X4df0gFy-kk9PgWhDvBeFUUCrac2UMk1RDJqYa_4Moc57Ey83KTVG8pd8m9YWzLgYON4n2QvtoEAIe3xb_kxUYAl7qq0YUtam4zqdcdp1WT4wPqHJfPyznQpBd8F9h8pcEAEWgj7E277cLYPoT67CMRdr_1VKD1Wf2TmderZcOIDu-qSTlaJ3P9I6qgQ1WSG45kH_zY-_6VGetc0mWRVRPbpBZWl1FEr42wIzAdSFVuyuxz1a-GFODE5tdM9pwzPaueWbUA7dqnaC9FOrDoYCDKTSuQDcFC7M2L1BQvRy_zAIux4lP_qW5S1nxaU_2Hm8R562FoL2YgLWO381_bR0tvgikdIiqKZyQ2CeXxJSzn5NErVGdc1Wn3ET3WB1ocA41sDZv64J8Q3H2Ch9O_Vam5B2OJLacWWweEUBIXIVTpyKeD2YQsCtE34wEWV-N85hhuppj7jzjlYy2JmttcX6n7gZd4jtmJEbDJUsRncnraI59eCzqmRzAxs2M-2HUJoZCiKPmOtofSoZ_MYgTBaAxMXJ_NqPWnB2r7PC9pK80gQP98EEhgmRmXD5-Eih8XrrugnzoLcJToIb_N4_vhLNYgT0pqbEjy6kGjgx8h_elnaL4TRErCWnaQXVF3So3PeYRdhHe1SUoNBrXRLyymjKiW9MTUNrReR407doVipIX4lJF-4YpZvXNjvjEazs-m_CxBium6OPKlvluNdbnsUxdh1MSwKzaJfbZVuK_mRBgzj5jnbMiXR1dNwdw-FpJAFcAt0rphOw5cUKJTBlCG5oDQHiOC8MezTlsnh2HUzvFhI94ROK5qMv82dI-xVcZXWj9aqTmtaKL4EV2zm6UDs0RjcjGDgLSkOD8h30JXgSePhcsrDMSTVOPUAlguxOOBajhQ6EUG31gpQdRBINduVEX1O4rFsPyCFiJN50NqJjkA1xAipC-eav7QnbJvUZ7vJtGngwg1lxcb3KDlV1ysjAksHMMyPKfr90hNL3uSQhnbDtZJfDntwMzzoc8lbY-JCBtKZeFjnXOfPVkXjcUbofrqbUR9WqmZG3l3YY_fwKfbfBr0_PzxKpOf0d7C912ezv-9WjO_xSZ9z4TPcRIHqrdC1aZ_TmyKyVEmrBNr_Talmw0xvYnpojC3WKdrlyrGQProxuAreO0mdf_QyC7qlbPWZ6GkcIBBI_AOrbo318sc5X3cqkVce_v0GoUK1nmnXH5p6Wlq30okksPqD065XfziAx6a5CyKoF9x5vntrcWLaYF1t8MFmnGAEgE2AB&cry=1&adsafe_url=https%3A%2F%2Fmohtawaa.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fmohtawaa.com%2Fhow-might-i-purchase-bitcoin%2F&adsafe_type=c&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-39%2Fhtml%2Fcontainer.html&adsafe_type=bed&adsafe_jsinfo=,id:6a6b6091-30d8-78db-10f0-ec65e1bf9f43,c:trh3so,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-75cd96f6cf-vvm2v,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tmETGed+11%7C12%7C13%7C14%7C151*.1194052-66719900%7C1511%7C1611%7C1612%7C17,idMap:151*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:20,oid:3b34632d-5fe2-11ed-b1e3-ba37930ba475,v:19.8.360,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.226 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 09 Nov 2022 03:54:38 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 70AC 0
0 40ms
28ms Fetch
image/gif 142.250.65.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu3PwxVdfwjcy54nO4dhx_kdHB-ZpOxb4tU6VBlVXkHmPs6TNmFkq67iNiyb6mEzz4rEbKuRjek_5Qk5emh2_9h4nIlZhPOiynQ65oS_M2d6GIONkHebsAVFc-uWxZ-BFQKmnOUDz5F4ZfV_I6bZw&sai=AMfl-YScn6_GacGXoDkBOpjy0sxgehn5HwVmSM4ASkvYiysxTSmQgvg5ZZS63aYFEo-9KnPWmlO5mDlwgQNohc93jTr9IETpvHPSb5TCnMJ85X3ZNtY33n7zAen2XuRvdFqA1hHpXQ&sig=Cg0ArKJSzJgqyx8Km2_QEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=252&vt=11&dtpt=251&dett=2&cstd=0&cisv=r20221108.34297&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.226 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 09 Nov 2022 03:54:38 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 7DD3 106 KB
37 KB 16ms
4ms Script
text/javascript 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
Origin: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 02:34:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4816
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 10 Nov 2022 02:34:22 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221108/r20110914/elements/html/ Frame 7DD3 8 KB
3 KB 4ms
4ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221108/r20110914/elements/html/omrhp.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1224441/66655758/xbbe/creative/adj?p=APEucNX93xuAyhr8_sR7oHiwxXCB5PvA_QcvkCZ9Ze4baFSq5qhXra4&d=CokBAKAmf-BB8r78UPJ_D-dhtu4Y4r8crNbw-H68HBzmykwSrbEf_5ES0kq4624I6_mC81sNGKSgc962c1OUYFFwvvXQ-4HUYV8zUQp_T8fIjBByGm8WMLg8ZCTL7XmwJQWdhXmf3kXb1AYbi4tysLlQG27gBhY5ZfWcl2VRAikHb7Imj4O7kzbUqWYS6RMAoCZ_4Gwk45EJpo90V_tb590rnqwFpT_u24tgWpZn4A4HrhxjPHw9pALWz8Op-U8pEMlnXjDJvW8-Nz7v13uGXsHL9qVV79bcSoOBWsVWuM2oKcpGbAc2mXxtm4rY6H98R_pGg1C2T6ylTgWqO8W5Ki-hl8lcLMbKWJxNM-LeS4QSRccmftTKmZ0-dhdVTI2g1ucf7iJ0GMCl-yEmZruOiN9jlJTbRzg9HRSxcH2979iPds4mEASC6iUuvy3u8RFzNnxHD9PnTV0F4H7mHxKmtXI-Ffy0Efky-m0o7FnFaIL3AYR-kVgE48OxqE-wXueRWe2NDsNxVp_pW_Q2NceLYJnnzfiTDh5Ur-gaXcnhkU813aiSChVvxUGCmYM5QW5_4PKLPpdPMH4Q6FKtjsSizVZk0HZsNd7FT3IZhD9mTNuN30GSBrIqHOV1pcP7KI3DQKCBKiR9Uh-o-84ehi1KTu57FJODjPArBO8wVFA1QVjXFoNSw6VOdDINQASTXP2W7r4Om0cwtLSsOE_URy6JIyK4KSBdAdzy_hG9qbQNzSn2TDbV6CVq3Hml-7lJTACbEw4pKMmJWMKISqZzNv7LVbDZ6qY7oogr8OumSRaRm2aspBEOtoUikLv8hI0WlklGnheD7OAY5PCuZDZ2YvsSCvkVkbh_7ZaOc3gOn3fpIpJxGtSPrthDhGh5HxpmUZ_j1H1wQQviQgaEMop-mLVDtIyLh0EC3NdvboBdWvRX0mUk5ZH3RO2flTCZ-wmEI2LKXLpckX_9QI3P7sj9_id-id1iAR0vcTU1zDNYSlMt-H4cHZTByi78Wn6d-AXZn3gwFxMiRFPOqfOAzcAPD7dY04IgFBANz4W-GX0rb3Vdh_OQ29LNuH9n7vY7_7zqFujTxh-eE59TDGpCANKJsOVsP-nFOtfuUWRHZAFPUymSzrdkDYUl6ey9Y-0SieO2ZesfLMWAnRawgpzwDlsm46Mrt0J1KfpYmCcNpKrsas5JO-OltZGpj7Z-reIEXQXEv4rMnImOAbDkjvt4pwaKi_mD5Q_Cjph_SBGo8o6XAD09A1WeNFphQYH02bF6QNozeIreCAbZkY_rwFR3WkEjlPqh7BlPNYnvvOfJ0ypR6K9BdZGwvsH2WfLEedZ7d5dS_WAGhQ3bqzLHd-Qiqt6aM6PXzOY_viQYeCfvjBxXWXRJLfTbR8c-pcI8noabNEQjlyUaru8DEdaLRpgYyHuZD6jGddbjhzjYhAP3P61GFhGgCCyFsOsYThSLNPKh9eIIGRJ9LEJ8NDFGt4-xkpyZa4XHakM7C-997ysN68FjLxZBfyESHtCOM0iqAE_bhhoijHNn9YUkIhoGQ4_dFpLS8kZChds8HiHZukGQjAYEB4F2G5UnVUZ0DVCEn2fMaaPB0-OvMS4f8d3pcI6p1Vaws9GyOmVKP5q97aExPzDdSahOW_FuJQXcuqV3wa-YWcF8H8gzENza4YUuXQPEKLXwku6tlK4ZU0_mcV5lxHwLfPlHfni7KXr4NXh4ScfYulLvf23sWu8CXCR5v1x7ZCONDWjL_RlkYmqil0drS5vfKSQzsBZsjEhM4UDEtM0okMANxWUauQnc_E7TU7htN6jE9Gs7oQkyHZMOGz5tfbCjz-bUwXNexPRwf5LaWCbYrBmGON7r3D0x5TOmZAb1mAqYrPI7pCHURE79WM_Bt5th778ZWvOdIfb4MlgJShE2amr3Bw8r2bUXnH5lT38ViO0W2EJAE0fot10_KVM1CHK_oov3mZZx9Xajxj8IO8w0WddlRjRSLb38paJ1CtPdToYhAzO6hDMw5ANywIqOHM3AukrEwxWlKbWEMBtBDRd-ElOHiea1EOAuMnkuW2Vl0AUMwia7jIpEu8TMbRdQ0snXtU5YDSoaxcXI5FOX2FlHNySJShz9LNbW549krFw0Tl1cu_0sg6UdAE3rQ3o5kFpUhv75XUzETEjpd6Y6m50qiQ-A5v828Qu2hC6x6ahlpuTkzGWONG4CeDDI9Ib-rg6nbpCstTvHe3Q0l0QjBneI9CINXI_bGs9krkOqzDoc1iOXOJoZD9GU4RsPs_-cWzWSH2hHFJcsQm3UtH2p-UoUyzbLjVjzp2u7m5d59A-xKN2StoKoOIvGxEQHTyFTFI24l1_bvwT25kMXudIwTvXaVkR_RJL8UwIBc2crAF-4LOWZ32i6QlNNPLI4LqUavvPyr1NoY_B0xqlPSEHzvKM-QaeP70fvV7HFnt9VGiBdDRaXCWC09xtthhfYybdov3UqrBPvUmfQqho-OO_JKm--_T_dDcr-B_U9O_AIuw2QNZXy8rH8nGtdXCKZFo7fP957RuaCvVMzf9mue409wUrgfDRpQYkf_7fAkQ6opzWWpAP-Em36bNIxZMg8jznPhcQJrK07cMf6_0iw4nUIBsK2SaSB4yms0cnk1BeSkJh2NAyvEkj8qBBJ98Y7w9EBOggg_w_5uUL0XUHAyB_-1Y8qIl2tnT1l_jHHAd3pjZHttxdit1a1GfCxJ4xHi3GfhXof036cuuLK6CxiYE6Evmijgs_i5fHKFH7sUKdPeJmxY7_pZkpAu5aRCoUIyPhxO-Sf4wG2SURyE2LTnquAKmXhHoxPrAvaXrCd69UvKUTDXhIU7IJMXeJOSW8IAq3Fn6w8kXE-WFSZ5n1Y_B94qNyvvL9NXHKb3lGbW2Mar_0yANPMAmkT8ymdSoWoGC6XObWr1DpXdjFmpaGIpNrIn5sEPFTfmKuQhEfEKNhkNF1S1k0wxgW2Iz2S3nFubClIznbgt7nXN11RSm3uQfqLuwYwTz88vWIzTYCqOD9ASbRqG1SHLueMLsUwtadjuJh1XzOiFwzJnD6a9z2lWduQhFmQwrQB5NUXAv6drriVYSjaKl8on-IQDRN8NyBvPLiF0su_b0h7to10ar7PYRBYmrQ81eEbpSz-EBau0e81OdAa5e20UejKg8guy-pGHuBZN64W2wJIyNj_Tr00WoAmyAoHqx_lGTiVpwLHll7KhzTw0RV53rHdATa_WBmufIwmoBebvhUstWPogwQGZEa__eBnrf_2YzidG-YPelOxnYNLais_vvWb04XoaoGc4hkq-M10v3WAHuUDkWa07VDGImxknjBmRNIBXrxur0qgVVy0R4lJ7LLByfTmSbC9kQW8gji_Jbnn5QCWkw5v8ZezFO81AfUbxa27G45XICc748rx84LBLRKqd-F9JXUZ5xerAoOMnfijEOSyozRg99UN_y16soAPvQXwPeZ_mPO7QwE6D9Q19vGCDYbsvysgW7Ok50msJkHMQGWJ_cO0l3JqdKeRtPNh_iCRqVjRRadQ6mMxAuGMgLpBUcmmSTypfC_Kz25eVY_peWR2dHpgwnM23xpGCAQSPgDq26N9bKKP3zMMv9KQPVRGsvO8u2FdTVA0adMi35UzNhjLf8zRX3QVxd7S-Z6Wf2avG2CZpuWhSmNGw-WqGAEgE2AB&bundleId=&ias_dspID=3&ias_campId=1009169364&ias_pubId=pub-3831894559014614&ias_chanId=1&ias_placementId=18473376445&bidurl=https://mohtawaa.com/how-might-i-purchase-bitcoin/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0ipoaA63ag0v7ZvSBUVd1hS&adsafe_url=https%3A%2F%2Fmohtawaa.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fmohtawaa.com%2Fhow-might-i-purchase-bitcoin%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-39%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:863b7a53-5a44-3163-ca25-2d25c1757990,c:trh3wG,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-75cd96f6cf-9r4bk,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:4,mot:0,app:0,maw:0,fm:tmETGir+11%7C12%7C13%7C141%7C1511%7C1512%7C1513%7C1611%7C1612%7C1613%7C17*.1224441-66655758%7C171,idMap:17*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:26,oid:3b55a731-5fe2-11ed-8ce4-4686a8a0c982,v:19.8.360,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:57:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35844
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:57:14 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221108/r20110914/ Frame 7DD3 29 KB
11 KB 4ms
4ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221108/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddd61ecebf36941bd6d1aa20ca07868d826fd9eb6f3a5e660e0afbb703ae6793

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:57:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35844
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11141
x-xss-protection: 0
server: cafe
etag: 7611781198975194673
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:57:14 GMT

GET
H3 200 container.html Show response
7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/ Frame F197 6 KB
3 KB 5ms
4ms Document
text/html 2607:f8b0:4006:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110701.js?cb=31070788

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mohtawaa.com/how-might-i-purchase-bitcoin/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 2988
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 03:54:37 GMT
expires: Thu, 09 Nov 2023 03:54:37 GMT
last-modified: Tue, 25 Oct 2022 18:59:17 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
299 B 19ms
18ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?r=mohtawaa.com_fluid_sq&pn=1&sn=3&pc=0.7372676610946655&ds=true&e=wdp&dsReferer=bW9odGF3YWEuY29tL2hvdy1taWdodC1pLXB1cmNoYXNlLWJpdGNvaW4v
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v16.1.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://mohtawaa.com/how-might-i-purchase-bitcoin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-nf-request-id: 01GHAR6CPWS8RF208HBJQK4CDC
date: Wed, 09 Nov 2022 03:54:38 GMT
cf-cache-status: HIT
age: 67016
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "8a9dc9c7d095d16caa762d82212746e7-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 76739bb83f328c5d-EWR

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
299 B 50ms
50ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?gl=0.01&b=3&r=mohtawaa.com_fluid_sq&sy=7a801ae0-dc8a-4c58-86c6-a8fab334d80e&ts=89&cd=2&mlbr=ch&mlos=wi&mlla=en&mlco=us&mldo=mohtawaa.com&mlre=undefined&mlin=0&mlsi=800x280&mlbw=4g&mlcs=NaN&mltp=191e511b-91d0-45c2-b655-8d403b778259&e=lm&dsReferer=bW9odGF3YWEuY29tL2hvdy1taWdodC1pLXB1cmNoYXNlLWJpdGNvaW4v
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v16.1.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://mohtawaa.com/how-might-i-purchase-bitcoin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-nf-request-id: 01GHAR6CPWS8RF208HBJQK4CDC
date: Wed, 09 Nov 2022 03:54:38 GMT
cf-cache-status: HIT
age: 67016
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "8a9dc9c7d095d16caa762d82212746e7-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 76739bb83f378c5d-EWR

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 70AC 43 B
215 B 86ms
85ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1194052&asId=1bf87a7f-2f53-806b-c13c-aeadc9381d19&tv=%7Bc:trh3DQ,pingTime:-10,time:778,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTA3LjAuNTMwNC44NyBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222222222222222202222222220222202000022000220222222220000022202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1667966078778%7C%7C864843d8a24c110440b658e3b52c8fe6%7C%7Cf8a61638d246180133c226b527e2398b%7C%7Ce88e2fa72f111406b896e12aa1915d90%7C%7C3eda4e96105fb580041bd1cbfb685676%7C%7C06e565520521a2c92b176bcafc7a6e06%7C%7C57457e1dee3d7de56bb94a6a0fd9ce75%7C%7C46d4c3e47a2fd435ee03c01a378b1a6a%7C%7C1663701684,im:%7Bpci:%7Btdr:592%7D%7D%7D
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: nginx
x-server-name: dt13.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1596 43 B
215 B 86ms
85ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1194052&asId=6a6b6091-30d8-78db-10f0-ec65e1bf9f43&tv=%7Bc:trh3Ea,pingTime:-10,time:749,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTA3LjAuNTMwNC44NyBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222222222222222202222222220222202000022000220222222220000022202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1667966078797%7C%7Cd990eee734d22fa4fdf228b392f2aca8%7C%7Cf8a61638d246180133c226b527e2398b%7C%7C55aef5c1b0516074cf6d4d3b39bd4bba%7C%7C1507ecff979760e0684b55dba225c083%7C%7C72276393308160beefc97e83a42f59f8%7C%7Cc9a93afba978416fb9b8e1ff74efc677%7C%7C81226b85f8c65bb63507539a418ea2bc%7C%7C1663701684,im:%7BpWait:171,pci:%7Btdr:630%7D%7D%7D
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
server: nginx
x-server-name: dt16.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 72F8 107 B
122 B 23ms
23ms Script
application/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=almu7asib.blogspot.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211020101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://almu7asib.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 403 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0944 603 B
66 B 41ms
40ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6910583905428044&output=html&adk=1812271804&adf=3279755398&plat=1%3A66048%2C2%3A66048%2C8%3A66048%2C9%3A66048%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A66048%2C27%3A66048%2C30%3A1049088%2C32%3A32%2C41%3A32&format=0x0&url=https%3A%2F%2Fmohtawaa.com%2Fhow-might-i-purchase-bitcoin%2F&ea=0&host=ca-host-pub-1556223355139109&pra=5&wgl=1&easpi=1&easai=1&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=1000&asna=5&asnd=5&asnp=5&asns=5&asmat=-1&asptt=-1&aspe=0&asro=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1667966078252&bpp=6&bdt=373&idt=555&shv=r20221108&mjsv=m202211020101&ptt=9&saldr=aa&nras=1&correlator=7574563085535&frm=24&ife=1&pv=2&ga_vid=794276333.1667966079&ga_sid=1667966079&ga_hid=1751958397&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=244&ish=244&ifk=2019722536&scr_x=-12245933&scr_y=-12245933&eid=44759875%2C44759926%2C44759842%2C31070307%2C42531706%2C31070617%2C44775016%2C44776449&oid=2&pvsid=984390733761389&tmod=944968369&uas=0&nvt=1&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C244%2C244&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=1.e46e61j5bjod&fsb=1&dtd=577

