provdm.com Open in urlscan Pro
2606:4700:3035::6815:33b6 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://provdm.com/en/cost/flirt4.cam
Submission: On July 05 via manual (July 5th 2021, 8:27:20 am UTC) from LU

Summary HTTP 219 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 29 IPs in 5 countries across 22 domains to perform 219 HTTP transactions. The main IP is 2606:4700:3035::6815:33b6, located in United States and belongs to CLOUDFLARENET, US. The main domain is provdm.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 27th 2020. Valid for: a year.

This is the only time provdm.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: GDrive and other (Online)

Domain & IP information

	IP Address	AS Autonomous System
33	2606:4700:303... 2606:4700:3035::6815:33b6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
1	2600:9000:20e... 2600:9000:20eb:7e00:1c:8a07:5e80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::2004	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
15	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
1	2600:9000:20e... 2600:9000:20eb:3200:c:abe:f440:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:21f... 2600:9000:21f3:1000:c:a9b7:ddc0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	176.9.106.58 176.9.106.58	24940 (HETZNER-AS) (HETZNER-AS)
23	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
1	18.198.109.212 18.198.109.212	16509 (AMAZON-02) (AMAZON-02)
5 12	2a00:1450:400... 2a00:1450:4001:808::2004	15169 (GOOGLE) (GOOGLE)
1	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
24	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
15	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
1	3.130.50.33 3.130.50.33	16509 (AMAZON-02) (AMAZON-02)
5	2600:9000:215... 2600:9000:2156:9200:1d:85c3:6640:93a1	16509 (AMAZON-02) (AMAZON-02)
30	2a00:1450:400... 2a00:1450:4001:813::2001	15169 (GOOGLE) (GOOGLE)
3 4	2620:116:800d... 2620:116:800d:21:f916:5049:f87f:108e	16509 (AMAZON-02) (AMAZON-02)
1 1	52.18.11.109 52.18.11.109	16509 (AMAZON-02) (AMAZON-02)
26	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
5 5	35.186.253.211 35.186.253.211	15169 (GOOGLE) (GOOGLE)
5 5	185.64.189.115 185.64.189.115	62713 (AS-PUBMATIC) (AS-PUBMATIC)
4 4	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
3 3	79.137.68.187 79.137.68.187	16276 (OVH) (OVH)
2	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
3 3	23.45.99.241 23.45.99.241	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.185.242 142.250.185.242	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82f::2012	15169 (GOOGLE) (GOOGLE)
219	29

33 2606:4700:3035::6815:33b6 (United States)

ASN13335 (CLOUDFLARENET, US)

provdm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:7e00:1c:8a07:5e80:93a1 (United States)

ASN16509 (AMAZON-02, US)

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:3200:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)

buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:1000:c:a9b7:ddc0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.sharethis.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 176.9.106.58 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: lb2.pagepeeker.com

api.pagepeeker.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.198.109.212 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-198-109-212.eu-central-1.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:808::2004 (Frankfurt am Main, Germany) 5 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.130.50.33 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-130-50-33.us-east-2.compute.amazonaws.com

count-server.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:2156:9200:1d:85c3:6640:93a1 (United States)

ASN16509 (AMAZON-02, US)

platform-cdn.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

30 2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:116:800d:21:f916:5049:f87f:108e (United States) 3 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.18.11.109 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-11-109.eu-west-1.compute.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 142.250.185.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.186.253.211 (Kansas City, United States) 5 redirects

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.64.189.115 (United Kingdom) 5 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.173.144.138 (Frankfurt am Main, Germany) 4 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 79.137.68.187 (France) 3 redirects

ASN16276 (OVH, FR)
PTR: gcm9.host.hit.gemius.pl

googlecm.hit.gemius.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.45.99.241 (Frankfurt am Main, Germany) 3 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-45-99-241.deploy.static.akamaitechnologies.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.242 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f18.1e100.net

p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-573645-i1-v6exp3.v4.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2012 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-573645-i2-v6exp3.ds.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
54	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	454 KB
50	doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	153 KB
34	gstatic.com fonts.gstatic.com www.gstatic.com p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-573645-i1-v6exp3.v4.metric.gstatic.com p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-573645-i2-v6exp3.ds.metric.gstatic.com	792 KB
33	provdm.com provdm.com	274 KB
15	google.com 5 redirects www.google.com adservice.google.com	23 KB
9	sharethis.com platform-api.sharethis.com buttons-config.sharethis.com l.sharethis.com count-server.sharethis.com platform-cdn.sharethis.com	45 KB
8	googleapis.com ajax.googleapis.com maps.googleapis.com fonts.googleapis.com	37 KB
7	googletagservices.com www.googletagservices.com	250 KB
5	pubmatic.com 5 redirects image6.pubmatic.com	2 KB
5	openx.net 5 redirects rtb.openx.net	1 KB
4	rubiconproject.com 4 redirects pixel.rubiconproject.com	2 KB
4	quantserve.com 3 redirects cms.quantserve.com	1 KB
3	rlcdn.com 2 redirects id.rlcdn.com	1 KB
3	addthis.com 3 redirects e.dlx.addthis.com	2 KB
3	gemius.pl 3 redirects googlecm.hit.gemius.pl	669 B
2	google.de adservice.google.de	975 B
1	cloudflare.com cdnjs.cloudflare.com	1 KB
1	everesttech.net 1 redirects pixel.everesttech.net	375 B
1	googleadservices.com partner.googleadservices.com	655 B
1	pagepeeker.com api.pagepeeker.com	31 KB
1	consensu.org c.sharethis.mgr.consensu.org	1 KB
0	alexa.com Failed traffic.alexa.com Failed
219	22

	Domain	Requested by
33	provdm.com	provdm.com
30	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
26	cm.g.doubleclick.net	provdm.com googleads.g.doubleclick.net
24	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
24	pagead2.googlesyndication.com	provdm.com pagead2.googlesyndication.com googleads.g.doubleclick.net www.gstatic.com tpc.googlesyndication.com www.googletagservices.com
16	www.gstatic.com	www.google.com www.gstatic.com googleads.g.doubleclick.net
14	fonts.gstatic.com	fonts.googleapis.com www.google.com
13	www.google.com	5 redirects provdm.com www.gstatic.com googleads.g.doubleclick.net tpc.googlesyndication.com
7	www.googletagservices.com	pagead2.googlesyndication.com googleads.g.doubleclick.net
6	fonts.googleapis.com	provdm.com googleads.g.doubleclick.net
5	image6.pubmatic.com	5 redirects
5	rtb.openx.net	5 redirects
5	platform-cdn.sharethis.com	provdm.com
4	pixel.rubiconproject.com	4 redirects
4	cms.quantserve.com	3 redirects googleads.g.doubleclick.net
3	id.rlcdn.com	2 redirects googleads.g.doubleclick.net
3	e.dlx.addthis.com	3 redirects
3	googlecm.hit.gemius.pl	3 redirects
2	p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com	googleads.g.doubleclick.net p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
1	p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-573645-i2-v6exp3.ds.metric.gstatic.com
1	p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-573645-i1-v6exp3.v4.metric.gstatic.com
1	cdnjs.cloudflare.com	provdm.com
1	pixel.everesttech.net	1 redirects
1	count-server.sharethis.com	platform-api.sharethis.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	l.sharethis.com	platform-api.sharethis.com
1	api.pagepeeker.com	provdm.com
1	c.sharethis.mgr.consensu.org	platform-api.sharethis.com
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	maps.googleapis.com	provdm.com
1	platform-api.sharethis.com	provdm.com
1	ajax.googleapis.com	provdm.com
0	traffic.alexa.com Failed	provdm.com
219	35

This site contains links to these domains. Also see Links.

Domain
www.google.com
silktide.com
google.com
developers.google.com
play.google.com
ishanguru.com
pagepeeker.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-12-27` - `2021-12-26`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
sharethis.com Amazon	`2020-08-17` - `2021-09-16`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
sharethis.mgr.consensu.org Amazon	`2021-04-07` - `2022-05-06`	a year	crt.sh
*.pagepeeker.com Sectigo RSA Domain Validation Secure Server CA	`2020-12-02` - `2022-01-02`	a year	crt.sh
*.google.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-25` - `2022-03-28`	a year	crt.sh
*.v4.metric.gstatic.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.ds.metric.gstatic.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh

This page contains 29 frames:

Primary Page: https://provdm.com/en/cost/flirt4.cam
Frame ID: 7515A388BFF6468C6DE78C8D6BEC8694
Requests: 65 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/portal-v2.html
Frame ID: B2C1B1AD262B3F5418A237727D746CE6
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210630/r20190131/zrt_lookup.html
Frame ID: 79D8F0D205331149438F64E659E6133A
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcjoIgUAAAAACvaIGr5wV_aG_H13eMFy89N999Q&co=aHR0cHM6Ly9wcm92ZG0uY29tOjQ0Mw..&hl=en&type=image&v=TbD3vPFlUWKZD-9L4ZxB0HJI&theme=light&size=normal&cb=p63w9hk4vczl
Frame ID: D9D5513C32F65D31DFB8689BF57A6623
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110
Frame ID: 6903B158822C9520DA466994CBDEBA09
Requests: 27 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=2859905419&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618006&bpp=1&bdt=246&idt=117&shv=r20210630&ptt=9&saldr=aa&abxe=1&prev_fmts=1140x280&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3614&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeEbr%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=jhyMw3l4pC&p=https%3A//provdm.com&dtd=121
Frame ID: 04B89BF8003BDE56C2309E88BC9F889F
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&adk=1812271804&adf=3025194257&lmt=1625473618&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618018&bpp=2&bdt=257&idt=113&shv=r20210630&ptt=9&saldr=aa&abxe=1&prev_fmts=1140x280%2C1140x280&nras=1&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=120
Frame ID: 7088F6C708E77C9F4BA5FA7100CBA9D2
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=TbD3vPFlUWKZD-9L4ZxB0HJI&k=6LcjoIgUAAAAACvaIGr5wV_aG_H13eMFy89N999Q&cb=vz8as77lqbg4
Frame ID: 0D5D04FC9F36ED3D1FFDCC3A29A4F674
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=681361582&adf=3492703260&pi=t.aa~a.730631131~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1108x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=2&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0&nras=2&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=246&ady=1323&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=UHcYfslRn5&p=https%3A//provdm.com&dtd=14
Frame ID: D085DD1273E790A09C7D75C0C9634F6B
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=740684668&adf=1231177959&pi=t.aa~a.3843052896~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280&nras=3&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=1934&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=8xEsZiubVZ&p=https%3A//provdm.com&dtd=18
Frame ID: D57E198BE51EDBA1286139254CC6B704
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21
Frame ID: 182D0B9701A976A43E07E54EE7DCABD2
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=1116290991&pi=t.aa~a.2730154545~rp.1&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=1&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280%2C1140x90&nras=5&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3603&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=qKfVqTNViQ&p=https%3A//provdm.com&dtd=24
Frame ID: 5735649E8D6126DFE3B54799C04A8A9E
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 1AB85FC5824857EA456C784D453F9529
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 2A04EC8153FB0447F757224F87527A73
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/rHFBlN4oL05Ux9gYvr7a9rbt1s0P-Z7gKSgB9mRTgDU.js
Frame ID: 12CE21B72130DDFB43F7DF14BF072346
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: E21B1E128999AC8B161E7F5441FA0D96
Requests: 2 HTTP requests in this frame

Frame: https://p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html
Frame ID: 30E4B870053F3351FFE62FA2D6D9854B
Requests: 4 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: A3FC9BA7612E79DBF961D4EF42936F05
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 1DFFF562C3C1898919C55E841FDAD032
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/rHFBlN4oL05Ux9gYvr7a9rbt1s0P-Z7gKSgB9mRTgDU.js
Frame ID: 9D642635B0D2BFE730C7875494FB4112
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: D8E6E722ECC1E5E643FBE7DC370CF23D
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: D4C17F31E793E7420F73F4E5EF9BEF40
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/rHFBlN4oL05Ux9gYvr7a9rbt1s0P-Z7gKSgB9mRTgDU.js
Frame ID: A684992DB3C6904F6CB237C7F3CC5F2D
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/rHFBlN4oL05Ux9gYvr7a9rbt1s0P-Z7gKSgB9mRTgDU.js
Frame ID: BE2AE8F8E994C24A4DB50290CFDBD124
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 245212DD4FAE4EC1EF68C5A1073F7C85
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 05990E7878056E943B78C727C45F4853
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/rHFBlN4oL05Ux9gYvr7a9rbt1s0P-Z7gKSgB9mRTgDU.js
Frame ID: E4B6E4350A7881ADDF5C96F9ECF85DF4
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: E08071CFA8B0E2ADB5E4A07C8A9996B9
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 548D9D9BB617A635FA39DF53C0ECE29A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

219
Requests

97 %
HTTPS

59 %
IPv6

22
Domains

35
Subdomains

29
IPs

5
Countries

2063 kB
Transfer

4520 kB
Size

6
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: http://www.google.com/intl/en/policies/privacy/partners/
Title: Learn more

Search URL Search Domain Scan URL

URL: http://silktide.com/cookieconsent
Title: Cookie Consent plugin for the EU cookie law

Search URL Search Domain Scan URL

URL: https://google.com/
Title: Search Site in Google

Search URL Search Domain Scan URL

URL: https://developers.google.com/search
Title: Webmaster info

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.ishan.vpn.pro
Title: Download VPN Free

Search URL Search Domain Scan URL

URL: https://ishanguru.com/
Title: ISHAN GURU

Search URL Search Domain Scan URL

URL: http://pagepeeker.com/free-thumbnails/
Title: Free Thumbnails by PagePeeker

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 127

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPJ9kmLaLa5jbCoDYmmcmlePnhNtOZfNXO9V5tLVuapVsMs5RhGrX9jhVOXJhwu53MBG9dtvMQKUy6WD_RpJt-WkGn3TT-Q&google_gid=CAESEIpYfLA96F5KUOMGk_JMPY4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU9MQ1V3QUFCQUJ0dnpzeQ&google_push=AYg5qPJ9kmLaLa5jbCoDYmmcmlePnhNtOZfNXO9V5tLVuapVsMs5RhGrX9jhVOXJhwu53MBG9dtvMQKUy6WD_RpJt-WkGn3TT-Q

Request Chain 128

https://rtb.openx.net/sync/dds?google_gid=CAESELsH8nvdot2jwtL9UZZblZ0&google_cver=1&google_push=AYg5qPIGVv9yZfmfvPyl8MfpmE2x2Q-xLaMk_nj37HhI3zj_B6mu48t60BVvyfsJCcxUC1RuWQq8bx5O608G7QyPMi5Hye3KVPo HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESELsH8nvdot2jwtL9UZZblZ0&google_cver=1&google_push=AYg5qPIGVv9yZfmfvPyl8MfpmE2x2Q-xLaMk_nj37HhI3zj_B6mu48t60BVvyfsJCcxUC1RuWQq8bx5O608G7QyPMi5Hye3KVPo&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIGVv9yZfmfvPyl8MfpmE2x2Q-xLaMk_nj37HhI3zj_B6mu48t60BVvyfsJCcxUC1RuWQq8bx5O608G7QyPMi5Hye3KVPo&google_hm=2TaesS8eyLU6RTC5sa0RXw==

Request Chain 129

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJ97vwLmMS9N8_sngZMNCYc&google_cver=1&google_push=AYg5qPJmNgT1Ctyk7TpEhtFn9NNJL8MutK15nS3_f7xK_yoRBzoHTw6_BJoZ6OvWcC1yjwclJMsOaHG7dX2e23FhJAMrufBYk_IA HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJ97vwLmMS9N8_sngZMNCYc&google_cver=1&google_push=AYg5qPJmNgT1Ctyk7TpEhtFn9NNJL8MutK15nS3_f7xK_yoRBzoHTw6_BJoZ6OvWcC1yjwclJMsOaHG7dX2e23FhJAMrufBYk_IA&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_x1bgkWQSFWBIomF9tmnQA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJmNgT1Ctyk7TpEhtFn9NNJL8MutK15nS3_f7xK_yoRBzoHTw6_BJoZ6OvWcC1yjwclJMsOaHG7dX2e23FhJAMrufBYk_IA

Request Chain 130

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJc8v-ekozvKJv_QxXBbgRc&google_cver=1&google_push=AYg5qPL9moYgL4fJTLQnOMWtoEH6deOG5tqIVvpwfXkkTghqdMT9NHHXxry692GCKzKIc_71ZpizUBJMYX2Z0qQ2iFWYhY6QSN96 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRRDBWSkktMjItSE8xOQ==&google_push=AYg5qPL9moYgL4fJTLQnOMWtoEH6deOG5tqIVvpwfXkkTghqdMT9NHHXxry692GCKzKIc_71ZpizUBJMYX2Z0qQ2iFWYhY6QSN96

Request Chain 131

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_cver=1&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl

Request Chain 132

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEPHaps8BPVZh2BeGP1OumRE&google_cver=1&google_push=AYg5qPLSIGFzVfL6QnSU8UEdVXMUsAXbwAANPCtJea85h8F3WTgHXqw6yIW63V0PDI7m_XfvzvQKE9Qc9Erp6XSwdZbHeeuZ8owF HTTP 301
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLSIGFzVfL6QnSU8UEdVXMUsAXbwAANPCtJea85h8F3WTgHXqw6yIW63V0PDI7m_XfvzvQKE9Qc9Erp6XSwdZbHeeuZ8owF&google_hm=

Request Chain 136

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 155

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEIw8ThITglO-OdIM00bvI4U&google_cver=1&google_push=AYg5qPLiV2fKVu5rUMF3070fBLbHFMabEkXETJqwwSaanJVRvxe3-OpjZ6HvE3WTFbFQcfM8f87rxh6YTGayE3KNiwKGQp-AKaq- HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLiV2fKVu5rUMF3070fBLbHFMabEkXETJqwwSaanJVRvxe3-OpjZ6HvE3WTFbFQcfM8f87rxh6YTGayE3KNiwKGQp-AKaq-&google_hm=No-FjkErnGu5waEM29ompw

Request Chain 156

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPK2uq400Kuh3UDm2gQtz6M2uwiF60pv1oRkPTwQ2rSJSyqdD2X21AcsOg4C_JHrS7ddDIwYiHBJTwkTOdF2NFmKx2QB-CP0&google_gid=CAESEBOodQRKKxVUM4qERnhY16U&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPK2uq400Kuh3UDm2gQtz6M2uwiF60pv1oRkPTwQ2rSJSyqdD2X21AcsOg4C_JHrS7ddDIwYiHBJTwkTOdF2NFmKx2QB-CP0&google_gid=CAESEBOodQRKKxVUM4qERnhY16U&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA3MDUwODI2NTk1NDI0NTA4ODY4ODIzMw%3D%3D&google_push=AYg5qPK2uq400Kuh3UDm2gQtz6M2uwiF60pv1oRkPTwQ2rSJSyqdD2X21AcsOg4C_JHrS7ddDIwYiHBJTwkTOdF2NFmKx2QB-CP0

Request Chain 157

https://rtb.openx.net/sync/dds?google_gid=CAESEJyxEE50E8nzbUYFbjEoxIg&google_cver=1&google_push=AYg5qPLRlkK5yexrDyXnkdafj1vSdPJgqP4hHsaRs_qX28VVM9NcsZ-M37O2IOlZRRDaxmAFDyriL_QLJTNOiFsOMgKlmO1Nf_n6 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLRlkK5yexrDyXnkdafj1vSdPJgqP4hHsaRs_qX28VVM9NcsZ-M37O2IOlZRRDaxmAFDyriL_QLJTNOiFsOMgKlmO1Nf_n6&google_hm=2TaesS8eyLU6RTC5sa0RXw==

Request Chain 158

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESENtQu_MQBoWnKml2tx2_TCc&google_cver=1&google_push=AYg5qPLuanTdECO62mfTAKYYluUMK3J1d1goEcP0A6NDUzB3J0VooMnCGo9QAqYh0eHryh4tLJ6sJjCerTW0tUWTXLFq00FKlkFo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_x1bgkWQSFWBIomF9tmnQA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLuanTdECO62mfTAKYYluUMK3J1d1goEcP0A6NDUzB3J0VooMnCGo9QAqYh0eHryh4tLJ6sJjCerTW0tUWTXLFq00FKlkFo

Request Chain 159

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJw-CE8lH9F4ezfStUGR2r0&google_cver=1&google_push=AYg5qPLlKuagbEu2eKX7DSINhm5pJ7ZUsdeZ8QNuiFvuei2SAELDObZwtQfK9UvCmjx4R0H-9Q6matGZzixh-NoXVQz9VrvzDiGx HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRRDBWUFEtMjMtTDZXRw==&google_push=AYg5qPLlKuagbEu2eKX7DSINhm5pJ7ZUsdeZ8QNuiFvuei2SAELDObZwtQfK9UvCmjx4R0H-9Q6matGZzixh-NoXVQz9VrvzDiGx

Request Chain 160

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ&google_cver=1&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ

Request Chain 161

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESENAAyvMA8eImM5BesaG4P_E&google_cver=1&google_push=AYg5qPJVj1r4mip8MHsKvik5XnM5lcFnN0oUSUJmI3h5hQ8YaAEfU_6CZcuMJPai9YzHznBE3D9iFKiboZncfKLj8vlOekYSfUod2Q HTTP 301
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJVj1r4mip8MHsKvik5XnM5lcFnN0oUSUJmI3h5hQ8YaAEfU_6CZcuMJPai9YzHznBE3D9iFKiboZncfKLj8vlOekYSfUod2Q&google_hm=

Request Chain 164

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 165

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 180

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEGpNKb5_zBHISlQtQ6Q1Vak&google_cver=1&google_push=AYg5qPKJNCmS7uQmnjPlM2RTvatH4PPDuwXFVW9aAk8faTo17xoy5IVdP0XgTuFZ2EJkCWtNV2zqHIXeLthC9WLLS9Lq6JOQwnCZ HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKJNCmS7uQmnjPlM2RTvatH4PPDuwXFVW9aAk8faTo17xoy5IVdP0XgTuFZ2EJkCWtNV2zqHIXeLthC9WLLS9Lq6JOQwnCZ&google_hm=No-FjkErnGu5waEM29ompw

Request Chain 181

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPK7UpYDBtEsltUOhEXfGKJ0aSJTKHy8D-QX-p1BBnSiN7_kokdHKD2iMbH6WOy5MJgmtKiNrvkFyDBflOhXeiCdGq75QV1g&google_gid=CAESENHH9x-OukCUBdVNGJ7BN9s&google_cver=1 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCNOEi4cGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BWWc1cVBLN1VwWURCdEVzbHRVT2hFWGZHS0owYVNKVEtIeThELVFYLXAxQkJuU2lON19rb2tkSEtEMmlNYkg2V095NU1KZ210S2lOcnZrRnlEQmZsT2hYZWlDZEdxNzVRVjFn HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwS093d2p1R20wQW55TURuc2tyUmZGZ25xRGxaZWZXNHJqWFlSREVOdzRXWQ==&google_push

Request Chain 182

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPLVXtkfZHQx0jR86tDoAXX3EwNpQmhGjXyhLC-_dLn16gGmENnXWcpSmiRD3CsVuwfrBHtDdrrZP6lOYL0SQ4GViIXiD6lp&google_gid=CAESEEJs_5N9z9m6o0hjZIHJRNc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA3MDUwODI2NTk1NzEyMDYzMjYyMTg3MQ%3D%3D&google_push=AYg5qPLVXtkfZHQx0jR86tDoAXX3EwNpQmhGjXyhLC-_dLn16gGmENnXWcpSmiRD3CsVuwfrBHtDdrrZP6lOYL0SQ4GViIXiD6lp

Request Chain 183

https://rtb.openx.net/sync/dds?google_gid=CAESELSCRMifva8-KG0DelpnwzQ&google_cver=1&google_push=AYg5qPI5tsHoHA4ZcrH5nWNm249pI0TN-9kcuxcuCAwArONnef_P4tiqf-06IndJ8LN7aPa_L_f74v7LdMspf74PuS-XH1cDHn3Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPI5tsHoHA4ZcrH5nWNm249pI0TN-9kcuxcuCAwArONnef_P4tiqf-06IndJ8LN7aPa_L_f74v7LdMspf74PuS-XH1cDHn3Y&google_hm=2TaesS8eyLU6RTC5sa0RXw==

Request Chain 184

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEB3MqhitiC5bVO7p5uEZNRI&google_cver=1&google_push=AYg5qPJa-T6UQ35WJ__8mt1z-_OfUfhvMBt1hxqYGomL8tMunMgOKkJg7rC-4_M53eKLpmgJHNODu7DLVNZjwwF_DGoOamyCNVme HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_x1bgkWQSFWBIomF9tmnQA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJa-T6UQ35WJ__8mt1z-_OfUfhvMBt1hxqYGomL8tMunMgOKkJg7rC-4_M53eKLpmgJHNODu7DLVNZjwwF_DGoOamyCNVme

Request Chain 185

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESECD3Ld9p_LGDPFV6lpQj4Jo&google_cver=1&google_push=AYg5qPLMWEhWFmyo7wyYfehSl4mFQAOoxPudGeam3wioCvEDNVVDgcx1n6IU48rW6lyGtq2HHWu1ZV0-A-flEaS_GBm7IkR2Nm1o HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRRDBWVVotTS1LWldQ&google_push=AYg5qPLMWEhWFmyo7wyYfehSl4mFQAOoxPudGeam3wioCvEDNVVDgcx1n6IU48rW6lyGtq2HHWu1ZV0-A-flEaS_GBm7IkR2Nm1o

Request Chain 186

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1

Request Chain 190

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 208

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENp3vGYEywvlhgwAvQ7sZmw&google_cver=1&google_push=AYg5qPKkkpqUr-ZYxpp8Xmg7Xb_TKeje1SwDZ9YxRFgGDnm8FqoA7QGwvSBhd2sBsNFhKtjj_xYCbyMKtbUW17m_SugSHEEVqulo HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKkkpqUr-ZYxpp8Xmg7Xb_TKeje1SwDZ9YxRFgGDnm8FqoA7QGwvSBhd2sBsNFhKtjj_xYCbyMKtbUW17m_SugSHEEVqulo&google_hm=No-FjkErnGu5waEM29ompw

Request Chain 210

https://rtb.openx.net/sync/dds?google_gid=CAESEEVmBDS0aZcpsSoPfD4aWo8&google_cver=1&google_push=AYg5qPJ9rge9eF03insrwCsVdEb17vlirOKgKDlhYiYIQxPs8V5DKlpQ-EFHaKzl-DpjgTH77XVRa64QxRSSrxHiAlMErWEmmoYn HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJ9rge9eF03insrwCsVdEb17vlirOKgKDlhYiYIQxPs8V5DKlpQ-EFHaKzl-DpjgTH77XVRa64QxRSSrxHiAlMErWEmmoYn&google_hm=2TaesS8eyLU6RTC5sa0RXw==

Request Chain 211

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEG1GYHE34ykMploAYqtgvXg&google_cver=1&google_push=AYg5qPLaQQ1g4rHJz9QFohpuJaE_ivP5d1sNjAMeL40Dza8A6COBNdsPeWOYLbbjryyE0xf1RvV9mKv1YKx7TUJj2w9Brk1-vOKe HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_x1bgkWQSFWBIomF9tmnQA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLaQQ1g4rHJz9QFohpuJaE_ivP5d1sNjAMeL40Dza8A6COBNdsPeWOYLbbjryyE0xf1RvV9mKv1YKx7TUJj2w9Brk1-vOKe

Request Chain 212

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESELy97eWoRk7n13JwaaMUSrs&google_cver=1&google_push=AYg5qPLNw3YfoE3R4F9ylhoZPWo9VMJBEkdYWYB7MUWOkVZ1wyQ4TJJFiLtVpe-cLFisJaBZyBA-KN7P0mRtMggupgpJgp7MBlJg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRRDBXMVYtMjAtNDc2UQ==&google_push=AYg5qPLNw3YfoE3R4F9ylhoZPWo9VMJBEkdYWYB7MUWOkVZ1wyQ4TJJFiLtVpe-cLFisJaBZyBA-KN7P0mRtMggupgpJgp7MBlJg

Request Chain 213

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1

Request Chain 214

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESENsbhEVPRZCuMGK2HEocPdA&google_cver=1&google_push=AYg5qPLbOZGhcyFxB8C6Ek2xjHtdELbIrMEqj2pJCRKaet-Q-hHybgFe7LX3Pv1eoJ-66ItH5iDDAm5ZPg7hEZ7rho4nkpsUhDGuLA HTTP 301
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLbOZGhcyFxB8C6Ek2xjHtdELbIrMEqj2pJCRKaet-Q-hHybgFe7LX3Pv1eoJ-66ItH5iDDAm5ZPg7hEZ7rho4nkpsUhDGuLA&google_hm=

Request Chain 218

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

219 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request flirt4.cam Show response
provdm.com/en/cost/ 26 KB
7 KB 556ms
517ms Document
text/html 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://provdm.com/en/cost/flirt4.cam

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/7.0.33

Resource Hash

c598dc59e3491216053f1fecd1281db5015b2d2a95e29a2b23018a1ae948a145

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: provdm.com
:scheme: https
:path: /en/cost/flirt4.cam
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.33
set-cookie: language=en; expires=Tue, 05-Jul-2022 08:26:57 GMT; Max-Age=31536000; path=/; secure PHPSESSID=j4t8fo40ao0li3ijooefaivvh4; path=/; secure
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=71%2BE2D7wfeVe4OnkA4XUo1VBHfGz8C1OZgGn685%2FqCVECFRnhBzTy5Q6WPbx2%2FZ2MWFWVVqq1nj4rGQynRXfgN16FQlgwI3CguB8UYlpe%2Fw9V%2BsCikbb%2FKA5SQs5qqTrA2mRIg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 669f361bc8ae0eb3-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H3-29 200 yeti.bootstrap.min.css
provdm.com/css/ 104 KB
17 KB 46ms
31ms Stylesheet
text/css 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://provdm.com/css/yeti.bootstrap.min.css

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a8b4a995f328c98eb55bf3aff8fd232abd890422d071ea5604731661954db715

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /css/yeti.bootstrap.min.css
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 249824
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Tue, 24 Jun 2014 10:37:36 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2FDRWydpoYGIwDhqL2TAbD8ChQzStk6kM8NAU7fbrGVbkRF%2FiNVMkESjgAlHBRpUfc8Q5ULuea90GGD%2BbZM6bXTzb5oGdp5KiO0MGWMTQwuHv7AchxGC1Mw3ZuFInDWOCs4yx%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
cf-ray: 669f361f2e1b4e50-FRA
expires: Fri, 09 Jul 2021 11:03:12 GMT

GET
H3-29 200 app.css
provdm.com/css/ 3 KB
2 KB 47ms
32ms Stylesheet
text/css 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://provdm.com/css/app.css

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb88ab3a4e37f334c8c2212847afe49ca7b0aae387cf8f723db47a1d479c65f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /css/app.css
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 249824
cf-polished: origSize=4293
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Sun, 22 May 2016 14:07:20 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Mfj6Nmzs8zxPLinpdYP3AkYkkmHswwnCSXBFpOYSMekmPbY7CklnSeh%2F%2F%2B6gLnftQqfmmqO3JKvmKubVxkIhyO5EulKStetkvfGSThLyRAQwqx6fOTLkHbTMmWGSNAodGTPHmw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
cf-ray: 669f361f2e174e50-FRA
expires: Fri, 09 Jul 2021 11:03:12 GMT

GET
H3-29 200 font-awesome.min.css
provdm.com/css/ 20 KB
5 KB 40ms
25ms Stylesheet
text/css 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://provdm.com/css/font-awesome.min.css

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b769324e0921f9f649611113e65f528ebae5e140da8a7e63c5d6ea7bc7a33bc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /css/font-awesome.min.css
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 217001
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Mon, 23 Jun 2014 19:43:04 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=wDDHrJ8BPY%2FZVGOCAntlir4C3ED3X58d%2FPocV3LCjlKe1AgwM8g4%2Bs7LR9KfrR6WoIoMxGEEPprbKNKEQ%2BMSjvt22Rw2Lddsq4wrHmAnBOeNvdmed4wIDF%2Bm7bgeQy6%2BzKsDrA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
cf-ray: 669f361f2e1f4e50-FRA
expires: Fri, 09 Jul 2021 20:10:16 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.8.3/ 91 KB
33 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:12:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 869
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33593
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Jul 2022 08:12:28 GMT

GET
H3-29 200 bootstrap.min.js Show response
provdm.com/js/ 27 KB
7 KB 40ms
26ms Script
application/javascript 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://provdm.com/js/bootstrap.min.js

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13d9e9ce4061c6b648768b09a36d000a7bfba969d4570cf329f938ede6a8f393

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /js/bootstrap.min.js
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 217001
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Wed, 06 Nov 2013 09:40:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=8fdU1ynBNq5jjbdt2XbLSQgOCr3NYv2cT1fM3DcHGfviL6O52OYDIPNyJ2DvlkGKHszZTj30YiPsQeUJKYacPiEcZ6X4RL5nkicj4vJv%2FodhSQAQrB6NcIIxrbNbGJ6rT7mG6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
cf-ray: 669f361f2e1d4e50-FRA
expires: Fri, 09 Jul 2021 20:10:16 GMT

GET
H3-29 200 base.js Show response
provdm.com/js/ 2 KB
1 KB 36ms
21ms Script
application/javascript 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://provdm.com/js/base.js?v=0.1

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db8470f5f5a0687f233a64723f84602eff639a7db64dfa4bf7547ec4d4e090ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /js/base.js?v=0.1
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 234702
cf-polished: origSize=3516
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Thu, 27 Feb 2020 10:38:56 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=9P3TNQ2Wal%2BSemEl16e4FmOCjazNw0Utk35xaZpvmf0w06rRH7IppTIZwoqjeEX%2FeLRz%2F9AgbuZrqBIJ9N6Ly5H%2BFSxw8Gr3LQLUrCMKxBS8Q%2BNELVxNe%2BIGkttspbNaOJI%2B2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
cf-ray: 669f361f2e224e50-FRA
expires: Fri, 09 Jul 2021 15:15:15 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 135 KB
48 KB 31ms
22ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

789d25597a48ee75857b4f804d9bc81fe5c0484b6f05cf76c3c6335948c41cb0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48740
x-xss-protection: 0
server: cafe
etag: 4822591463873944812
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 05 Jul 2021 08:26:57 GMT

GET
H3-29 200 loader.gif
provdm.com/images/ 44 KB
45 KB 28ms
22ms Image
image/gif 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/loader.gif

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

59fa38cd262684e31a79589eb660b94084a6e2d459f83b76f42554e148dc1561

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/loader.gif
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194556
cf-bgj: csam-hash
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 45452
last-modified: Fri, 08 Feb 2013 09:21:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=gHuS4TZwdMsQCO5Od2WvdRVVe0cfFO%2B00DlG5gBMDe%2BBsQz4WPyrWsAXwK%2Br4QCrRAFaNNMv32mFMOqg78w0KE4nGvbhjBA9brOgNZvfdIYfFx4Jwedb81OcdeShiR8lz56WTA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
vary: Accept-Encoding
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f454e50-FRA
expires: Sat, 10 Jul 2021 02:24:21 GMT

GET
H3-29 200 coins.png
provdm.com/images/ 11 KB
11 KB 20ms
13ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/coins.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

730098975d7531f577b849a6148bfa719bcf45893771fe56e5897bed799965f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/coins.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194552
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 10753
last-modified: Tue, 24 Jun 2014 10:19:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=VqRxtZvqiQhquJztackyB3Z4A9w0RG17t%2BT27K5chbs1lgsIWfMBtT%2FXeuVvaqd0kiOc2o1z962bWGSu5t8u%2BBgW0K5gQt9jaETCTOX88DMgWhZemGZKgCZWVZTI5gBeS64jUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f4a4e50-FRA
expires: Sat, 10 Jul 2021 02:24:24 GMT

GET
H2 200 sharethis.js Show response
platform-api.sharethis.com/js/ 172 KB
38 KB 29ms
11ms Script
text/javascript 2600:9000:20eb:7e00:1c:8a07:5e80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://platform-api.sharethis.com/js/sharethis.js
Requested by: Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:7e00:1c:8a07:5e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: c63e08efff2c004e867b8de6ec09585ba5499dda44024ee1dedb14e7b45a8245

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:24:05 GMT
content-encoding: gzip
age: 172
etag: W/"2af13-ilA0+GK6k3/lGShh36vh+RHVr3o"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
edge-control: cache-maxage=60m,downstream-ttl=60m
cache-control: max-age=600, public
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: GleQJURUZgeRiI30nBBZFhs0M9X4iYYRWt0fRNP_Ne7rGQMT3uwZwg==

GET
H3-29 200 analytics.png
provdm.com/images/ 665 B
1 KB 25ms
19ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/analytics.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

902c0fd167176a2432bc678512ec11b468fc6c5f35f2269963fa23fffee49975

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/analytics.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194556
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 665
last-modified: Fri, 19 Sep 2014 06:26:28 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=LWM015zXL4%2Bi11ACCgXBziK7wLccI8OdWQ%2B3GlaG81%2BZJeXR6O8TKRfLaOJZt9Pkce0M5eqfJ582CG4aYVsNXnxmVLTYkCEn5VdXVlaIn%2Br36OvdHnFk3U3w%2BdgiXckJvwW%2F0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f4c4e50-FRA
expires: Sat, 10 Jul 2021 02:24:21 GMT

GET
H3-29 200 visitors.png
provdm.com/images/ 2 KB
3 KB 492ms
485ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/visitors.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af8cc8d5e1ac11873a8e7ca37e977c037d5b4592cdac6c9f3ed0c7f7d296591d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/visitors.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:58 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 1957
last-modified: Fri, 19 Sep 2014 09:48:56 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=2Ye1X2%2FslkGk2kvQqnwqDA6eJFmWrDL0DR9gXCnMolFnD0ibJ2yJ%2BTRGZ%2BYrs3TSsf1IFyiGyG2mOnVCgvi3yXIAGdAe11E7B8pblPFOw%2FuLOxvOLDlXVmTJ5kIq%2FPYnkMWX0g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f4d4e50-FRA
expires: Mon, 12 Jul 2021 08:26:58 GMT

GET
H3-29 200 pageviews.png
provdm.com/images/ 4 KB
4 KB 21ms
14ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/pageviews.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

76569376bca8aca9adf6b577e3f4f55f8ebdb66b3507d58331789d50c3f67753

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/pageviews.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194556
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 3877
last-modified: Fri, 19 Sep 2014 09:53:54 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=zjLfqg3sMYH5tnQBKcWo58i9l8%2BBRccfm%2Fuu0YJek5vrDk7nAcpAlAbuu5m4ignnljgvKnlaqzXhZSj%2BJKPFFou%2Bz8RuXLRK8fR%2F2bsvRplB2msDqeoNdqHQRtlH0RgDbupLGA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f4e4e50-FRA
expires: Sat, 10 Jul 2021 02:24:21 GMT

GET
H3-29 200 revenue.png
provdm.com/images/ 3 KB
4 KB 20ms
14ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/revenue.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e4bdafb349ba28203aef06372029837c0f248982b73db2fe9c72c8326762732a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/revenue.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194556
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 3557
last-modified: Sat, 20 Sep 2014 09:29:54 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=RP4q2muR6%2BM3935WXV7LVHsClhLRFKFrsY%2FDHRN7IeQBtaRe8eIC8u7Ddl2%2Ff7aHzPGoIMr22FvA3dm%2FrIjwitu2td88yxvgvSuZJudFnIbd7nx4KELVqHoQ6gEVoA1GI%2Fm1hw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f4f4e50-FRA
expires: Sat, 10 Jul 2021 02:24:21 GMT

GET
H3-29 200 info.png
provdm.com/images/ 4 KB
5 KB 25ms
19ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/info.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae61835f9e7022c9584685c73decc65cf5a35175338bb9d9c595ec95e6cc9624

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/info.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194556
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 4599
last-modified: Tue, 24 Jun 2014 18:47:30 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=EjiUUaayHZOYvlp2W5P0F3nswhqHW5S9P3XTRih3Vtkbj8qcrqE%2BxdTuPC4bnQ2q5qSQK%2F0mAWdel%2Bb7nScchl4Fc3n8%2BfIGb7j3MQDj%2F6%2FEaas049KQ0x3dftBjs3tYDcfxOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f514e50-FRA
expires: Sat, 10 Jul 2021 02:24:21 GMT

GET
H3-29 200 search_engine.png
provdm.com/images/ 1 KB
2 KB 21ms
15ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/search_engine.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1c59e93d6c5932aa25cf0fe2de7d44fbe2859c9c017c414a5ee1c76e9862d50

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/search_engine.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194556
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 1148
last-modified: Tue, 24 Jun 2014 17:40:34 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=V6SgFalOYs1Eit01Y%2FlBjDHr81DN1gRsJB%2BHrNtknYDbtjm%2BgxeM4nnqw1JdMuln8%2FZyjQnLyz63OJbrzPX71tavr7WKMZcTdX7CuKUiKpYzyQ%2BT9BUgcgjTYjQ8Tg1%2BwxDHQg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f524e50-FRA
expires: Sat, 10 Jul 2021 02:24:21 GMT

GET
H3-29 200 google.png
provdm.com/images/ 2 KB
2 KB 489ms
484ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/google.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d77856271d2779dfbcb1dab710e3b37942bd4b4f07e0a1c0268335cc5eefb36