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211020101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://almu7asib.blogspot.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 03:54:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 403 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9B0D 603 B
66 B 41ms
40ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6910583905428044&output=html&h=200&slotname=2646211261&adk=4178570851&adf=904710468&pi=t.ma~as.2646211261&w=244&fwrn=16&fwrnh=100&rafmt=1&psa=0&format=244x200&url=https%3A%2F%2Fmohtawaa.com%2Fhow-might-i-purchase-bitcoin%2F&ea=0&host=ca-host-pub-1556223355139109&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&sfro=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1667966078258&bpp=18&bdt=378&idt=622&shv=r20221108&mjsv=m202211020101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=7574563085535&frm=24&ife=1&pv=1&ga_vid=794276333.1667966079&ga_sid=1667966079&ga_hid=1751958397&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=244&ish=244&ifk=2019722536&scr_x=-12245933&scr_y=-12245933&eid=44759875%2C44759926%2C44759842%2C31070307%2C42531706%2C31070617%2C44775016%2C44776449&oid=2&pvsid=984390733761389&tmod=944968369&uas=0&nvt=1&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C244%2C244&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=2.bytqw5l9np4o&fsb=1&dtd=632

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211020101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://almu7asib.blogspot.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 03:54:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9D19 611 B
266 B 23ms
22ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CP-L8QIQ5O66_wMYpvCu1QEwAQ&v=APEucNVZxG5NrEmoJR571vde5lWND2kLo6Bz0I97UuTSXr23H7_6qAm18hsy-K8mHDmSje0SmfWrZWYUQVOzHzRq-7ZoYcU0aw

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

55b198b5ed1bd02e77f84c6971a69d5c2160c0c32fd770ce33405e194750f5fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 243
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 03:54:38 GMT
expires: Wed, 09 Nov 2022 03:54:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 002F 15 KB
11 KB 46ms
44ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DxMRzHqhoRNv5I8CpqV7NL2lop-uKQ3Ux0e7OZhzb5kxwMSG-x3yjCpNgTtyFHbfrjIfrQFK-M_nnNfHFsUdXh2IG2yyU4d1-ZGTu7ERS5HqnJGtk7CkiHds2dxKVppLycfGFWnbuukAhe6ERvXVOlw_yXCL88Xo03gQTnK8ANLe8YE_w&cry=1&dbm_d=AKAmf-A8OtwC9fia9tr2tQmShpxOkop8uaRuVeXC6KVQhiPvYTX9JdZMHTWpsm0pUVQBOwc1xG7OVyQlOy-JzTOqYQ-SAzpywfVREa62SBqf54-9M5ooQ5EVGl3YkhZJC8pRT1HkF6dYVAbxJ7VAQ71TW4cw7or_eqvmhVpCEUaRO2nZBVjf7ouqQxeNskBTMVmu_wBik8iBwDpfdnX0Fybfl1qt1_UtGQDeEAyu3IxsNcaReyephuqsh0Kb7LomUYJ_2DN869OgYk1jA5tkb3uXGi888Zx2aSE9XJI9_SJvP0iCu4hmaZDVq-g1R9jqvzlKSSz6cc2nAgfU-Fy6vqkjY665AFiXFfG9UPeoAHlJ_LkJbrhZU7FnRi1dz8VCMcN6KWtutuD_B_seUixDePkcgGckNE2kZlix5i8Umam-aNS9RMNRTYu4FGzqOYwERmCh2EUYA5HTTmTnbPqasPb2OlZHfxL14XcRthWEj-iEfxscp-vEmsNGSBnj_xVe4L9Jt-HpgLBT0frRob0djO4fK6WXJif7CPLusPCthXncaSdRNCVHsS0s5_6bE-yxGNjXdby-9qXTlmWBS9XsZmF4ZCO-FL-Od0XZTOj-WWSZZgf5BRf97ZCTsmaImgMwID70t8_NF6Yf2tDmhkoZe3PLmhooFsRqbvsxtFgVZlS2Qsktkq-U4wlo6u-jfPo3lRba569mEk9b8Mi2yUP1Fz38xAMuomV55hGS9o40eqgQxmIDrvVE8vwPrEcD0uLRqanEF-J0ZNrmV8F9Qgr7xH6THty2GJPIP4KodHN7N5XkmMmSJPtTdXdNaBsRoJwAloOlNcjs7ZQuLEb8Fy9leTR1OPB6YoA7jpnx83SPEm7BIDV1QQfk-x7tm5yo1GN7TJ2l7Qslash5uisRu9PaAXTJrByYAPwlHp_ObdBM8hH8nCrtw9CwYH8M-tyiDpnCpHQ0KXs01Syqk03s7KI2pXhH8E_bJBffqJ8z4qvxvsp-hoGpuXjFBaOV4fgzeZDrkimYqrTSg3bRrdm67Jn0isLLhqMj5UVgRAxPVGt_SO7s5GghTk8HHw6hpSPp4d4u0rmx6wILHUq98x0bNO0FNDVjJeYFlCjuJfogIwq-pPZVJ4w2zDAOu65iMo48VlnwqyKWyN-4qp9Hfmkj0ioToqLFpnpWfCRbaWiPtOUd_GT9x_jEaac8Z1KWpZkgoM8QcE_bbAJrq4BrONu5aL5RInKcMsQJdYOJYJGO2kIx2_7417XU65SuwhJdKZhaRSxEcbjJiBLih0H-VsGBUIF1OnpgySS1Mgpll7SN4h_ZqydgZ3WPxQnJYN68HKtgKnD1puIneLJXHXJcjwEJ9C2mosRq_417MnfzBqH2N7cUnNlaf-lpsb3F69AyLDbW-_gdulOG7k5QlYaXIBSIunpxmTTfXZhjcbZmF15MlibzqemrMnBrqByRiT7qPj8wpqadWG2bCeRuv3LeDjtt1tBbcii1IKVQN2b0uKnu9Fr-qYdNhD_V29sa_Xi2OAKQev9nlsDhqNmO6J4UqUnf9DMe92rYR3l7I0Qm7P51NRc7FhfEeMH7nr02AqRZiVV87MA6Jd6TfHilvqGBiTpOdtReOx-825pJ_ZJR_XE2CV2-OTMKNVQJMLNR5LoJwotQ8AFH7Gv5EX7CUo49XQz7wYr6PJBkrKVRaxSotSVXzjPwsPi5ZJIcHvswhDbPeqPBbRUx0DIlx4RTgrhgMbr8G5ZqhPq_I9B7F2TspGLZUu-A-Sqt_PkkiNSyj_whrBiEH80A13al6A2iowpnswIbKp4cEs-Uy2i9ChDjRXbiD2tILObq9aODNJKznvxkpxaH81ZEmZDrHBso6u3z3rUqXlfzN2dUt2Y-lk3sIdutdxDt0tiQ7D-UPSODWMhlEQJIdxWU2AEyLRqYU_fmOFGMAYgl6U9ITeLmVeRt-nXPedFygrbdrco7QzM9lo_Rva8vHfkpD0YlWsiTHKmJoo0JC-2ReJIA0iS5FlxMHq1AXfhCkf3WXRpKLCJTDoCKKLBmr9MluebRgZPcPmgsMFjuVl_tDaRsEv8PtqaeulZbQI2hkBQfaDR4WCiWc65DXSNSy3SHP0u-OFzayZ9iMnDsndoahKFLAoi1XDeN88gD_wkham_4BAoedJ6Ngzax84ozBdEecuRCofEvcNInxZcipER1-BRAU-K-beOGlMkeTaiDvwq9sIqAvK8EAkGkFYmZlNd8_mfA2k0_DDkXl31lZeATkAue_ji1XXOX65UiIBPX2K_9aSD9WJir7H-TOchoXpaHMGs3M8l_1sQ-0KhdMy_ycQfaANhTVzMIS_3QyXW5vhTGS0vMYDEec1AbXejjr2SHUqfdOA-XQM5UBF9XdJXKKiyP9xT0RwKJzmaPHE69DmT14Oyxy1WH46lOCKR_oAQBPKyXbTzljMd9HeqI8jZPznFbK-k0pa2lGmkQwxURKwC43LyY80k5slpUZUNIp8iPUUpwQdWG7H0mClCiuiKe9O4jPE4ddUd8TGb1xRSWNYG0pfgxJOvWObR9oad4jGU8fX-7Zj5y0N9tv0B1tNd958SRGVj4aVHSyIdebggdCr5ZCMFP31G4hym1OlVgYbWi6Q5E1LvsvWySzkPTo9dAsn2cwrFT965FdAhRJTqBrHY_8l6Ny71LYTZhMPTskXiboHfzQp3zSAcII42Vm-fRsA5MR6r_IWD1mgQWZZPPbWrAZ13Bt80rLY0CEO2yx14CMrWE-NXRNDixyJBHLQDT_h03IGQiV_wbrzGRvv7iJrrhRFvUgz5OOM4DWZEy8zsczhBza7CNppl4&cid=CAQSOwDq26N9TqESqqcYjP0U7W-bOpD0CXaINAIuBPjlBvJRvvVIaWl-k7ReF2uFDF-zIYbpiCrNY3T01VpiGAEgEw&rfl=2%2Chttps%253A%252F%252Fmohtawaa.com%252Fhow-might-i-purchase-bitcoin%252F%240

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7203e7d952287be2bd6f290c0cb4bbdcde6a4c764b5c15af2fab1aaf500b72e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11342
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/1194052/66719900/xbbe/creative/ Frame 002F 244 KB
74 KB 29ms
27ms Script
application/javascript 35.153.63.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/1194052/66719900/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-DlJqKNDJ8sh1vCV-SIC1ZBku1-czImyCEGNsZ96JY0TlzDJChEG6CWEkeCPURv244-g48LNuLtNoRYAWWBYJ5wdq142T1_ZO2coa5sNVT4t1Kn3hq9pwGaugPYHrptm1dxHSHmjohbwtTvy580bx7qMQxXA15dH6UBd6tXII4I6QZ-9i8S2RMAoCZ_4JhaTZpQSYNQR-_fDyqxd8i6N4gXfadv5yjal4lZYCvtNxswAcWne46LLzasHSwJxDEo4ZgI5GhCdBWYZBhTuzrFNqTp_-Pq9IRoGMD-bH6PFAKAa2nKUBWP2gx9twrbGQ7K040-iuO_5zBdAuzTgNj1i3b5M0H2V9v3qRdMX4NQUxWaI_mlz-GmmjBdN_K28UjmiYRuYSK-c-NDqxAeUxCS__3LUb5cb-ck9Qt6rCx-JkHbO45yhzA7t6JINZfp2OhWOxP60lCcmeC5gpiB02ft678hf6aNUtDEpfHgOnyK4e2xE9td7c6lFXksDMqaRXe8c8c2rI2Ajh7cqnqnU-ztUlFxWWDZB_G9a-HNCeVyS7d8yTslJjI5IZMWvS9EubjbFAIsSQesna7KFzF-yQvD8Qw-vmYrV7LiwRDJ0kdsrhEKleDnR-RhhrLkjGahRS3U-nMBU5xp-KyToPAyyD4172BOMzz4stEqR4kNkOr1qMGrsAIZRgRqBNaihOU21tP_YuoZqHxSjzA0FKuxWiwdISAHQae9FbqpXn26Y5g8n3yL2ksxizxnU_FCz6kckZmD0e9bRkQIZl7AJAxNygJVnP72913_oDzxW82hXNEGK5WkGjopwzq6pCwnXmbq1Kp6zJYVVLdSDG-9rBRL_Njj5bNS0jVNyX_yAnDz722y_ggzLYHbqtclKy60yAcqXURNzMx3aH5vXsMvcc5_P9m-tUQw_Qd3qm1cXQot-p4-53hfbzSR6owDbT0rLDSEJWjF37HnA3CAU79s3EeEsechPHouFRpYzBCcDT1cM_3js3I4fr8gDuz0zj10FUSErQqsPxHeqsgRraVEwkRtXdFOhxX2pAVIzyriZoozVkmAvPld3h04s4w6cFY5wKWLT_Hqcg8mxIMlHI3p-Ee8H0CNDUgF44vYBDez46vsZ5pOsX--7i-Nso-i4JPgW3J2yuvaww8rzF9gQiMuf6xLHwRWl3F9sP7W-d808pKYuCczjn0-cXOoNMLY7pU4opNsW-sEVCJJxr55sBUDhIgCURA2o_LxeOYy2eEoUVEVzCH61XNNKBTDk8NHsO_LP7dIWuE_ZBSozrgHNjmaLopY2Oe48JcP_FQRorQyMEIryFpmpk-7h3I1wHCKFTZLq76WUZbjMbe2WWKn1BSLOLKxiiNygzG9XfV104s0RylnyoFaHefiJtHgrVudMSUTFRv5WJjr31p2fPYkAroRJMAqkwkeCp6a7QHIhuaJEfabnZkb0MpWfK4pHX6GNGaTgCBMJPoMPejXszRHHhY3eN_VfifuFEPVrhGO2v9KQsyvikB__oYBI2LWuabkKfkStsZBldfbW4rkN4xN5YRJViYqKY5PuDXTYxRYNfP50Da5OV1zF0Vbf2pe9zCjOBf9MQzVzriq95AvxjIp89hvpXzzWh7wOjgf6swy2s5dZ4YCZJ3EdNBH1VLhSnqbJSAO5vYyUZeuKCGDR1Rse9-U1D66yxIsgIonhk-Vb4YjRi5hc1FB9jRNaGeeUBPm5cnJPfdTYs2c7CZhLfc5c24heHvy_T4sKF9ia_eaMwgc3zZSVSSbQRYS6izhSYba8OJd38qXX8tv-c5opup5NZMP4koDROFF28w9TnR2Oqn7jEOJZQBftNnSbU3QBJqon8ZqzidU5rPVK3NIzXbghF9w6PsUt4hIS4Lv8Ip00PkSk4OSO8zaf4QJcuyWAQrmjS1m_qKb12VNquA8dDycxjIT4aKnFULko-_EqrCO-w7a9nmhV6CB0CMCKJBS8kPnY-nI4-Uwa3qH_KBQy4vADq6fuHo3G3mnoqT-7-Qox9HSYopX7MF-_4jMz-znrKaVHnPFbTePohsYf89ma4CHgZyfrgYtOT5nJY1CH_eQUIu0aSmgT30eKHuTrKz4NBywWdyJp3t9C9UXs-NwpDulRDWzEfDnsvbPTILCnRA0qwtclUpm2TSgy-n6W8ISVK4I1P-yKDuhsd0Knlc-gdtN1G-W4Hp0-Xs0QIPce4BdU-NiN8QOvQKZ-nkLK_uzS4Ig4rf3hYetTObWhos5aJdRR-LsxWfw0LaNAbAEM5Uc0gcvgqjaYOfbM2eq0JxBhQZzZQBqm4-nuqznvWSBDoPdOsS0CAqtYnKG1RfNvUkfyTxnSp4q-GMf_NYlxtwVox_LXZzOFAAQpqOlgJKOVMaPk74COqehcADb8Ib5O2DrcQrVmvtJ8BeArG3X12ERS3rJLnIXTbeSSE2Na-VMt1NYhbs4RA-8hmBwQi5_A7SCAEcrTuN0gTyE7WKTfPU22Sojhu-ds86enEMPuSPwZMhQdPTE5eF9MnvrqeMqQbMZUsv5FU_u1OJYMzTyzu3d6me6wcQQXVcP7ikIBcEYeHCV5ZS7HNKTVomoNJRKCoZ_Dvly7T9WIibR-siS01vcEDdjgviEQ6EEh0W2eF63QrQnZHozB8U2XvTmrKIRICqPJfeOXlkzpOrX1VQaPYpTaAUJGLsyY06O5r4AqYad3Pk-YWZw-J_uYIozaQO9OTAFEnkBBx5GuSuggev7RWl6cJ4sktkgVEn9pl8r1xztmzYnbWxut01_DuSQJtI471VLRjm2uQaBY7r7irDGN-iuYPENQP8cfae-E5Z_yGLJTpAeeb1XD52xiMEAi3IfCgVSjTIxfGlmiH1jOE9YtSH3mvoq6myf3FjeMwInF_SdZTBvKrBRsPxfH7BZYLFf-5IBBnkiwoYF0eiXqQ4yhUDYy8U0qFuTCRO5iNMHnVLh-BVsIS9kA2Gji2jVEiHfswvRYXYMZcJV0zK3ReD9N1bYQ2gU0GCTydwE3-fhZXZYj2DkGPINydZ9uvbyApwPPfTrxLshbzLfLak3oIZPHnY95rv_CfZeuEXGiL1KB00edmo-qsMmrMvvmepTvBA9GYwivVESf8x8GCblK8IkkkiHmSO3COTDrmT7FCKAQzqDxuyvf_3wbbY1jB4q95GzjSGF6BQBuJubWDW3qNiKGN5njD4UDuhAg4BSdeM6XDviJg7L60pv8f-6FLucQfQrrx3IgQlX13Hg8tjAl3QMiR39wuk84G8wH9TBXJgS-HwMSmOHbrG6DaQyHOil-nwtYTqV5x6o5_-t28B3Wfo73_FxRaLwh0TTWRyn0z5ndLswpinVHhqaoieNv99gP2bb8CsFyXzwFW3AXuE6eGj8iAB4saW3l7o8lqDtJl95A4fdPmoaj_shjocxt7trcqCozUiKq1nkXAW11wxzAYtyjHgSjvdAWCK5Zf_JYjCyTWJ4h31UhFHo8oWcJEfaqZiTQ6LSynmosDjWXAqYAHmI6W4PhwEG87m6H9OpjxCBhV77xOqOi9G87NTJpu_tLpMNGkMIBBI7AOrbo31OoRKqpxiM_RTtb5s6kPQJdog0Ai4E-OUG8lG-9UhpaX6TtF4Xa4UMX7MhhumIKs1jdPTVWmIYASATYAE&cry=1
Requested by: Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.153.63.133 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-153-63-133.compute-1.amazonaws.com
Software: /
Resource Hash: f6eb041ebb6e3e5bc6906b3f13595e344352b092b7836e9ee3f5ec5cd18b5fc8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221101/r20110914/client/ Frame 002F 3 KB
1 KB 5ms
4ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221101/r20110914/client/window_focus_fy2021.js

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:28:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37549
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:28:49 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221101/r20110914/client/ Frame 002F 17 KB
7 KB 6ms
5ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221101/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

71d49d865114d9bb25bfdfc0272b738cdfd771749b21360ce5fb40eee3b4d986

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:28:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37549
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7305
x-xss-protection: 0
server: cafe
etag: 12747696668401323709
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:28:49 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 002F 0
0 22ms
21ms Image
text/html 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSdFAW1M8xw-p4yJ8-chzhBqOT20aaEYTm9lRcLiqLpRnKUFPz-qXe0EOlz3s4e_mJiJkei-yEaVznhXGPFUN_T59YPSQ
Requested by: Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 002F 154 KB
47 KB 33ms
31ms Script
text/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6080610ed8ad1ec28b32a16cd5fb8be853a45dc27de0757acad068588e067a45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48209
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1667824238049716"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 09 Nov 2022 03:54:38 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 002F 42 B
63 B 25ms
24ms Image
image/gif 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C_2F0LdbRV7nPm_aHkifUBkyVm-S1-yuEkRDEN2qPfHK5qM5TeJ8O0ATxxfOxzBVykUozUM3MvtHBeD6655G1JUTpN6G_lIXh2dsZNezey_RwWoXY

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame 0D49 36 KB
16 KB 4ms
4ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Fri, 04 Nov 2022 19:56:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 374309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Nov 2023 19:56:09 GMT

GET
H3 200 async-ads.js Show response
cse.google.com/adsense/search/ Frame 72F8 141 KB
51 KB 36ms
24ms Script
text/javascript 2607:f8b0:4006:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cse.google.com/adsense/search/async-ads.js

Requested by

Host: www.google.com
URL: https://www.google.com/cse/static/element/f275a300093f201a/cse_element__en.js?usqp=CAI%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

233a7482115f0b694f84eec4ce8d52cf8d30e931567a7bcb17b388c26a17a9f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://almu7asib.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
etag: "12346072151045643729"
vary: Accept-Encoding
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
accept-ranges: bytes
expires: Wed, 09 Nov 2022 03:54:38 GMT

GET
H3 200 clear.png
www.google.com/cse/static/css/v2/ Frame 72F8 1018 B
1 KB 5ms
5ms Image
image/png 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/cse/static/css/v2/clear.png

Requested by

Host: www.google.com
URL: https://www.google.com/cse/static/element/f275a300093f201a/default+en.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

329d1a750114920332eadc55c129957d9dbe5a1b25745e2f7e0ed4fad75e04cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/cse/static/element/f275a300093f201a/default+en.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sun, 06 Nov 2022 00:19:42 GMT
x-content-type-options: nosniff
age: 272096
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1018
x-xss-protection: 0
last-modified: Mon, 25 May 2020 08:30:00 GMT
server: sffe
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
expires: Mon, 06 Nov 2023 00:19:42 GMT

GET
H3 200 branding.png
www.google.com/cse/static/images/1x/en/ Frame 72F8 1 KB
1 KB 4ms
4ms Image
image/png 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/cse/static/images/1x/en/branding.png

Requested by

Host: almu7asib.blogspot.com
URL: https://almu7asib.blogspot.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

331b2b1241f1f2a53744bdca867c5b76954d9431970e91f490f64c707fc24a16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://almu7asib.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 02 Nov 2022 18:37:09 GMT
x-content-type-options: nosniff
age: 551849
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1372
x-xss-protection: 0
last-modified: Mon, 25 May 2020 08:30:00 GMT
server: sffe
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
expires: Thu, 02 Nov 2023 18:37:09 GMT

GET
H2 204 generate_204
www.googleapis.com/ Frame 72F8 0
210 B 37ms
4ms Image
text/plain 2607:f8b0:4006:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.googleapis.com/generate_204
Requested by: Host: almu7asib.blogspot.com
URL: https://almu7asib.blogspot.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:809::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://almu7asib.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:39 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 204 generate_204
clients1.google.com/ Frame 72F8 0
210 B 52ms
4ms Image
text/plain 2607:f8b0:4006:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://clients1.google.com/generate_204
Requested by: Host: almu7asib.blogspot.com
URL: https://almu7asib.blogspot.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:80d::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://almu7asib.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:39 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 403 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DCAA 603 B
66 B 47ms
47ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6910583905428044&output=html&h=200&slotname=7718861586&adk=2889011155&adf=1981686666&pi=t.ma~as.7718861586&w=204&fwrn=16&fwrnh=100&rafmt=1&psa=0&format=204x200&url=https%3A%2F%2Fmohtawaa.com%2Fhow-might-i-purchase-bitcoin%2F&ea=0&host=ca-host-pub-1556223355139109&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&sfro=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1667966078276&bpp=2&bdt=396&idt=710&shv=r20221108&mjsv=m202211020101&ptt=9&saldr=aa&prev_fmts=0x0%2C244x200&nras=1&correlator=7574563085535&frm=24&ife=1&pv=1&ga_vid=794276333.1667966079&ga_sid=1667966079&ga_hid=1751958397&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=244&ish=244&ifk=3011661190&scr_x=-12245933&scr_y=-12245933&eid=44759875%2C44759926%2C44759842%2C31070307%2C42531706%2C31070617%2C44775016%2C44776449&oid=2&pvsid=984390733761389&tmod=944968369&uas=0&nvt=1&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C244%2C244&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=3.ipma1hk4zjgy&fsb=1&dtd=715

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211020101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://almu7asib.blogspot.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 03:54:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7DD3 43 B
215 B 86ms
84ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1224441&asId=863b7a53-5a44-3163-ca25-2d25c1757990&tv=%7Bc:trh3HX,pingTime:-10,time:722,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTA3LjAuNTMwNC44NyBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222222222222222202222222220222202000022000220222222220000022202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1667966079033%7C%7Cce8566b30f5364e7d45cf4c69d87deea%7C%7Cf8a61638d246180133c226b527e2398b%7C%7Ca42d93b3d55cf8e52e1c91d4fa3d8d95%7C%7C224a1ed0ba79762b0f1abb12e1a48c7d%7C%7C691162fd11d65c2f850b6c926d1cd488%7C%7C409bb22efeae301cb1e82e1de8c636dd%7C%7C729920a6c535a29bc5683870b5f2adbc%7C%7C1663701684%7D
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: nginx
x-server-name: dt18.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 Illustration_Free_Trial_Copy_1_728x90.html Show response
s0.2mdn.net/sadbundle/69658610996852204/ Frame 0B51 7 KB
2 KB 18ms
5ms Document
text/html 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1053d855095e42f97d77544f2165fcb73a4dc16004ba963400dcde5a85fa437f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 81377
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2376
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 08 Nov 2022 05:18:22 GMT
expires: Wed, 08 Nov 2023 05:18:22 GMT
last-modified: Fri, 21 Oct 2022 21:35:45 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7DD3 0
0 36ms
35ms Fetch
image/gif 142.250.65.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvYECMY0o9D10DRuQsHEXRsclNG1Nu95-rBdFUyod10jSqbkHnleQvTe8ahB-B1jbWgWJTYfZXL6vtuEUkKxoldR_0ea-4CVGtMSz8ZX6OThP1rz2RQGWxdn4JendcZhtoh_R8kMpo&sai=AMfl-YQX_JRLvet5zLW91pKBGV0q63Ww3HlfwyuZ1CWSu5a5b0YXkuaTV6K0M2uZhmuOnGeZRCJrFsOM_UhkIl5TCfXYNbU04cEH4LA2f3_AM2klgg1JnAL3H-efqVpJjO_uJ9zI&sig=Cg0ArKJSzLZvCBXKr7ANEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=343&cbvp=1&cstd=340&cisv=r20221108.29177&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.226 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:39 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 09 Nov 2022 03:54:39 GMT

GET
H2 204 imp
analyticspixel.microsoft.com/aid/ Frame 7DD3 0
655 B 69ms
19ms Image
text/plain 204.79.197.204
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://analyticspixel.microsoft.com/aid/imp?dcmadvertiserid=12373846&dcmcampaignid=28813629&dcmadid=542140640&dcmrenderingid=180435978&dcmsiteid=6958819&dcmplacementid=349560458&customer=Microsoft&dv360auctionid=ABAjH0ipoaA63ag0v7ZvSBUVd1hS
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 204.79.197.204 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS: a-0005.a-msedge.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5C5A68F9649144D3950615F5AF926733 Ref B: EWR311000107025 Ref C: 2022-11-09T03:54:39Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 9D19
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPjVBGK0i43HoOghPEBshis&google_cver=1

43 B
1 KB

12ms
12ms

Image
image/gif

68.67.160.114
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPjVBGK0i43HoOghPEBshis&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP-L8QIQ5O66_wMYpvCu1QEwAQ&v=APEucNVZxG5NrEmoJR571vde5lWND2kLo6Bz0I97UuTSXr23H7_6qAm18hsy-K8mHDmSje0SmfWrZWYUQVOzHzRq-7ZoYcU0aw

Protocol

HTTP/1.1

Server

68.67.160.114 Newark, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Nov 2022 03:54:39 GMT
AN-X-Request-Uuid: 164c0e9d-5f37-4d4c-a5a1-1cf853a5bd32
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 5.181.234.158; 5.181.234.158; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPjVBGK0i43HoOghPEBshis&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9D19
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY2NTAzNjg3MDY5MzU3Mzg%3D

170 B
188 B

20ms
20ms

Image
image/png

142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY2NTAzNjg3MDY5MzU3Mzg%3D

Requested by

Protocol

Server

142.250.80.34 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 09 Nov 2022 03:54:39 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 5.181.234.158; 5.181.234.158; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 55b40b73-9a4c-434d-b85a-b7b91c92a692
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY2NTAzNjg3MDY5MzU3Mzg%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 9D19
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEE-t78Sg8hXEMbaFV_jTwU8&google_cver=1

43 B
61 B

32ms
24ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEE-t78Sg8hXEMbaFV_jTwU8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CP-L8QIQ5O66_wMYpvCu1QEwAQ&v=APEucNVZxG5NrEmoJR571vde5lWND2kLo6Bz0I97UuTSXr23H7_6qAm18hsy-K8mHDmSje0SmfWrZWYUQVOzHzRq-7ZoYcU0aw
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEE-t78Sg8hXEMbaFV_jTwU8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9D19
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZGU4MjA5MzgtYzhlNC0yMmExLWM2YjQtZmVlZWUyMThkNmFh

170 B
188 B

22ms
21ms

Image
image/png

142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZGU4MjA5MzgtYzhlNC0yMmExLWM2YjQtZmVlZWUyMThkNmFh

Requested by

Protocol

Server

142.250.80.34 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 09 Nov 2022 03:54:39 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZGU4MjA5MzgtYzhlNC0yMmExLWM2YjQtZmVlZWUyMThkNmFh
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 all.min.js Show response
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/js/ Frame 0B51 1 MB
350 KB 32ms
17ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/js/all.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b8d6285de7d646abfe3ec205fce7e5366c2d28ce254ad9fdcabcf681597aca6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:39 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 18853928
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 357529
last-modified: Wed, 15 Jul 2020 18:15:47 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f0f47d3-120bd8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DUdQVEvL%2B4Tf16S35KN4OLqmb4jjlhbmUx9E7Ve8tjIBvjpqf5OI1dbKk6Gvwj5WiE%2F8G9QEPA%2FiZ5gXF7IGSt9So8s%2FXhRiEHvIallZAWT2%2FGB4VIt0THhFujjlSJ%2B%2BBUEClNLWdtrQZPTBWSqpJCVW"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 76739bbb0bac15b7-EWR
expires: Mon, 30 Oct 2023 03:54:39 GMT

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.8.0/ Frame 0B51 62 KB
22 KB 27ms
13ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.8.0/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a14255e68fc99fc5b4a8b323c13070ac67f42775917706fd3b147b436810a5da

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:39 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 682726
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 22641
last-modified: Wed, 29 Sep 2021 08:04:56 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "61541e28-5871"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GtxmBikjeIIe3Y%2BU0PTL3tFPTnDhOgoonEOH%2FLNjFKwe8RVU%2FfYlsP1jh%2Fgpv3mx7ZSDecQC5bMP2Xa8WaLg1G3WBamEII3%2BDAKFLVZZivyn8F85kicbXK323fIYjDZDpx3%2FkcjP%2BW9LlVq0BQS%2BUd2D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 76739bbb0bae15b7-EWR
expires: Mon, 30 Oct 2023 03:54:39 GMT

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ Frame 0B51 87 KB
28 KB 26ms
12ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:39 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 3081847
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27938
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "603e8adc-15d9d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0lj9zX76eb8CUcZbfot77hCeMAxhkgM4py%2Bmkp2P%2Bek5sJ%2FyuKPVGo%2BOzQhiCQrGMSpWIxWb%2B9gwfBwKNafDjSFvKwEH0L4h5IWBZpKbe46SEow8jMURx1fO2zx52DIPniJSXOLmpG2Y2vIkfbd9yhIt"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 76739bbb0baf15b7-EWR
expires: Mon, 30 Oct 2023 03:54:39 GMT

GET
H3 200 SplitText.min.js Show response
s0.2mdn.net/sadbundle/69658610996852204/js/ Frame 0B51 15 KB
5 KB 7ms
5ms Script
application/x-javascript 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/69658610996852204/js/SplitText.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

51e42f06d6a3da19b5e618e837bab6f288e4b2ee70688243274a8b6dd0d78b8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 05:18:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81377
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5292
x-xss-protection: 0
last-modified: Fri, 21 Oct 2022 21:35:45 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Nov 2023 05:18:22 GMT

GET
H2 200 createjs.min.js Show response
cdn.jsdelivr.net/npm/createjs@1.0.1/builds/1.0.0/ Frame 0B51 235 KB
65 KB 37ms
22ms Script
application/javascript 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/createjs@1.0.1/builds/1.0.0/createjs.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db0740eb17879a7458c8925e207fd80ca8424f80ddcde2cdfbc4f7f5b44eed1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 8556706
x-jsd-version: 1.0.1
content-encoding: br
x-cache: HIT, MISS
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19126-FRA, cache-cdg20741-CDG
x-jsd-version-type: version
server: cloudflare
etag: W/"3ab4e-xn3IgYMtlVnhcxmfPmvYx82Nl6Q"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sQDJYfvxmnx0DULhH7JwXbocIh8HT%2FI5LtMKYrf9AAn3oUxv%2B%2BJDIvIrx0hlpbtpUp1UDLmoX1w54fQcqeRdKLt%2BjoLfRwSLqO20FCBSNOpiWa0cWog4xh%2Fr0HQ7JtieSfpmfhiFUSUhJ1LZGj0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 76739bbb1b101825-EWR

GET
H3 200 Illustration_Free_Trial_Copy_1_728x90.js Show response
s0.2mdn.net/sadbundle/69658610996852204/ Frame 0B51 664 KB
43 KB 8ms
7ms Script
application/x-javascript 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.js?1501171107836

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d020174459b751f2664e92566a7907b09f6b57688ca1270caa9f7b0475304ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 05:18:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81377
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43687
x-xss-protection: 0
last-modified: Fri, 21 Oct 2022 21:35:45 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Nov 2023 05:18:22 GMT

GET
H3 200 main.css
s0.2mdn.net/sadbundle/69658610996852204/css/ Frame 0B51 1 KB
570 B 7ms
7ms Stylesheet
text/css 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/69658610996852204/css/main.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

16d71746bc207282c0951c5d066d228f6faac748098c25de8566ddba99e6c8ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 05:18:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81377
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 541
x-xss-protection: 0
last-modified: Fri, 21 Oct 2022 21:35:45 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Nov 2023 05:18:22 GMT

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/69658610996852204/images/ Frame 0B51 1 KB
676 B 5ms
5ms Image
image/svg+xml 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/69658610996852204/images/logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db69e2b90a062ef5969638a0f9f2eb53e59e2b1e044387190c24f89f54a9e475

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Thu, 03 Nov 2022 18:30:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 465820
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 647
x-xss-protection: 0
last-modified: Fri, 21 Oct 2022 21:35:45 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 03 Nov 2023 18:30:59 GMT

GET
H3 200 init.js Show response
s0.2mdn.net/sadbundle/69658610996852204/js/ Frame 0B51 8 KB
3 KB 6ms
5ms Script
application/x-javascript 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/69658610996852204/js/init.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f8ce9116a9aab5d2ddf8ec69700b407b25918cf056e1df4a78b1033ede7066fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:01:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3204
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2532
x-xss-protection: 0
last-modified: Fri, 21 Oct 2022 21:35:45 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 09 Nov 2023 03:01:15 GMT

GET
H3 200 anim.js Show response
s0.2mdn.net/sadbundle/69658610996852204/ Frame 0B51 851 B
406 B 7ms
6ms Script
application/x-javascript 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/69658610996852204/anim.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28bfde0892ceab81c7d10019c3d9af2c5f15423f52f111a65b187cd7dd3a2e1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 05:18:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81377
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 377
x-xss-protection: 0
last-modified: Fri, 21 Oct 2022 21:35:45 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Nov 2023 05:18:22 GMT

GET
DATA 200
OK truncated
/ Frame 7DD3 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 047239d3265036e2447cb87b7b13c67f7051e49c6d11366d452564ffc70c5f25

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 002F 41 KB
15 KB 5ms
4ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DxMRzHqhoRNv5I8CpqV7NL2lop-uKQ3Ux0e7OZhzb5kxwMSG-x3yjCpNgTtyFHbfrjIfrQFK-M_nnNfHFsUdXh2IG2yyU4d1-ZGTu7ERS5HqnJGtk7CkiHds2dxKVppLycfGFWnbuukAhe6ERvXVOlw_yXCL88Xo03gQTnK8ANLe8YE_w&cry=1&dbm_d=AKAmf-A8OtwC9fia9tr2tQmShpxOkop8uaRuVeXC6KVQhiPvYTX9JdZMHTWpsm0pUVQBOwc1xG7OVyQlOy-JzTOqYQ-SAzpywfVREa62SBqf54-9M5ooQ5EVGl3YkhZJC8pRT1HkF6dYVAbxJ7VAQ71TW4cw7or_eqvmhVpCEUaRO2nZBVjf7ouqQxeNskBTMVmu_wBik8iBwDpfdnX0Fybfl1qt1_UtGQDeEAyu3IxsNcaReyephuqsh0Kb7LomUYJ_2DN869OgYk1jA5tkb3uXGi888Zx2aSE9XJI9_SJvP0iCu4hmaZDVq-g1R9jqvzlKSSz6cc2nAgfU-Fy6vqkjY665AFiXFfG9UPeoAHlJ_LkJbrhZU7FnRi1dz8VCMcN6KWtutuD_B_seUixDePkcgGckNE2kZlix5i8Umam-aNS9RMNRTYu4FGzqOYwERmCh2EUYA5HTTmTnbPqasPb2OlZHfxL14XcRthWEj-iEfxscp-vEmsNGSBnj_xVe4L9Jt-HpgLBT0frRob0djO4fK6WXJif7CPLusPCthXncaSdRNCVHsS0s5_6bE-yxGNjXdby-9qXTlmWBS9XsZmF4ZCO-FL-Od0XZTOj-WWSZZgf5BRf97ZCTsmaImgMwID70t8_NF6Yf2tDmhkoZe3PLmhooFsRqbvsxtFgVZlS2Qsktkq-U4wlo6u-jfPo3lRba569mEk9b8Mi2yUP1Fz38xAMuomV55hGS9o40eqgQxmIDrvVE8vwPrEcD0uLRqanEF-J0ZNrmV8F9Qgr7xH6THty2GJPIP4KodHN7N5XkmMmSJPtTdXdNaBsRoJwAloOlNcjs7ZQuLEb8Fy9leTR1OPB6YoA7jpnx83SPEm7BIDV1QQfk-x7tm5yo1GN7TJ2l7Qslash5uisRu9PaAXTJrByYAPwlHp_ObdBM8hH8nCrtw9CwYH8M-tyiDpnCpHQ0KXs01Syqk03s7KI2pXhH8E_bJBffqJ8z4qvxvsp-hoGpuXjFBaOV4fgzeZDrkimYqrTSg3bRrdm67Jn0isLLhqMj5UVgRAxPVGt_SO7s5GghTk8HHw6hpSPp4d4u0rmx6wILHUq98x0bNO0FNDVjJeYFlCjuJfogIwq-pPZVJ4w2zDAOu65iMo48VlnwqyKWyN-4qp9Hfmkj0ioToqLFpnpWfCRbaWiPtOUd_GT9x_jEaac8Z1KWpZkgoM8QcE_bbAJrq4BrONu5aL5RInKcMsQJdYOJYJGO2kIx2_7417XU65SuwhJdKZhaRSxEcbjJiBLih0H-VsGBUIF1OnpgySS1Mgpll7SN4h_ZqydgZ3WPxQnJYN68HKtgKnD1puIneLJXHXJcjwEJ9C2mosRq_417MnfzBqH2N7cUnNlaf-lpsb3F69AyLDbW-_gdulOG7k5QlYaXIBSIunpxmTTfXZhjcbZmF15MlibzqemrMnBrqByRiT7qPj8wpqadWG2bCeRuv3LeDjtt1tBbcii1IKVQN2b0uKnu9Fr-qYdNhD_V29sa_Xi2OAKQev9nlsDhqNmO6J4UqUnf9DMe92rYR3l7I0Qm7P51NRc7FhfEeMH7nr02AqRZiVV87MA6Jd6TfHilvqGBiTpOdtReOx-825pJ_ZJR_XE2CV2-OTMKNVQJMLNR5LoJwotQ8AFH7Gv5EX7CUo49XQz7wYr6PJBkrKVRaxSotSVXzjPwsPi5ZJIcHvswhDbPeqPBbRUx0DIlx4RTgrhgMbr8G5ZqhPq_I9B7F2TspGLZUu-A-Sqt_PkkiNSyj_whrBiEH80A13al6A2iowpnswIbKp4cEs-Uy2i9ChDjRXbiD2tILObq9aODNJKznvxkpxaH81ZEmZDrHBso6u3z3rUqXlfzN2dUt2Y-lk3sIdutdxDt0tiQ7D-UPSODWMhlEQJIdxWU2AEyLRqYU_fmOFGMAYgl6U9ITeLmVeRt-nXPedFygrbdrco7QzM9lo_Rva8vHfkpD0YlWsiTHKmJoo0JC-2ReJIA0iS5FlxMHq1AXfhCkf3WXRpKLCJTDoCKKLBmr9MluebRgZPcPmgsMFjuVl_tDaRsEv8PtqaeulZbQI2hkBQfaDR4WCiWc65DXSNSy3SHP0u-OFzayZ9iMnDsndoahKFLAoi1XDeN88gD_wkham_4BAoedJ6Ngzax84ozBdEecuRCofEvcNInxZcipER1-BRAU-K-beOGlMkeTaiDvwq9sIqAvK8EAkGkFYmZlNd8_mfA2k0_DDkXl31lZeATkAue_ji1XXOX65UiIBPX2K_9aSD9WJir7H-TOchoXpaHMGs3M8l_1sQ-0KhdMy_ycQfaANhTVzMIS_3QyXW5vhTGS0vMYDEec1AbXejjr2SHUqfdOA-XQM5UBF9XdJXKKiyP9xT0RwKJzmaPHE69DmT14Oyxy1WH46lOCKR_oAQBPKyXbTzljMd9HeqI8jZPznFbK-k0pa2lGmkQwxURKwC43LyY80k5slpUZUNIp8iPUUpwQdWG7H0mClCiuiKe9O4jPE4ddUd8TGb1xRSWNYG0pfgxJOvWObR9oad4jGU8fX-7Zj5y0N9tv0B1tNd958SRGVj4aVHSyIdebggdCr5ZCMFP31G4hym1OlVgYbWi6Q5E1LvsvWySzkPTo9dAsn2cwrFT965FdAhRJTqBrHY_8l6Ny71LYTZhMPTskXiboHfzQp3zSAcII42Vm-fRsA5MR6r_IWD1mgQWZZPPbWrAZ13Bt80rLY0CEO2yx14CMrWE-NXRNDixyJBHLQDT_h03IGQiV_wbrzGRvv7iJrrhRFvUgz5OOM4DWZEy8zsczhBza7CNppl4&cid=CAQSOwDq26N9TqESqqcYjP0U7W-bOpD0CXaINAIuBPjlBvJRvvVIaWl-k7ReF2uFDF-zIYbpiCrNY3T01VpiGAEgEw&rfl=2%2Chttps%253A%252F%252Fmohtawaa.com%252Fhow-might-i-purchase-bitcoin%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 04:43:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83448
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Nov 2023 04:43:51 GMT