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/google.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:58 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 1684
last-modified: Sat, 09 Feb 2013 17:54:06 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=EkGw5DvlOzObLiGK%2BxWSDG2mHCZcHXeAwxy%2FXb5cjVudhnWXNwnngDIFc0yJZCLKsJW7D2jGbntkl0P9BPKxG1Adj0thSNdqaPsgugeGK0qphTlXPA90wO%2FS405NRWrU3wzsIw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f534e50-FRA
expires: Mon, 12 Jul 2021 08:26:58 GMT

GET
H3-29 200 yahoo.png
provdm.com/images/ 3 KB
3 KB 35ms
30ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/yahoo.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0b6c1e1b33c085efad5bdc32654ec90b4ddc934eb1c1aca71a439ff89867f468

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/yahoo.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194555
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 2830
last-modified: Sat, 09 Feb 2013 18:00:44 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=D3%2FjzAPFEidbShKeCitOZ3ct0i4q%2FqvvkGTUy14lVz0pEuqERtnqnoWqVnVLD%2Bztbl8rRg6Adq42H9Xk3PJneTZ0nJiKTsLFn8JzfDLG3DqL9tZ4BrQ6iUyYkmsC%2F67m4qGA%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f544e50-FRA
expires: Sat, 10 Jul 2021 02:24:22 GMT

GET
H3-29 200 bing.png
provdm.com/images/ 1 KB
2 KB 20ms
14ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/bing.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

914e6010ae41678122b8d63486796ad17ebaa988e6badda1afc8243de24a38b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/bing.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194556
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 1275
last-modified: Sat, 09 Feb 2013 18:01:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=mrdz48fimvANC%2FPlyT8XVjDdY9GuUbOFrkGM%2B6xtbQxfjQTg%2F6wVQXAYhTu8jWFbNALHVWHMl92q7p23NHJEm4iLtH1724pXT41ty4X2mz0IXdFD6yAi5dKIFes8vH8aYihFUg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f554e50-FRA
expires: Sat, 10 Jul 2021 02:24:21 GMT

GET
H3-29 200 backlink.png
provdm.com/images/ 1 KB
2 KB 31ms
26ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/backlink.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bcc6c323289739f7330093aa4bf3a0a27354a1d72806c282f42aafd1bf6224fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/backlink.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194556
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 1480
last-modified: Tue, 24 Jun 2014 17:55:40 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=qoqtyGX4cMDajxZKqL%2BBVfXASg8vwLycr0Jzz9eCe5WWi%2BHoil2%2BzNVvfE%2F4GTa6xMXv6%2Bkzuli5QSmf6WIMwLwNNLLcD6hk666VmRtVWuwVD4637W4s800dP9M%2FIozao89Gxw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f574e50-FRA
expires: Sat, 10 Jul 2021 02:24:21 GMT

GET
H3-29 200 facebook.png
provdm.com/images/ 865 B
1 KB 26ms
21ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/facebook.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8755c3830cd00faa5a0658cbbe133834c3e318a280032220c9a24da3c6aaac36

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/facebook.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194556
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 865
last-modified: Sat, 09 Feb 2013 18:03:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=tsAk3AG6GXBfYG0Em0hnjv7NGmtIsTYpFLnTwgulv5cLR6hNEYLMsrrIEu1ogmtbnwvATeDzOm6iv2KZU3M9mNEOA7964JW0w99rJKMA6Y2s%2FRMh62mg%2Btkp5nhsUsl5PZvw1g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f584e50-FRA
expires: Sat, 10 Jul 2021 02:24:21 GMT

GET
H3-29 200 alexa.png
provdm.com/images/ 3 KB
3 KB 37ms
32ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/alexa.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bda8f2eaf8e48162c6d11e3319f3e284849ab0c1cad3fc2a60155ad05feeda86

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/alexa.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194556
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 2731
last-modified: Sat, 09 Feb 2013 18:37:20 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=qKQrcqwXZTMcniwoAKT4u5n9MdRlwKPnZXONXMQ0q0tgr2MRNPzrPpWHqAYbnphFlX0GJt5fF8yOVl112DRWETqRmf8VjUcl2rsquRV9MMzm94IcKuaKhcryeUtmwam0rBD4XQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f5a4e50-FRA
expires: Sat, 10 Jul 2021 02:24:21 GMT

GET graph
traffic.alexa.com/ 0
0

GET
H3-29 200 antivirus.png
provdm.com/images/ 5 KB
6 KB 31ms
26ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/antivirus.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea9784c2f3c024eccaf7bbeb7ea5e59671aae6f17c59c7258b7da090a6d3a8aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/antivirus.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194556
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 5029
last-modified: Tue, 24 Jun 2014 19:06:16 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=MxkiG%2B30vQqQShy3l2QJwgNWgXzBak0504XXO8XGlC5zJWcUtYHSMkear12fqjkN8sZlwciGuKDh7o%2B1T6pPdlTIUvrZ%2BCv8pGKIh0QST1Zi4DcqfOxu40gOOlcWE8jhF3Vs%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f5c4e50-FRA
expires: Sat, 10 Jul 2021 02:24:21 GMT

GET
H3-29 200 safe.png
provdm.com/images/ 4 KB
4 KB 26ms
21ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/safe.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b685408da8385dd6e157e96c993edd3092510657dba04a3ee2d76ec68ddfb716

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/safe.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194556
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 3842
last-modified: Thu, 11 Apr 2013 08:06:10 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=4FVw4kVPvMC12P3eMs5TBQ3XV0e2DCzJcMaMo4GVd9MXcva8l2sQdc2T2ZcH4xDN%2B0lkVBlr3BKf8x8Wl4T10p0%2F0kwqidb%2BuFVmBaorBLw3QcOOdC5osTEahEBmLBoPvybabA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f5d4e50-FRA
expires: Sat, 10 Jul 2021 02:24:21 GMT

GET
H3-29 200 norton.png
provdm.com/images/ 5 KB
6 KB 20ms
15ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/norton.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8009448564ed107678d83113542315d9e4f617e0795ef256a26707cfe1ca3fd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/norton.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194556
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 5156
last-modified: Sat, 20 Sep 2014 09:28:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=lxVidsEGOGPqDKWrm1bscHiELuZNRH3dFokEw%2BTZN8zzxDYJFv7HbKrzzEPO9WJsO%2B8r5Vw5Sz2FCycy%2FiJ%2ByCW5XDKGL6R0YZoluL1TRnZgpJV3aJvzrZwKDBZxOnxzMzfmkA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f604e50-FRA
expires: Sat, 10 Jul 2021 02:24:21 GMT

GET
H3-29 200 untested.png
provdm.com/images/ 4 KB
4 KB 31ms
26ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/untested.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56c6612bbf0521ac758fc1ae4ca5cff8149291d2d897b52fe193896cf1166eca

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/untested.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 60602
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 3778
last-modified: Thu, 11 Apr 2013 08:08:30 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bTTjW%2BzEhqEsB15%2B42EQxbnlwgl5VzdbTLJQm0dc0YWl7y06ozKuxtHidA8wlcslStEcJPtp3gGwXl8oO8WuOwNVetjDKYPx1hK%2FbrmAnhn9e5Ioy3Hg0ge1RGodP%2BH5R%2BkZhg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f624e50-FRA
expires: Sun, 11 Jul 2021 15:36:55 GMT

GET
H3-29 200 social.png
provdm.com/images/ 2 KB
3 KB 34ms
29ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/social.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5e1f0ca18309376cce0530673de23fae91eba07acfcba5bb4f1006ac60329574

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/social.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194555
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 2224
last-modified: Tue, 24 Jun 2014 18:50:00 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=hYE92p%2FJCEx5oh5MgjsVMemL6h7yybi2v5X2p39173IpZEyJ35aaLYXw21X0Yc1q6sURIZOEnz4yXcauZeCNpVdKPTqSv2jXhVq53W4%2FAXioI9n2gV5gCqZNHYe%2FZmOvzJm0Aw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f644e50-FRA
expires: Sat, 10 Jul 2021 02:24:22 GMT

GET
H3-29 200 pinterest.png
provdm.com/images/ 1 KB
2 KB 31ms
26ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/pinterest.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

80958d079925762d945253a6718e8f6ef12eb59225379ac618d79c6685b66327

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/pinterest.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194556
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 1190
last-modified: Sat, 09 Feb 2013 17:06:50 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=4zMpTbGU1mRuVITpiHUkg8AbW1cGZfPtjDHWGCbHVSDbPoITQ58feNDt%2BjBj5eoAw6C%2BIH0vpz8zJGJ%2BnVmxBb995XWIpvQ8BkZIt4ubb%2BekpqYTmF9D8kGHbFmRKsP7F6VSEg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f654e50-FRA
expires: Sat, 10 Jul 2021 02:24:21 GMT

GET
H3-29 200 location.png
provdm.com/images/ 2 KB
2 KB 31ms
26ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/location.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a005d794ff8c3e5d4d8ba3faa517f1d49aa3db01736e4ed6ff443fdfa11f7e11

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/location.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194556
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 1747
last-modified: Sat, 09 Feb 2013 18:42:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=5JKmfQ%2BKel1sdP5ZPXAGOCjbzILwesgp%2FjZeZyMbl6eaAu4SPHaAYE4HLmG%2B7%2Bj72xqq5k9kkVfUtV84P92qTuN1%2F%2BBk2Wkv2x%2BnTK%2BU1hxfsT%2BaAK8DHdSG63As03Xx%2Br0nAg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f684e50-FRA
expires: Sat, 10 Jul 2021 02:24:21 GMT

GET
H3-29 200 nl.png
provdm.com/images/flags/ 469 B
1 KB 483ms
478ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/flags/nl.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5d75fea10bb270c341503bda4357e90bb069e3e46c7a670a3583f924f3524bd3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/flags/nl.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:58 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 469
last-modified: Sat, 16 Jun 2007 07:27:38 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=kt4M472CfbltNNqha8WIGTGW2ePx8jrMOPDmUjzuXwRYysyxn0pQB81QwQIa6SNh4i7dSxvBnXaP6K1lNXum06iWL0pvZVhxxF9s9eEVw6xEki2V2zC1uS3wSij2wyxX85XdUA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f694e50-FRA
expires: Mon, 12 Jul 2021 08:26:58 GMT

GET
H2 403 staticmap
maps.googleapis.com/maps/api/ 0
0 55ms
50ms Image
text/plain 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://maps.googleapis.com/maps/api/staticmap?center=52.3702,4.89517&sensor=false&zoom=5&size=640x250&markers=52.3702,4.89517&key=AIzaSyAf71sw6n03_XcId35a-KWxpG8wn-R1nfY
Requested by: Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *

GET
H3-29 200 whois.png
provdm.com/images/ 7 KB
8 KB 31ms
26ms Image
image/png 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://provdm.com/images/whois.png

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1816fb146c0559f24e91c5e6afa9c9adc7f437ed4242f7d75515b98123c7cf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /images/whois.png
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 138447
cf-bgj: csam-hash
vary: Accept-Encoding
content-length: 7050
last-modified: Thu, 21 Mar 2013 07:54:40 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=CyIeJdJoACr9omRjPF7de2am5d6OuD9%2BYo2NpnSME9nnzzv13UbG%2FWKk4ffwDjOgkOZixCrUeFDOi9WCopKAVEev2fFyuTlpVnAAWXrooRtS3nq%2F9jp41CZS%2BUGCwfA9hVxxbA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f6b4e50-FRA
expires: Sat, 10 Jul 2021 17:59:30 GMT

GET
H3-29 200 email-decode.min.js Show response
provdm.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 8ms
8ms Script
application/javascript 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://provdm.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

:path: /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to":"cf-nel","max_age":604800}
cf-request-id: 0b1760279900004e507696f000000001
last-modified: Tue, 29 Jun 2021 09:14:34 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"60dae47a-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=AaU2fjAK9CwD3jielYdgKJvTOHL%2F1U2NoTll1m92lZwsPmUZB21OP%2FU9az9ZcNCJVIsZeBPSFq7yV5MYTcx8cgrGVYXM0bjXMMIqVmc3hsvz6Ic2icZlSEXXijjRmzNS7uS5dQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800 public
cf-ray: 669f361f5e954e50-FRA
expires: Wed, 07 Jul 2021 08:26:57 GMT

GET
H3-29 200 cookieconsent.latest.min.js Show response
provdm.com/js/ 4 KB
2 KB 18ms
18ms Script
application/javascript 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://provdm.com/js/cookieconsent.latest.min.js

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

190fc02d8e8f1dd5acc40f48d0d6203e6115eb31e3f47f55db0c3f07797d68f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:path: /js/cookieconsent.latest.min.js
pragma: no-cache
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: provdm.com
referer: https://provdm.com/en/cost/flirt4.cam
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://provdm.com/en/cost/flirt4.cam
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 194556
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Sat, 09 Jan 2016 16:38:04 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=dx5bWPwCtT%2BjXoIA%2FhDkLVSTb0hjkfG4ZP%2FLKBrvE1xMrBECT2X6rIxmKhaiIX6Ij0nl%2BBdluyTaHrgcENzA77Yt1tpG6ZhKD027fz4ShaAAsl2UnOvuo%2B0yqY4xF4O6Aq54eQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
cf-ray: 669f361f7ed54e50-FRA
expires: Sat, 10 Jul 2021 02:24:20 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 942 B
700 B 23ms
18ms Script
text/javascript 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en&onload=captcha_loaded_19e3713687a0a37de8de79e625bb5a26&render=explicit

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

fbf30a17d5ae65a9ed8d950ca76016c11abe8222505d7eb8698c819f9d32823e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 608
x-xss-protection: 1; mode=block
expires: Mon, 05 Jul 2021 08:26:57 GMT

GET
H2 200 css
fonts.googleapis.com/ 12 KB
982 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,700italic,400,300,700

Requested by

Host: provdm.com
URL: https://provdm.com/css/yeti.bootstrap.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

14f17c26f61e7e76d5a5207ac229e0a3a741d11916803153677fad4aeb0dd7d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 07:49:59 GMT
server: ESF
date: Mon, 05 Jul 2021 08:26:57 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 05 Jul 2021 08:26:57 GMT

GET
H2 200 mem5YaGs126MiZpBA-UN_r8OUuhp.woff2
fonts.gstatic.com/s/opensans/v20/ 15 KB
15 KB 10ms
5ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem5YaGs126MiZpBA-UN_r8OUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,700italic,400,300,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9f7216d2f53a731d9749077c22e15cfb38bcdc40806511ccf736f440c7569d64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://provdm.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 10:05:12 GMT
x-content-type-options: nosniff
age: 426105
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14992
x-xss-protection: 0
last-modified: Tue, 18 May 2021 21:21:24 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 10:05:12 GMT

GET
H3-29 200 fontawesome-webfont.woff
provdm.com/fonts/ 82 KB
82 KB 29ms
26ms Font
font/woff 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://provdm.com/fonts/fontawesome-webfont.woff?v=4.1.0

Requested by

Host: provdm.com
URL: https://provdm.com/css/font-awesome.min.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66db52b456efe7e29cec11fa09421d03cb09e37ed1b567307ec0444fd605ce31

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-fetch-mode: cors
origin: https://provdm.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
:path: /fonts/fontawesome-webfont.woff?v=4.1.0
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: provdm.com
referer: https://provdm.com/css/font-awesome.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://provdm.com
Referer: https://provdm.com/css/font-awesome.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1962
vary: Accept-Encoding
content-length: 83760
last-modified: Mon, 23 Jun 2014 19:43:04 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=HDPqdHqP4aAYZ8EBiF1gs2UM5E7J8Y4SjPAvCRzGCzMaRb3olatD0hT2JleNnDw3E6soCDc%2B42grBo7P%2BK7efZCxxA%2BJJYYctHtnYxjWLb8Fdp8eO3UNJsBv6bPPjkcRDlm07g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: max-age=14400
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361f9f6d4e50-FRA

GET
H3-29 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v20/ 14 KB
14 KB 11ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,700italic,400,300,700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://provdm.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 13:09:35 GMT
x-content-type-options: nosniff
age: 415042
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14440
x-xss-protection: 0
last-modified: Tue, 18 May 2021 21:21:19 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 13:09:35 GMT

GET
H3-29 200 glyphicons-halflings-regular.woff
provdm.com/fonts/ 23 KB
23 KB 19ms
15ms Font
font/woff 2606:4700:3035::6815:33b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://provdm.com/fonts/glyphicons-halflings-regular.woff

Requested by

Host: provdm.com
URL: https://provdm.com/css/yeti.bootstrap.min.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3035::6815:33b6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

63faf0af44a428f182686f0d924bb30e369a9549630c7b98a969394f58431067

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-fetch-mode: cors
origin: https://provdm.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: language=en; PHPSESSID=j4t8fo40ao0li3ijooefaivvh4
:path: /fonts/glyphicons-halflings-regular.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: provdm.com
referer: https://provdm.com/css/yeti.bootstrap.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://provdm.com
Referer: https://provdm.com/css/yeti.bootstrap.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:57 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1962
vary: Accept-Encoding
content-length: 23292
last-modified: Mon, 14 Apr 2014 10:25:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=B5hyU%2B32uzRE5Ws1UzLv%2BxqepSy95kQSWmc6FIp%2BjKZl1ouhgont3eIF4DTD%2B5VKsmdMGt%2Fb6TCi8LDxptDmOFOX0gLbx4e5bTIeoe%2BaotrYiMPBy%2B1UgnWLw%2Fsw5gAhGiI5LQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cache-control: max-age=14400
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 669f361fcfdb4e50-FRA

GET
H2 200 5c3756ef22caa600115a73fa.js Show response
buttons-config.sharethis.com/js/ 778 B
1 KB 404ms
388ms Script
text/javascript 2600:9000:20eb:3200:c:abe:f440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://buttons-config.sharethis.com/js/5c3756ef22caa600115a73fa.js
Requested by: Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3200:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 79eb02d0785950356a390a71612cfca75c708b06dcaf5662a707b5fcf3063bc4

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:59 GMT
via: 1.1 0e7eb16f335fe24acf3f13c5dee19c88.cloudfront.net (CloudFront)
last-modified: Sat, 12 Jan 2019 04:00:35 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
etag: "7b92f4b7acd9c6def1a571057a9139e0"
x-cache: RefreshHit from cloudfront
content-type: text/javascript
cache-control: max-age=60,public
accept-ranges: bytes
content-length: 778
x-amz-cf-id: YmfQS2_6bzFO3mT2KUasdg0W_d9AdwE78AKB3RwvLlVrkwHrv2ur8A==

GET
H3-29 200 mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
fonts.gstatic.com/s/opensans/v20/ 15 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,700italic,400,300,700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c73575543a5c99018f842960f9882edaa0918965ea856e91de9717a0d58d3f1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://provdm.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 29 Jun 2021 16:31:16 GMT
x-content-type-options: nosniff
age: 489341
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15112
x-xss-protection: 0
last-modified: Tue, 18 May 2021 21:21:50 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Jun 2022 16:31:16 GMT

GET
H2 200 portal-v2.html Show response
c.sharethis.mgr.consensu.org/ Frame B2C1 2 KB
1 KB 22ms
6ms Document
text/html 2600:9000:21f3:1000:c:a9b7:ddc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.sharethis.mgr.consensu.org/portal-v2.html
Requested by: Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:1000:c:a9b7:ddc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8bc62c9ef81390af989b3829ace60aae916e299dab9df7ec5e49db2d07a956b6

Request headers

:method: GET
:authority: c.sharethis.mgr.consensu.org
:scheme: https
:path: /portal-v2.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://provdm.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://provdm.com/

Response headers

content-type: text/html; charset=utf-8
content-encoding: gzip
cache-control: max-age=3600, public
date: Mon, 05 Jul 2021 08:25:19 GMT
etag: W/"865-g9QqzjbIJI1xmvSY3DM2A/8Cpl8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 ac0e9b19969df989a920e6d1b834d009.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: phiDoV-xHqX69js2Y2y9Dmx09eg11_jeS55YPJ5di2Tbn2LRFbkzYA==
age: 98

GET
H/1.1 200
OK thumbs.php
api.pagepeeker.com/v2/ 31 KB
31 KB 59ms
20ms Image
image/jpeg 176.9.106.58
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://api.pagepeeker.com/v2/thumbs.php?url=flirt4.cam&size=l
Requested by: Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 176.9.106.58 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: lb2.pagepeeker.com
Software: nginx/1.4.6 /
Resource Hash: da4974cfd727034dbd492a1741b12024ec0314658d5c5932c5cdd2bdb2a445af

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jul 2021 08:26:58 GMT
Content-Type: image/jpeg
Server: nginx/1.4.6
X-PP-Error: False
X-PP-Hash: 6154c5e1ae44b667e8d03e1f3803ed0e
X-PP-Final-URL: http://flirt4.cam/
X-PP-Capture-Method: webkit
X-PP-Server: 1004
Cache-Control: no-cache, no-store, must-revalidate
X-PP-Capture-Time: 11.82
X-PP-Timestamp: 1619613481
X-Robots-Tag: noindex, nofollow
Content-Length: 31531