GET
H3 200 HZrunHRjvTX5MIeL6Ibl7iJKqMmAAzHWmbkaKM7M3x0.js Show response
pagead2.googlesyndication.com/bg/ Frame 8A8E 36 KB
16 KB 5ms
4ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/HZrunHRjvTX5MIeL6Ibl7iJKqMmAAzHWmbkaKM7M3x0.js

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d9aee9c7463bd35f930878be886e5ee224aa8c9800331d699b91a28ceccdf1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 02:06:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 352072
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16118
x-xss-protection: 0
last-modified: Thu, 20 Oct 2022 10:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 05 Nov 2023 02:06:47 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 72F8 14 KB
11 KB 26ms
26ms XHR
application/json 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221108&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211020101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a34792c880c43ef511cf0b21e627c3baa5d085d55c3d5a2282bbe07c5fd92466

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://almu7asib.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:39 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11094
x-xss-protection: 0

GET
H3

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 002F
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/1194052/66719900/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-DlJqKNDJ8sh1vCV-SIC1ZBku1-czImyCEGNsZ96JY0TlzDJChEG6C...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-DlJqKNDJ8sh1vCV-SIC1ZBku1-czImyCEGNsZ96JY0TlzDJChEG6CWEkeCPURv244-g48LNuLtNoRYA...

51 KB
20 KB

46ms
46ms

Script
text/javascript

172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-DlJqKNDJ8sh1vCV-SIC1ZBku1-czImyCEGNsZ96JY0TlzDJChEG6CWEkeCPURv244-g48LNuLtNoRYAWWBYJ5wdq142T1_ZO2coa5sNVT4t1Kn3hq9pwGaugPYHrptm1dxHSHmjohbwtTvy580bx7qMQxXA15dH6UBd6tXII4I6QZ-9i8S2RMAoCZ_4JhaTZpQSYNQR-_fDyqxd8i6N4gXfadv5yjal4lZYCvtNxswAcWne46LLzasHSwJxDEo4ZgI5GhCdBWYZBhTuzrFNqTp_-Pq9IRoGMD-bH6PFAKAa2nKUBWP2gx9twrbGQ7K040-iuO_5zBdAuzTgNj1i3b5M0H2V9v3qRdMX4NQUxWaI_mlz-GmmjBdN_K28UjmiYRuYSK-c-NDqxAeUxCS__3LUb5cb-ck9Qt6rCx-JkHbO45yhzA7t6JINZfp2OhWOxP60lCcmeC5gpiB02ft678hf6aNUtDEpfHgOnyK4e2xE9td7c6lFXksDMqaRXe8c8c2rI2Ajh7cqnqnU-ztUlFxWWDZB_G9a-HNCeVyS7d8yTslJjI5IZMWvS9EubjbFAIsSQesna7KFzF-yQvD8Qw-vmYrV7LiwRDJ0kdsrhEKleDnR-RhhrLkjGahRS3U-nMBU5xp-KyToPAyyD4172BOMzz4stEqR4kNkOr1qMGrsAIZRgRqBNaihOU21tP_YuoZqHxSjzA0FKuxWiwdISAHQae9FbqpXn26Y5g8n3yL2ksxizxnU_FCz6kckZmD0e9bRkQIZl7AJAxNygJVnP72913_oDzxW82hXNEGK5WkGjopwzq6pCwnXmbq1Kp6zJYVVLdSDG-9rBRL_Njj5bNS0jVNyX_yAnDz722y_ggzLYHbqtclKy60yAcqXURNzMx3aH5vXsMvcc5_P9m-tUQw_Qd3qm1cXQot-p4-53hfbzSR6owDbT0rLDSEJWjF37HnA3CAU79s3EeEsechPHouFRpYzBCcDT1cM_3js3I4fr8gDuz0zj10FUSErQqsPxHeqsgRraVEwkRtXdFOhxX2pAVIzyriZoozVkmAvPld3h04s4w6cFY5wKWLT_Hqcg8mxIMlHI3p-Ee8H0CNDUgF44vYBDez46vsZ5pOsX--7i-Nso-i4JPgW3J2yuvaww8rzF9gQiMuf6xLHwRWl3F9sP7W-d808pKYuCczjn0-cXOoNMLY7pU4opNsW-sEVCJJxr55sBUDhIgCURA2o_LxeOYy2eEoUVEVzCH61XNNKBTDk8NHsO_LP7dIWuE_ZBSozrgHNjmaLopY2Oe48JcP_FQRorQyMEIryFpmpk-7h3I1wHCKFTZLq76WUZbjMbe2WWKn1BSLOLKxiiNygzG9XfV104s0RylnyoFaHefiJtHgrVudMSUTFRv5WJjr31p2fPYkAroRJMAqkwkeCp6a7QHIhuaJEfabnZkb0MpWfK4pHX6GNGaTgCBMJPoMPejXszRHHhY3eN_VfifuFEPVrhGO2v9KQsyvikB__oYBI2LWuabkKfkStsZBldfbW4rkN4xN5YRJViYqKY5PuDXTYxRYNfP50Da5OV1zF0Vbf2pe9zCjOBf9MQzVzriq95AvxjIp89hvpXzzWh7wOjgf6swy2s5dZ4YCZJ3EdNBH1VLhSnqbJSAO5vYyUZeuKCGDR1Rse9-U1D66yxIsgIonhk-Vb4YjRi5hc1FB9jRNaGeeUBPm5cnJPfdTYs2c7CZhLfc5c24heHvy_T4sKF9ia_eaMwgc3zZSVSSbQRYS6izhSYba8OJd38qXX8tv-c5opup5NZMP4koDROFF28w9TnR2Oqn7jEOJZQBftNnSbU3QBJqon8ZqzidU5rPVK3NIzXbghF9w6PsUt4hIS4Lv8Ip00PkSk4OSO8zaf4QJcuyWAQrmjS1m_qKb12VNquA8dDycxjIT4aKnFULko-_EqrCO-w7a9nmhV6CB0CMCKJBS8kPnY-nI4-Uwa3qH_KBQy4vADq6fuHo3G3mnoqT-7-Qox9HSYopX7MF-_4jMz-znrKaVHnPFbTePohsYf89ma4CHgZyfrgYtOT5nJY1CH_eQUIu0aSmgT30eKHuTrKz4NBywWdyJp3t9C9UXs-NwpDulRDWzEfDnsvbPTILCnRA0qwtclUpm2TSgy-n6W8ISVK4I1P-yKDuhsd0Knlc-gdtN1G-W4Hp0-Xs0QIPce4BdU-NiN8QOvQKZ-nkLK_uzS4Ig4rf3hYetTObWhos5aJdRR-LsxWfw0LaNAbAEM5Uc0gcvgqjaYOfbM2eq0JxBhQZzZQBqm4-nuqznvWSBDoPdOsS0CAqtYnKG1RfNvUkfyTxnSp4q-GMf_NYlxtwVox_LXZzOFAAQpqOlgJKOVMaPk74COqehcADb8Ib5O2DrcQrVmvtJ8BeArG3X12ERS3rJLnIXTbeSSE2Na-VMt1NYhbs4RA-8hmBwQi5_A7SCAEcrTuN0gTyE7WKTfPU22Sojhu-ds86enEMPuSPwZMhQdPTE5eF9MnvrqeMqQbMZUsv5FU_u1OJYMzTyzu3d6me6wcQQXVcP7ikIBcEYeHCV5ZS7HNKTVomoNJRKCoZ_Dvly7T9WIibR-siS01vcEDdjgviEQ6EEh0W2eF63QrQnZHozB8U2XvTmrKIRICqPJfeOXlkzpOrX1VQaPYpTaAUJGLsyY06O5r4AqYad3Pk-YWZw-J_uYIozaQO9OTAFEnkBBx5GuSuggev7RWl6cJ4sktkgVEn9pl8r1xztmzYnbWxut01_DuSQJtI471VLRjm2uQaBY7r7irDGN-iuYPENQP8cfae-E5Z_yGLJTpAeeb1XD52xiMEAi3IfCgVSjTIxfGlmiH1jOE9YtSH3mvoq6myf3FjeMwInF_SdZTBvKrBRsPxfH7BZYLFf-5IBBnkiwoYF0eiXqQ4yhUDYy8U0qFuTCRO5iNMHnVLh-BVsIS9kA2Gji2jVEiHfswvRYXYMZcJV0zK3ReD9N1bYQ2gU0GCTydwE3-fhZXZYj2DkGPINydZ9uvbyApwPPfTrxLshbzLfLak3oIZPHnY95rv_CfZeuEXGiL1KB00edmo-qsMmrMvvmepTvBA9GYwivVESf8x8GCblK8IkkkiHmSO3COTDrmT7FCKAQzqDxuyvf_3wbbY1jB4q95GzjSGF6BQBuJubWDW3qNiKGN5njD4UDuhAg4BSdeM6XDviJg7L60pv8f-6FLucQfQrrx3IgQlX13Hg8tjAl3QMiR39wuk84G8wH9TBXJgS-HwMSmOHbrG6DaQyHOil-nwtYTqV5x6o5_-t28B3Wfo73_FxRaLwh0TTWRyn0z5ndLswpinVHhqaoieNv99gP2bb8CsFyXzwFW3AXuE6eGj8iAB4saW3l7o8lqDtJl95A4fdPmoaj_shjocxt7trcqCozUiKq1nkXAW11wxzAYtyjHgSjvdAWCK5Zf_JYjCyTWJ4h31UhFHo8oWcJEfaqZiTQ6LSynmosDjWXAqYAHmI6W4PhwEG87m6H9OpjxCBhV77xOqOi9G87NTJpu_tLpMNGkMIBBI7AOrbo31OoRKqpxiM_RTtb5s6kPQJdog0Ai4E-OUG8lG-9UhpaX6TtF4Xa4UMX7MhhumIKs1jdPTVWmIYASATYAE&cry=1

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

29a3a66d2902005e553b6f2446474a43f8f644cf9969255aaaa3c19c9cfe24f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20761
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: nginx
x-server-name: app08.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-DlJqKNDJ8sh1vCV-SIC1ZBku1-czImyCEGNsZ96JY0TlzDJChEG6CWEkeCPURv244-g48LNuLtNoRYAWWBYJ5wdq142T1_ZO2coa5sNVT4t1Kn3hq9pwGaugPYHrptm1dxHSHmjohbwtTvy580bx7qMQxXA15dH6UBd6tXII4I6QZ-9i8S2RMAoCZ_4JhaTZpQSYNQR-_fDyqxd8i6N4gXfadv5yjal4lZYCvtNxswAcWne46LLzasHSwJxDEo4ZgI5GhCdBWYZBhTuzrFNqTp_-Pq9IRoGMD-bH6PFAKAa2nKUBWP2gx9twrbGQ7K040-iuO_5zBdAuzTgNj1i3b5M0H2V9v3qRdMX4NQUxWaI_mlz-GmmjBdN_K28UjmiYRuYSK-c-NDqxAeUxCS__3LUb5cb-ck9Qt6rCx-JkHbO45yhzA7t6JINZfp2OhWOxP60lCcmeC5gpiB02ft678hf6aNUtDEpfHgOnyK4e2xE9td7c6lFXksDMqaRXe8c8c2rI2Ajh7cqnqnU-ztUlFxWWDZB_G9a-HNCeVyS7d8yTslJjI5IZMWvS9EubjbFAIsSQesna7KFzF-yQvD8Qw-vmYrV7LiwRDJ0kdsrhEKleDnR-RhhrLkjGahRS3U-nMBU5xp-KyToPAyyD4172BOMzz4stEqR4kNkOr1qMGrsAIZRgRqBNaihOU21tP_YuoZqHxSjzA0FKuxWiwdISAHQae9FbqpXn26Y5g8n3yL2ksxizxnU_FCz6kckZmD0e9bRkQIZl7AJAxNygJVnP72913_oDzxW82hXNEGK5WkGjopwzq6pCwnXmbq1Kp6zJYVVLdSDG-9rBRL_Njj5bNS0jVNyX_yAnDz722y_ggzLYHbqtclKy60yAcqXURNzMx3aH5vXsMvcc5_P9m-tUQw_Qd3qm1cXQot-p4-53hfbzSR6owDbT0rLDSEJWjF37HnA3CAU79s3EeEsechPHouFRpYzBCcDT1cM_3js3I4fr8gDuz0zj10FUSErQqsPxHeqsgRraVEwkRtXdFOhxX2pAVIzyriZoozVkmAvPld3h04s4w6cFY5wKWLT_Hqcg8mxIMlHI3p-Ee8H0CNDUgF44vYBDez46vsZ5pOsX--7i-Nso-i4JPgW3J2yuvaww8rzF9gQiMuf6xLHwRWl3F9sP7W-d808pKYuCczjn0-cXOoNMLY7pU4opNsW-sEVCJJxr55sBUDhIgCURA2o_LxeOYy2eEoUVEVzCH61XNNKBTDk8NHsO_LP7dIWuE_ZBSozrgHNjmaLopY2Oe48JcP_FQRorQyMEIryFpmpk-7h3I1wHCKFTZLq76WUZbjMbe2WWKn1BSLOLKxiiNygzG9XfV104s0RylnyoFaHefiJtHgrVudMSUTFRv5WJjr31p2fPYkAroRJMAqkwkeCp6a7QHIhuaJEfabnZkb0MpWfK4pHX6GNGaTgCBMJPoMPejXszRHHhY3eN_VfifuFEPVrhGO2v9KQsyvikB__oYBI2LWuabkKfkStsZBldfbW4rkN4xN5YRJViYqKY5PuDXTYxRYNfP50Da5OV1zF0Vbf2pe9zCjOBf9MQzVzriq95AvxjIp89hvpXzzWh7wOjgf6swy2s5dZ4YCZJ3EdNBH1VLhSnqbJSAO5vYyUZeuKCGDR1Rse9-U1D66yxIsgIonhk-Vb4YjRi5hc1FB9jRNaGeeUBPm5cnJPfdTYs2c7CZhLfc5c24heHvy_T4sKF9ia_eaMwgc3zZSVSSbQRYS6izhSYba8OJd38qXX8tv-c5opup5NZMP4koDROFF28w9TnR2Oqn7jEOJZQBftNnSbU3QBJqon8ZqzidU5rPVK3NIzXbghF9w6PsUt4hIS4Lv8Ip00PkSk4OSO8zaf4QJcuyWAQrmjS1m_qKb12VNquA8dDycxjIT4aKnFULko-_EqrCO-w7a9nmhV6CB0CMCKJBS8kPnY-nI4-Uwa3qH_KBQy4vADq6fuHo3G3mnoqT-7-Qox9HSYopX7MF-_4jMz-znrKaVHnPFbTePohsYf89ma4CHgZyfrgYtOT5nJY1CH_eQUIu0aSmgT30eKHuTrKz4NBywWdyJp3t9C9UXs-NwpDulRDWzEfDnsvbPTILCnRA0qwtclUpm2TSgy-n6W8ISVK4I1P-yKDuhsd0Knlc-gdtN1G-W4Hp0-Xs0QIPce4BdU-NiN8QOvQKZ-nkLK_uzS4Ig4rf3hYetTObWhos5aJdRR-LsxWfw0LaNAbAEM5Uc0gcvgqjaYOfbM2eq0JxBhQZzZQBqm4-nuqznvWSBDoPdOsS0CAqtYnKG1RfNvUkfyTxnSp4q-GMf_NYlxtwVox_LXZzOFAAQpqOlgJKOVMaPk74COqehcADb8Ib5O2DrcQrVmvtJ8BeArG3X12ERS3rJLnIXTbeSSE2Na-VMt1NYhbs4RA-8hmBwQi5_A7SCAEcrTuN0gTyE7WKTfPU22Sojhu-ds86enEMPuSPwZMhQdPTE5eF9MnvrqeMqQbMZUsv5FU_u1OJYMzTyzu3d6me6wcQQXVcP7ikIBcEYeHCV5ZS7HNKTVomoNJRKCoZ_Dvly7T9WIibR-siS01vcEDdjgviEQ6EEh0W2eF63QrQnZHozB8U2XvTmrKIRICqPJfeOXlkzpOrX1VQaPYpTaAUJGLsyY06O5r4AqYad3Pk-YWZw-J_uYIozaQO9OTAFEnkBBx5GuSuggev7RWl6cJ4sktkgVEn9pl8r1xztmzYnbWxut01_DuSQJtI471VLRjm2uQaBY7r7irDGN-iuYPENQP8cfae-E5Z_yGLJTpAeeb1XD52xiMEAi3IfCgVSjTIxfGlmiH1jOE9YtSH3mvoq6myf3FjeMwInF_SdZTBvKrBRsPxfH7BZYLFf-5IBBnkiwoYF0eiXqQ4yhUDYy8U0qFuTCRO5iNMHnVLh-BVsIS9kA2Gji2jVEiHfswvRYXYMZcJV0zK3ReD9N1bYQ2gU0GCTydwE3-fhZXZYj2DkGPINydZ9uvbyApwPPfTrxLshbzLfLak3oIZPHnY95rv_CfZeuEXGiL1KB00edmo-qsMmrMvvmepTvBA9GYwivVESf8x8GCblK8IkkkiHmSO3COTDrmT7FCKAQzqDxuyvf_3wbbY1jB4q95GzjSGF6BQBuJubWDW3qNiKGN5njD4UDuhAg4BSdeM6XDviJg7L60pv8f-6FLucQfQrrx3IgQlX13Hg8tjAl3QMiR39wuk84G8wH9TBXJgS-HwMSmOHbrG6DaQyHOil-nwtYTqV5x6o5_-t28B3Wfo73_FxRaLwh0TTWRyn0z5ndLswpinVHhqaoieNv99gP2bb8CsFyXzwFW3AXuE6eGj8iAB4saW3l7o8lqDtJl95A4fdPmoaj_shjocxt7trcqCozUiKq1nkXAW11wxzAYtyjHgSjvdAWCK5Zf_JYjCyTWJ4h31UhFHo8oWcJEfaqZiTQ6LSynmosDjWXAqYAHmI6W4PhwEG87m6H9OpjxCBhV77xOqOi9G87NTJpu_tLpMNGkMIBBI7AOrbo31OoRKqpxiM_RTtb5s6kPQJdog0Ai4E-OUG8lG-9UhpaX6TtF4Xa4UMX7MhhumIKs1jdPTVWmIYASATYAE&cry=1
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 5E8E 91 KB
23 KB 13ms
11ms Script
application/javascript 2600:9000:2105:c00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2105:c00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 19:25:35 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 db82ddc02f317cd7d03bb2c60ec7cd58.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-C3
age: 4264145
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: f5KVmn6hN-GbCl9S68r9tztMAmRUyJHV6VVtjp6W_KZR5D0c9JR5_A==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 002F 43 B
215 B 86ms
85ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1194052&asId=ea14f601-d191-89b7-744f-1074cf34d553&tv=%7Bc:trh3NP,pingTime:-3,time:95,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:22%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:95,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:22,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B90~0%5D,as:%5B90~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tmETGyq+11%7C12%7C131%7C132%7C133%7C134%7C1411%7C1412%7C14131%7C1511%7C1512%7C15131%7C161%7C162%7C1631%7C164%7C1711%7C181*.1194052-66719900%7C1811,idMap:181*,rmeas:1,rend:0,renddet:IMG.us,siq:24%7D&br=c
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: nginx
x-server-name: dt12.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 72F8 17 KB
6 KB 32ms
32ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211020101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://almu7asib.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 09 Nov 2022 03:54:39 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 002F 43 B
215 B 85ms
85ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1194052&asId=ea14f601-d191-89b7-744f-1074cf34d553&tv=%7Bc:trh3NT,pingTime:-6,time:99,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:99,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:22,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B93~0%5D,as:%5B93~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tmETGyq+11%7C12%7C131%7C132%7C133%7C134%7C1411%7C1412%7C14131%7C1511%7C1512%7C15131%7C161%7C162%7C1631%7C164%7C1711%7C181*.1194052-66719900%7C1811,idMap:181*,rmeas:1,rend:0,renddet:IMG.us,siq:24%7D&tpiLookup=ao:mohtawaa.com*%2C7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com*&br=c
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: nginx
x-server-name: dt04.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame A632 22 KB
8 KB 5ms
4ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 83448
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 08 Nov 2022 04:43:51 GMT
expires: Wed, 08 Nov 2023 04:43:51 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 002F 43 B
215 B 86ms
85ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1194052&asId=ea14f601-d191-89b7-744f-1074cf34d553&tv=%7Bc:trh3PJ,pingTime:-2,time:213,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:362,beZ:363,mfA:365,cmA:366,inA:366,inZ:370,prA:370,prZ:378,si:385,poA:387,poZ:411,cmZ:411,mfZ:411,loA:460,loZ:464,ltA:575,ltZ:575%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:22%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:213,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:22,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B208~0%5D,as:%5B208~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tmETGdq+11%7C12%7C131%7C132%7C133%7C134%7C1411%7C1412%7C14131%7C151.1194052-66719900%7C1511%7C1512%7C15131%7C161.1194052-66719900%7C162%7C1631%7C164%7C17.1224441-66655758%7C1711%7C181*.1194052-66719900%7C1811,idMap:181*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:IMG.us,siq:24,sinceFw:188,readyFired:false%7D&br=c
Requested by: Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: nginx
x-server-name: dt21.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 11490417459626673180
s0.2mdn.net/simgad/ Frame 002F 21 KB
21 KB 6ms
5ms Image
image/jpeg 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/11490417459626673180

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1194052/66719900/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-DlJqKNDJ8sh1vCV-SIC1ZBku1-czImyCEGNsZ96JY0TlzDJChEG6CWEkeCPURv244-g48LNuLtNoRYAWWBYJ5wdq142T1_ZO2coa5sNVT4t1Kn3hq9pwGaugPYHrptm1dxHSHmjohbwtTvy580bx7qMQxXA15dH6UBd6tXII4I6QZ-9i8S2RMAoCZ_4JhaTZpQSYNQR-_fDyqxd8i6N4gXfadv5yjal4lZYCvtNxswAcWne46LLzasHSwJxDEo4ZgI5GhCdBWYZBhTuzrFNqTp_-Pq9IRoGMD-bH6PFAKAa2nKUBWP2gx9twrbGQ7K040-iuO_5zBdAuzTgNj1i3b5M0H2V9v3qRdMX4NQUxWaI_mlz-GmmjBdN_K28UjmiYRuYSK-c-NDqxAeUxCS__3LUb5cb-ck9Qt6rCx-JkHbO45yhzA7t6JINZfp2OhWOxP60lCcmeC5gpiB02ft678hf6aNUtDEpfHgOnyK4e2xE9td7c6lFXksDMqaRXe8c8c2rI2Ajh7cqnqnU-ztUlFxWWDZB_G9a-HNCeVyS7d8yTslJjI5IZMWvS9EubjbFAIsSQesna7KFzF-yQvD8Qw-vmYrV7LiwRDJ0kdsrhEKleDnR-RhhrLkjGahRS3U-nMBU5xp-KyToPAyyD4172BOMzz4stEqR4kNkOr1qMGrsAIZRgRqBNaihOU21tP_YuoZqHxSjzA0FKuxWiwdISAHQae9FbqpXn26Y5g8n3yL2ksxizxnU_FCz6kckZmD0e9bRkQIZl7AJAxNygJVnP72913_oDzxW82hXNEGK5WkGjopwzq6pCwnXmbq1Kp6zJYVVLdSDG-9rBRL_Njj5bNS0jVNyX_yAnDz722y_ggzLYHbqtclKy60yAcqXURNzMx3aH5vXsMvcc5_P9m-tUQw_Qd3qm1cXQot-p4-53hfbzSR6owDbT0rLDSEJWjF37HnA3CAU79s3EeEsechPHouFRpYzBCcDT1cM_3js3I4fr8gDuz0zj10FUSErQqsPxHeqsgRraVEwkRtXdFOhxX2pAVIzyriZoozVkmAvPld3h04s4w6cFY5wKWLT_Hqcg8mxIMlHI3p-Ee8H0CNDUgF44vYBDez46vsZ5pOsX--7i-Nso-i4JPgW3J2yuvaww8rzF9gQiMuf6xLHwRWl3F9sP7W-d808pKYuCczjn0-cXOoNMLY7pU4opNsW-sEVCJJxr55sBUDhIgCURA2o_LxeOYy2eEoUVEVzCH61XNNKBTDk8NHsO_LP7dIWuE_ZBSozrgHNjmaLopY2Oe48JcP_FQRorQyMEIryFpmpk-7h3I1wHCKFTZLq76WUZbjMbe2WWKn1BSLOLKxiiNygzG9XfV104s0RylnyoFaHefiJtHgrVudMSUTFRv5WJjr31p2fPYkAroRJMAqkwkeCp6a7QHIhuaJEfabnZkb0MpWfK4pHX6GNGaTgCBMJPoMPejXszRHHhY3eN_VfifuFEPVrhGO2v9KQsyvikB__oYBI2LWuabkKfkStsZBldfbW4rkN4xN5YRJViYqKY5PuDXTYxRYNfP50Da5OV1zF0Vbf2pe9zCjOBf9MQzVzriq95AvxjIp89hvpXzzWh7wOjgf6swy2s5dZ4YCZJ3EdNBH1VLhSnqbJSAO5vYyUZeuKCGDR1Rse9-U1D66yxIsgIonhk-Vb4YjRi5hc1FB9jRNaGeeUBPm5cnJPfdTYs2c7CZhLfc5c24heHvy_T4sKF9ia_eaMwgc3zZSVSSbQRYS6izhSYba8OJd38qXX8tv-c5opup5NZMP4koDROFF28w9TnR2Oqn7jEOJZQBftNnSbU3QBJqon8ZqzidU5rPVK3NIzXbghF9w6PsUt4hIS4Lv8Ip00PkSk4OSO8zaf4QJcuyWAQrmjS1m_qKb12VNquA8dDycxjIT4aKnFULko-_EqrCO-w7a9nmhV6CB0CMCKJBS8kPnY-nI4-Uwa3qH_KBQy4vADq6fuHo3G3mnoqT-7-Qox9HSYopX7MF-_4jMz-znrKaVHnPFbTePohsYf89ma4CHgZyfrgYtOT5nJY1CH_eQUIu0aSmgT30eKHuTrKz4NBywWdyJp3t9C9UXs-NwpDulRDWzEfDnsvbPTILCnRA0qwtclUpm2TSgy-n6W8ISVK4I1P-yKDuhsd0Knlc-gdtN1G-W4Hp0-Xs0QIPce4BdU-NiN8QOvQKZ-nkLK_uzS4Ig4rf3hYetTObWhos5aJdRR-LsxWfw0LaNAbAEM5Uc0gcvgqjaYOfbM2eq0JxBhQZzZQBqm4-nuqznvWSBDoPdOsS0CAqtYnKG1RfNvUkfyTxnSp4q-GMf_NYlxtwVox_LXZzOFAAQpqOlgJKOVMaPk74COqehcADb8Ib5O2DrcQrVmvtJ8BeArG3X12ERS3rJLnIXTbeSSE2Na-VMt1NYhbs4RA-8hmBwQi5_A7SCAEcrTuN0gTyE7WKTfPU22Sojhu-ds86enEMPuSPwZMhQdPTE5eF9MnvrqeMqQbMZUsv5FU_u1OJYMzTyzu3d6me6wcQQXVcP7ikIBcEYeHCV5ZS7HNKTVomoNJRKCoZ_Dvly7T9WIibR-siS01vcEDdjgviEQ6EEh0W2eF63QrQnZHozB8U2XvTmrKIRICqPJfeOXlkzpOrX1VQaPYpTaAUJGLsyY06O5r4AqYad3Pk-YWZw-J_uYIozaQO9OTAFEnkBBx5GuSuggev7RWl6cJ4sktkgVEn9pl8r1xztmzYnbWxut01_DuSQJtI471VLRjm2uQaBY7r7irDGN-iuYPENQP8cfae-E5Z_yGLJTpAeeb1XD52xiMEAi3IfCgVSjTIxfGlmiH1jOE9YtSH3mvoq6myf3FjeMwInF_SdZTBvKrBRsPxfH7BZYLFf-5IBBnkiwoYF0eiXqQ4yhUDYy8U0qFuTCRO5iNMHnVLh-BVsIS9kA2Gji2jVEiHfswvRYXYMZcJV0zK3ReD9N1bYQ2gU0GCTydwE3-fhZXZYj2DkGPINydZ9uvbyApwPPfTrxLshbzLfLak3oIZPHnY95rv_CfZeuEXGiL1KB00edmo-qsMmrMvvmepTvBA9GYwivVESf8x8GCblK8IkkkiHmSO3COTDrmT7FCKAQzqDxuyvf_3wbbY1jB4q95GzjSGF6BQBuJubWDW3qNiKGN5njD4UDuhAg4BSdeM6XDviJg7L60pv8f-6FLucQfQrrx3IgQlX13Hg8tjAl3QMiR39wuk84G8wH9TBXJgS-HwMSmOHbrG6DaQyHOil-nwtYTqV5x6o5_-t28B3Wfo73_FxRaLwh0TTWRyn0z5ndLswpinVHhqaoieNv99gP2bb8CsFyXzwFW3AXuE6eGj8iAB4saW3l7o8lqDtJl95A4fdPmoaj_shjocxt7trcqCozUiKq1nkXAW11wxzAYtyjHgSjvdAWCK5Zf_JYjCyTWJ4h31UhFHo8oWcJEfaqZiTQ6LSynmosDjWXAqYAHmI6W4PhwEG87m6H9OpjxCBhV77xOqOi9G87NTJpu_tLpMNGkMIBBI7AOrbo31OoRKqpxiM_RTtb5s6kPQJdog0Ai4E-OUG8lG-9UhpaX6TtF4Xa4UMX7MhhumIKs1jdPTVWmIYASATYAE&cry=1&adsafe_url=https%3A%2F%2Fmohtawaa.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fmohtawaa.com%2Fhow-might-i-purchase-bitcoin%2F&adsafe_type=c&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-39%2Fhtml%2Fcontainer.html&adsafe_type=bed&adsafe_jsinfo=,id:ea14f601-d191-89b7-744f-1074cf34d553,c:trh3ME,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-75cd96f6cf-82qxq,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tmETGyq+11%7C12%7C131%7C132%7C133%7C134%7C1411%7C1412%7C14131%7C1511%7C1512%7C15131%7C161%7C162%7C1631%7C164%7C1711%7C181*.1194052-66719900%7C1811,idMap:181*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:23,oid:3bd86bd2-5fe2-11ed-9cf2-127244b4e0ab,v:19.8.360,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1dbf39e32568470be782dd27be072e15e6ede45351e4f90fac04558baa4cf3b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Fri, 04 Nov 2022 02:07:54 GMT
x-content-type-options: nosniff
age: 438405
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21836
x-xss-protection: 0
last-modified: Fri, 30 Sep 2022 19:58:35 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 04 Nov 2023 02:07:54 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221108/r20110914/ Frame 002F 29 KB
11 KB 13ms
12ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221108/r20110914/abg_lite.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1194052/66719900/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-DlJqKNDJ8sh1vCV-SIC1ZBku1-czImyCEGNsZ96JY0TlzDJChEG6CWEkeCPURv244-g48LNuLtNoRYAWWBYJ5wdq142T1_ZO2coa5sNVT4t1Kn3hq9pwGaugPYHrptm1dxHSHmjohbwtTvy580bx7qMQxXA15dH6UBd6tXII4I6QZ-9i8S2RMAoCZ_4JhaTZpQSYNQR-_fDyqxd8i6N4gXfadv5yjal4lZYCvtNxswAcWne46LLzasHSwJxDEo4ZgI5GhCdBWYZBhTuzrFNqTp_-Pq9IRoGMD-bH6PFAKAa2nKUBWP2gx9twrbGQ7K040-iuO_5zBdAuzTgNj1i3b5M0H2V9v3qRdMX4NQUxWaI_mlz-GmmjBdN_K28UjmiYRuYSK-c-NDqxAeUxCS__3LUb5cb-ck9Qt6rCx-JkHbO45yhzA7t6JINZfp2OhWOxP60lCcmeC5gpiB02ft678hf6aNUtDEpfHgOnyK4e2xE9td7c6lFXksDMqaRXe8c8c2rI2Ajh7cqnqnU-ztUlFxWWDZB_G9a-HNCeVyS7d8yTslJjI5IZMWvS9EubjbFAIsSQesna7KFzF-yQvD8Qw-vmYrV7LiwRDJ0kdsrhEKleDnR-RhhrLkjGahRS3U-nMBU5xp-KyToPAyyD4172BOMzz4stEqR4kNkOr1qMGrsAIZRgRqBNaihOU21tP_YuoZqHxSjzA0FKuxWiwdISAHQae9FbqpXn26Y5g8n3yL2ksxizxnU_FCz6kckZmD0e9bRkQIZl7AJAxNygJVnP72913_oDzxW82hXNEGK5WkGjopwzq6pCwnXmbq1Kp6zJYVVLdSDG-9rBRL_Njj5bNS0jVNyX_yAnDz722y_ggzLYHbqtclKy60yAcqXURNzMx3aH5vXsMvcc5_P9m-tUQw_Qd3qm1cXQot-p4-53hfbzSR6owDbT0rLDSEJWjF37HnA3CAU79s3EeEsechPHouFRpYzBCcDT1cM_3js3I4fr8gDuz0zj10FUSErQqsPxHeqsgRraVEwkRtXdFOhxX2pAVIzyriZoozVkmAvPld3h04s4w6cFY5wKWLT_Hqcg8mxIMlHI3p-Ee8H0CNDUgF44vYBDez46vsZ5pOsX--7i-Nso-i4JPgW3J2yuvaww8rzF9gQiMuf6xLHwRWl3F9sP7W-d808pKYuCczjn0-cXOoNMLY7pU4opNsW-sEVCJJxr55sBUDhIgCURA2o_LxeOYy2eEoUVEVzCH61XNNKBTDk8NHsO_LP7dIWuE_ZBSozrgHNjmaLopY2Oe48JcP_FQRorQyMEIryFpmpk-7h3I1wHCKFTZLq76WUZbjMbe2WWKn1BSLOLKxiiNygzG9XfV104s0RylnyoFaHefiJtHgrVudMSUTFRv5WJjr31p2fPYkAroRJMAqkwkeCp6a7QHIhuaJEfabnZkb0MpWfK4pHX6GNGaTgCBMJPoMPejXszRHHhY3eN_VfifuFEPVrhGO2v9KQsyvikB__oYBI2LWuabkKfkStsZBldfbW4rkN4xN5YRJViYqKY5PuDXTYxRYNfP50Da5OV1zF0Vbf2pe9zCjOBf9MQzVzriq95AvxjIp89hvpXzzWh7wOjgf6swy2s5dZ4YCZJ3EdNBH1VLhSnqbJSAO5vYyUZeuKCGDR1Rse9-U1D66yxIsgIonhk-Vb4YjRi5hc1FB9jRNaGeeUBPm5cnJPfdTYs2c7CZhLfc5c24heHvy_T4sKF9ia_eaMwgc3zZSVSSbQRYS6izhSYba8OJd38qXX8tv-c5opup5NZMP4koDROFF28w9TnR2Oqn7jEOJZQBftNnSbU3QBJqon8ZqzidU5rPVK3NIzXbghF9w6PsUt4hIS4Lv8Ip00PkSk4OSO8zaf4QJcuyWAQrmjS1m_qKb12VNquA8dDycxjIT4aKnFULko-_EqrCO-w7a9nmhV6CB0CMCKJBS8kPnY-nI4-Uwa3qH_KBQy4vADq6fuHo3G3mnoqT-7-Qox9HSYopX7MF-_4jMz-znrKaVHnPFbTePohsYf89ma4CHgZyfrgYtOT5nJY1CH_eQUIu0aSmgT30eKHuTrKz4NBywWdyJp3t9C9UXs-NwpDulRDWzEfDnsvbPTILCnRA0qwtclUpm2TSgy-n6W8ISVK4I1P-yKDuhsd0Knlc-gdtN1G-W4Hp0-Xs0QIPce4BdU-NiN8QOvQKZ-nkLK_uzS4Ig4rf3hYetTObWhos5aJdRR-LsxWfw0LaNAbAEM5Uc0gcvgqjaYOfbM2eq0JxBhQZzZQBqm4-nuqznvWSBDoPdOsS0CAqtYnKG1RfNvUkfyTxnSp4q-GMf_NYlxtwVox_LXZzOFAAQpqOlgJKOVMaPk74COqehcADb8Ib5O2DrcQrVmvtJ8BeArG3X12ERS3rJLnIXTbeSSE2Na-VMt1NYhbs4RA-8hmBwQi5_A7SCAEcrTuN0gTyE7WKTfPU22Sojhu-ds86enEMPuSPwZMhQdPTE5eF9MnvrqeMqQbMZUsv5FU_u1OJYMzTyzu3d6me6wcQQXVcP7ikIBcEYeHCV5ZS7HNKTVomoNJRKCoZ_Dvly7T9WIibR-siS01vcEDdjgviEQ6EEh0W2eF63QrQnZHozB8U2XvTmrKIRICqPJfeOXlkzpOrX1VQaPYpTaAUJGLsyY06O5r4AqYad3Pk-YWZw-J_uYIozaQO9OTAFEnkBBx5GuSuggev7RWl6cJ4sktkgVEn9pl8r1xztmzYnbWxut01_DuSQJtI471VLRjm2uQaBY7r7irDGN-iuYPENQP8cfae-E5Z_yGLJTpAeeb1XD52xiMEAi3IfCgVSjTIxfGlmiH1jOE9YtSH3mvoq6myf3FjeMwInF_SdZTBvKrBRsPxfH7BZYLFf-5IBBnkiwoYF0eiXqQ4yhUDYy8U0qFuTCRO5iNMHnVLh-BVsIS9kA2Gji2jVEiHfswvRYXYMZcJV0zK3ReD9N1bYQ2gU0GCTydwE3-fhZXZYj2DkGPINydZ9uvbyApwPPfTrxLshbzLfLak3oIZPHnY95rv_CfZeuEXGiL1KB00edmo-qsMmrMvvmepTvBA9GYwivVESf8x8GCblK8IkkkiHmSO3COTDrmT7FCKAQzqDxuyvf_3wbbY1jB4q95GzjSGF6BQBuJubWDW3qNiKGN5njD4UDuhAg4BSdeM6XDviJg7L60pv8f-6FLucQfQrrx3IgQlX13Hg8tjAl3QMiR39wuk84G8wH9TBXJgS-HwMSmOHbrG6DaQyHOil-nwtYTqV5x6o5_-t28B3Wfo73_FxRaLwh0TTWRyn0z5ndLswpinVHhqaoieNv99gP2bb8CsFyXzwFW3AXuE6eGj8iAB4saW3l7o8lqDtJl95A4fdPmoaj_shjocxt7trcqCozUiKq1nkXAW11wxzAYtyjHgSjvdAWCK5Zf_JYjCyTWJ4h31UhFHo8oWcJEfaqZiTQ6LSynmosDjWXAqYAHmI6W4PhwEG87m6H9OpjxCBhV77xOqOi9G87NTJpu_tLpMNGkMIBBI7AOrbo31OoRKqpxiM_RTtb5s6kPQJdog0Ai4E-OUG8lG-9UhpaX6TtF4Xa4UMX7MhhumIKs1jdPTVWmIYASATYAE&cry=1&adsafe_url=https%3A%2F%2Fmohtawaa.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fmohtawaa.com%2Fhow-might-i-purchase-bitcoin%2F&adsafe_type=c&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-39%2Fhtml%2Fcontainer.html&adsafe_type=bed&adsafe_jsinfo=,id:ea14f601-d191-89b7-744f-1074cf34d553,c:trh3ME,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-75cd96f6cf-82qxq,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tmETGyq+11%7C12%7C131%7C132%7C133%7C134%7C1411%7C1412%7C14131%7C1511%7C1512%7C15131%7C161%7C162%7C1631%7C164%7C1711%7C181*.1194052-66719900%7C1811,idMap:181*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:23,oid:3bd86bd2-5fe2-11ed-9cf2-127244b4e0ab,v:19.8.360,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddd61ecebf36941bd6d1aa20ca07868d826fd9eb6f3a5e660e0afbb703ae6793