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210630/r20190131/ 240 KB
89 KB 50ms
33ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210630/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-6817767505758970&plah=provdm.com&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c107239496609ede285e80b91336c653f68e65956a25b489ef9b4d9591d07ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 91175
x-xss-protection: 0
server: cafe
etag: 16806287549005047208
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 05 Jul 2021 08:26:58 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210630/r20190131/ Frame 79D8 10 KB
5 KB 6ms
5ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210630/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210630/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://provdm.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://provdm.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 05 Jul 2021 04:24:00 GMT
expires: Mon, 19 Jul 2021 04:24:00 GMT
content-type: text/html; charset=UTF-8
etag: 15579341980913220427
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4579
x-xss-protection: 0
age: 14578
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/ 341 KB
133 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en&onload=captcha_loaded_19e3713687a0a37de8de79e625bb5a26&render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

839392b626a00e09ce3ec77706959d551de27cca63c559fcd4a6415aef3e722a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://provdm.com
Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 04 Jul 2021 11:14:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76359
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 135961
x-xss-protection: 0
last-modified: Mon, 28 Jun 2021 04:05:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 04 Jul 2022 11:14:19 GMT

GET
H/1.1 204
No Content pview Show response
l.sharethis.com/ 0
332 B 30ms
8ms XHR
text/plain 18.198.109.212
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://l.sharethis.com/pview?event=pview&hostname=provdm.com&location=%2Fen%2Fcost%2Fflirt4.cam&product=inline-share-buttons&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=flirt4.cam%20worth%20is%20%24%209%2C24&cms=unknown&publisher=5c3756ef22caa600115a73fa&sop=true&bsamesite=true&consent_cookie_duration=119&consent_duration=119&gdpr_domain=.consensu.org&gdpr_method=cookie&version=st_sop.js&lang=en&description=flirt4.cam%20worth%20is%20%24%209%2C24
Requested by: Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.198.109.212 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-198-109-212.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 08:26:58 GMT
Access-Control-Max-Age: 1728000
Access-Control-Allow-Origin: https://provdm.com
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H3-29 200 anchor Show response
www.google.com/recaptcha/api2/ Frame D9D5 39 KB
20 KB 27ms
27ms Document
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcjoIgUAAAAACvaIGr5wV_aG_H13eMFy89N999Q&co=aHR0cHM6Ly9wcm92ZG0uY29tOjQ0Mw..&hl=en&type=image&v=TbD3vPFlUWKZD-9L4ZxB0HJI&theme=light&size=normal&cb=p63w9hk4vczl

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/recaptcha__en.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

99e7f90ad20a4051a2eba63717dc6b3a3bf860e7694e3557b5d39c4e4cfcf9b5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-9oZyKxtwYC7oiHV3qzmFeA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LcjoIgUAAAAACvaIGr5wV_aG_H13eMFy89N999Q&co=aHR0cHM6Ly9wcm92ZG0uY29tOjQ0Mw..&hl=en&type=image&v=TbD3vPFlUWKZD-9L4ZxB0HJI&theme=light&size=normal&cb=p63w9hk4vczl
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://provdm.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://provdm.com/

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 05 Jul 2021 08:26:58 GMT
content-security-policy: script-src 'report-sample' 'nonce-9oZyKxtwYC7oiHV3qzmFeA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 20453
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 200 B
655 B 37ms
15ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=provdm.com&callback=_gfp_s_&client=ca-pub-6817767505758970

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210630/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-6817767505758970&plah=provdm.com&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

30826f2c49f1e60d5cd1e8e242b7df31405545c265f4ca130aed43de86b821b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 190
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 36ms
16ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=provdm.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 08:26:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 35ms
15ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=provdm.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 08:26:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6903 75 KB
25 KB 724ms
710ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d6a1204f7063d9779c458cec1d0a6dae5f2a95295d825d4a7be45491a9eeee10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://provdm.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://provdm.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 05 Jul 2021 08:26:58 GMT
server: cafe
content-length: 25637
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 05-Jul-2021 08:41:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 05 Jul 2021 08:26:58 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c4a89afd48453d83067f4f59988766d5bded647ac8e316bbb5fe7572bbce06c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:58 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625225358082386"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27725
x-xss-protection: 0
expires: Mon, 05 Jul 2021 08:26:58 GMT

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 04B8 70 KB
23 KB 658ms
658ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=2859905419&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618006&bpp=1&bdt=246&idt=117&shv=r20210630&ptt=9&saldr=aa&abxe=1&prev_fmts=1140x280&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3614&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeEbr%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=jhyMw3l4pC&p=https%3A//provdm.com&dtd=121

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fc1d8683cae600ae14430e42498f84ef8352729acf7cb15372277f3fedec380c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=2859905419&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618006&bpp=1&bdt=246&idt=117&shv=r20210630&ptt=9&saldr=aa&abxe=1&prev_fmts=1140x280&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3614&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeEbr%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=jhyMw3l4pC&p=https%3A//provdm.com&dtd=121
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://provdm.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://provdm.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 05 Jul 2021 08:26:58 GMT
server: cafe
content-length: 24001
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 05-Jul-2021 08:41:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 05 Jul 2021 08:26:58 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7088 7 KB
697 B 98ms
98ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&adk=1812271804&adf=3025194257&lmt=1625473618&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618018&bpp=2&bdt=257&idt=113&shv=r20210630&ptt=9&saldr=aa&abxe=1&prev_fmts=1140x280%2C1140x280&nras=1&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=120

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

218f063a0d1c2136de9971bb2d9fb175bfea077992d914b4934c0fb88ec76ba7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6817767505758970&output=html&adk=1812271804&adf=3025194257&lmt=1625473618&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618018&bpp=2&bdt=257&idt=113&shv=r20210630&ptt=9&saldr=aa&abxe=1&prev_fmts=1140x280%2C1140x280&nras=1&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=120
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://provdm.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://provdm.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 05 Jul 2021 08:26:58 GMT
server: cafe
content-length: 674
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 05-Jul-2021 08:41:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 05 Jul 2021 08:26:58 GMT
cache-control: private

GET
H3-29 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/ Frame D9D5 52 KB
25 KB 8ms
8ms Stylesheet
text/css 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcjoIgUAAAAACvaIGr5wV_aG_H13eMFy89N999Q&co=aHR0cHM6Ly9wcm92ZG0uY29tOjQ0Mw..&hl=en&type=image&v=TbD3vPFlUWKZD-9L4ZxB0HJI&theme=light&size=normal&cb=p63w9hk4vczl

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:01:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1549
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25732
x-xss-protection: 0
last-modified: Mon, 28 Jun 2021 04:05:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 08:01:09 GMT

GET
H3-29 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/ Frame D9D5 341 KB
133 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/recaptcha__en.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

839392b626a00e09ce3ec77706959d551de27cca63c559fcd4a6415aef3e722a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:03:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1388
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 135961
x-xss-protection: 0
last-modified: Mon, 28 Jun 2021 04:05:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 08:03:50 GMT

GET
DATA 200
OK truncated
/ Frame D9D5 14 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame D9D5 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame D9D5 2 KB
2 KB 7ms
7ms Image
image/png 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/styles__ltr.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 29 Jun 2021 14:48:51 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
age: 495487
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
expires: Tue, 06 Jul 2021 14:48:51 GMT

GET
H3-29 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame D9D5 15 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.google.com
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 08:09:57 GMT
x-content-type-options: nosniff
age: 433021
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 08:09:57 GMT

GET
H3-29 200 webworker.js
www.google.com/recaptcha/api2/ Frame D9D5 102 B
135 B 15ms
15ms Other
text/javascript 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=TbD3vPFlUWKZD-9L4ZxB0HJI

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

5dfdffa77335a103ec942c9384df984b5d38a267d619ee0ac3a045b766bbf2d5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcjoIgUAAAAACvaIGr5wV_aG_H13eMFy89N999Q&co=aHR0cHM6Ly9wcm92ZG0uY29tOjQ0Mw..&hl=en&type=image&v=TbD3vPFlUWKZD-9L4ZxB0HJI&theme=light&size=normal&cb=p63w9hk4vczl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Mon, 05 Jul 2021 08:26:58 GMT

GET
H3-29 200 bframe Show response
www.google.com/recaptcha/api2/ Frame 0D5D 7 KB
1 KB 21ms
20ms Document
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=TbD3vPFlUWKZD-9L4ZxB0HJI&k=6LcjoIgUAAAAACvaIGr5wV_aG_H13eMFy89N999Q&cb=vz8as77lqbg4

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/recaptcha__en.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

be10c39936e50047ccdd4bd35ddff431454ccc3e69b19698234661561c8930da

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-UwiqebUouXurHR7RL27RTw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=TbD3vPFlUWKZD-9L4ZxB0HJI&k=6LcjoIgUAAAAACvaIGr5wV_aG_H13eMFy89N999Q&cb=vz8as77lqbg4
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://provdm.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://provdm.com/

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 05 Jul 2021 08:26:58 GMT
content-security-policy: script-src 'report-sample' 'nonce-UwiqebUouXurHR7RL27RTw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1113
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 28ms
14ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=provdm.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 08:26:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 29ms
15ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=provdm.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 08:26:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame D085 79 KB
28 KB 1288ms
1288ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=681361582&adf=3492703260&pi=t.aa~a.730631131~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1108x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=2&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0&nras=2&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=246&ady=1323&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=UHcYfslRn5&p=https%3A//provdm.com&dtd=14

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7abbc19121813b368bf6406806b8e9b7bb588456b530d95dc8a1d2ac57dd39bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=681361582&adf=3492703260&pi=t.aa~a.730631131~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1108x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=2&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0&nras=2&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=246&ady=1323&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=UHcYfslRn5&p=https%3A//provdm.com&dtd=14
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://provdm.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://provdm.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 05 Jul 2021 08:26:59 GMT
server: cafe
content-length: 28133
x-xss-protection: 0
set-cookie: IDE=AHWqTUnQ5UmpVROqAQu9cRtwfTqnfVHTgyKG0mjc4hT6HX3_7ODh66wsn0dOFxpxE4c; expires=Sat, 30-Jul-2022 08:26:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 05 Jul 2021 08:26:59 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame D57E 73 KB
25 KB 951ms
950ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=740684668&adf=1231177959&pi=t.aa~a.3843052896~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280&nras=3&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=1934&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=8xEsZiubVZ&p=https%3A//provdm.com&dtd=18

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

92eaaad05664ddfc940b3910ecb47161954b15581449efe72707e0cb908a5e58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=740684668&adf=1231177959&pi=t.aa~a.3843052896~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280&nras=3&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=1934&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=8xEsZiubVZ&p=https%3A//provdm.com&dtd=18
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://provdm.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://provdm.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 05 Jul 2021 08:26:59 GMT
server: cafe
content-length: 26049
x-xss-protection: 0
set-cookie: IDE=AHWqTUnAVLBHlClWUXoj2HTG0c9vt4Usb-UPRrQ0hxL_ao__xcMh9vQk9R0PppwkyT8; expires=Sat, 30-Jul-2022 08:26:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 05 Jul 2021 08:26:59 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 182D 61 KB
24 KB 581ms
580ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9dc9a3c53343f8687fe7c99a5c91d1823284406a0253424085aff56a56273d09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://provdm.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://provdm.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 05 Jul 2021 08:26:58 GMT
server: cafe
content-length: 24490
x-xss-protection: 0
set-cookie: IDE=AHWqTUlrnq9u6CX2W2S_A3HgcTDtJOqZs7DnjgvPlJVHRGgUIkyG6YFO1LG_Vqcevn8; expires=Sat, 30-Jul-2022 08:26:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 05 Jul 2021 08:26:58 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 5735 53 KB
17 KB 368ms
367ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=1116290991&pi=t.aa~a.2730154545~rp.1&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=1&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280%2C1140x90&nras=5&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3603&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=qKfVqTNViQ&p=https%3A//provdm.com&dtd=24

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

55b2f6d3176cb658efc0f6791b8bcad117073882f66a2f30b15dac31e56ce254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=1116290991&pi=t.aa~a.2730154545~rp.1&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=1&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280%2C1140x90&nras=5&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3603&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=qKfVqTNViQ&p=https%3A//provdm.com&dtd=24
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://provdm.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://provdm.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 05 Jul 2021 08:26:58 GMT
server: cafe
content-length: 17001
x-xss-protection: 0
set-cookie: IDE=AHWqTUljHULEWi2UJdsedsfAFWb0--E3iAFRdXGrljuntiUHgbvws9XwigC_IKcI1u4; expires=Sat, 30-Jul-2022 08:26:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 05 Jul 2021 08:26:58 GMT
cache-control: private

GET
H/1.1 200
OK get_counts Show response
count-server.sharethis.com/v2.0/ 138 B
384 B 474ms
150ms Script
text/javascript 3.130.50.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://count-server.sharethis.com/v2.0/get_counts?cb=window.__sharethis__.cb2&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam
Requested by: Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.130.50.33 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-130-50-33.us-east-2.compute.amazonaws.com
Software: / Express
Resource Hash: 602ae368dc0ad21937a1c9dae6ec56de283c88a3b0e5fcd26ce933c0e6a447c6

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 08:26:58 GMT
Cache-Control: public, max-age=900
ETag: 6bf8e26bf6abe7b7715add3c5ee9d505
Connection: keep-alive
X-Powered-By: Express
Content-Length: 138
Content-Type: text/javascript; charset=utf-8

GET
H2 200 facebook.svg
platform-cdn.sharethis.com/img/ 301 B
679 B 42ms
10ms Image
image/svg+xml 2600:9000:2156:9200:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform-cdn.sharethis.com/img/facebook.svg
Requested by: Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Wed, 16 Jun 2021 02:42:02 GMT
via: 1.1 45de888accabe1a1cb5a389e8c9c1e07.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
server: AmazonS3
age: 1662297
etag: "c6e9be45643e197ce1db1d7e24a99adc"
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 301
x-amz-cf-id: BiD_kLCCSSQj1uTk8Vp6s87IJ9ZQgpC4vGuY_XF9ARSxkTDuWjcRNQ==

GET
H2 200 twitter.svg
platform-cdn.sharethis.com/img/ 731 B
1 KB 42ms
11ms Image
image/svg+xml 2600:9000:2156:9200:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform-cdn.sharethis.com/img/twitter.svg
Requested by: Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Sat, 19 Jun 2021 12:02:46 GMT
via: 1.1 45de888accabe1a1cb5a389e8c9c1e07.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
server: AmazonS3
age: 1369453
etag: "0af2fb38987598376c99e21af17ade45"
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 731
x-amz-cf-id: nD142izD6KEfJajcMLDkgUmL7IpX4Zj_fYIu9v_iGaUdIhdTe512Tg==

GET
H2 200 pinterest.svg
platform-cdn.sharethis.com/img/ 771 B
1 KB 42ms
11ms Image
image/svg+xml 2600:9000:2156:9200:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform-cdn.sharethis.com/img/pinterest.svg
Requested by: Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: efc737b4f58cfe73a9bd0e57d7570365701381da31e628b269e7217a0ce3359d

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Fri, 11 Jun 2021 11:03:51 GMT
via: 1.1 45de888accabe1a1cb5a389e8c9c1e07.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
server: AmazonS3
age: 2064188
etag: "2b10a062e719c64b686e2e8fcdc216dc"
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 771
x-amz-cf-id: V4bhsJLuwIzE0wHXzno8iaGXCnEDIsTNmdXSK2m6sCrhrnRrxhjkRg==

GET
H2 200 email.svg
platform-cdn.sharethis.com/img/ 343 B
721 B 42ms
11ms Image
image/svg+xml 2600:9000:2156:9200:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform-cdn.sharethis.com/img/email.svg
Requested by: Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Fri, 11 Jun 2021 00:33:37 GMT
via: 1.1 45de888accabe1a1cb5a389e8c9c1e07.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
server: AmazonS3
age: 2102002
etag: "5977437466e857c7ddcadda6f6d88c2a"
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 343
x-amz-cf-id: q7dHuogfJYrWvFgVk3g_36hLgGi2x_epuDIA1_voBzkP2tXqOxRf6w==

GET
H2 200 sharethis.svg
platform-cdn.sharethis.com/img/ 514 B
892 B 42ms
11ms Image
image/svg+xml 2600:9000:2156:9200:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform-cdn.sharethis.com/img/sharethis.svg
Requested by: Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 15 Jun 2021 20:31:22 GMT
via: 1.1 45de888accabe1a1cb5a389e8c9c1e07.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
server: AmazonS3
age: 1684537
etag: "deecdaa377907db5cc1722fc831670a1"
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 514
x-amz-cf-id: 9bC0zlQpbuVdGxjBDgkAa2i1zBJZrN0RHAKZl4tsLkAqwxa4ZouXVw==

GET
H3-29 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/ Frame 0D5D 52 KB
25 KB 8ms
8ms Stylesheet
text/css 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=en&v=TbD3vPFlUWKZD-9L4ZxB0HJI&k=6LcjoIgUAAAAACvaIGr5wV_aG_H13eMFy89N999Q&cb=vz8as77lqbg4

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:01:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1549
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25732
x-xss-protection: 0
last-modified: Mon, 28 Jun 2021 04:05:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 08:01:09 GMT

GET
H3-29 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/ Frame 0D5D 341 KB
133 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/TbD3vPFlUWKZD-9L4ZxB0HJI/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=en&v=TbD3vPFlUWKZD-9L4ZxB0HJI&k=6LcjoIgUAAAAACvaIGr5wV_aG_H13eMFy89N999Q&cb=vz8as77lqbg4

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

839392b626a00e09ce3ec77706959d551de27cca63c559fcd4a6415aef3e722a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:03:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1388
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 135961
x-xss-protection: 0
last-modified: Mon, 28 Jun 2021 04:05:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Jul 2022 08:03:50 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 5735 3 KB
578 B 23ms
22ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=1116290991&pi=t.aa~a.2730154545~rp.1&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=1&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280%2C1140x90&nras=5&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3603&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=qKfVqTNViQ&p=https%3A//provdm.com&dtd=24

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 07:19:20 GMT
server: ESF
date: Mon, 05 Jul 2021 08:26:58 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 05 Jul 2021 08:26:58 GMT

GET
H2 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 5735 1 KB
990 B 36ms
14ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:14:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 746
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:14:32 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 5735 17 KB
7 KB 27ms
5ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

013bec3910ad3d4838f46d1a0095d9e6f0ea3e676e786daf0147dce032b651b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7112
x-xss-protection: 0
server: cafe
etag: 12276874145846594193
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:26:09 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 5735 3 KB
1 KB 35ms
15ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:25:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:25:47 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5735 123 KB
37 KB 29ms
14ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af5a35708a776c4c51024ec463b3d21d04b1007cfc8286309c13ded97a4119e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:58 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625225346277716"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37896
x-xss-protection: 0
expires: Mon, 05 Jul 2021 08:26:58 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 5735 14 KB
6 KB 28ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:25:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 90
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:25:28 GMT

GET
H3-29 200 3a5e94886a53c84cf1384eecbc513cea.js Show response
www.gstatic.com/mysidia/ Frame 5735 25 KB
10 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/3a5e94886a53c84cf1384eecbc513cea.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

646ccb2bc6d5f34ef2196899f1cc72b43cc0df424b166f9cc93c58112c9377bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 03 Jul 2021 20:25:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 129664
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10696
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 18:22:34 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 01 Oct 2021 20:25:54 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 5735 0
0 42ms
42ms Fetch
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Ctmv1UsLiYJiOGYuJ7gPPsImQBbim3slj-uKfs7kN0-fp8fseEAEg6fnHSmCVAqABkpmr_ALIAQGoAwGqBLEBT9Cn-fUbFU2Z1lcEWNZBuIfa_4yqsF6v9ntPuwTCDFnFjud3pHCBEDwvajxpizVlhBtmN816eN4cn-an8JEaSskg_xxcxvGgTENlqeYtFS1roGGRpN7E2OSVxGrE2jj8Zz1ggdkfQMZc5wDZbK1xZssB8mdbmsSL5vYIpUrJjbaXTBOf4UcXwaCWuTpGxwVLCgAOplJs6Ymo62NVZsI-ymXkyr2aUqt5ddcpG2Lmsf7BwAT50PWZtAOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAYAH1ubUgwGoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQ4sUE0ggJCIDhgBAQARgfgAoByAsB2BMN0BUBmBYBgBcBshcaChgIABIUcHViLTY4MTc3Njc1MDU3NTg5NzA&sigh=qcTQ68XjEK0&template_id=5001

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=1116290991&pi=t.aa~a.2730154545~rp.1&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=1&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280%2C1140x90&nras=5&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3603&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=qKfVqTNViQ&p=https%3A//provdm.com&dtd=24
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 05 Jul 2021 08:26:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/14917255203208823081/ Frame 5735 2 KB
2 KB 30ms
15ms Image
image/jpeg 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14917255203208823081/downsize_200k_v1?w=100&h=100