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:57:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35845
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11141
x-xss-protection: 0
server: cafe
etag: 7611781198975194673
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:57:14 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221108/r20110914/elements/html/ Frame 002F 8 KB
3 KB 15ms
13ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221108/r20110914/elements/html/omrhp.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1194052/66719900/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-DlJqKNDJ8sh1vCV-SIC1ZBku1-czImyCEGNsZ96JY0TlzDJChEG6CWEkeCPURv244-g48LNuLtNoRYAWWBYJ5wdq142T1_ZO2coa5sNVT4t1Kn3hq9pwGaugPYHrptm1dxHSHmjohbwtTvy580bx7qMQxXA15dH6UBd6tXII4I6QZ-9i8S2RMAoCZ_4JhaTZpQSYNQR-_fDyqxd8i6N4gXfadv5yjal4lZYCvtNxswAcWne46LLzasHSwJxDEo4ZgI5GhCdBWYZBhTuzrFNqTp_-Pq9IRoGMD-bH6PFAKAa2nKUBWP2gx9twrbGQ7K040-iuO_5zBdAuzTgNj1i3b5M0H2V9v3qRdMX4NQUxWaI_mlz-GmmjBdN_K28UjmiYRuYSK-c-NDqxAeUxCS__3LUb5cb-ck9Qt6rCx-JkHbO45yhzA7t6JINZfp2OhWOxP60lCcmeC5gpiB02ft678hf6aNUtDEpfHgOnyK4e2xE9td7c6lFXksDMqaRXe8c8c2rI2Ajh7cqnqnU-ztUlFxWWDZB_G9a-HNCeVyS7d8yTslJjI5IZMWvS9EubjbFAIsSQesna7KFzF-yQvD8Qw-vmYrV7LiwRDJ0kdsrhEKleDnR-RhhrLkjGahRS3U-nMBU5xp-KyToPAyyD4172BOMzz4stEqR4kNkOr1qMGrsAIZRgRqBNaihOU21tP_YuoZqHxSjzA0FKuxWiwdISAHQae9FbqpXn26Y5g8n3yL2ksxizxnU_FCz6kckZmD0e9bRkQIZl7AJAxNygJVnP72913_oDzxW82hXNEGK5WkGjopwzq6pCwnXmbq1Kp6zJYVVLdSDG-9rBRL_Njj5bNS0jVNyX_yAnDz722y_ggzLYHbqtclKy60yAcqXURNzMx3aH5vXsMvcc5_P9m-tUQw_Qd3qm1cXQot-p4-53hfbzSR6owDbT0rLDSEJWjF37HnA3CAU79s3EeEsechPHouFRpYzBCcDT1cM_3js3I4fr8gDuz0zj10FUSErQqsPxHeqsgRraVEwkRtXdFOhxX2pAVIzyriZoozVkmAvPld3h04s4w6cFY5wKWLT_Hqcg8mxIMlHI3p-Ee8H0CNDUgF44vYBDez46vsZ5pOsX--7i-Nso-i4JPgW3J2yuvaww8rzF9gQiMuf6xLHwRWl3F9sP7W-d808pKYuCczjn0-cXOoNMLY7pU4opNsW-sEVCJJxr55sBUDhIgCURA2o_LxeOYy2eEoUVEVzCH61XNNKBTDk8NHsO_LP7dIWuE_ZBSozrgHNjmaLopY2Oe48JcP_FQRorQyMEIryFpmpk-7h3I1wHCKFTZLq76WUZbjMbe2WWKn1BSLOLKxiiNygzG9XfV104s0RylnyoFaHefiJtHgrVudMSUTFRv5WJjr31p2fPYkAroRJMAqkwkeCp6a7QHIhuaJEfabnZkb0MpWfK4pHX6GNGaTgCBMJPoMPejXszRHHhY3eN_VfifuFEPVrhGO2v9KQsyvikB__oYBI2LWuabkKfkStsZBldfbW4rkN4xN5YRJViYqKY5PuDXTYxRYNfP50Da5OV1zF0Vbf2pe9zCjOBf9MQzVzriq95AvxjIp89hvpXzzWh7wOjgf6swy2s5dZ4YCZJ3EdNBH1VLhSnqbJSAO5vYyUZeuKCGDR1Rse9-U1D66yxIsgIonhk-Vb4YjRi5hc1FB9jRNaGeeUBPm5cnJPfdTYs2c7CZhLfc5c24heHvy_T4sKF9ia_eaMwgc3zZSVSSbQRYS6izhSYba8OJd38qXX8tv-c5opup5NZMP4koDROFF28w9TnR2Oqn7jEOJZQBftNnSbU3QBJqon8ZqzidU5rPVK3NIzXbghF9w6PsUt4hIS4Lv8Ip00PkSk4OSO8zaf4QJcuyWAQrmjS1m_qKb12VNquA8dDycxjIT4aKnFULko-_EqrCO-w7a9nmhV6CB0CMCKJBS8kPnY-nI4-Uwa3qH_KBQy4vADq6fuHo3G3mnoqT-7-Qox9HSYopX7MF-_4jMz-znrKaVHnPFbTePohsYf89ma4CHgZyfrgYtOT5nJY1CH_eQUIu0aSmgT30eKHuTrKz4NBywWdyJp3t9C9UXs-NwpDulRDWzEfDnsvbPTILCnRA0qwtclUpm2TSgy-n6W8ISVK4I1P-yKDuhsd0Knlc-gdtN1G-W4Hp0-Xs0QIPce4BdU-NiN8QOvQKZ-nkLK_uzS4Ig4rf3hYetTObWhos5aJdRR-LsxWfw0LaNAbAEM5Uc0gcvgqjaYOfbM2eq0JxBhQZzZQBqm4-nuqznvWSBDoPdOsS0CAqtYnKG1RfNvUkfyTxnSp4q-GMf_NYlxtwVox_LXZzOFAAQpqOlgJKOVMaPk74COqehcADb8Ib5O2DrcQrVmvtJ8BeArG3X12ERS3rJLnIXTbeSSE2Na-VMt1NYhbs4RA-8hmBwQi5_A7SCAEcrTuN0gTyE7WKTfPU22Sojhu-ds86enEMPuSPwZMhQdPTE5eF9MnvrqeMqQbMZUsv5FU_u1OJYMzTyzu3d6me6wcQQXVcP7ikIBcEYeHCV5ZS7HNKTVomoNJRKCoZ_Dvly7T9WIibR-siS01vcEDdjgviEQ6EEh0W2eF63QrQnZHozB8U2XvTmrKIRICqPJfeOXlkzpOrX1VQaPYpTaAUJGLsyY06O5r4AqYad3Pk-YWZw-J_uYIozaQO9OTAFEnkBBx5GuSuggev7RWl6cJ4sktkgVEn9pl8r1xztmzYnbWxut01_DuSQJtI471VLRjm2uQaBY7r7irDGN-iuYPENQP8cfae-E5Z_yGLJTpAeeb1XD52xiMEAi3IfCgVSjTIxfGlmiH1jOE9YtSH3mvoq6myf3FjeMwInF_SdZTBvKrBRsPxfH7BZYLFf-5IBBnkiwoYF0eiXqQ4yhUDYy8U0qFuTCRO5iNMHnVLh-BVsIS9kA2Gji2jVEiHfswvRYXYMZcJV0zK3ReD9N1bYQ2gU0GCTydwE3-fhZXZYj2DkGPINydZ9uvbyApwPPfTrxLshbzLfLak3oIZPHnY95rv_CfZeuEXGiL1KB00edmo-qsMmrMvvmepTvBA9GYwivVESf8x8GCblK8IkkkiHmSO3COTDrmT7FCKAQzqDxuyvf_3wbbY1jB4q95GzjSGF6BQBuJubWDW3qNiKGN5njD4UDuhAg4BSdeM6XDviJg7L60pv8f-6FLucQfQrrx3IgQlX13Hg8tjAl3QMiR39wuk84G8wH9TBXJgS-HwMSmOHbrG6DaQyHOil-nwtYTqV5x6o5_-t28B3Wfo73_FxRaLwh0TTWRyn0z5ndLswpinVHhqaoieNv99gP2bb8CsFyXzwFW3AXuE6eGj8iAB4saW3l7o8lqDtJl95A4fdPmoaj_shjocxt7trcqCozUiKq1nkXAW11wxzAYtyjHgSjvdAWCK5Zf_JYjCyTWJ4h31UhFHo8oWcJEfaqZiTQ6LSynmosDjWXAqYAHmI6W4PhwEG87m6H9OpjxCBhV77xOqOi9G87NTJpu_tLpMNGkMIBBI7AOrbo31OoRKqpxiM_RTtb5s6kPQJdog0Ai4E-OUG8lG-9UhpaX6TtF4Xa4UMX7MhhumIKs1jdPTVWmIYASATYAE&cry=1&adsafe_url=https%3A%2F%2Fmohtawaa.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fmohtawaa.com%2Fhow-might-i-purchase-bitcoin%2F&adsafe_type=c&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-39%2Fhtml%2Fcontainer.html&adsafe_type=bed&adsafe_jsinfo=,id:ea14f601-d191-89b7-744f-1074cf34d553,c:trh3ME,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-75cd96f6cf-82qxq,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tmETGyq+11%7C12%7C131%7C132%7C133%7C134%7C1411%7C1412%7C14131%7C1511%7C1512%7C15131%7C161%7C162%7C1631%7C164%7C1711%7C181*.1194052-66719900%7C1811,idMap:181*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:23,oid:3bd86bd2-5fe2-11ed-9cf2-127244b4e0ab,v:19.8.360,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 17:57:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35845
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 17:57:14 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 002F 0
0 29ms
28ms Fetch
image/gif 142.250.65.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss1F4XhGViItRd_KBh2x_rTPrI-sU5LEguB9WzI5kYyeuxkj-CHr43St1CFtLYnd8pj6TONsxf0h3YAori6zswPD5uAGastUNSzSWUleYBuLYS5-DC6Haq3Mv9TkahaswKEtT9OkGCJdvvH968Q_T4MCvVaaEmyo-nPHM4&sai=AMfl-YT2h-7QWoDYHwgUT5xTsjhoPx7RKxQe69UZ-rkPK1EqXQ9iJqmhD-sVNeiauzbau0aVTvNMDYin0UoldfCOWAKaKEKJRaRE-ShKjSunAHyj9Uy-BN6FdsIt_mDJ63ua&sig=Cg0ArKJSzO9sRBTJBjHREAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20221108.47084&arae=0&ftch=1&adurl=

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1194052/66719900/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-DlJqKNDJ8sh1vCV-SIC1ZBku1-czImyCEGNsZ96JY0TlzDJChEG6CWEkeCPURv244-g48LNuLtNoRYAWWBYJ5wdq142T1_ZO2coa5sNVT4t1Kn3hq9pwGaugPYHrptm1dxHSHmjohbwtTvy580bx7qMQxXA15dH6UBd6tXII4I6QZ-9i8S2RMAoCZ_4JhaTZpQSYNQR-_fDyqxd8i6N4gXfadv5yjal4lZYCvtNxswAcWne46LLzasHSwJxDEo4ZgI5GhCdBWYZBhTuzrFNqTp_-Pq9IRoGMD-bH6PFAKAa2nKUBWP2gx9twrbGQ7K040-iuO_5zBdAuzTgNj1i3b5M0H2V9v3qRdMX4NQUxWaI_mlz-GmmjBdN_K28UjmiYRuYSK-c-NDqxAeUxCS__3LUb5cb-ck9Qt6rCx-JkHbO45yhzA7t6JINZfp2OhWOxP60lCcmeC5gpiB02ft678hf6aNUtDEpfHgOnyK4e2xE9td7c6lFXksDMqaRXe8c8c2rI2Ajh7cqnqnU-ztUlFxWWDZB_G9a-HNCeVyS7d8yTslJjI5IZMWvS9EubjbFAIsSQesna7KFzF-yQvD8Qw-vmYrV7LiwRDJ0kdsrhEKleDnR-RhhrLkjGahRS3U-nMBU5xp-KyToPAyyD4172BOMzz4stEqR4kNkOr1qMGrsAIZRgRqBNaihOU21tP_YuoZqHxSjzA0FKuxWiwdISAHQae9FbqpXn26Y5g8n3yL2ksxizxnU_FCz6kckZmD0e9bRkQIZl7AJAxNygJVnP72913_oDzxW82hXNEGK5WkGjopwzq6pCwnXmbq1Kp6zJYVVLdSDG-9rBRL_Njj5bNS0jVNyX_yAnDz722y_ggzLYHbqtclKy60yAcqXURNzMx3aH5vXsMvcc5_P9m-tUQw_Qd3qm1cXQot-p4-53hfbzSR6owDbT0rLDSEJWjF37HnA3CAU79s3EeEsechPHouFRpYzBCcDT1cM_3js3I4fr8gDuz0zj10FUSErQqsPxHeqsgRraVEwkRtXdFOhxX2pAVIzyriZoozVkmAvPld3h04s4w6cFY5wKWLT_Hqcg8mxIMlHI3p-Ee8H0CNDUgF44vYBDez46vsZ5pOsX--7i-Nso-i4JPgW3J2yuvaww8rzF9gQiMuf6xLHwRWl3F9sP7W-d808pKYuCczjn0-cXOoNMLY7pU4opNsW-sEVCJJxr55sBUDhIgCURA2o_LxeOYy2eEoUVEVzCH61XNNKBTDk8NHsO_LP7dIWuE_ZBSozrgHNjmaLopY2Oe48JcP_FQRorQyMEIryFpmpk-7h3I1wHCKFTZLq76WUZbjMbe2WWKn1BSLOLKxiiNygzG9XfV104s0RylnyoFaHefiJtHgrVudMSUTFRv5WJjr31p2fPYkAroRJMAqkwkeCp6a7QHIhuaJEfabnZkb0MpWfK4pHX6GNGaTgCBMJPoMPejXszRHHhY3eN_VfifuFEPVrhGO2v9KQsyvikB__oYBI2LWuabkKfkStsZBldfbW4rkN4xN5YRJViYqKY5PuDXTYxRYNfP50Da5OV1zF0Vbf2pe9zCjOBf9MQzVzriq95AvxjIp89hvpXzzWh7wOjgf6swy2s5dZ4YCZJ3EdNBH1VLhSnqbJSAO5vYyUZeuKCGDR1Rse9-U1D66yxIsgIonhk-Vb4YjRi5hc1FB9jRNaGeeUBPm5cnJPfdTYs2c7CZhLfc5c24heHvy_T4sKF9ia_eaMwgc3zZSVSSbQRYS6izhSYba8OJd38qXX8tv-c5opup5NZMP4koDROFF28w9TnR2Oqn7jEOJZQBftNnSbU3QBJqon8ZqzidU5rPVK3NIzXbghF9w6PsUt4hIS4Lv8Ip00PkSk4OSO8zaf4QJcuyWAQrmjS1m_qKb12VNquA8dDycxjIT4aKnFULko-_EqrCO-w7a9nmhV6CB0CMCKJBS8kPnY-nI4-Uwa3qH_KBQy4vADq6fuHo3G3mnoqT-7-Qox9HSYopX7MF-_4jMz-znrKaVHnPFbTePohsYf89ma4CHgZyfrgYtOT5nJY1CH_eQUIu0aSmgT30eKHuTrKz4NBywWdyJp3t9C9UXs-NwpDulRDWzEfDnsvbPTILCnRA0qwtclUpm2TSgy-n6W8ISVK4I1P-yKDuhsd0Knlc-gdtN1G-W4Hp0-Xs0QIPce4BdU-NiN8QOvQKZ-nkLK_uzS4Ig4rf3hYetTObWhos5aJdRR-LsxWfw0LaNAbAEM5Uc0gcvgqjaYOfbM2eq0JxBhQZzZQBqm4-nuqznvWSBDoPdOsS0CAqtYnKG1RfNvUkfyTxnSp4q-GMf_NYlxtwVox_LXZzOFAAQpqOlgJKOVMaPk74COqehcADb8Ib5O2DrcQrVmvtJ8BeArG3X12ERS3rJLnIXTbeSSE2Na-VMt1NYhbs4RA-8hmBwQi5_A7SCAEcrTuN0gTyE7WKTfPU22Sojhu-ds86enEMPuSPwZMhQdPTE5eF9MnvrqeMqQbMZUsv5FU_u1OJYMzTyzu3d6me6wcQQXVcP7ikIBcEYeHCV5ZS7HNKTVomoNJRKCoZ_Dvly7T9WIibR-siS01vcEDdjgviEQ6EEh0W2eF63QrQnZHozB8U2XvTmrKIRICqPJfeOXlkzpOrX1VQaPYpTaAUJGLsyY06O5r4AqYad3Pk-YWZw-J_uYIozaQO9OTAFEnkBBx5GuSuggev7RWl6cJ4sktkgVEn9pl8r1xztmzYnbWxut01_DuSQJtI471VLRjm2uQaBY7r7irDGN-iuYPENQP8cfae-E5Z_yGLJTpAeeb1XD52xiMEAi3IfCgVSjTIxfGlmiH1jOE9YtSH3mvoq6myf3FjeMwInF_SdZTBvKrBRsPxfH7BZYLFf-5IBBnkiwoYF0eiXqQ4yhUDYy8U0qFuTCRO5iNMHnVLh-BVsIS9kA2Gji2jVEiHfswvRYXYMZcJV0zK3ReD9N1bYQ2gU0GCTydwE3-fhZXZYj2DkGPINydZ9uvbyApwPPfTrxLshbzLfLak3oIZPHnY95rv_CfZeuEXGiL1KB00edmo-qsMmrMvvmepTvBA9GYwivVESf8x8GCblK8IkkkiHmSO3COTDrmT7FCKAQzqDxuyvf_3wbbY1jB4q95GzjSGF6BQBuJubWDW3qNiKGN5njD4UDuhAg4BSdeM6XDviJg7L60pv8f-6FLucQfQrrx3IgQlX13Hg8tjAl3QMiR39wuk84G8wH9TBXJgS-HwMSmOHbrG6DaQyHOil-nwtYTqV5x6o5_-t28B3Wfo73_FxRaLwh0TTWRyn0z5ndLswpinVHhqaoieNv99gP2bb8CsFyXzwFW3AXuE6eGj8iAB4saW3l7o8lqDtJl95A4fdPmoaj_shjocxt7trcqCozUiKq1nkXAW11wxzAYtyjHgSjvdAWCK5Zf_JYjCyTWJ4h31UhFHo8oWcJEfaqZiTQ6LSynmosDjWXAqYAHmI6W4PhwEG87m6H9OpjxCBhV77xOqOi9G87NTJpu_tLpMNGkMIBBI7AOrbo31OoRKqpxiM_RTtb5s6kPQJdog0Ai4E-OUG8lG-9UhpaX6TtF4Xa4UMX7MhhumIKs1jdPTVWmIYASATYAE&cry=1&adsafe_url=https%3A%2F%2Fmohtawaa.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fmohtawaa.com%2Fhow-might-i-purchase-bitcoin%2F&adsafe_type=c&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-39%2Fhtml%2Fcontainer.html&adsafe_type=bed&adsafe_jsinfo=,id:ea14f601-d191-89b7-744f-1074cf34d553,c:trh3ME,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-75cd96f6cf-82qxq,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tmETGyq+11%7C12%7C131%7C132%7C133%7C134%7C1411%7C1412%7C14131%7C1511%7C1512%7C15131%7C161%7C162%7C1631%7C164%7C1711%7C181*.1194052-66719900%7C1811,idMap:181*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:23,oid:3bd86bd2-5fe2-11ed-9cf2-127244b4e0ab,v:19.8.360,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.226 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:39 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 09 Nov 2022 03:54:39 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame B5AC 13 KB
5 KB 9ms
4ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://almu7asib.blogspot.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 37115
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 08 Nov 2022 17:36:04 GMT
expires: Wed, 08 Nov 2023 17:36:04 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 8D48 783 B
535 B 28ms
25ms Document
text/html 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

597870fbf4ff1ac2e979cca7396e44411f4ac9671dd51970bab6b1561b1a7dd7

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-cfCRCQTKiel3D5kM243PfQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://almu7asib.blogspot.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-cfCRCQTKiel3D5kM243PfQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 03:54:39 GMT
expires: Wed, 09 Nov 2022 03:54:39 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 Alliance_ExtraBold.woff
s0.2mdn.net/sadbundle/69658610996852204/fonts/ Frame 0B51 34 KB
34 KB 13ms
9ms Font
font/woff 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/69658610996852204/fonts/Alliance_ExtraBold.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

724b767bd22af3734817328ce04a759e3bb30f9e95cf2899c831557009d56378

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 19:11:08 GMT
x-content-type-options: nosniff
age: 31411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34512
x-xss-protection: 0
last-modified: Fri, 21 Oct 2022 21:35:45 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Nov 2023 19:11:08 GMT

GET
H3 200 Alliance_Regular.woff
s0.2mdn.net/sadbundle/69658610996852204/fonts/ Frame 0B51 33 KB
33 KB 11ms
9ms Font
font/woff 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/69658610996852204/fonts/Alliance_Regular.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a14db92aa8be7649e77385cdc58fc869dd1ff8fd00f37b2ac02c1a2e200a8f94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html
Origin: https://s0.2mdn.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 05:18:22 GMT
x-content-type-options: nosniff
age: 81377
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33396
x-xss-protection: 0
last-modified: Fri, 21 Oct 2022 21:35:45 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Nov 2023 05:18:22 GMT

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame A632 36 KB
16 KB 5ms
5ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Fri, 04 Nov 2022 19:56:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 374310
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Nov 2023 19:56:09 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 002F 0
0 28ms
28ms Fetch
image/gif 142.250.65.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss1F4XhGViItRd_KBh2x_rTPrI-sU5LEguB9WzI5kYyeuxkj-CHr43St1CFtLYnd8pj6TONsxf0h3YAori6zswPD5uAGastUNSzSWUleYBuLYS5-DC6Haq3Mv9TkahaswKEtT9OkGCJdvvH968Q_T4MCvVaaEmyo-nPHM4&sai=AMfl-YT2h-7QWoDYHwgUT5xTsjhoPx7RKxQe69UZ-rkPK1EqXQ9iJqmhD-sVNeiauzbau0aVTvNMDYin0UoldfCOWAKaKEKJRaRE-ShKjSunAHyj9Uy-BN6FdsIt_mDJ63ua&sig=Cg0ArKJSzO9sRBTJBjHREAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=56&vt=11&dtpt=55&dett=2&cstd=0&cisv=r20221108.47084&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1194052/66719900/xbbe/creative/adj?p=APEucNXTyEvO5-rOZkhPTGAzr1lpVwX_6pUzjHTr2A2axn5rijaOxzw&d=CokBAKAmf-DlJqKNDJ8sh1vCV-SIC1ZBku1-czImyCEGNsZ96JY0TlzDJChEG6CWEkeCPURv244-g48LNuLtNoRYAWWBYJ5wdq142T1_ZO2coa5sNVT4t1Kn3hq9pwGaugPYHrptm1dxHSHmjohbwtTvy580bx7qMQxXA15dH6UBd6tXII4I6QZ-9i8S2RMAoCZ_4JhaTZpQSYNQR-_fDyqxd8i6N4gXfadv5yjal4lZYCvtNxswAcWne46LLzasHSwJxDEo4ZgI5GhCdBWYZBhTuzrFNqTp_-Pq9IRoGMD-bH6PFAKAa2nKUBWP2gx9twrbGQ7K040-iuO_5zBdAuzTgNj1i3b5M0H2V9v3qRdMX4NQUxWaI_mlz-GmmjBdN_K28UjmiYRuYSK-c-NDqxAeUxCS__3LUb5cb-ck9Qt6rCx-JkHbO45yhzA7t6JINZfp2OhWOxP60lCcmeC5gpiB02ft678hf6aNUtDEpfHgOnyK4e2xE9td7c6lFXksDMqaRXe8c8c2rI2Ajh7cqnqnU-ztUlFxWWDZB_G9a-HNCeVyS7d8yTslJjI5IZMWvS9EubjbFAIsSQesna7KFzF-yQvD8Qw-vmYrV7LiwRDJ0kdsrhEKleDnR-RhhrLkjGahRS3U-nMBU5xp-KyToPAyyD4172BOMzz4stEqR4kNkOr1qMGrsAIZRgRqBNaihOU21tP_YuoZqHxSjzA0FKuxWiwdISAHQae9FbqpXn26Y5g8n3yL2ksxizxnU_FCz6kckZmD0e9bRkQIZl7AJAxNygJVnP72913_oDzxW82hXNEGK5WkGjopwzq6pCwnXmbq1Kp6zJYVVLdSDG-9rBRL_Njj5bNS0jVNyX_yAnDz722y_ggzLYHbqtclKy60yAcqXURNzMx3aH5vXsMvcc5_P9m-tUQw_Qd3qm1cXQot-p4-53hfbzSR6owDbT0rLDSEJWjF37HnA3CAU79s3EeEsechPHouFRpYzBCcDT1cM_3js3I4fr8gDuz0zj10FUSErQqsPxHeqsgRraVEwkRtXdFOhxX2pAVIzyriZoozVkmAvPld3h04s4w6cFY5wKWLT_Hqcg8mxIMlHI3p-Ee8H0CNDUgF44vYBDez46vsZ5pOsX--7i-Nso-i4JPgW3J2yuvaww8rzF9gQiMuf6xLHwRWl3F9sP7W-d808pKYuCczjn0-cXOoNMLY7pU4opNsW-sEVCJJxr55sBUDhIgCURA2o_LxeOYy2eEoUVEVzCH61XNNKBTDk8NHsO_LP7dIWuE_ZBSozrgHNjmaLopY2Oe48JcP_FQRorQyMEIryFpmpk-7h3I1wHCKFTZLq76WUZbjMbe2WWKn1BSLOLKxiiNygzG9XfV104s0RylnyoFaHefiJtHgrVudMSUTFRv5WJjr31p2fPYkAroRJMAqkwkeCp6a7QHIhuaJEfabnZkb0MpWfK4pHX6GNGaTgCBMJPoMPejXszRHHhY3eN_VfifuFEPVrhGO2v9KQsyvikB__oYBI2LWuabkKfkStsZBldfbW4rkN4xN5YRJViYqKY5PuDXTYxRYNfP50Da5OV1zF0Vbf2pe9zCjOBf9MQzVzriq95AvxjIp89hvpXzzWh7wOjgf6swy2s5dZ4YCZJ3EdNBH1VLhSnqbJSAO5vYyUZeuKCGDR1Rse9-U1D66yxIsgIonhk-Vb4YjRi5hc1FB9jRNaGeeUBPm5cnJPfdTYs2c7CZhLfc5c24heHvy_T4sKF9ia_eaMwgc3zZSVSSbQRYS6izhSYba8OJd38qXX8tv-c5opup5NZMP4koDROFF28w9TnR2Oqn7jEOJZQBftNnSbU3QBJqon8ZqzidU5rPVK3NIzXbghF9w6PsUt4hIS4Lv8Ip00PkSk4OSO8zaf4QJcuyWAQrmjS1m_qKb12VNquA8dDycxjIT4aKnFULko-_EqrCO-w7a9nmhV6CB0CMCKJBS8kPnY-nI4-Uwa3qH_KBQy4vADq6fuHo3G3mnoqT-7-Qox9HSYopX7MF-_4jMz-znrKaVHnPFbTePohsYf89ma4CHgZyfrgYtOT5nJY1CH_eQUIu0aSmgT30eKHuTrKz4NBywWdyJp3t9C9UXs-NwpDulRDWzEfDnsvbPTILCnRA0qwtclUpm2TSgy-n6W8ISVK4I1P-yKDuhsd0Knlc-gdtN1G-W4Hp0-Xs0QIPce4BdU-NiN8QOvQKZ-nkLK_uzS4Ig4rf3hYetTObWhos5aJdRR-LsxWfw0LaNAbAEM5Uc0gcvgqjaYOfbM2eq0JxBhQZzZQBqm4-nuqznvWSBDoPdOsS0CAqtYnKG1RfNvUkfyTxnSp4q-GMf_NYlxtwVox_LXZzOFAAQpqOlgJKOVMaPk74COqehcADb8Ib5O2DrcQrVmvtJ8BeArG3X12ERS3rJLnIXTbeSSE2Na-VMt1NYhbs4RA-8hmBwQi5_A7SCAEcrTuN0gTyE7WKTfPU22Sojhu-ds86enEMPuSPwZMhQdPTE5eF9MnvrqeMqQbMZUsv5FU_u1OJYMzTyzu3d6me6wcQQXVcP7ikIBcEYeHCV5ZS7HNKTVomoNJRKCoZ_Dvly7T9WIibR-siS01vcEDdjgviEQ6EEh0W2eF63QrQnZHozB8U2XvTmrKIRICqPJfeOXlkzpOrX1VQaPYpTaAUJGLsyY06O5r4AqYad3Pk-YWZw-J_uYIozaQO9OTAFEnkBBx5GuSuggev7RWl6cJ4sktkgVEn9pl8r1xztmzYnbWxut01_DuSQJtI471VLRjm2uQaBY7r7irDGN-iuYPENQP8cfae-E5Z_yGLJTpAeeb1XD52xiMEAi3IfCgVSjTIxfGlmiH1jOE9YtSH3mvoq6myf3FjeMwInF_SdZTBvKrBRsPxfH7BZYLFf-5IBBnkiwoYF0eiXqQ4yhUDYy8U0qFuTCRO5iNMHnVLh-BVsIS9kA2Gji2jVEiHfswvRYXYMZcJV0zK3ReD9N1bYQ2gU0GCTydwE3-fhZXZYj2DkGPINydZ9uvbyApwPPfTrxLshbzLfLak3oIZPHnY95rv_CfZeuEXGiL1KB00edmo-qsMmrMvvmepTvBA9GYwivVESf8x8GCblK8IkkkiHmSO3COTDrmT7FCKAQzqDxuyvf_3wbbY1jB4q95GzjSGF6BQBuJubWDW3qNiKGN5njD4UDuhAg4BSdeM6XDviJg7L60pv8f-6FLucQfQrrx3IgQlX13Hg8tjAl3QMiR39wuk84G8wH9TBXJgS-HwMSmOHbrG6DaQyHOil-nwtYTqV5x6o5_-t28B3Wfo73_FxRaLwh0TTWRyn0z5ndLswpinVHhqaoieNv99gP2bb8CsFyXzwFW3AXuE6eGj8iAB4saW3l7o8lqDtJl95A4fdPmoaj_shjocxt7trcqCozUiKq1nkXAW11wxzAYtyjHgSjvdAWCK5Zf_JYjCyTWJ4h31UhFHo8oWcJEfaqZiTQ6LSynmosDjWXAqYAHmI6W4PhwEG87m6H9OpjxCBhV77xOqOi9G87NTJpu_tLpMNGkMIBBI7AOrbo31OoRKqpxiM_RTtb5s6kPQJdog0Ai4E-OUG8lG-9UhpaX6TtF4Xa4UMX7MhhumIKs1jdPTVWmIYASATYAE&cry=1&adsafe_url=https%3A%2F%2Fmohtawaa.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fmohtawaa.com%2Fhow-might-i-purchase-bitcoin%2F&adsafe_type=c&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-39%2Fhtml%2Fcontainer.html&adsafe_type=bed&adsafe_jsinfo=,id:ea14f601-d191-89b7-744f-1074cf34d553,c:trh3ME,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-75cd96f6cf-82qxq,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tmETGyq+11%7C12%7C131%7C132%7C133%7C134%7C1411%7C1412%7C14131%7C1511%7C1512%7C15131%7C161%7C162%7C1631%7C164%7C1711%7C181*.1194052-66719900%7C1811,idMap:181*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:23,oid:3bd86bd2-5fe2-11ed-9cf2-127244b4e0ab,v:19.8.360,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.226 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:39 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 09 Nov 2022 03:54:39 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4787 1 KB
643 B 8ms
4ms Document
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 75491
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 08 Nov 2022 06:56:28 GMT
etag: 48472445140208031
expires: Wed, 09 Nov 2022 06:56:28 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 002F 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f316d78e07f806a7b346392922651e6ad9daf898cb8c3378f32b740290bfbf2

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 70AC 43 B
215 B 86ms
85ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1194052&asId=1bf87a7f-2f53-806b-c13c-aeadc9381d19&tv=%7Bc:trh3SR,pingTime:1,time:1709,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:20%7D,%7Bpiv:100,vs:i,r:,t:654%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1056,o:653,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B647~0%5D,as:%5B647~728.90%5D%7D%7D,%7Bsl:i,t:653,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1055~100%5D,as:%5B1055~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:301,fm:tmETGdq+11%7C12%7C13%7C14%7C151.1194052-66719900%7C1511%7C161*.1194052-66719900%7C1611%7C17.1224441-66655758%7C181.1194052-66719900,idMap:161*,rmeas:1,rend:1,renddet:IMG.qs,siq:22,sis:472%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: nginx
x-server-name: dt21.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 70AC 43 B
215 B 87ms
86ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1194052&asId=1bf87a7f-2f53-806b-c13c-aeadc9381d19&tv=%7Bc:trh3SR,pingTime:1,time:1709,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:20%7D,%7Bpiv:100,vs:i,r:,t:654%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1056,o:653,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B647~0%5D,as:%5B647~728.90%5D%7D%7D,%7Bsl:i,t:653,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1055~100%5D,as:%5B1055~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:301,fm:tmETGdq+11%7C12%7C13%7C14%7C151.1194052-66719900%7C1511%7C161*.1194052-66719900%7C1611%7C17.1224441-66655758%7C181.1194052-66719900,idMap:161*,rmeas:1,rend:1,renddet:IMG.qs,siq:22,sis:472%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: nginx
x-server-name: dt08.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 70AC 42 B
64 B 25ms
25ms Fetch
image/gif 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstqy1OSy8Zg7IIwC6gXFh48eVWFc9Gwq6YLYzI409KlPl-HG1sw2SZNrLCceXxGHoSK6AqMr5yogR-GWiEMcbLqtTZkgMM2wMTUYx5KB1QGtEAxqugUXqrVkBkmMMO7Ru1vTdmM&sai=AMfl-YTpDG91F92glFblmoPpycog8ZyM2kf5nZMmXXaDBFQkc90fFcw7wfNeX4Wf5Q19h5uRT_fnc_e9d1GhEel5OnCLw6cABpw2mhCoPURzOB13EQ-niwZeBQeqQfAA0RbERY8&sig=Cg0ArKJSzMlliAVt2vaVEAE&cid=CAQSPwDq26N9fc7f7MQyvzc_OYSzU9G3jX13yDxDh0nukl592-kXnleEzs9kRBxPWnfgmeShoGYK1yajbCQlQL_PDBgBIBM&id=lidar2&mcvt=1058&p=553,400,643,1128&mtos=1058,1058,1058,1058,1058&tos=1058,0,0,0,0&v=20221107&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3864893977&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1667966077852&rpt=794&isd=0&lsd=0&met=mue&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 66B8 0
20 B 30ms
28ms Image
image/gif 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BFvC4fSRrY8HEN6mboPMP2OukqAoAAAAAOAHgBAI&bg=!e3ileDzNAAbvMpMzzzI7ACkAdvg8WvU2HJ5J2Gn9KFz_NzD6GW8sHJRb4zcp8l8pv-7qJDXHOqU_bgIAAAMOUgAAAANoAQeZAzHR_HDZrnzBYQOJrXwetBfrtLt-ZSmv_HcvGcOrxc5Bfh2qC9q3GxJi5f1U6pY9IiE4823-UIFy0KkzEo8tG8RrUVOaLB14jCIS97oKGlof5fx2VfeSshJltPJeejlM_eipLNZwuni49TbK1jtUU5AUfB4wUHMEvrm4SAzDGiQBNpZnE5tnu1lOIFE8ZuPWyoC3UP_YZhDHaRGKEDgaBNvofaRHfHUURDzUvBP4rcnkow2vQG9QA6hN-XiaInj9a84Lu2mG5YDh5mZP-Fz5Di5yJgT2Ihhr8ACEVQqMai3wHuFVyy5HijYShaFV2gMLT5B0KsdQYYxAe69yh4E7T3P1QZvKkbdw8-vLbKhdexduo987T6ewjLgbqjOSAj8LSoMEePlBYbQXWHO8lvnCFF0lNIcBrsKR5UjLfVZSwzGUXdjFcNAcPLiIpW8ZlTlz_8nGQxjSyuwuJTfZyZPMyfRO5N7gD24sntqZO47ovIaQZHcGSLzm5GwlnKdcHpEL-dq0MA4Id1TrphAOJidLZ7DjPLcLHpO_9hQHWGRroGlKUb8VyXcrqfYkVExVGrvhKl1QBxY48xpwBi6R-UmOChmwmxdXPZlkJWLSLzsYowbNllXj8fb-cPoD577AFakmrtNnmbcpHvaTj-KN38uY_GrNc9K_Gr3tTGgiHpSCtGJoh8aYqF_yEEmWQq5jz2CJmiigC7Hlmf22NGbLRvatygTY0bkFZNqiyoDlhWT4NOldmobXj8et5O3tSNmZ-VNbjnm1XmBnnko0CQHk7CIxTJvBJBW-dAVDZyExv86ECpco-h6ikSVBzMu21w9Tn608_US8bWTM9qNHbQ6d6YEfdEbdiZuc48UH0lyqcA2RWxkC2GL0yat_9HqV4rqSkg0JUTNc4dfe6wvWL1DaLEBfMpduU5sxMqKFAEQz81WCVCsz74iQgc3HG-gM616TjyF4Tc5VrWPEgBhwk2uLzXl_9guquUUv4cp4gBYUun-jVfme30pxdY-gcHvJhw3GGZG0dIO2Yv4KOIndPRAe_pG9EuJXYhU3NaPpxhEp8ZKIcIH4B1zSc3YegBTLY1Xsx6Osc43I