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

734c2df9c65821f7c46650a222529e1644712fe3a603fb2d23f539c8266f8946

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 29 Jun 2021 18:15:38 GMT
x-content-type-options: nosniff
age: 483080
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1554
x-xss-protection: 0
last-modified: Thu, 22 Oct 2020 14:58:50 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Jun 2022 18:15:38 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 04B8 3 KB
578 B 18ms
14ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=2859905419&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618006&bpp=1&bdt=246&idt=117&shv=r20210630&ptt=9&saldr=aa&abxe=1&prev_fmts=1140x280&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3614&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeEbr%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=jhyMw3l4pC&p=https%3A//provdm.com&dtd=121

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 07:11:41 GMT
server: ESF
date: Mon, 05 Jul 2021 08:26:58 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 05 Jul 2021 08:26:58 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 1AB8 143 B
163 B 8ms
6ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=1116290991&pi=t.aa~a.2730154545~rp.1&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=1&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280%2C1140x90&nras=5&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3603&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=qKfVqTNViQ&p=https%3A//provdm.com&dtd=24
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUljHULEWi2UJdsedsfAFWb0--E3iAFRdXGrljuntiUHgbvws9XwigC_IKcI1u4; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=1116290991&pi=t.aa~a.2730154545~rp.1&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=1&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280%2C1140x90&nras=5&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3603&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=qKfVqTNViQ&p=https%3A//provdm.com&dtd=24

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 05 Jul 2021 07:57:41 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1757
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2A04 1 KB
749 B 8ms
6ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 04 Jul 2021 08:59:18 GMT
expires: Mon, 05 Jul 2021 08:59:18 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 84460
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 04B8 1 KB
909 B 25ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:14:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 746
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:14:32 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 04B8 17 KB
7 KB 24ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

013bec3910ad3d4838f46d1a0095d9e6f0ea3e676e786daf0147dce032b651b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7112
x-xss-protection: 0
server: cafe
etag: 12276874145846594193
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:26:09 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 04B8 3 KB
1 KB 21ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:25:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:25:47 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 04B8 123 KB
37 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af5a35708a776c4c51024ec463b3d21d04b1007cfc8286309c13ded97a4119e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:58 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625225346277716"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37896
x-xss-protection: 0
expires: Mon, 05 Jul 2021 08:26:58 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 04B8 14 KB
6 KB 18ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:25:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 90
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:25:28 GMT

GET
H3-29 200 3a5e94886a53c84cf1384eecbc513cea.js Show response
www.gstatic.com/mysidia/ Frame 04B8 25 KB
10 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/3a5e94886a53c84cf1384eecbc513cea.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

646ccb2bc6d5f34ef2196899f1cc72b43cc0df424b166f9cc93c58112c9377bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 03 Jul 2021 20:25:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 129664
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10696
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 18:22:34 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 01 Oct 2021 20:25:54 GMT

GET
H3-29 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/17105705476131918291/ Frame 04B8 95 KB
95 KB 19ms
9ms Image
image/jpeg 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17105705476131918291/downsize_200k_v1

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fe3a7d25c2f4ec7634ca930d425f0e3d87781915e44aea6a255062da535245e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Jul 2021 22:14:35 GMT
x-content-type-options: nosniff
age: 295943
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 96966
x-xss-protection: 0
last-modified: Tue, 06 Apr 2021 15:15:23 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Jul 2022 22:14:35 GMT

GET
DATA 200
OK truncated
/ Frame 04B8 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 04B8 0
0 47ms
47ms Fetch
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cfs8RUsLiYP7nCM6igAeoiJHwD6W9_Y9isrfR04EOwI23ARABIOn5x0pglQKgAZyM4boByAEJqQImElZgxOezPqgDAcgDywSqBLgBT9CQaV4lJoKc92Zpdp8TG7O7pu9NG9CRVFe2LG5m0CDVdonxX5psUNNARblYG7Q86W_CI77zkhwj2ZdnjyyqjfRMrNjPH8HCE1gnIM_RED_WKrwf6C6f-K2ZMLCZqvT7QkQ-IZWjCZi6JJOKHwxtCo_vcldI22pALq2Ggf9osS56ziQXCLN3K6G7QoUHYMU_ycfdJwFIBvNqCgrcKXyNOkBS1ItwEIdNFSlSxpQGz2bFVDveb7Lj8MAEpcrh_rkDkgUECAQYAZIFBAgFGASgBi6AB8zznsUCqAeKnLECqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEELO2CtIICQiA4YAQEAEYH4AKAcgLAbgTiCfYEwrQFQGAFwGyFxoKGAgAEhRwdWItNjgxNzc2NzUwNTc1ODk3MA&sigh=2-WqfCjHSU8&template_id=5000

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=2859905419&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618006&bpp=1&bdt=246&idt=117&shv=r20210630&ptt=9&saldr=aa&abxe=1&prev_fmts=1140x280&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=3614&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeEbr%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=jhyMw3l4pC&p=https%3A//provdm.com&dtd=121
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 05 Jul 2021 08:26:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 5735 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fa74615098d23afecb60ae573c69ff73f380fc3361588e80ce9e927f67a988fe

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 04B8 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a3480b3d549103c5f62a6c230697d3958a5aa674e9c975cfcd038cdc0827d0b4

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 04B8 21 KB
21 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 12:14:46 GMT
x-content-type-options: nosniff
age: 418333
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 12:14:46 GMT

GET
H3-29 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 04B8 21 KB
21 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 08:25:33 GMT
x-content-type-options: nosniff
age: 432086
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21552
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:16 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 08:25:33 GMT

GET
H3-29 200 7aca84fd6a3a248f1bbb3c321b834482.js Show response
www.gstatic.com/mysidia/ Frame 6903 7 KB
3 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7aca84fd6a3a248f1bbb3c321b834482.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c8859c39c7afe947dc42ecf0811268d4d711778725ad698e7f7af98e1e3f56da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 03 Jul 2021 12:58:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 156534
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2920
x-xss-protection: 0
last-modified: Wed, 23 Jun 2021 22:35:17 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 01 Oct 2021 12:58:05 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 6903 3 KB
578 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 07:11:40 GMT
server: ESF
date: Mon, 05 Jul 2021 08:26:59 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 05 Jul 2021 08:26:59 GMT

GET
H3-29 200 dd5bd7b5ea801a422f14dfa8402e492a.js Show response
www.gstatic.com/mysidia/ Frame 6903 10 KB
4 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/dd5bd7b5ea801a422f14dfa8402e492a.js?tag=pingback

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

71f63137adf19f2cb52ef4cc0470d0bc7d29554ee57cc390ed2abc246094edfe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 03 Jul 2021 12:58:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 156534
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4376
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 18:22:34 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 01 Oct 2021 12:58:05 GMT

GET
H3-29 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 6903 1 KB
909 B 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:14:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 747
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:14:32 GMT

GET
H3-29 200 278637ad7738bbf71fa7cabaa1f8a99a.js Show response
www.gstatic.com/mysidia/ Frame 6903 3 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/278637ad7738bbf71fa7cabaa1f8a99a.js?tag=analytics_pingback_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bf5b145648b3c4c81b277e5ec0ee321c1052dc4de01100837f51a285f6ab8b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 03 Jul 2021 12:58:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 156534
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1407
x-xss-protection: 0
last-modified: Wed, 23 Jun 2021 22:35:17 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 01 Oct 2021 12:58:05 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 6903 17 KB
7 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

013bec3910ad3d4838f46d1a0095d9e6f0ea3e676e786daf0147dce032b651b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7112
x-xss-protection: 0
server: cafe
etag: 12276874145846594193
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:26:09 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 6903 3 KB
1 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:25:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:25:47 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6903 123 KB
37 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af5a35708a776c4c51024ec463b3d21d04b1007cfc8286309c13ded97a4119e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:59 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625225346277716"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37896
x-xss-protection: 0
expires: Mon, 05 Jul 2021 08:26:59 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 6903 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:25:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:25:28 GMT

GET
H3-29 200 3a5e94886a53c84cf1384eecbc513cea.js Show response
www.gstatic.com/mysidia/ Frame 6903 25 KB
10 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/3a5e94886a53c84cf1384eecbc513cea.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

646ccb2bc6d5f34ef2196899f1cc72b43cc0df424b166f9cc93c58112c9377bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 03 Jul 2021 20:25:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 129665
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10696
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 18:22:34 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 01 Oct 2021 20:25:54 GMT

GET
H3-29 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 5735 21 KB
21 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 12:14:46 GMT
x-content-type-options: nosniff
age: 418333
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 12:14:46 GMT

GET
H3-29 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 5735 21 KB
21 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 08:25:33 GMT
x-content-type-options: nosniff
age: 432086
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21552
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:16 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 08:25:33 GMT

GET
H3-29 200 rHFBlN4oL05Ux9gYvr7a9rbt1s0P-Z7gKSgB9mRTgDU.js Show response
pagead2.googlesyndication.com/bg/ Frame 12CE 14 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rHFBlN4oL05Ux9gYvr7a9rbt1s0P-Z7gKSgB9mRTgDU.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac714194de282f4e54c7d818bebedaf6b6edd6cd0ff99ee0292801f664538035

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 02 Jul 2021 08:54:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 257545
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5752
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 02 Jul 2022 08:54:34 GMT

GET
H3-29 200 13946264361245217913
tpc.googlesyndication.com/simgad/ Frame 182D 29 KB
29 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13946264361245217913?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qm62q9VKDM9gvSoNe34UcxMxBGVCA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

59125c382ebec8eb8a6396b7b47d3d064d7e642d3010e6d4011a3630f7c97038

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 06:11:28 GMT
x-content-type-options: nosniff
last-modified: Thu, 24 Jun 2021 21:15:22 GMT
server: sffe
age: 8131
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29936
x-xss-protection: 0
expires: Tue, 05 Jul 2022 06:11:28 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 182D 17 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

013bec3910ad3d4838f46d1a0095d9e6f0ea3e676e786daf0147dce032b651b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7112
x-xss-protection: 0
server: cafe
etag: 12276874145846594193
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:26:09 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 182D 3 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:25:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:25:47 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 182D 123 KB
37 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af5a35708a776c4c51024ec463b3d21d04b1007cfc8286309c13ded97a4119e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:59 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625225346277716"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37896
x-xss-protection: 0
expires: Mon, 05 Jul 2021 08:26:59 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 182D 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:25:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:25:28 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 182D 0
0 14ms
13ms Image
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT5taqeG3ZWAR9PbmA2jkXnHNL7eMgvUpfGNfSRJgCWRWVdg_zuv9Iik-cN9SzAOyI3iXzUmzgphplFIGeIWS1n1xbadw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 182D 25 KB
10 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

db28bd9c2ec3c62e3265cc0aaee5f68c6e433b9855173a2ed151585f8965b68e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 07:56:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1800
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10681
x-xss-protection: 0
server: cafe
etag: 16033238240403784879
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 07:56:59 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 182D 0
0 43ms
42ms Fetch
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CNItDUsLiYIirGcf47gOEkKHABrrtorpj3qz9pfMNv-EeEAEg6fnHSmCVAqABmMLS0APIAQKoAwHIA8kEqgStAU_QA2xXAWFbmdq9QLYsCyoSvR_q8jl3MKzlxnC-lCuqWnlOr2T_hnzQjwsugEbTW6fDGFRkig_a45Fps6I7X3kTjsFv8FNAdOKY5tfrvOK-7i5lw9ShycCGXevcokNf9wwfmhIV5H4U-xWJWdZiRXuwGO1OBED2HCRwA4H3AGjnogUNLNY6Wk1mIGDS8aCl_WJ3syTFcZI-FKn_frhTnRAGFyRGyVifxeTUE37uwATrycvRzAOSBQQIBBgBkgUECAUYBKAGAoAH0L2tL6gHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBCnlw3SCAkIgOGAEBABGB-ACgHICwHYEwLQFQGAFwGyFxoKGAgAEhRwdWItNjgxNzc2NzUwNTc1ODk3MA&sigh=ocr7Z96vtiA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 05 Jul 2021 08:26:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 dpixel
cms.quantserve.com/ Frame 2A04 35 B
464 B 33ms
12ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESECkrLETiIktkv8enVMe0WPA&google_cver=1&google_push=AYg5qPJ8C5iq4kOlfiIdUrBk6LmPgd5KMtcEVaX7QjKYXl3ePifETm1tGDC-G-DiXgHAn1p117-v09x2jz-64TVxZaf47S8FDXKm

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 2A04
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPJ9kmLaLa5jbCoDYmmcmlePnhNtOZfNXO9V5tL...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU9MQ1V3QUFCQUJ0dnpzeQ&google_push=AYg5qPJ9kmLaLa5jbCoDYmmcmlePnhNtOZfNXO9V5tLVuapVsMs5RhGrX9jhVOXJhwu53MBG9dtvMQKUy6WD_RpJt-WkGn3TT-Q

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU9MQ1V3QUFCQUJ0dnpzeQ&google_push=AYg5qPJ9kmLaLa5jbCoDYmmcmlePnhNtOZfNXO9V5tLVuapVsMs5RhGrX9jhVOXJhwu53MBG9dtvMQKUy6WD_RpJt-WkGn3TT-Q

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU9MQ1V3QUFCQUJ0dnpzeQ&google_push=AYg5qPJ9kmLaLa5jbCoDYmmcmlePnhNtOZfNXO9V5tLVuapVsMs5RhGrX9jhVOXJhwu53MBG9dtvMQKUy6WD_RpJt-WkGn3TT-Q
Date: Mon, 05 Jul 2021 08:26:59 GMT
Server: Apache
Connection: keep-alive
Content-Length: 390
Content-Type: text/html; charset=iso-8859-1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 2A04
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESELsH8nvdot2jwtL9UZZblZ0&google_cver=1&google_push=AYg5qPIGVv9yZfmfvPyl8MfpmE2x2Q-xLaMk_nj37HhI3zj_B6mu48t60BVvyfsJCcxUC1RuWQq8bx5O608G7QyPMi5Hye3KVPo
https://rtb.openx.net/sync/dds?google_gid=CAESELsH8nvdot2jwtL9UZZblZ0&google_cver=1&google_push=AYg5qPIGVv9yZfmfvPyl8MfpmE2x2Q-xLaMk_nj37HhI3zj_B6mu48t60BVvyfsJCcxUC1RuWQq8bx5O608G7QyPMi5Hye3KVPo&o...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIGVv9yZfmfvPyl8MfpmE2x2Q-xLaMk_nj37HhI3zj_B6mu48t60BVvyfsJCcxUC1RuWQq8bx5O608G7QyPMi5Hye3KVPo&google_hm=2TaesS8eyLU6RTC5sa0RXw==

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIGVv9yZfmfvPyl8MfpmE2x2Q-xLaMk_nj37HhI3zj_B6mu48t60BVvyfsJCcxUC1RuWQq8bx5O608G7QyPMi5Hye3KVPo&google_hm=2TaesS8eyLU6RTC5sa0RXw==

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:58 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIGVv9yZfmfvPyl8MfpmE2x2Q-xLaMk_nj37HhI3zj_B6mu48t60BVvyfsJCcxUC1RuWQq8bx5O608G7QyPMi5Hye3KVPo&google_hm=2TaesS8eyLU6RTC5sa0RXw==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: hu36brp9ujtaoo0ufvfcubafp73qetmf

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 2A04
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_x1bgkWQSFWBIomF9tmnQA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_x1bgkWQSFWBIomF9tmnQA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJmNgT1Ctyk7TpEhtFn9NNJL8MutK15nS3_f7xK_yoRBzoHTw6_BJoZ6OvWcC1yjwclJMsOaHG7dX2e23FhJAMrufBYk_IA

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_x1bgkWQSFWBIomF9tmnQA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJmNgT1Ctyk7TpEhtFn9NNJL8MutK15nS3_f7xK_yoRBzoHTw6_BJoZ6OvWcC1yjwclJMsOaHG7dX2e23FhJAMrufBYk_IA
date: Mon, 05 Jul 2021 08:26:58 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 2A04
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJc8v-ekozvKJv_QxXBbgRc&google_cver=1&google_push=AYg5qPL9moYgL4fJTLQnOMWtoEH6deOG5tqIVvpwfXkkTghqdMT9NHHXxry692GCKzKIc_71Zpi...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRRDBWSkktMjItSE8xOQ==&google_push=AYg5qPL9moYgL4fJTLQnOMWtoEH6deOG5tqIVvpwfXkkTghqdMT9NHHXxry692GCKzKIc_71ZpizUBJMYX2Z0qQ2iFWYhY6QSN96

170 B
188 B

25ms
24ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRRDBWSkktMjItSE8xOQ==&google_push=AYg5qPL9moYgL4fJTLQnOMWtoEH6deOG5tqIVvpwfXkkTghqdMT9NHHXxry692GCKzKIc_71ZpizUBJMYX2Z0qQ2iFWYhY6QSN96

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRRDBWSkktMjItSE8xOQ==&google_push=AYg5qPL9moYgL4fJTLQnOMWtoEH6deOG5tqIVvpwfXkkTghqdMT9NHHXxry692GCKzKIc_71ZpizUBJMYX2Z0qQ2iFWYhY6QSN96
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 2A04
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7...

0
0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 2A04
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEPHaps8BPVZh2BeGP1OumRE&google_cver=1&google_push=AYg5qPLSIGFzVfL6QnSU8UEd...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLSIGFzVfL6QnSU8UEdVXMUsAXbwAANPCtJea85h8F3WTgHXqw6yIW63V0PDI7m_XfvzvQKE9Qc9Erp6XSwdZbHeeuZ8owF&google_hm=

170 B
188 B

16ms
15ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLSIGFzVfL6QnSU8UEdVXMUsAXbwAANPCtJea85h8F3WTgHXqw6yIW63V0PDI7m_XfvzvQKE9Qc9Erp6XSwdZbHeeuZ8owF&google_hm=

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLSIGFzVfL6QnSU8UEdVXMUsAXbwAANPCtJea85h8F3WTgHXqw6yIW63V0PDI7m_XfvzvQKE9Qc9Erp6XSwdZbHeeuZ8owF&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Sun, 04 Jul 2021 08:26:59 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 2A04 0
253 B 39ms
14ms Image
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KKtYRPGjFAXiW82XPx2RfUP0Jzj7cxI9b8FIeRE06R-sGNu-m--Z0xXO8yCC6pm7o9XPB9sw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/15415938589377353232/ Frame 6903 26 KB
26 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15415938589377353232/downsize_200k_v1?w=600&h=314

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

56072ca1af64c8875693534c66c8d5a0a6d2e4d0217abe0035f990f45ba5b003

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 08:10:41 GMT
x-content-type-options: nosniff
age: 432978
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26699
x-xss-protection: 0
last-modified: Tue, 09 Mar 2021 22:42:49 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 08:10:41 GMT

GET
DATA 200
OK truncated
/ Frame 6903 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0594e5880994f1656bc457a6d35f95f3800f0b993edfeef0b72f86ed838224c0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 1AB8
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

38ms
38ms

Document
text/html

2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlrnq9u6CX2W2S_A3HgcTDtJOqZs7DnjgvPlJVHRGgUIkyG6YFO1LG_Vqcevn8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 05 Jul 2021 08:26:59 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Mon, 05-Jul-2021 09:26:59 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 05 Jul 2021 08:26:59 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 05 Jul 2021 08:26:59 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6903 0
20 B 39ms
39ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=CgoIASoGYmFubmVyCgoIAioGc2VydmVyCjoIBCo2bXlzaWRpYV9hbmFseXRpY3NfZXhwMSxkaXNhYmxlX2h5YnJpZF93cmFwcGVyX29uX2ltYWdlCgUIBioBMAoNEAMhAAAAzMwEj0AwBBIaQ0x6WTU0ekJ5X0VDRmRaVTRBb2RZSTBFZ3ciCXRleHQvcnl1aygV

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/dd5bd7b5ea801a422f14dfa8402e492a.js?tag=pingback

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6903 0
20 B 39ms
38ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=CgoIASoGYmFubmVyCgoIAioGc2VydmVyCjoIBCo2bXlzaWRpYV9hbmFseXRpY3NfZXhwMSxkaXNhYmxlX2h5YnJpZF93cmFwcGVyX29uX2ltYWdlCgUIBioBMAoNEAohAAAAAJyZAUAwBBIaQ0x6WTU0ekJ5X0VDRmRaVTRBb2RZSTBFZ3ciCXRleHQvcnl1aygV

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/dd5bd7b5ea801a422f14dfa8402e492a.js?tag=pingback

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6903 0
20 B 39ms
38ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=CgoIASoGYmFubmVyCgoIAioGc2VydmVyCjoIBCo2bXlzaWRpYV9hbmFseXRpY3NfZXhwMSxkaXNhYmxlX2h5YnJpZF93cmFwcGVyX29uX2ltYWdlCgUIBioBMAoNEA0hAAAAAAAAAAAwBAoOEB4qCDExNDB4MjgwMAQKDhAZKggxMTQweDI4MDAEEhpDTHpZNTR6QnlfRUNGZFpVNEFvZFlJMEVndyIJdGV4dC9yeXVrKBU=

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/dd5bd7b5ea801a422f14dfa8402e492a.js?tag=pingback

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6903 0
20 B 39ms
39ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=CgoIASoGYmFubmVyCgoIAioGc2VydmVyCjoIBCo2bXlzaWRpYV9hbmFseXRpY3NfZXhwMSxkaXNhYmxlX2h5YnJpZF93cmFwcGVyX29uX2ltYWdlCgUIBioBMAoNEA4hAAAAAAAAAAAwBBIaQ0x6WTU0ekJ5X0VDRmRaVTRBb2RZSTBFZ3ciCXRleHQvcnl1aygV

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/dd5bd7b5ea801a422f14dfa8402e492a.js?tag=pingback

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6903 0
20 B 39ms
38ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=CgoIASoGYmFubmVyCgoIAioGc2VydmVyCjoIBCo2bXlzaWRpYV9hbmFseXRpY3NfZXhwMSxkaXNhYmxlX2h5YnJpZF93cmFwcGVyX29uX2ltYWdlCgUIBioBMAoNEBAhAAAAAMAP2UAwBAoNEBEhAAAAAIAeykAwBAoNEBIhAAAAAAAAEEAwBAoNEBMhAAAAAAAAAEAwBAoNEAQhAAAAAABEj0AwBBIaQ0x6WTU0ekJ5X0VDRmRaVTRBb2RZSTBFZ3ciCXRleHQvcnl1aygV

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/dd5bd7b5ea801a422f14dfa8402e492a.js?tag=pingback

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6903 0
20 B 39ms
39ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=CgoIASoGYmFubmVyCgoIAioGc2VydmVyCjoIBCo2bXlzaWRpYV9hbmFseXRpY3NfZXhwMSxkaXNhYmxlX2h5YnJpZF93cmFwcGVyX29uX2ltYWdlCgUIBioBMAoNEA8hAAAAAICZuT8wBBIaQ0x6WTU0ekJ5X0VDRmRaVTRBb2RZSTBFZ3ciCXRleHQvcnl1aygV

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/dd5bd7b5ea801a422f14dfa8402e492a.js?tag=pingback

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6903 0
20 B 39ms
38ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=CgoIASoGYmFubmVyCgoIAioGc2VydmVyCjoIBCo2bXlzaWRpYV9hbmFseXRpY3NfZXhwMSxkaXNhYmxlX2h5YnJpZF93cmFwcGVyX29uX2ltYWdlCgUIBioBMAoNEBQhAAAAAIA_y0AwBAoNEBUhAAAAAAAAGEAwBAoNEBYhAAAAAAAACEAwBAoNEAUhAAAAAABQj0AwBBIaQ0x6WTU0ekJ5X0VDRmRaVTRBb2RZSTBFZ3ciCXRleHQvcnl1aygV

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/dd5bd7b5ea801a422f14dfa8402e492a.js?tag=pingback

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 6903 0
0 43ms
43ms Fetch
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Ci8pDUsLiYLznCNapgQfgmpKYCKnaw-Rh7P7pqasNg5nnqL8hEAEg6fnHSmCVAqABi9z6mgPIAQmpAic4vsI3O6s-qAMByAPLBKoErQFP0FXX9OL5CwpeAlFqPypLOCsKdB648aokjDs3Pp3oWaWkLYDjxNQvFKqJ2EVx1ZmHicgtn3rmX0QeN5EetoB2N42-PivyKSeOxTlw7K3kn8T9CuqBVFWiq5kfko0P29UeyAWNeACEpO6MoTr7ilz76xOCX0HwOuzve-Ra3IrluWYtxzgQTPrap_StBUvSBmj0rav8_dqpGGuw-i_jOJ7ZRHHMqQE9LxCbg6F09cAE35mQ1bgDkgUECAQYAZIFBAgFGASgBi6AB92jhWWoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwDyBwQQtvcS0ggJCIDhgBAQARgfgAoByAsBuBOIJ9gTDdAVAZgWAYAXAbIXGgoYCAASFHB1Yi02ODE3NzY3NTA1NzU4OTcw&sigh=UfDx7tOZdoQ&template_id=5000

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 05 Jul 2021 08:26:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E21B 143 B
163 B 6ms
5ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlrnq9u6CX2W2S_A3HgcTDtJOqZs7DnjgvPlJVHRGgUIkyG6YFO1LG_Vqcevn8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 05 Jul 2021 07:57:41 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1758
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 redir.html Show response
p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 30E4 247 B
803 B 50ms
14ms Document
text/html 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

0fa0dd7feaffdfac233975771603a95f7211ee7827e83031d4136c8bcc10e63c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com
:scheme: https
:path: /v6exp3/redir.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-0QqbpSbtOrWyuxeh5y-2VQ' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
cross-origin-resource-policy: cross-origin
content-length: 201
date: Mon, 05 Jul 2021 08:26:59 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Mon, 02 Dec 2019 20:15:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame A3FC 1 KB
749 B 8ms
6ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 04 Jul 2021 08:59:18 GMT
expires: Mon, 05 Jul 2021 08:59:18 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 84461
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 182D 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5c442497b67dd7ea19b999fc31744194ceab2f51635b4036af408541a28e2387

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 1DFF 143 B
163 B 6ms
5ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlrnq9u6CX2W2S_A3HgcTDtJOqZs7DnjgvPlJVHRGgUIkyG6YFO1LG_Vqcevn8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 05 Jul 2021 07:57:41 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1758
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6903 0
20 B 39ms
38ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=CgoIASoGYmFubmVyCgoIAioGc2VydmVyCjoIBCo2bXlzaWRpYV9hbmFseXRpY3NfZXhwMSxkaXNhYmxlX2h5YnJpZF93cmFwcGVyX29uX2ltYWdlCgUIBioBMAoNEBchAAAAAAD4kEAwBBIaQ0x6WTU0ekJ5X0VDRmRaVTRBb2RZSTBFZ3ciCXRleHQvcnl1aygV

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/dd5bd7b5ea801a422f14dfa8402e492a.js?tag=pingback

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 6903 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bc29696a70eefc95ef0b56f7d1cbc4b55a1038e0f10c58e9b722583b83df180b

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 6903 21 KB
21 KB 8ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 12:14:46 GMT
x-content-type-options: nosniff
age: 418333
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 12:14:46 GMT

GET
H3-29 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 6903 21 KB
21 KB 9ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 08:25:33 GMT
x-content-type-options: nosniff
age: 432086
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21552
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:16 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 08:25:33 GMT

GET
H3-29 200 iframe.html Show response
p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 30E4 4 KB
2 KB 29ms
15ms Document
text/html 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html

Requested by

Host: p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com
URL: https://p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

707d3528c01604e70ea3faccbd8d5a29e70ad1d3db292c3a816b68e6f0c7d78b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com
:scheme: https
:path: /v6exp3/iframe.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-xLFizb2pbYJA5LEzz2kS6g' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
cross-origin-resource-policy: cross-origin
content-length: 1861
date: Mon, 05 Jul 2021 08:26:59 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Thu, 29 Apr 2021 21:38:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame A3FC
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEIw8ThITglO-OdIM00bvI4U&google_cver=1&google_push=AYg5qPLiV2fKVu5rUMF3070fBLbHFMabEkXETJqwwSaanJVRvxe3-OpjZ6...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLiV2fKVu5rUMF3070fBLbHFMabEkXETJqwwSaanJVRvxe3-OpjZ6HvE3WTFbFQcfM8f87rxh6YTGayE3KNiwKGQp-AKaq-&google_hm=No-Fjk...

170 B
188 B

18ms
16ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLiV2fKVu5rUMF3070fBLbHFMabEkXETJqwwSaanJVRvxe3-OpjZ6HvE3WTFbFQcfM8f87rxh6YTGayE3KNiwKGQp-AKaq-&google_hm=No-FjkErnGu5waEM29ompw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLiV2fKVu5rUMF3070fBLbHFMabEkXETJqwwSaanJVRvxe3-OpjZ6HvE3WTFbFQcfM8f87rxh6YTGayE3KNiwKGQp-AKaq-&google_hm=No-FjkErnGu5waEM29ompw
pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame A3FC
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPK2uq40...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPK2uq40...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA3MDUwODI2NTk1NDI0NTA4ODY4ODIzMw%3D%3D&google_push=AYg5qPK2uq400Kuh3UDm2gQtz6M2uwiF60pv1oRkPTwQ2rSJSyqdD2X21AcsOg4C_JHrS7...

170 B
188 B

16ms
16ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA3MDUwODI2NTk1NDI0NTA4ODY4ODIzMw%3D%3D&google_push=AYg5qPK2uq400Kuh3UDm2gQtz6M2uwiF60pv1oRkPTwQ2rSJSyqdD2X21AcsOg4C_JHrS7ddDIwYiHBJTwkTOdF2NFmKx2QB-CP0

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA3MDUwODI2NTk1NDI0NTA4ODY4ODIzMw%3D%3D&google_push=AYg5qPK2uq400Kuh3UDm2gQtz6M2uwiF60pv1oRkPTwQ2rSJSyqdD2X21AcsOg4C_JHrS7ddDIwYiHBJTwkTOdF2NFmKx2QB-CP0
pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Mon, 05 Jul 2021 08:26:59 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame A3FC
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEJyxEE50E8nzbUYFbjEoxIg&google_cver=1&google_push=AYg5qPLRlkK5yexrDyXnkdafj1vSdPJgqP4hHsaRs_qX28VVM9NcsZ-M37O2IOlZRRDaxmAFDyriL_QLJTNOiFsOMgKlmO1Nf_n6
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLRlkK5yexrDyXnkdafj1vSdPJgqP4hHsaRs_qX28VVM9NcsZ-M37O2IOlZRRDaxmAFDyriL_QLJTNOiFsOMgKlmO1Nf_n6&google_hm=2TaesS8eyLU6RTC5sa0RXw==

170 B
188 B

18ms
18ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLRlkK5yexrDyXnkdafj1vSdPJgqP4hHsaRs_qX28VVM9NcsZ-M37O2IOlZRRDaxmAFDyriL_QLJTNOiFsOMgKlmO1Nf_n6&google_hm=2TaesS8eyLU6RTC5sa0RXw==

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:58 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLRlkK5yexrDyXnkdafj1vSdPJgqP4hHsaRs_qX28VVM9NcsZ-M37O2IOlZRRDaxmAFDyriL_QLJTNOiFsOMgKlmO1Nf_n6&google_hm=2TaesS8eyLU6RTC5sa0RXw==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: ndcu2mllimp42ndcgmbsf898its6vk34

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame A3FC
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_x1bgkWQSFWBIomF9tmnQA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_x1bgkWQSFWBIomF9tmnQA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLuanTdECO62mfTAKYYluUMK3J1d1goEcP0A6NDUzB3J0VooMnCGo9QAqYh0eHryh4tLJ6sJjCerTW0tUWTXLFq00FKlkFo

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_x1bgkWQSFWBIomF9tmnQA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLuanTdECO62mfTAKYYluUMK3J1d1goEcP0A6NDUzB3J0VooMnCGo9QAqYh0eHryh4tLJ6sJjCerTW0tUWTXLFq00FKlkFo
date: Mon, 05 Jul 2021 08:26:58 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame A3FC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJw-CE8lH9F4ezfStUGR2r0&google_cver=1&google_push=AYg5qPLlKuagbEu2eKX7DSINhm5pJ7ZUsdeZ8QNuiFvuei2SAELDObZwtQfK9UvCmjx4R0H-9Q6...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRRDBWUFEtMjMtTDZXRw==&google_push=AYg5qPLlKuagbEu2eKX7DSINhm5pJ7ZUsdeZ8QNuiFvuei2SAELDObZwtQfK9UvCmjx4R0H-9Q6matGZzixh-NoXVQz9VrvzDiGx

170 B
188 B

19ms
19ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRRDBWUFEtMjMtTDZXRw==&google_push=AYg5qPLlKuagbEu2eKX7DSINhm5pJ7ZUsdeZ8QNuiFvuei2SAELDObZwtQfK9UvCmjx4R0H-9Q6matGZzixh-NoXVQz9VrvzDiGx

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRRDBWUFEtMjMtTDZXRw==&google_push=AYg5qPLlKuagbEu2eKX7DSINhm5pJ7ZUsdeZ8QNuiFvuei2SAELDObZwtQfK9UvCmjx4R0H-9Q6matGZzixh-NoXVQz9VrvzDiGx
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame A3FC
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQy...

0
0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame A3FC
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESENAAyvMA8eImM5BesaG4P_E&google_cver=1&google_push=AYg5qPJVj1r4mip8MHsKvik5...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJVj1r4mip8MHsKvik5XnM5lcFnN0oUSUJmI3h5hQ8YaAEfU_6CZcuMJPai9YzHznBE3D9iFKiboZncfKLj8vlOekYSfUod2Q&google_hm=

170 B
188 B

22ms
18ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJVj1r4mip8MHsKvik5XnM5lcFnN0oUSUJmI3h5hQ8YaAEfU_6CZcuMJPai9YzHznBE3D9iFKiboZncfKLj8vlOekYSfUod2Q&google_hm=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJVj1r4mip8MHsKvik5XnM5lcFnN0oUSUJmI3h5hQ8YaAEfU_6CZcuMJPai9YzHznBE3D9iFKiboZncfKLj8vlOekYSfUod2Q&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Sun, 04 Jul 2021 08:26:59 GMT

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame A3FC 0
12 B 16ms
15ms Image
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IHb4_POppFplIkKR4WtNMdFXKjzwXPxAxgAoWEvggTdlYGflf77lFtI0rhf00VK_KfmGWVHQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6903 0
20 B 40ms
39ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=CgoIASoGYmFubmVyCgoIAioGc2VydmVyCjoIBCo2bXlzaWRpYV9hbmFseXRpY3NfZXhwMSxkaXNhYmxlX2h5YnJpZF93cmFwcGVyX29uX2ltYWdlCgUIBioBMAoNEBghAAAAZmYek0AwBBIaQ0x6WTU0ekJ5X0VDRmRaVTRBb2RZSTBFZ3ciCXRleHQvcnl1aygV

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/dd5bd7b5ea801a422f14dfa8402e492a.js?tag=pingback

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E21B
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

40ms
39ms

Document
text/html

2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUnAVLBHlClWUXoj2HTG0c9vt4Usb-UPRrQ0hxL_ao__xcMh9vQk9R0PppwkyT8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 05 Jul 2021 08:26:59 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Mon, 05-Jul-2021 09:26:59 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 05 Jul 2021 08:26:59 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 05 Jul 2021 08:26:59 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 1DFF
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

42ms
41ms

Document
text/html

2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUnAVLBHlClWUXoj2HTG0c9vt4Usb-UPRrQ0hxL_ao__xcMh9vQk9R0PppwkyT8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 05 Jul 2021 08:26:59 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Mon, 05-Jul-2021 09:26:59 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 05 Jul 2021 08:26:59 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 05 Jul 2021 08:26:59 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 rHFBlN4oL05Ux9gYvr7a9rbt1s0P-Z7gKSgB9mRTgDU.js Show response
pagead2.googlesyndication.com/bg/ Frame 9D64 14 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rHFBlN4oL05Ux9gYvr7a9rbt1s0P-Z7gKSgB9mRTgDU.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&slotname=5289409372&adk=803367059&adf=1621880502&pi=t.ma~as.5289409372&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618001&bpp=5&bdt=240&idt=88&shv=r20210630&ptt=9&saldr=aa&abxe=1&correlator=3801006025848&frm=20&pv=2&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=66&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Co%7CpeE%7C&abl=NS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RAFLLIKX2Y&p=https%3A//provdm.com&dtd=110

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac714194de282f4e54c7d818bebedaf6b6edd6cd0ff99ee0292801f664538035

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 02 Jul 2021 08:54:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 257545
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5752
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 02 Jul 2022 08:54:34 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame D57E 3 KB
578 B 18ms
15ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=740684668&adf=1231177959&pi=t.aa~a.3843052896~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280&nras=3&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=1934&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=8xEsZiubVZ&p=https%3A//provdm.com&dtd=18

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 07:09:06 GMT
server: ESF
date: Mon, 05 Jul 2021 08:26:59 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 05 Jul 2021 08:26:59 GMT

GET
H3-29 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame D57E 1 KB
909 B 8ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:14:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 747
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:14:32 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame D57E 17 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

013bec3910ad3d4838f46d1a0095d9e6f0ea3e676e786daf0147dce032b651b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7112
x-xss-protection: 0
server: cafe
etag: 12276874145846594193
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:26:09 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame D57E 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:25:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:25:47 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D57E 123 KB
37 KB 21ms
14ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af5a35708a776c4c51024ec463b3d21d04b1007cfc8286309c13ded97a4119e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:59 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625225346277716"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37896
x-xss-protection: 0
expires: Mon, 05 Jul 2021 08:26:59 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame D57E 14 KB
6 KB 12ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:25:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:25:28 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame D57E 0
0 20ms
14ms Image
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTjYSd28m-uQqTom-KKBNvHqq55Kd-yHAbon4sAf2O4qlTgbZDfbeL1-iQT8RyQwqAS5H_s0fYaLbFYaAMQLs-xqYq46w
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=740684668&adf=1231177959&pi=t.aa~a.3843052896~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280&nras=3&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=1934&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=8xEsZiubVZ&p=https%3A//provdm.com&dtd=18
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 3a5e94886a53c84cf1384eecbc513cea.js Show response
www.gstatic.com/mysidia/ Frame D57E 25 KB
10 KB 12ms
7ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/3a5e94886a53c84cf1384eecbc513cea.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

646ccb2bc6d5f34ef2196899f1cc72b43cc0df424b166f9cc93c58112c9377bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 03 Jul 2021 20:25:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 129665
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10696
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 18:22:34 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 01 Oct 2021 20:25:54 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame D57E 0
0 45ms
41ms Fetch
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C__0xUsLiYOneGIGN7gOmsqpQ7snismL0wpfeqgzAjbcBEAEg6fnHSmCVAqABlbnLhQPIAQGoAwHIA8MEqgSxAU_Q927q9Cdwou_hjQNbQZsbw7_c_Ow6kcdsfd3iRJ56O_LYdKSrqnvYhCewNMQhOazD2Gre3JCn5BVS3mK1cupP-uwoPj-ksOy6R6-AJ2upUSeQ5IZuojYI29Ua1tUMkEUn5l4ShThdXjvmZNswFWHhIbr6Bmv-68TzHqueCfcJbZIddF2z1p6ghbI1cWFSbdRP9pYVjtzsNAf46BTX7SP7kcPEJPkmG7fuNOhmeb_mpcAE5qqXvZwDkgUECAQYAZIFBAgFGASgBlGAB9PGtHqoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQ4fcb0ggJCIDhgBAQARgfgAoByAsB2BMK0BUBmBYBgBcBshcaChgIABIUcHViLTY4MTc3Njc1MDU3NTg5NzA&sigh=pOJkYhb49xI

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=740684668&adf=1231177959&pi=t.aa~a.3843052896~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280&nras=3&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=1934&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=8xEsZiubVZ&p=https%3A//provdm.com&dtd=18
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 05 Jul 2021 08:26:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D8E6 143 B
163 B 6ms
5ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=740684668&adf=1231177959&pi=t.aa~a.3843052896~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280&nras=3&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=1934&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=8xEsZiubVZ&p=https%3A//provdm.com&dtd=18
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUnAVLBHlClWUXoj2HTG0c9vt4Usb-UPRrQ0hxL_ao__xcMh9vQk9R0PppwkyT8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=740684668&adf=1231177959&pi=t.aa~a.3843052896~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280&nras=3&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=1934&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=8xEsZiubVZ&p=https%3A//provdm.com&dtd=18

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 05 Jul 2021 07:57:41 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1758
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D4C1 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 04 Jul 2021 08:59:18 GMT
expires: Mon, 05 Jul 2021 08:59:18 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 84461
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame D57E 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cc74c1f146d36918e1546217effe973a065673810228ea6225af5ca6d83884a7

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 rHFBlN4oL05Ux9gYvr7a9rbt1s0P-Z7gKSgB9mRTgDU.js Show response
pagead2.googlesyndication.com/bg/ Frame A684 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rHFBlN4oL05Ux9gYvr7a9rbt1s0P-Z7gKSgB9mRTgDU.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=90&adk=1028048724&adf=645977371&pi=t.aa~a.3843053961~rp.4&w=1140&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1140x90&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=1&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0%2C1108x280%2C1140x280&nras=4&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=230&ady=2847&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wV6zbXOOGA&p=https%3A//provdm.com&dtd=21

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac714194de282f4e54c7d818bebedaf6b6edd6cd0ff99ee0292801f664538035

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 02 Jul 2021 08:54:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 257545
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5752
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 02 Jul 2022 08:54:34 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D4C1
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEGpNKb5_zBHISlQtQ6Q1Vak&google_cver=1&google_push=AYg5qPKJNCmS7uQmnjPlM2RTvatH4PPDuwXFVW9aAk8faTo17xoy5IVdP0...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKJNCmS7uQmnjPlM2RTvatH4PPDuwXFVW9aAk8faTo17xoy5IVdP0XgTuFZ2EJkCWtNV2zqHIXeLthC9WLLS9Lq6JOQwnCZ&google_hm=No-Fjk...

170 B
188 B

20ms
16ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKJNCmS7uQmnjPlM2RTvatH4PPDuwXFVW9aAk8faTo17xoy5IVdP0XgTuFZ2EJkCWtNV2zqHIXeLthC9WLLS9Lq6JOQwnCZ&google_hm=No-FjkErnGu5waEM29ompw

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKJNCmS7uQmnjPlM2RTvatH4PPDuwXFVW9aAk8faTo17xoy5IVdP0XgTuFZ2EJkCWtNV2zqHIXeLthC9WLLS9Lq6JOQwnCZ&google_hm=No-FjkErnGu5waEM29ompw
pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D4C1
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPK7UpYDBtEsltUOhEXfGKJ0aSJTKHy8D-QX-p1BBnSiN7_kokdHKD2iMbH6WOy5MJgmtKiNrvkFyDBflOhXeiCdGq75QV1g&google_gid=CAESENHH9x-OukCUBdVNGJ7BN9s&goo...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCNOEi4cGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BWWc1cVBLN1VwWURCdEVzbHRVT2hFWGZHS0owYVNKVEtIeThELVFYLXAxQkJuU2lON19rb2tkSEtEMmlNYkg2V095NU1KZ210S2lOcnZrRnlEQmZsT2...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwS093d2p1R20wQW55TURuc2tyUmZGZ25xRGxaZWZXNHJqWFlSREVOdzRXWQ==&google_push

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwS093d2p1R20wQW55TURuc2tyUmZGZ25xRGxaZWZXNHJqWFlSREVOdzRXWQ==&google_push

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 05 Jul 2021 08:26:59 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwS093d2p1R20wQW55TURuc2tyUmZGZ25xRGxaZWZXNHJqWFlSREVOdzRXWQ==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D4C1
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPLVXtkf...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA3MDUwODI2NTk1NzEyMDYzMjYyMTg3MQ%3D%3D&google_push=AYg5qPLVXtkfZHQx0jR86tDoAXX3EwNpQmhGjXyhLC-_dLn16gGmENnXWcpSmiRD3CsVuw...

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA3MDUwODI2NTk1NzEyMDYzMjYyMTg3MQ%3D%3D&google_push=AYg5qPLVXtkfZHQx0jR86tDoAXX3EwNpQmhGjXyhLC-_dLn16gGmENnXWcpSmiRD3CsVuwfrBHtDdrrZP6lOYL0SQ4GViIXiD6lp

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA3MDUwODI2NTk1NzEyMDYzMjYyMTg3MQ%3D%3D&google_push=AYg5qPLVXtkfZHQx0jR86tDoAXX3EwNpQmhGjXyhLC-_dLn16gGmENnXWcpSmiRD3CsVuwfrBHtDdrrZP6lOYL0SQ4GViIXiD6lp
pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Mon, 05 Jul 2021 08:26:59 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D4C1
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESELSCRMifva8-KG0DelpnwzQ&google_cver=1&google_push=AYg5qPI5tsHoHA4ZcrH5nWNm249pI0TN-9kcuxcuCAwArONnef_P4tiqf-06IndJ8LN7aPa_L_f74v7LdMspf74PuS-XH1cDHn3Y
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPI5tsHoHA4ZcrH5nWNm249pI0TN-9kcuxcuCAwArONnef_P4tiqf-06IndJ8LN7aPa_L_f74v7LdMspf74PuS-XH1cDHn3Y&google_hm=2TaesS8eyLU6RTC5sa0RXw==

170 B
188 B

16ms
15ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPI5tsHoHA4ZcrH5nWNm249pI0TN-9kcuxcuCAwArONnef_P4tiqf-06IndJ8LN7aPa_L_f74v7LdMspf74PuS-XH1cDHn3Y&google_hm=2TaesS8eyLU6RTC5sa0RXw==

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:58 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPI5tsHoHA4ZcrH5nWNm249pI0TN-9kcuxcuCAwArONnef_P4tiqf-06IndJ8LN7aPa_L_f74v7LdMspf74PuS-XH1cDHn3Y&google_hm=2TaesS8eyLU6RTC5sa0RXw==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 1j9di3e8c4a74att0f827ikfaqrrn847

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D4C1
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_x1bgkWQSFWBIomF9tmnQA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_x1bgkWQSFWBIomF9tmnQA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJa-T6UQ35WJ__8mt1z-_OfUfhvMBt1hxqYGomL8tMunMgOKkJg7rC-4_M53eKLpmgJHNODu7DLVNZjwwF_DGoOamyCNVme

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_x1bgkWQSFWBIomF9tmnQA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJa-T6UQ35WJ__8mt1z-_OfUfhvMBt1hxqYGomL8tMunMgOKkJg7rC-4_M53eKLpmgJHNODu7DLVNZjwwF_DGoOamyCNVme
date: Mon, 05 Jul 2021 08:26:57 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D4C1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESECD3Ld9p_LGDPFV6lpQj4Jo&google_cver=1&google_push=AYg5qPLMWEhWFmyo7wyYfehSl4mFQAOoxPudGeam3wioCvEDNVVDgcx1n6IU48rW6lyGtq2HHWu...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRRDBWVVotTS1LWldQ&google_push=AYg5qPLMWEhWFmyo7wyYfehSl4mFQAOoxPudGeam3wioCvEDNVVDgcx1n6IU48rW6lyGtq2HHWu1ZV0-A-flEaS_GBm7IkR2Nm1o

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRRDBWVVotTS1LWldQ&google_push=AYg5qPLMWEhWFmyo7wyYfehSl4mFQAOoxPudGeam3wioCvEDNVVDgcx1n6IU48rW6lyGtq2HHWu1ZV0-A-flEaS_GBm7IkR2Nm1o

Requested by

Host: provdm.com
URL: https://provdm.com/en/cost/flirt4.cam

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRRDBWVVotTS1LWldQ&google_push=AYg5qPLMWEhWFmyo7wyYfehSl4mFQAOoxPudGeam3wioCvEDNVVDgcx1n6IU48rW6lyGtq2HHWu1ZV0-A-flEaS_GBm7IkR2Nm1o
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame D4C1
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89...

0
0

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame D4C1 0
12 B 17ms
15ms Image
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JUrBRVPC1myCnSb1m6eI7nN0b6bIbdSaox5mNbDa794Pzxa-ofzLrczsm35jgJPtWsR6Cd

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame D57E 21 KB
21 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 12:14:46 GMT
x-content-type-options: nosniff
age: 418333
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 12:14:46 GMT

GET
H3-29 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame D57E 21 KB
21 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 08:25:33 GMT
x-content-type-options: nosniff
age: 432086
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21552
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:16 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 08:25:33 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D8E6
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

40ms
39ms

Document
text/html

2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUnAVLBHlClWUXoj2HTG0c9vt4Usb-UPRrQ0hxL_ao__xcMh9vQk9R0PppwkyT8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 05 Jul 2021 08:26:59 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Mon, 05-Jul-2021 09:26:59 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 05 Jul 2021 08:26:59 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 05 Jul 2021 08:26:59 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 rHFBlN4oL05Ux9gYvr7a9rbt1s0P-Z7gKSgB9mRTgDU.js Show response
pagead2.googlesyndication.com/bg/ Frame BE2A 14 KB
6 KB 11ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rHFBlN4oL05Ux9gYvr7a9rbt1s0P-Z7gKSgB9mRTgDU.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac714194de282f4e54c7d818bebedaf6b6edd6cd0ff99ee0292801f664538035

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 02 Jul 2021 08:54:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 257545
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5752
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 02 Jul 2022 08:54:34 GMT

GET
H3-29 200 2de7d4a201450dd00e5b8adc4f453659.js Show response
www.gstatic.com/mysidia/ Frame D085 7 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/2de7d4a201450dd00e5b8adc4f453659.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=681361582&adf=3492703260&pi=t.aa~a.730631131~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1108x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=2&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0&nras=2&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=246&ady=1323&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=UHcYfslRn5&p=https%3A//provdm.com&dtd=14

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8732ecd03e74a025ce2d26fb67e8b5e91e54c915fc086f74b6f56f6fbba4fdcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Jul 2021 09:33:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 341601
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2915
x-xss-protection: 0
last-modified: Thu, 01 Jul 2021 07:49:39 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 29 Sep 2021 09:33:38 GMT

GET
H3-29 200 1c175b8327315081314d0698d67e52ac.js Show response
www.gstatic.com/mysidia/ Frame D085 8 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/1c175b8327315081314d0698d67e52ac.js?tag=text/vanilla_rda_animated_cta

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6cc97a63a088790a83328ca5b06afaeae280a246e74eee067a325d1a0da2151b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Jul 2021 09:33:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 341581
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3515
x-xss-protection: 0
last-modified: Thu, 01 Jul 2021 07:49:39 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 29 Sep 2021 09:33:58 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame D085 3 KB
578 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 05 Jul 2021 07:11:51 GMT
server: ESF
date: Mon, 05 Jul 2021 08:26:59 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 05 Jul 2021 08:26:59 GMT

GET
H3-29 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame D085 1 KB
909 B 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:14:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 747
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:14:32 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame D085 17 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

013bec3910ad3d4838f46d1a0095d9e6f0ea3e676e786daf0147dce032b651b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7112
x-xss-protection: 0
server: cafe
etag: 12276874145846594193
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:26:09 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame D085 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:25:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:25:47 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D085 123 KB
37 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af5a35708a776c4c51024ec463b3d21d04b1007cfc8286309c13ded97a4119e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:59 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625225346277716"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37896
x-xss-protection: 0
expires: Mon, 05 Jul 2021 08:26:59 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame D085 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:25:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jul 2021 08:25:28 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame D085 0
0 18ms
16ms Image
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSsc5KfsnEs5aOL_7tN6cKLKVnfi96W6g7CXRqjmTKYEh9fVlDQ-RYZq8Won42Y8lOFNiTZjVYBIgAFAarFDJ05C-S5Ow
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=681361582&adf=3492703260&pi=t.aa~a.730631131~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1108x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=2&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0&nras=2&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=246&ady=1323&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=UHcYfslRn5&p=https%3A//provdm.com&dtd=14
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 a419caddb94ba229832f3cb0e96cc3a1.js Show response
www.gstatic.com/mysidia/ Frame D085 26 KB
11 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a419caddb94ba229832f3cb0e96cc3a1.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1608463daf92a71b2a1c6ee7042cc0a1b6bf99f1a1816787c554536948a50ae4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Jul 2021 08:12:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 346448
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10765
x-xss-protection: 0
last-modified: Thu, 01 Jul 2021 07:49:39 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 29 Sep 2021 08:12:51 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame D085 0
0 43ms
42ms Fetch
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CE51nUsLiYLLGGNCzgAfHt5ugCbim3slj-uKfs7kN0-fp8fseEAEg6fnHSmCVAqABkpmr_ALIAQGoAwHIA8sEqgSyAU_QAzUdzZFGkkBltlxoOnF1xuCx-8VZOuFXiqYCGZ1QmohX-FWFwmJ0DYeJv1ceK3IKvqnAZkaM2KGvpOf7_x5uMYbGuc_IwIR42jlJ7R7HO4W12pL74S4ngxuO4Wywq3STIGvGMZNliYtYUQrBnEzriUq_qStVUml8qyotL7tnhsDoBgTLnnlGaaxbULe8wUarhzmlgBmUGQ1QiGBaewuf5cLixx8zLM50X-VFriykjBnABPnQ9Zm0A5IFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBgAfW5tSDAagHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBDDnw7SCAkIgOGAEBABGB-ACgHICwHYEw3QFQGYFgGAFwGyFxoKGAgAEhRwdWItNjgxNzc2NzUwNTc1ODk3MA&sigh=eNcKVmsfiqE

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=681361582&adf=3492703260&pi=t.aa~a.730631131~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1108x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=2&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0&nras=2&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=246&ady=1323&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=UHcYfslRn5&p=https%3A//provdm.com&dtd=14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 05 Jul 2021 08:26:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2452 143 B
163 B 11ms
6ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=681361582&adf=3492703260&pi=t.aa~a.730631131~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1108x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=2&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0&nras=2&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=246&ady=1323&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=UHcYfslRn5&p=https%3A//provdm.com&dtd=14
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUnQ5UmpVROqAQu9cRtwfTqnfVHTgyKG0mjc4hT6HX3_7ODh66wsn0dOFxpxE4c
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=681361582&adf=3492703260&pi=t.aa~a.730631131~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1108x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=2&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0&nras=2&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=246&ady=1323&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=UHcYfslRn5&p=https%3A//provdm.com&dtd=14

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 05 Jul 2021 07:57:41 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1758
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0599 1 KB
749 B 11ms
7ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 04 Jul 2021 08:59:18 GMT
expires: Mon, 05 Jul 2021 08:59:18 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 84461
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame D085 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1569c02155ec30dbcc0c476e7ca90ec9c0b620b8e29eb8ff77133360efa77d45

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame D085 21 KB
21 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 12:14:46 GMT
x-content-type-options: nosniff
age: 418333
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 12:14:46 GMT

GET
H3-29 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame D085 21 KB
21 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 08:25:33 GMT
x-content-type-options: nosniff
age: 432086
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21552
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:16 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jun 2022 08:25:33 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0599
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENp3vGYEywvlhgwAvQ7sZmw&google_cver=1&google_push=AYg5qPKkkpqUr-ZYxpp8Xmg7Xb_TKeje1SwDZ9YxRFgGDnm8FqoA7QGwvS...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKkkpqUr-ZYxpp8Xmg7Xb_TKeje1SwDZ9YxRFgGDnm8FqoA7QGwvSBhd2sBsNFhKtjj_xYCbyMKtbUW17m_SugSHEEVqulo&google_hm=No-Fjk...

170 B
188 B

16ms
15ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKkkpqUr-ZYxpp8Xmg7Xb_TKeje1SwDZ9YxRFgGDnm8FqoA7QGwvSBhd2sBsNFhKtjj_xYCbyMKtbUW17m_SugSHEEVqulo&google_hm=No-FjkErnGu5waEM29ompw

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKkkpqUr-ZYxpp8Xmg7Xb_TKeje1SwDZ9YxRFgGDnm8FqoA7QGwvSBhd2sBsNFhKtjj_xYCbyMKtbUW17m_SugSHEEVqulo&google_hm=No-FjkErnGu5waEM29ompw
pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 466606.gif
id.rlcdn.com/ Frame 0599 42 B
315 B 15ms
14ms Image
image/gif 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPKOILLkuPtOm2xt2SMjMAEO6D30JlvvgzKBHcmmWBZPkHoTn3Y-24fK_aRqgr3Sy1PnO7ZTv8x1MrQ1RWkUMnmXKCWfzeq3&google_gid=CAESEA9JcWRkM4qJKft28PW6m6E&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6817767505758970&output=html&h=280&adk=681361582&adf=3492703260&pi=t.aa~a.730631131~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1625473618&rafmt=1&to=qs&pwprc=7930788343&psa=0&format=1108x280&url=https%3A%2F%2Fprovdm.com%2Fen%2Fcost%2Fflirt4.cam&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1625473618369&bpp=2&bdt=609&idt=-M&shv=r20210630&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd38d0cd8681242e2-22c1484c62c90037%3AT%3D1625473618%3ART%3D1625473618%3AS%3DALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ&prev_fmts=1140x280%2C1140x280%2C0x0&nras=2&correlator=3801006025848&frm=20&pv=1&ga_vid=1871288944.1625473618&ga_sid=1625473618&ga_hid=394444640&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=246&ady=1323&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31061218%2C31061421&oid=3&pvsid=1743602590458555&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=UHcYfslRn5&p=https%3A//provdm.com&dtd=14
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 08:26:59 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0599
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEEVmBDS0aZcpsSoPfD4aWo8&google_cver=1&google_push=AYg5qPJ9rge9eF03insrwCsVdEb17vlirOKgKDlhYiYIQxPs8V5DKlpQ-EFHaKzl-DpjgTH77XVRa64QxRSSrxHiAlMErWEmmoYn
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJ9rge9eF03insrwCsVdEb17vlirOKgKDlhYiYIQxPs8V5DKlpQ-EFHaKzl-DpjgTH77XVRa64QxRSSrxHiAlMErWEmmoYn&google_hm=2TaesS8eyLU6RTC5sa0RXw==

170 B
188 B

16ms
15ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJ9rge9eF03insrwCsVdEb17vlirOKgKDlhYiYIQxPs8V5DKlpQ-EFHaKzl-DpjgTH77XVRa64QxRSSrxHiAlMErWEmmoYn&google_hm=2TaesS8eyLU6RTC5sa0RXw==

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJ9rge9eF03insrwCsVdEb17vlirOKgKDlhYiYIQxPs8V5DKlpQ-EFHaKzl-DpjgTH77XVRa64QxRSSrxHiAlMErWEmmoYn&google_hm=2TaesS8eyLU6RTC5sa0RXw==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: gregido75audij8m7k8dsqoq7o3pl6is

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0599
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_x1bgkWQSFWBIomF9tmnQA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

15ms
15ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_x1bgkWQSFWBIomF9tmnQA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLaQQ1g4rHJz9QFohpuJaE_ivP5d1sNjAMeL40Dza8A6COBNdsPeWOYLbbjryyE0xf1RvV9mKv1YKx7TUJj2w9Brk1-vOKe

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_x1bgkWQSFWBIomF9tmnQA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLaQQ1g4rHJz9QFohpuJaE_ivP5d1sNjAMeL40Dza8A6COBNdsPeWOYLbbjryyE0xf1RvV9mKv1YKx7TUJj2w9Brk1-vOKe
date: Mon, 05 Jul 2021 08:26:59 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0599
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESELy97eWoRk7n13JwaaMUSrs&google_cver=1&google_push=AYg5qPLNw3YfoE3R4F9ylhoZPWo9VMJBEkdYWYB7MUWOkVZ1wyQ4TJJFiLtVpe-cLFisJaBZyBA...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRRDBXMVYtMjAtNDc2UQ==&google_push=AYg5qPLNw3YfoE3R4F9ylhoZPWo9VMJBEkdYWYB7MUWOkVZ1wyQ4TJJFiLtVpe-cLFisJaBZyBA-KN7P0mRtMggupgpJgp7MBlJg

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRRDBXMVYtMjAtNDc2UQ==&google_push=AYg5qPLNw3YfoE3R4F9ylhoZPWo9VMJBEkdYWYB7MUWOkVZ1wyQ4TJJFiLtVpe-cLFisJaBZyBA-KN7P0mRtMggupgpJgp7MBlJg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FRRDBXMVYtMjAtNDc2UQ==&google_push=AYg5qPLNw3YfoE3R4F9ylhoZPWo9VMJBEkdYWYB7MUWOkVZ1wyQ4TJJFiLtVpe-cLFisJaBZyBA-KN7P0mRtMggupgpJgp7MBlJg
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 0599
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDa...

0
0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0599
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESENsbhEVPRZCuMGK2HEocPdA&google_cver=1&google_push=AYg5qPLbOZGhcyFxB8C6Ek2x...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLbOZGhcyFxB8C6Ek2xjHtdELbIrMEqj2pJCRKaet-Q-hHybgFe7LX3Pv1eoJ-66ItH5iDDAm5ZPg7hEZ7rho4nkpsUhDGuLA&google_hm=

170 B
188 B

16ms
15ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLbOZGhcyFxB8C6Ek2xjHtdELbIrMEqj2pJCRKaet-Q-hHybgFe7LX3Pv1eoJ-66ItH5iDDAm5ZPg7hEZ7rho4nkpsUhDGuLA&google_hm=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:26:59 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLbOZGhcyFxB8C6Ek2xjHtdELbIrMEqj2pJCRKaet-Q-hHybgFe7LX3Pv1eoJ-66ItH5iDDAm5ZPg7hEZ7rho4nkpsUhDGuLA&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Sun, 04 Jul 2021 08:26:59 GMT

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 0599 0
12 B 16ms
15ms Image
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LeKlIPCNtFZ6LzH56pJEPLaLpcSB5EtaQSmTbdk6X7SVpK-o_uxBEN0vE9gQA6VF71p8HRvw

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 light-floating.css
cdnjs.cloudflare.com/ajax/libs/cookieconsent2/1.0.9/ 3 KB
1 KB 13ms
12ms Stylesheet
text/css 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/1.0.9/light-floating.css

Requested by

Host: provdm.com
URL: https://provdm.com/js/cookieconsent.latest.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2092ebd1f047497d83275b8d386fa1e6085a691004ed65c7810c332551393109

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:59 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 5225183
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 776
cf-request-id: 09dfee373d0000dfb771335000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:09:17 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e2d-d10"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bstoejXgPomDebzYop1764H8p1%2B42i9N8%2BFlgb7xXRebKg26UG3nQYGoudnoFzAUG9hNZSJ6MoJhBRIn%2FUpORoOstmhy3oKTL0EwOx2IDmH80Ozi8IoBBkKnsDIgwRvR6QQluujy2NAJd7zoGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 669f362b9da94e67-FRA
expires: Sat, 25 Jun 2022 08:26:59 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 10 KB
8 KB 35ms
22ms XHR
application/json 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210630&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5c7d241389a488232659357439dd889c01df840461c9d26a84fc1105ecbfc2af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Jul 2021 08:26:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7861
x-xss-protection: 0

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2452
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

38ms
38ms

Document
text/html

2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUnQ5UmpVROqAQu9cRtwfTqnfVHTgyKG0mjc4hT6HX3_7ODh66wsn0dOFxpxE4c
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 05 Jul 2021 08:26:59 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Mon, 05-Jul-2021 09:26:59 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 05 Jul 2021 08:26:59 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 05 Jul 2021 08:26:59 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 rHFBlN4oL05Ux9gYvr7a9rbt1s0P-Z7gKSgB9mRTgDU.js Show response
pagead2.googlesyndication.com/bg/ Frame E4B6 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rHFBlN4oL05Ux9gYvr7a9rbt1s0P-Z7gKSgB9mRTgDU.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac714194de282f4e54c7d818bebedaf6b6edd6cd0ff99ee0292801f664538035

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 02 Jul 2021 08:54:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 257545
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5752
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 02 Jul 2022 08:54:34 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 08:26:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Mon, 05 Jul 2021 08:26:59 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame E080 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://provdm.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://provdm.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Mon, 05 Jul 2021 04:52:00 GMT
expires: Tue, 05 Jul 2022 04:52:00 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 12899
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 548D 783 B
533 B 15ms
15ms Document
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

cc89e9cd33aba60ff776de95c1cfcf1eab93eabe2090fda8fb90595e1804919d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-agKprfOisFzVDud9Pw1x1g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://provdm.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://provdm.com/

Response headers

expires: Mon, 05 Jul 2021 08:26:59 GMT
date: Mon, 05 Jul 2021 08:26:59 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-agKprfOisFzVDud9Pw1x1g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 KtQVHgFmyc6avfEYQl6jwuIqHN0jrKlFlNnINk9N7x8.js Show response
pagead2.googlesyndication.com/bg/ Frame E080 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/KtQVHgFmyc6avfEYQl6jwuIqHN0jrKlFlNnINk9N7x8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2ad4151e0166c9ce9abdf118425ea3c2e22a1cdd23aca94594d9c8364f4def1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 03 Jul 2021 12:56:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 156623
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13206
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 16:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 03 Jul 2022 12:56:36 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20210630&jk=1743602590458555&bg=!SUqlSg7NAAbV4AdB1eA7ACkAdvg8WrDFOF-FWk6IDfXFWQs4PvwDEsDW048mBLP_LwX0Tqevvx5GTgIAAABkUgAAAAloAQcKAJthItaXmnrm2pC9-hN2UsKLVWVmPrqg2trNe_F9a2dHI--gCujWVUukwmRJ7TCyvvYEHvZCo8BqByn-bb4Xf-HKCNuNviYoK1sZebDz14TcVK_PhP7VhorMRWEAp_edBjE82AQZ6xMy5v1q5TWuw-gJVNBWS4YB7_wR2diL9YIL_RrsJGxHFrtsq4D-0LTiB-fXSFTBiQViq9uytZkCaLOywEuJJ_7c7X1WRDQOkOOniW6uITaR_sbVF7aiNrTQ8RIMj8gfVVod-eLXg74QQffqBQw9yasMcDXUzXZ8ZUyPVEQs-vIsD87wUGqYIndKOPxTzNKWKJkIDd43QyvdbJC0sD86e8rJUDv8VN8d6mdRXHfqG2_saLxz3WgNgk6efpI8Fr0yt510o21CjryOkA9ZUIqIESHHPKtywzSY1QBHkMt84LRAhIP6w5PU7UYHS1Fhh3rKtb5JHAevMT7mTs4u8PWerjTSZMsnrDV8ORmIfiTWdFJAABbaDWYXbJjjkVNd1Lc0aeOPTx45zHdb0rGs7EXB7n-jXxgbQCLf28tc0SWh_TuKHEmhmvkyEAoObIa2Htt9VQRpUeiciYIyKKlW46EiE3MBa5ZOuO_4uAOykdM-gd7Vdx2Aj6P2RBekC8CAC6CV_m_y_BN4uwxW0dhZXl41XuM-ThvfjXRMtgzBRkNVnNTYx0hfj7J1emhP8YF065VmlWpA3eHWTNkLcd4O5rLpBAbSJNEn18POj_clzlx9_H0B640AvOXS_wYSj7_TTSbAGHViORujO94sLkw6nJmPMbTxKPvsO35hvBSMl8K_WZk2iwSoWp_K1_Eno-Y2bcursm9KmFOauJ3IefB64T9IKvZatKy2mB1SftzBqXJeHFbDvhgfA6mOJZIa_dCSfVbNHa1mYMsn471w_k41rmw4lOaQIEpbdcjhwNVs9ap3Xh8sxW-mNDkJ8iWhbC3o1Ml01WHZIml6XD4Tpo6UBR6l1iDnRNJG7nkPNuJlb9t8I6G5BQLaFO14BBzYI2q69ZpOjCg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://provdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:27:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6903 42 B
64 B 17ms
17ms Fetch
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsssn_UheXNE6fc69qZNQzvtsn4QXmbYpiAaLYJU0tbcE_Zo7XbmO2QXZvs0gtureQo-fAnaNUVJ7CCSWC4hjxZhpRPGafMqWZq0RFjGnvXQNes8tIej5Ab5dIqeKg&sai=AMfl-YSHLqQDrNCJWuE_c8Do4qSp53yfOP7o1-0NKsLV7-UPakqXBfZrUqaAng3GBaunFz7ZRmcVNXaKZRX7&sig=Cg0ArKJSzNB3p9d-TfbmEAE&id=lidar2&mcvt=1000&p=66,230,346,1370&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210702&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=803367059&rs=2&met=mue&la=1&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1625473618116&dlt=681&rpt=61&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:27:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 6.gif
p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-573645-i1-v6exp3.v4.metric.gstatic.com/v6exp3/ Frame 30E4 35 B
427 B 52ms
14ms Image
image/gif 142.250.185.242
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-573645-i1-v6exp3.v4.metric.gstatic.com/v6exp3/6.gif

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.242 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f18.1e100.net

Software

sffe /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:27:09 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 6.gif
p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-573645-i2-v6exp3.ds.metric.gstatic.com/v6exp3/ Frame 30E4 35 B
427 B 47ms
14ms Image
image/gif 2a00:1450:4001:82f::2012
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-573645-i2-v6exp3.ds.metric.gstatic.com/v6exp3/6.gif

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2012 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jul 2021 08:27:09 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: traffic.alexa.com
URL: https://traffic.alexa.com/graph?&w=320&h=230&o=f&c=1&y=t&b=ffffff&r=1m&u=flirt4.cam

Domain: traffic.alexa.com
URL: https://traffic.alexa.com/graph?o=lt&y=q&b=ffffff&n=666666&f=999999&p=4e8cff&r=1y&t=2&z=0&c=1&h=150&w=340&u=flirt4.cam

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_cver=1&google_gid=CAESEOBPGD27Q8HeLMzN7cxvPuY&google_push=AYg5qPKOLxzcNfuUB8Z2ipe-3DzMFwDgRaVS7Th26y58llAedKWX7Hf5t5FI_OssIDDKXUzL3biamMRwnqnePCVlSpoBjSz-6kMl

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKjbQVWrelMfYL67U1XXgkwz0JVD2cICImcXC_pZJcbl3Z3GBpu7GRD5WFDYEEnNGYjKsmVkCtX1VGOeWyBQyFgXVm0RYXW&google_cver=1&google_gid=CAESEHem2IxIHWVcIKr8TiRbvLQ

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKCRoMoyj5l3LGEvN43HuC_xvagd-Nq6abifM5gt7SGSObBx5nMWMqj3tpwHJpfsB35g3U5V2RQnlEylxDq89Kc7Wk1Xf4&google_gid=CAESECdpcSKuD4cExUNP7XXPK64&google_cver=1

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YOLCU1IfY6Ys9P43JoNDNwAABHQAAAIB&google_push=AYg5qPKktgw4S-5clCVtIEDpvAh70GL0i1xs_IpF6kV3s1VLdz8kzfhV1XAEed5tnkrxUAeISq86A5u_1frfNZGwDapyBiysGvs_&google_gid=CAESEGzPAPyZCkMa3GMwilZm6x4&google_cver=1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: GDrive and other (Online)

90 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-20 04:52:49	Name: IDE Value: AHWqTUnQ5UmpVROqAQu9cRtwfTqnfVHTgyKG0mjc4hT6HX3_7ODh66wsn0dOFxpxE4c
provdm.com/	1969-12-31 23:59:59	Name: st_shares_https://provdm.com/en/cost/flirt4.cam Value: [object Object]
.provdm.com/	1970-01-20 04:52:49	Name: __gads Value: ID=d38d0cd8681242e2-22c1484c62c90037:T=1625473618:RT=1625473618:S=ALNI_Mb6B3b0uu5pK1xJU8_B9QCRkPtngQ
provdm.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: j4t8fo40ao0li3ijooefaivvh4
.doubleclick.net/	1970-01-19 19:31:17	Name: DSID Value: NO_DATA
provdm.com/	1970-01-20 04:16:49	Name: language Value: en

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
ajax.googleapis.com
api.pagepeeker.com
buttons-config.sharethis.com
c.sharethis.mgr.consensu.org
cdnjs.cloudflare.com
cm.g.doubleclick.net
cms.quantserve.com
count-server.sharethis.com
e.dlx.addthis.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googlecm.hit.gemius.pl
id.rlcdn.com
image6.pubmatic.com
l.sharethis.com
maps.googleapis.com
p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-573645-i1-v6exp3.v4.metric.gstatic.com
p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-573645-i2-v6exp3.ds.metric.gstatic.com
p4-cdwahi5kcyfmi-37vxbex4viqmgwoi-if-v6exp3-v4.metric.gstatic.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.everesttech.net
pixel.rubiconproject.com
platform-api.sharethis.com
platform-cdn.sharethis.com
provdm.com
rtb.openx.net
tpc.googlesyndication.com
traffic.alexa.com
www.google.com
www.googletagservices.com
www.gstatic.com
cm.g.doubleclick.net
traffic.alexa.com
142.250.181.226
142.250.185.130
142.250.185.242
142.250.186.35
176.9.106.58
18.198.109.212
185.64.189.115
23.45.99.241
2600:9000:20eb:3200:c:abe:f440:93a1
2600:9000:20eb:7e00:1c:8a07:5e80:93a1
2600:9000:2156:9200:1d:85c3:6640:93a1
2600:9000:21f3:1000:c:a9b7:ddc0:93a1
2606:4700:3035::6815:33b6
2606:4700::6810:135e
2620:116:800d:21:f916:5049:f87f:108e
2a00:1450:4001:800::2002
2a00:1450:4001:808::2004
2a00:1450:4001:808::200a
2a00:1450:4001:80f::2002
2a00:1450:4001:813::2001
2a00:1450:4001:82a::200a
2a00:1450:4001:82f::2002
2a00:1450:4001:82f::2003
2a00:1450:4001:82f::200a
2a00:1450:4001:82f::2012
2a00:1450:4001:830::2002
2a00:1450:4001:830::2003
2a00:1450:4001:831::2004
3.130.50.33
35.186.253.211
35.244.174.68
52.18.11.109
69.173.144.138
79.137.68.187
013bec3910ad3d4838f46d1a0095d9e6f0ea3e676e786daf0147dce032b651b6
0594e5880994f1656bc457a6d35f95f3800f0b993edfeef0b72f86ed838224c0
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
0b6c1e1b33c085efad5bdc32654ec90b4ddc934eb1c1aca71a439ff89867f468
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0fa0dd7feaffdfac233975771603a95f7211ee7827e83031d4136c8bcc10e63c
13d9e9ce4061c6b648768b09a36d000a7bfba969d4570cf329f938ede6a8f393
14f17c26f61e7e76d5a5207ac229e0a3a741d11916803153677fad4aeb0dd7d2
1569c02155ec30dbcc0c476e7ca90ec9c0b620b8e29eb8ff77133360efa77d45
1608463daf92a71b2a1c6ee7042cc0a1b6bf99f1a1816787c554536948a50ae4
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
190fc02d8e8f1dd5acc40f48d0d6203e6115eb31e3f47f55db0c3f07797d68f0
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
1fe3a7d25c2f4ec7634ca930d425f0e3d87781915e44aea6a255062da535245e
2092ebd1f047497d83275b8d386fa1e6085a691004ed65c7810c332551393109
20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4
218f063a0d1c2136de9971bb2d9fb175bfea077992d914b4934c0fb88ec76ba7
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2ad4151e0166c9ce9abdf118425ea3c2e22a1cdd23aca94594d9c8364f4def1f
30826f2c49f1e60d5cd1e8e242b7df31405545c265f4ca130aed43de86b821b1
3c107239496609ede285e80b91336c653f68e65956a25b489ef9b4d9591d07ea
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
55b2f6d3176cb658efc0f6791b8bcad117073882f66a2f30b15dac31e56ce254
56072ca1af64c8875693534c66c8d5a0a6d2e4d0217abe0035f990f45ba5b003
56c6612bbf0521ac758fc1ae4ca5cff8149291d2d897b52fe193896cf1166eca
59125c382ebec8eb8a6396b7b47d3d064d7e642d3010e6d4011a3630f7c97038
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
59fa38cd262684e31a79589eb660b94084a6e2d459f83b76f42554e148dc1561
5c442497b67dd7ea19b999fc31744194ceab2f51635b4036af408541a28e2387
5c7d241389a488232659357439dd889c01df840461c9d26a84fc1105ecbfc2af
5d75fea10bb270c341503bda4357e90bb069e3e46c7a670a3583f924f3524bd3
5dfdffa77335a103ec942c9384df984b5d38a267d619ee0ac3a045b766bbf2d5
5e1f0ca18309376cce0530673de23fae91eba07acfcba5bb4f1006ac60329574
5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009
5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f
602ae368dc0ad21937a1c9dae6ec56de283c88a3b0e5fcd26ce933c0e6a447c6
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
63faf0af44a428f182686f0d924bb30e369a9549630c7b98a969394f58431067
646ccb2bc6d5f34ef2196899f1cc72b43cc0df424b166f9cc93c58112c9377bf
66db52b456efe7e29cec11fa09421d03cb09e37ed1b567307ec0444fd605ce31
6cc97a63a088790a83328ca5b06afaeae280a246e74eee067a325d1a0da2151b
707d3528c01604e70ea3faccbd8d5a29e70ad1d3db292c3a816b68e6f0c7d78b
71f63137adf19f2cb52ef4cc0470d0bc7d29554ee57cc390ed2abc246094edfe
730098975d7531f577b849a6148bfa719bcf45893771fe56e5897bed799965f8
734c2df9c65821f7c46650a222529e1644712fe3a603fb2d23f539c8266f8946
76569376bca8aca9adf6b577e3f4f55f8ebdb66b3507d58331789d50c3f67753
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
789d25597a48ee75857b4f804d9bc81fe5c0484b6f05cf76c3c6335948c41cb0
79eb02d0785950356a390a71612cfca75c708b06dcaf5662a707b5fcf3063bc4
7abbc19121813b368bf6406806b8e9b7bb588456b530d95dc8a1d2ac57dd39bf
7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f
7d77856271d2779dfbcb1dab710e3b37942bd4b4f07e0a1c0268335cc5eefb36
8009448564ed107678d83113542315d9e4f617e0795ef256a26707cfe1ca3fd7
80958d079925762d945253a6718e8f6ef12eb59225379ac618d79c6685b66327
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
839392b626a00e09ce3ec77706959d551de27cca63c559fcd4a6415aef3e722a
8732ecd03e74a025ce2d26fb67e8b5e91e54c915fc086f74b6f56f6fbba4fdcc
8755c3830cd00faa5a0658cbbe133834c3e318a280032220c9a24da3c6aaac36
8bc62c9ef81390af989b3829ace60aae916e299dab9df7ec5e49db2d07a956b6
902c0fd167176a2432bc678512ec11b468fc6c5f35f2269963fa23fffee49975
914e6010ae41678122b8d63486796ad17ebaa988e6badda1afc8243de24a38b0
92eaaad05664ddfc940b3910ecb47161954b15581449efe72707e0cb908a5e58
99e7f90ad20a4051a2eba63717dc6b3a3bf860e7694e3557b5d39c4e4cfcf9b5
9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9dc9a3c53343f8687fe7c99a5c91d1823284406a0253424085aff56a56273d09
9f7216d2f53a731d9749077c22e15cfb38bcdc40806511ccf736f440c7569d64
a005d794ff8c3e5d4d8ba3faa517f1d49aa3db01736e4ed6ff443fdfa11f7e11
a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a3480b3d549103c5f62a6c230697d3958a5aa674e9c975cfcd038cdc0827d0b4
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a8b4a995f328c98eb55bf3aff8fd232abd890422d071ea5604731661954db715
ac714194de282f4e54c7d818bebedaf6b6edd6cd0ff99ee0292801f664538035
ae61835f9e7022c9584685c73decc65cf5a35175338bb9d9c595ec95e6cc9624
af5a35708a776c4c51024ec463b3d21d04b1007cfc8286309c13ded97a4119e1
af8cc8d5e1ac11873a8e7ca37e977c037d5b4592cdac6c9f3ed0c7f7d296591d
b685408da8385dd6e157e96c993edd3092510657dba04a3ee2d76ec68ddfb716
b769324e0921f9f649611113e65f528ebae5e140da8a7e63c5d6ea7bc7a33bc0
bc29696a70eefc95ef0b56f7d1cbc4b55a1038e0f10c58e9b722583b83df180b
bcc6c323289739f7330093aa4bf3a0a27354a1d72806c282f42aafd1bf6224fb
bda8f2eaf8e48162c6d11e3319f3e284849ab0c1cad3fc2a60155ad05feeda86
be10c39936e50047ccdd4bd35ddff431454ccc3e69b19698234661561c8930da
bf5b145648b3c4c81b277e5ec0ee321c1052dc4de01100837f51a285f6ab8b0e
c1c59e93d6c5932aa25cf0fe2de7d44fbe2859c9c017c414a5ee1c76e9862d50
c4a89afd48453d83067f4f59988766d5bded647ac8e316bbb5fe7572bbce06c2
c598dc59e3491216053f1fecd1281db5015b2d2a95e29a2b23018a1ae948a145
c63e08efff2c004e867b8de6ec09585ba5499dda44024ee1dedb14e7b45a8245
c73575543a5c99018f842960f9882edaa0918965ea856e91de9717a0d58d3f1c
c8859c39c7afe947dc42ecf0811268d4d711778725ad698e7f7af98e1e3f56da
cb88ab3a4e37f334c8c2212847afe49ca7b0aae387cf8f723db47a1d479c65f7
cc74c1f146d36918e1546217effe973a065673810228ea6225af5ca6d83884a7
cc89e9cd33aba60ff776de95c1cfcf1eab93eabe2090fda8fb90595e1804919d
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
d6a1204f7063d9779c458cec1d0a6dae5f2a95295d825d4a7be45491a9eeee10
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6
da4974cfd727034dbd492a1741b12024ec0314658d5c5932c5cdd2bdb2a445af
db28bd9c2ec3c62e3265cc0aaee5f68c6e433b9855173a2ed151585f8965b68e
db8470f5f5a0687f233a64723f84602eff639a7db64dfa4bf7547ec4d4e090ad
e1816fb146c0559f24e91c5e6afa9c9adc7f437ed4242f7d75515b98123c7cf9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4bdafb349ba28203aef06372029837c0f248982b73db2fe9c72c8326762732a
ea9784c2f3c024eccaf7bbeb7ea5e59671aae6f17c59c7258b7da090a6d3a8aa
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efc737b4f58cfe73a9bd0e57d7570365701381da31e628b269e7217a0ce3359d
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
fa74615098d23afecb60ae573c69ff73f380fc3361588e80ce9e927f67a988fe
fbf30a17d5ae65a9ed8d950ca76016c11abe8222505d7eb8698c819f9d32823e
fc1d8683cae600ae14430e42498f84ef8352729acf7cb15372277f3fedec380c

provdm.com Open in urlscan Pro 2606:4700:3035::6815:33b6 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

219 Requests

97 %HTTPS

59 %IPv6

22 Domains

35 Subdomains

29 IPs

5 Countries

2063 kBTransfer

4520 kBSize

6 Cookies

7 Outgoing links

Redirected requests

219 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

provdm.com Open in urlscan Pro
2606:4700:3035::6815:33b6 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

219
Requests

97 %
HTTPS

59 %
IPv6

22
Domains

35
Subdomains

29
IPs

5
Countries

2063 kB
Transfer

4520 kB
Size

6
Cookies

219 HTTP transactions
10 data transactions