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Illustration_Free_Trial_Copy_1_728x90_atlas_1.png
s0.2mdn.net/sadbundle/69658610996852204/images/ Frame 0B51 32 KB
32 KB 6ms
5ms Image
image/png 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/69658610996852204/images/Illustration_Free_Trial_Copy_1_728x90_atlas_1.png?1665411661653

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b4a1ee38ec941125d2d51226f13a1a5bdf7f6ff6f10e98fb358abbf573069a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/69658610996852204/Illustration_Free_Trial_Copy_1_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Tue, 08 Nov 2022 05:18:22 GMT
x-content-type-options: nosniff
age: 81377
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33201
x-xss-protection: 0
last-modified: Fri, 21 Oct 2022 21:35:45 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Nov 2023 05:18:22 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7DD3 0
0 28ms
28ms Fetch
image/gif 142.250.65.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvYECMY0o9D10DRuQsHEXRsclNG1Nu95-rBdFUyod10jSqbkHnleQvTe8ahB-B1jbWgWJTYfZXL6vtuEUkKxoldR_0ea-4CVGtMSz8ZX6OThP1rz2RQGWxdn4JendcZhtoh_R8kMpo&sai=AMfl-YQX_JRLvet5zLW91pKBGV0q63Ww3HlfwyuZ1CWSu5a5b0YXkuaTV6K0M2uZhmuOnGeZRCJrFsOM_UhkIl5TCfXYNbU04cEH4LA2f3_AM2klgg1JnAL3H-efqVpJjO_uJ9zI&sig=Cg0ArKJSzLZvCBXKr7ANEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1016&vt=11&dtpt=673&dett=3&cstd=340&cisv=r20221108.29177&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: mohtawaa.com
URL: https://mohtawaa.com/how-might-i-purchase-bitcoin/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.226 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Wed, 09 Nov 2022 03:54:39 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 09 Nov 2022 03:54:39 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FE04 0
20 B 28ms
27ms Image
image/gif 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BEMY4fSRrY83AN-uEoPMP9ZKq4AsAAAAAOAHgBAI&bg=!ysmlyY3NAAbvMpMzzzI7ACkAdvg8WlM4T1O5ynBXTPJJhwpbn203CIi2LX-NjSbIYnxqQeMmzbgoEgIAAALpUgAAAANoAQeZAzvkPM5ULOmuHDvNnA1wiQDoR7CTXgYG3QJJ69ylQac9LNrwkqNEbvUFYfsysz5Ui7IB30n1XR7L8osTCghr8bozd91jx6Pj8cLCMm8jTHHFgDZozWF1TMr4KN2ix5RxogTbv-rFAaIGoA0xSzp7NV9uWf9OADUM2RVPoKgGATTcJjbxNY_kL1Iap30zBf2DEFk1ERr1uHUjmqdraf6D8rmg2gZQlIxmX7glWBijftw9WmOC9d2u2CLP-nm6EfL7_pWOCoD44wLqLCnRzdfIKSjPXUm6QAJ5iRu0ORVnscjj9dfitBV4n65Ga7zfamAaSiZEVK5Eb2SHq_BiL4LADc9x8KH-MQh8tR7SntMXmtQ8tJbNL6eCaMSMXiTUguSLZ9hez3kaOB8-Bj9vvOiIdKMQ7HpxguLlkCVhS9be3B2DJ8r1xX1KTNUDcfUAfSqP-26Eoi14P6We4FNKGsVKfazYbQsGtRli3VQL13G86beBImOHVmBFPnCAjm0US5C0mV4tm2uZWaGqsveUzReZHz0WjL_gBbGgwyKJS5K_qHK35nLh3MtxK4YWRlYDAIW-QCYrVNPHGWHLA5xGxVLJ6pH_jGaSk5AqMvTmDfBTo68ozcNn5KvORqRGX9zZWJ4fXy59_XcBNP9zihn1TaOuLQad3QmKf6twrMhKr5-cyrOuDFHYdZtMFIYO8L-t5e2YD_yG2P8lOdhKqPy4QMa8rmM-kAmwowwyVsRK_fHDnoJ_yW-irx4BKcg3aDH8SMx7VTkST_wuDDZ2gS6m5NrO3BoHe_T8300MID7fsJenT8Sb7nTDQPzHcicryN-NPIvLfnfOx41lJHvaMZKvBvmSnssqhrxOGAnfe-mCsGZuZphxX_eqN5EKaOPTj3Y7QXQ2n5ts2ZhzpP9Y2lYLKi73RsjCNQM49wy9r5nDbS5TL-0W5wQyv4gIF1IBl5EfB_VhOvOX8ZFOgGqxKY2JXehOhqp7K0sdMKaiUURCXH8ZSyK2ROJvf2XfmQAWVA9pfZ-JrfNYBJBXm2l4QgtO1KCW_sl1sw3DHtRUMuYUm0UwwlQQwNW8NYFPqT5CNrBevYa4xlE5KSLEiZTt2YHuzg

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1596 43 B
215 B 86ms
85ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1194052&asId=6a6b6091-30d8-78db-10f0-ec65e1bf9f43&tv=%7Bc:trh3TC,pingTime:1,time:1707,type:p,im:%7BpLoad:1047%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:19%7D,%7Bpiv:100,vs:i,r:,t:669%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1038,o:669,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:19,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B663~0%5D,as:%5B663~728.90%5D%7D%7D,%7Bsl:i,t:669,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1038~100%5D,as:%5B1038~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:298,fm:tmETGdq+11%7C12%7C13%7C14%7C151*.1194052-66719900%7C1511%7C161.1194052-66719900%7C1611%7C1612%7C17.1224441-66655758%7C181.1194052-66719900,idMap:151*,rmeas:1,rend:1,renddet:IMG.qs,siq:20,sis:432%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: nginx
x-server-name: dt06.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1596 43 B
215 B 86ms
86ms Image
image/gif 2600:1f13:800:7782:bbfa:9ea9:3719:51c5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1194052&asId=6a6b6091-30d8-78db-10f0-ec65e1bf9f43&tv=%7Bc:trh3TD,pingTime:1,time:1708,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:19%7D,%7Bpiv:100,vs:i,r:,t:669%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1039,o:669,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:19,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B663~0%5D,as:%5B663~728.90%5D%7D%7D,%7Bsl:i,t:669,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1039~100%5D,as:%5B1039~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:298,fm:tmETGdq+11%7C12%7C13%7C14%7C151*.1194052-66719900%7C1511%7C161.1194052-66719900%7C1611%7C1612%7C17.1224441-66655758%7C181.1194052-66719900,idMap:151*,rmeas:1,rend:1,renddet:IMG.qs,siq:20,sis:432%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:bbfa:9ea9:3719:51c5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: nginx
x-server-name: dt02.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4787
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEMmzqAEP1GKvh6RmJshc4vs&google_cver=1&google_push=ASkJ3Fa7NTIDkdD2mnBuubXl5Nt9zsEGvJ722wLLvlZHLJWuy8ITCBsg2dYNM1mNgMkqbto__IXuXLCzMHB1ryOT...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ASkJ3Fa7NTIDkdD2mnBuubXl5Nt9zsEGvJ722wLLvlZHLJWuy8ITCBsg2dYNM1mNgMkqbto__IXuXLCzMHB1ryOTJJibJuiAKEOt

170 B
188 B

23ms
22ms

Image
image/png

142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ASkJ3Fa7NTIDkdD2mnBuubXl5Nt9zsEGvJ722wLLvlZHLJWuy8ITCBsg2dYNM1mNgMkqbto__IXuXLCzMHB1ryOTJJibJuiAKEOt

Protocol

Server

142.250.80.34 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 09 Nov 2022 03:54:39 GMT
Server: MT3 4629 97bee97 master ord-pixel-x50 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ASkJ3Fa7NTIDkdD2mnBuubXl5Nt9zsEGvJ722wLLvlZHLJWuy8ITCBsg2dYNM1mNgMkqbto__IXuXLCzMHB1ryOTJJibJuiAKEOt
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Wed, 09 Nov 2022 03:54:38 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4787
Redirect Chain

https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESEPIqWGwrkrCZ1B9Z6OLMJlA&google_cver=1&google_push=ASkJ3FatpFKcJR6a2Vj06mHCsSmEuxa8pXn_nXPfdrx1dTqg6e0AUuXKCKdfFruutcQKmsOSsjuiocT3ZY...
https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESEPIqWGwrkrCZ1B9Z6OLMJlA&google_cver=1&google_push=ASkJ3FatpFKcJR6a2Vj06mHCsSmEuxa8pXn_nXPfdrx1dTqg6e0AUuXKCKdfFruutcQKmsOSsjuiocT3ZY...
https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=ASkJ3FatpFKcJR6a2Vj06mHCsSmEuxa8pXn_nXPfdrx1dTqg6e0AUuXKCKdfFruutcQKmsOSsjuiocT3ZYfUen3P-Nj_KUxFRAflOQ&google_hm=MDUwMzAwMDJfNjM2Y...

170 B
188 B

21ms
21ms

Image
image/png

142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=ASkJ3FatpFKcJR6a2Vj06mHCsSmEuxa8pXn_nXPfdrx1dTqg6e0AUuXKCKdfFruutcQKmsOSsjuiocT3ZYfUen3P-Nj_KUxFRAflOQ&google_hm=MDUwMzAwMDJfNjM2YjI0ODAwNmY1ZA%3D%3D

Protocol

Server

142.250.80.34 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 09 Nov 2022 03:54:40 GMT
server: nginx
transfer-encoding: chunked
access-control-allow-methods: POST, GET, OPTIONS
p3p: CP="NOI DEV OUR BUS UNI"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=ASkJ3FatpFKcJR6a2Vj06mHCsSmEuxa8pXn_nXPfdrx1dTqg6e0AUuXKCKdfFruutcQKmsOSsjuiocT3ZYfUen3P-Nj_KUxFRAflOQ&google_hm=MDUwMzAwMDJfNjM2YjI0ODAwNmY1ZA%3D%3D
content-type: text/html; charset=UTF-8
cache-control: no-cache
keep-alive: timeout=10
access-control-allow-headers: Origin

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4787
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEOU8ENvxEtBsi3j0TxobAUE&google_cver=1&google_push=ASkJ3Fao7oTYcrEjMcKlF19GeiQrXSdE8StTIcuqT3AbVPQpQihOGGvwgBtsti4UGqrMVp50peYHN2fzvKuhTZ7raA8v...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEOU8ENvxEtBsi3j0TxobAUE&google_cver=1&google_push=ASkJ3Fao7oTYcrEjMcKlF19GeiQrXSdE8StTIcuqT3AbVPQpQihOGGvwgBtsti4UGqrMVp50peYHN2fzvKuhTZ...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ASkJ3Fao7oTYcrEjMcKlF19GeiQrXSdE8StTIcuqT3AbVPQpQihOGGvwgBtsti4UGqrMVp50peYHN2fzvKuhTZ7raA8vT6xfw1_Ihw&google_hm=gnLf10nDSBuAAIpMmHdDiw==

170 B
188 B

22ms
22ms

Image
image/png

142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ASkJ3Fao7oTYcrEjMcKlF19GeiQrXSdE8StTIcuqT3AbVPQpQihOGGvwgBtsti4UGqrMVp50peYHN2fzvKuhTZ7raA8vT6xfw1_Ihw&google_hm=gnLf10nDSBuAAIpMmHdDiw==

Protocol

Server

142.250.80.34 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ASkJ3Fao7oTYcrEjMcKlF19GeiQrXSdE8StTIcuqT3AbVPQpQihOGGvwgBtsti4UGqrMVp50peYHN2fzvKuhTZ7raA8vT6xfw1_Ihw&google_hm=gnLf10nDSBuAAIpMmHdDiw==
Date: Wed, 09 Nov 2022 03:54:39 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4787
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESENulqIz1XJ8IV6lbYlgw5mk&google_cver=1&google_push=ASkJ3FYsX98_QuJmK-q5R9XAt30WsdBiF_Psvn7jXZC_Y7ZGpkhP1mtbOCJd19TImi7Cy3-cB5kNWIhz...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESENulqIz1XJ8IV6lbYlgw5mk&google_cver=1&google_push=ASkJ3FYsX98_QuJmK-q5R9XAt30WsdBiF_Psvn7jXZC_Y7ZGpkhP1mtbOCJd19TImi7Cy3-cB5k...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDIwODkzOTg4OTAyNTI5MjQw&google_push=ASkJ3FYsX98_QuJmK-q5R9XAt30WsdBiF_Psvn7jXZC_Y7ZGpkhP1mtbOCJd19TImi7Cy3-cB5kNWIhz...

170 B
188 B

28ms
28ms

Image
image/png

142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDIwODkzOTg4OTAyNTI5MjQw&google_push=ASkJ3FYsX98_QuJmK-q5R9XAt30WsdBiF_Psvn7jXZC_Y7ZGpkhP1mtbOCJd19TImi7Cy3-cB5kNWIhz76c0Qikx-2eAFhaOA9CRXg

Protocol

Server

142.250.80.34 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDIwODkzOTg4OTAyNTI5MjQw&google_push=ASkJ3FYsX98_QuJmK-q5R9XAt30WsdBiF_Psvn7jXZC_Y7ZGpkhP1mtbOCJd19TImi7Cy3-cB5kNWIhz76c0Qikx-2eAFhaOA9CRXg
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4787
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEBNFZ6ZpOoskDMqoOXWAc4A&google_cver=1&google_push=ASkJ3Faku2xu20hpl6W5MbT5HRz5pB_-3upcclTJRYobTdCYx3uiYtxgMmhVOctm4PoIrohJ7SFXASDw5CojKdnYH...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEBNFZ6ZpOoskDMqoOXWAc4A&google_cver=1&google_push=ASkJ3Faku2xu20hpl6W5MbT5HRz5pB_-3upcclTJRYobTdCYx3uiYtxgMmhVOctm4PoIrohJ7SFXASDw5CojKdnYH...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=ASkJ3Faku2xu20hpl6W5MbT5HRz5pB_-3upcclTJRYobTdCYx3uiYtxgMmhVOctm4PoIrohJ7SFXASDw5CojKdnYHXzsxj5iOuNoWA&google_hm=FntKZGZHlES6vZXvQdqP...

170 B
188 B

22ms
22ms

Image
image/png

142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=ASkJ3Faku2xu20hpl6W5MbT5HRz5pB_-3upcclTJRYobTdCYx3uiYtxgMmhVOctm4PoIrohJ7SFXASDw5CojKdnYHXzsxj5iOuNoWA&google_hm=FntKZGZHlES6vZXvQdqPgLt5

Protocol

Server

142.250.80.34 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 09 Nov 2022 03:54:39 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=ASkJ3Faku2xu20hpl6W5MbT5HRz5pB_-3upcclTJRYobTdCYx3uiYtxgMmhVOctm4PoIrohJ7SFXASDw5CojKdnYHXzsxj5iOuNoWA&google_hm=FntKZGZHlES6vZXvQdqPgLt5
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap1ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4787
Redirect Chain

https://cc.adingo.jp/adx/push/?google_gid=CAESEDejtPhnQmLfA7zPb0VeTNY&google_cver=1&google_push=ASkJ3FbHzogsbE8Tyh3AhVasDw1mmvkJtK4xu7m4OgxwOHRJqkNU7eJcCRCNhVvblPjXD86Y0iXtOnrt7ZotEpXG-TVw-lVlRuZUOg
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=ASkJ3FbHzogsbE8Tyh3AhVasDw1mmvkJtK4xu7m4OgxwOHRJqkNU7eJcCRCNhVvblPjXD86Y0iXtOnrt7ZotEpXG-TVw-lVlRuZUOg&google_hm=fcc69a19432044a2b...

170 B
188 B

22ms
21ms

Image
image/png

142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=ASkJ3FbHzogsbE8Tyh3AhVasDw1mmvkJtK4xu7m4OgxwOHRJqkNU7eJcCRCNhVvblPjXD86Y0iXtOnrt7ZotEpXG-TVw-lVlRuZUOg&google_hm=fcc69a19432044a2b69665d8df7ba1fe

Protocol

Server

142.250.80.34 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=ASkJ3FbHzogsbE8Tyh3AhVasDw1mmvkJtK4xu7m4OgxwOHRJqkNU7eJcCRCNhVvblPjXD86Y0iXtOnrt7ZotEpXG-TVw-lVlRuZUOg&google_hm=fcc69a19432044a2b69665d8df7ba1fe
date: Wed, 09 Nov 2022 03:54:39 GMT
content-type: text/html; charset=UTF-8
server: nginx
p3p: CP=NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa HISa OUR SAMa OTRa STP UNI STA

GET
H2

200

/
onetag-sys.com/match/ Frame 4787
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEE8sMq4-M7v6_wegBC_mGVk&google_cver=1&google_push=ASkJ3FbpdYlzC1KkI11eN8GWYChheLfgO4oMQmD-eLJgHP4mgDL5-FxCJxOaf0Rp86zKRkCNsOrDo4Ghcwz...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ASkJ3FbpdYlzC1KkI11eN8GWYChheLfgO4oMQmD-eLJgHP4mgDL5-FxCJxOaf0Rp86zKRkCNsOrDo4Ghcwzzpaaz94WaGfWKOTp6XQ
https://onetag-sys.com/match/?int_id=19&google_error=5

0
151 B

20ms
20ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ip187.ip-51-222-39.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Wed, 09 Nov 2022 03:54:39 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4787 0
12 B 20ms
18ms Image
text/html 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LaZfWArzqO7OF4UTFbYIPem4LcfjmGR-Fv__6vohErg4pOfhBncBdTOLuarE2RPOV0yFISww

Requested by

Host: 7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com
URL: https://7cd9ba504ad4db02a3c748605347c7ea.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS