loan.freemod.link Open in urlscan Pro
66.29.137.24 Public Scan

Software

LiteSpeed /

Resource Hash

2ed2d67240313726591629edc32ca05ecdc325ebbdfe097f3edd73a8be0f689a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 04 Dec 2023 14:08:42 GMT
etag: "12067-1701609554;br"
link: <https://loan.freemod.link/wp-json/>; rel="https://api.w.org/"
referrer-policy: no-referrer-when-downgrade
server: LiteSpeed
strict-transport-security: max-age=31536000; includeSubDomains; preload;
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-litespeed-cache: hit
x-turbo-charged-by: LiteSpeed
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block

GET
H2 200 style.min.css
loan.freemod.link/wp-includes/css/dist/block-library/ 107 KB
14 KB 90ms
86ms Stylesheet
text/css 66.29.137.24
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://loan.freemod.link/wp-includes/css/dist/block-library/style.min.css?ver=6.4.1

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

66.29.137.24 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

Software

LiteSpeed /

Resource Hash

698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 13607
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 06 Nov 2023 06:10:32 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Mon, 11 Dec 2023 14:08:43 GMT

GET
H2 200 mediaelementplayer-legacy.min.css
loan.freemod.link/wp-includes/js/mediaelement/ 11 KB
3 KB 165ms
161ms Stylesheet
text/css 66.29.137.24
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://loan.freemod.link/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

66.29.137.24 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

Software

LiteSpeed /

Resource Hash

b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 2394
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 30 Sep 2020 01:23:06 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Mon, 11 Dec 2023 14:08:43 GMT

GET
H2 200 wp-mediaelement.min.css
loan.freemod.link/wp-includes/js/mediaelement/ 4 KB
1 KB 88ms
84ms Stylesheet
text/css 66.29.137.24
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://loan.freemod.link/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.4.1

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

66.29.137.24 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

Software

LiteSpeed /

Resource Hash

2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 982
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 08 Jun 2019 06:15:02 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Mon, 11 Dec 2023 14:08:43 GMT

GET
H2 200 main.min.css
loan.freemod.link/wp-content/themes/generatepress/assets/css/ 19 KB
5 KB 241ms
237ms Stylesheet
text/css 66.29.137.24
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://loan.freemod.link/wp-content/themes/generatepress/assets/css/main.min.css?ver=3.3.1

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

66.29.137.24 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

Software

LiteSpeed /

Resource Hash

0468af8d74ba377eec707308168b6bfcd146fe0a2669a11a9af0128ad85b3bc2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 4419
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 02 Dec 2023 06:04:15 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Mon, 11 Dec 2023 14:08:43 GMT

GET
H2 200 jetpack.css
loan.freemod.link/wp-content/plugins/jetpack/css/ 98 KB
17 KB 143ms
140ms Stylesheet
text/css 66.29.137.24
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://loan.freemod.link/wp-content/plugins/jetpack/css/jetpack.css?ver=12.8.1

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

66.29.137.24 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

Software

LiteSpeed /

Resource Hash

277fb30e91af19162de1bd98e6364ee78f0677257c118fd46d0255b83eeadd55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 17392
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 03 Dec 2023 11:51:19 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Mon, 11 Dec 2023 14:08:43 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 274 KB
91 KB 114ms
62ms Script
application/javascript 2607:f8b0:4020:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=GT-NN6G2FF

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7cdbe4e5baccab055dfe040f20f4e3d0df1d22fbf490f436cdf3a9a497e1f44d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93178
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Dec 2023 14:08:43 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 91 KB
30 KB 139ms
85ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a1ce6df7e60c3875b0a3cdfd57094470bfc41695ddb16be8779c38731f50ff4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29845
x-xss-protection: 0
server: cafe
etag: 688 / 19695 / m202311280101 / config-hash: 4024757909285761185
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 04 Dec 2023 14:08:43 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 186 KB
68 KB 89ms
38ms Script
application/javascript 2607:f8b0:4020:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-181670863-2

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f40438549fcc88c413a264022eb687bd8bbfbe078d1bbcaaad521e9e2afe5b7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68966
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Dec 2023 14:08:43 GMT

GET
H2 200 TimeCircles.css
loan.freemod.link/wp-content/plugins/countdown-builder/assets/css/ 74 KB
4 KB 163ms
160ms Stylesheet
text/css 66.29.137.24
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://loan.freemod.link/wp-content/plugins/countdown-builder/assets/css/TimeCircles.css?ver=2.69

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

66.29.137.24 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

Software

LiteSpeed /

Resource Hash

d18d5eff255001ddd6b19584c027dee433712b1d2faa7e7bb32aa7f0219b616f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 4195
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 03 Dec 2023 11:54:02 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Mon, 11 Dec 2023 14:08:43 GMT

GET
H2 200 menu.min.js Show response
loan.freemod.link/wp-content/themes/generatepress/assets/js/ 7 KB
2 KB 165ms
162ms Script
application/javascript 66.29.137.24
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://loan.freemod.link/wp-content/themes/generatepress/assets/js/menu.min.js?ver=3.3.1

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

66.29.137.24 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

Software

LiteSpeed /

Resource Hash

174066535cb768d1715ae34808cd4e83f16f23715524bfff79db8860e8c03296

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1535
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 02 Dec 2023 06:04:15 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Mon, 11 Dec 2023 14:08:43 GMT

GET
H2 200 e-202348.js Show response
stats.wp.com/ 7 KB
3 KB 23ms
2ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202348.js
Requested by: Host: loan.freemod.link
URL: https://loan.freemod.link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-minify-cache: hit
x-nc: HIT jfk
date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
server: nginx
x-minify: t
etag: W/13576-1684461103136.7104
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Mon, 25 Nov 2024 13:20:50 GMT

GET
H2 200 moment.min.js Show response
loan.freemod.link/wp-includes/js/dist/vendor/ 57 KB
18 KB 239ms
236ms Script
application/javascript 66.29.137.24
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://loan.freemod.link/wp-includes/js/dist/vendor/moment.min.js?ver=2.29.4

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

66.29.137.24 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

Software

LiteSpeed /

Resource Hash

56b95721a3bba73d47c6342c465047cc8d9d3d26384e42f452636862311d1389

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 18186
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 03 Feb 2023 03:06:32 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Mon, 11 Dec 2023 14:08:43 GMT

GET
H2 200 jquery.min.js Show response
loan.freemod.link/wp-includes/js/jquery/ 86 KB
29 KB 166ms
163ms Script
application/javascript 66.29.137.24
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://loan.freemod.link/wp-includes/js/jquery/jquery.min.js?ver=3.7.1

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

66.29.137.24 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

Software

LiteSpeed /

Resource Hash

cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 29744
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 29 Aug 2023 02:44:24 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Mon, 11 Dec 2023 14:08:43 GMT

GET
H2 200 jquery-migrate.min.js Show response
loan.freemod.link/wp-includes/js/jquery/ 13 KB
5 KB 226ms
224ms Script
application/javascript 66.29.137.24
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://loan.freemod.link/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

66.29.137.24 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

Software

LiteSpeed /

Resource Hash

5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 4678
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 09 Jun 2023 15:19:24 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Mon, 11 Dec 2023 14:08:43 GMT

GET
H2 200 YcdGeneral.js Show response
loan.freemod.link/wp-content/plugins/countdown-builder/assets/js/ 48 KB
13 KB 241ms
238ms Script
application/javascript 66.29.137.24
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://loan.freemod.link/wp-content/plugins/countdown-builder/assets/js/YcdGeneral.js?ver=2.69

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

66.29.137.24 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

Software

LiteSpeed /

Resource Hash

a94deea0680aed154d69ac954f00b12777e51a80483d0f3097bdc43e6de5a58b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 13356
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 03 Dec 2023 11:54:02 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Mon, 11 Dec 2023 14:08:43 GMT

GET
H2 200 Countdown.js Show response
loan.freemod.link/wp-content/plugins/countdown-builder/assets/js/ 24 KB
5 KB 292ms
289ms Script
application/javascript 66.29.137.24
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://loan.freemod.link/wp-content/plugins/countdown-builder/assets/js/Countdown.js?ver=2.69

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

66.29.137.24 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

Software

LiteSpeed /

Resource Hash

980d240b9244efd3c2273c8a3a50237c805c4b1d6c3fd99b8ae886fe66725e73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 4704
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 03 Dec 2023 11:54:02 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Mon, 11 Dec 2023 14:08:43 GMT

GET
H2 200 TimeCircles.js Show response
loan.freemod.link/wp-content/plugins/countdown-builder/assets/js/ 34 KB
8 KB 293ms
291ms Script
application/javascript 66.29.137.24
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://loan.freemod.link/wp-content/plugins/countdown-builder/assets/js/TimeCircles.js?ver=2.69

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

66.29.137.24 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

Software

LiteSpeed /

Resource Hash

4c3b437309fdc2181226393caf0f365b2736e47cba67358f827413b1b03deea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 7929
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 03 Dec 2023 11:54:02 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Mon, 11 Dec 2023 14:08:43 GMT

GET
BLOB 200
OK 0809aa64-5dc8-4e88-a3c7-63fdcf741751
https://loan.freemod.link/ 1 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://loan.freemod.link/0809aa64-5dc8-4e88-a3c7-63fdcf741751
Requested by: Host: loan.freemod.link
URL: https://loan.freemod.link/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Length: 1245
Content-Type: text/javascript

GET
H2 200 g.gif
pixel.wp.com/ 50 B
153 B 12ms
2ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=226612292&post=0&tz=0&srv=loan.freemod.link&j=1%3A12.8.1&host=loan.freemod.link&ref=&fcp=647&rand=0.47739910607760594
Requested by: Host: loan.freemod.link
URL: https://loan.freemod.link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 04 Dec 2023 14:08:43 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 wp-emoji-release.min.js Show response
loan.freemod.link/wp-includes/js/ 18 KB
5 KB 80ms
80ms Script
application/javascript 66.29.137.24
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://loan.freemod.link/wp-includes/js/wp-emoji-release.min.js?ver=6.4.1

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

66.29.137.24 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

Software

LiteSpeed /

Resource Hash

4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 4651
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 02 Feb 2023 11:23:26 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Mon, 11 Dec 2023 14:08:43 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 224 KB
79 KB 46ms
45ms Script
application/javascript 2607:f8b0:4020:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-KQ50CSGZB5&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-181670863-2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

edfabd65cbaa9d8e35d19d76fc0dd55a8adb1091c306653adb78f86bdaa401c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 81201
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Dec 2023 14:08:43 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 274 KB
91 KB 56ms
55ms Script
application/javascript 2607:f8b0:4020:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=GT-NN6G2FF&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-181670863-2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ca77a2a197e7ed19d508df5278bb9e52c71e09f3acf5cb48c7dfb49935c91fd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93095
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Dec 2023 14:08:43 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 56ms
11ms Script
text/javascript 2607:f8b0:4020:805::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-181670863-2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 12:52:28 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 4575
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 04 Dec 2023 14:52:28 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
172 B 32ms
32ms Ping
text/plain 2607:f8b0:4020:805::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-X0C35CHKZH&gtm=45Pe3bt0v9172370344&_p=1701698923309&gcd=11l1l1l1l1&dma=0&gdid=dZTNiMT&cid=347177670.1701698923&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1701698923&sct=1&seg=0&dl=https%3A%2F%2Floan.freemod.link%2F&dt=loan%20freemod&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=794
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=GT-NN6G2FF
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4020:805::200e Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:43 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://loan.freemod.link
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/ 432 KB
135 KB 14ms
11ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7e071e5b39d13cef80f7a46d854de133fd73c15d1351ebcf7e1f1b48821e7aeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 18:34:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70478
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138259
x-xss-protection: 0
server: cafe
etag: 16445146976575771301
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Mon, 02 Dec 2024 18:34:05 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
92 B 33ms
32ms XHR
text/plain 2607:f8b0:4020:805::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1703221726&t=pageview&_s=1&dl=https%3A%2F%2Floan.freemod.link%2F&ul=en-us&de=UTF-8&dt=loan%20freemod&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACUABBAAAACAAI~&jid=2078332158&gjid=306932760&cid=347177670.1701698923&tid=UA-181670863-2&_gid=1829989395.1701698924&_r=1&gtm=457e3bt0&gcd=11l1l1l1l1&dma=0&did=dZTNiMT&gdid=dZTNiMT&jsscut=1&z=185628186

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://loan.freemod.link/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://loan.freemod.link
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 33ms
33ms Ping
text/plain 2607:f8b0:4020:805::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-KQ50CSGZB5&gtm=45je3bt0v9135084564&_p=1701698923309&gcd=11l1l1l1l1&dma=0&gdid=dZTNiMT&cid=347177670.1701698923&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAAI&ngs=1&_s=1&sid=1701698923&sct=1&seg=0&dl=https%3A%2F%2Floan.freemod.link%2F&dt=loan%20freemod&en=page_view&_fv=1&_ss=1&tfd=871
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KQ50CSGZB5&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:805::200e Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:43 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://loan.freemod.link
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
347 B 44ms
18ms XHR
text/plain 2607:f8b0:4004:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-181670863-2&cid=347177670.1701698923&jid=2078332158&gjid=306932760&_gid=1829989395.1701698924&_u=YCDACUAABAAAACAAI~&z=598880404

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://loan.freemod.link/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 04 Dec 2023 14:08:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://loan.freemod.link
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rum.js Show response
pagead2.googlesyndication.com/pagead/js/ 64 KB
24 KB 66ms
13ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/rum.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a09ba825877d567e6cca03a8eaa2583f9e76a0f6d3ec64ead89048db668a82d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2814
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24457
x-xss-protection: 0
server: cafe
etag: 7553420222452197197
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 04 Dec 2023 14:21:49 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 223 KB
56 KB 1580ms
1576ms Fetch
text/plain 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3793351759215310&correlator=895794042261060&eid=31079525%2C31078660%2C31061691%2C31061692&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&iu_parts=23012126168%2Cinter&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=1&sfv=1-0-40&ists=1&fas=8&sc=1&cookie_enabled=1&abxe=1&dt=1701698923635&lmt=1701698923&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Floan.freemod.link%2F&rumc=3793351759215310&rume=1&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=347177670.1701698923&ga_sid=1701698924&ga_hid=1703221726&ga_fc=true&dlt=1701698923063&idt=529&cust_params=id_post_wp%3D26&adks=2020372035&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d2678360c26c4e6f0909de009d9322ef26e2b88a2f63b461400eb90f55f63bba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:45 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57312
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://loan.freemod.link
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 62 KB
15 KB 701ms
697ms Fetch
text/plain 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3793351759215310&correlator=895794042261060&eid=31079525%2C31078660%2C31061691%2C31061692&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&iu_parts=23012126168%2Cinter&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=2&sfv=1-0-40&ists=1&fas=2&sc=1&cookie_enabled=1&abxe=1&dt=1701698923645&lmt=1701698923&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Floan.freemod.link%2F&rumc=3793351759215310&rume=1&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=347177670.1701698923&ga_sid=1701698924&ga_hid=1703221726&ga_fc=true&dlt=1701698923063&idt=529&cust_params=id_post_wp%3D26&adks=2020372034&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

42e7c1bb174f3118c06c4e9b3ff864280b28aa0d5508d07a0af4cba95cb1821d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:44 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15054
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://loan.freemod.link
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 121 KB
34 KB 1149ms
1145ms Fetch
text/plain 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3793351759215310&correlator=895794042261060&eid=31079525%2C31078660%2C31061691%2C31061692&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&iu_parts=23012126168%2Cyhemo&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C320x480%7C300x50&ifi=3&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1701698923648&lmt=1701698923&adxs=200&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Floan.freemod.link%2F&rumc=3793351759215310&rume=1&vis=1&psz=820x50&msz=820x50&fws=0&ohw=0&ga_vid=347177670.1701698923&ga_sid=1701698924&ga_hid=1703221726&ga_fc=true&dlt=1701698923063&idt=529&cust_params=id_post_wp%3D26&adks=1360106061&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b02749168b28e91d3359ace2a944265ae956af209050f99cfc3e1d3a82579806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:44 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34332
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://loan.freemod.link
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 95 KB
43 KB 2753ms
2749ms Fetch
text/plain 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3793351759215310&correlator=895794042261060&eid=31079525%2C31078660%2C31061691%2C31061692&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&iu_parts=23012126168%2Cadx&enc_prev_ius=%2F0%2F1&prev_iu_szs=250x250%7C300x250&ifi=4&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1701698923652&lmt=1701698923&adxs=200&adys=1250&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Floan.freemod.link%2F&rumc=3793351759215310&rume=1&vis=1&psz=820x250&msz=820x250&fws=0&ohw=0&ga_vid=347177670.1701698923&ga_sid=1701698924&ga_hid=1703221726&ga_fc=true&dlt=1701698923063&idt=529&cust_params=id_post_wp%3D26&adks=2798142386&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

665f1c7562a598466087356df367554354dee0d28c93ddf671117a6a65ef2d93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:46 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44010
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://loan.freemod.link
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 52 KB
21 KB 2280ms
2276ms Fetch
text/plain 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3793351759215310&correlator=895794042261060&eid=31079525%2C31078660%2C31061691%2C31061692&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&iu_parts=23012126168%2Cft1&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=5&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1701698923655&lmt=1701698923&adxs=436&adys=1110&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Floan.freemod.link%2F&rumc=3793351759215310&rume=1&vis=1&psz=728x-1&msz=728x-1&fws=512&ohw=0&ga_vid=347177670.1701698923&ga_sid=1701698924&ga_hid=1703221726&ga_fc=true&dlt=1701698923063&idt=529&cust_params=id_post_wp%3D26&adks=926812160&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

82a2d0c903ec271dba2994e36949da659c2395ad9067208a7c7b445cd433b4a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:45 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21143
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://loan.freemod.link
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D846 6 KB
3 KB 147ms
63ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://loan.freemod.link/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 14:08:43 GMT
expires: Tue, 03 Dec 2024 14:08:43 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/ 39 KB
14 KB 17ms
15ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl_page_level_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

af28e1fa0b7aabfa4a23153610823a18f340847984b430a7aec34e7bc96176b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 16:12:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78965
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13834
x-xss-protection: 0
server: cafe
etag: 7824500842389344896
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Mon, 02 Dec 2024 16:12:38 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 139ms
79ms XHR
application/json 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202311280101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2d6f0b8bcc9f911335d8e65bad7ada6384e3311779fbfd6a0c15b8a68f29a465

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:43 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12228
x-xss-protection: 0

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
121 B 45ms
44ms Image
image/gif 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_stats&su=loan.freemod.link&doc=complete&pg_h=4520&pg_w=1600&pg_hs=4520&c=3&aa_c=0&av_h=130&av_w=789.333&av_a=103840&s=49.594&all_s=49.594&b=3020.406&all_b=3020.406&d=0.086&all_d=0.086&ard=0.043&all_ard=0.043&dt=d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:43 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 156ms
38ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 04 Dec 2023 14:08:44 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame D89E 13 KB
5 KB 14ms
12ms Document
text/html 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://loan.freemod.link/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 324009
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 30 Nov 2023 20:08:35 GMT
expires: Fri, 29 Nov 2024 20:08:35 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 9C7D 829 B
1 KB 55ms
23ms Document
text/html 2607:f8b0:4006:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c81cf0065f0c00b616c41891f294242b7a838aace1632ec8636e9122249b2885

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-h1dS_ZLYqNysIUINjVrzqg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://loan.freemod.link/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-h1dS_ZLYqNysIUINjVrzqg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 14:08:44 GMT
expires: Mon, 04 Dec 2023 14:08:44 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame D89E 39 KB
15 KB 17ms
17ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 10:30:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 185882
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 01 Dec 2024 10:30:42 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 9C7D 0
0 54ms
54ms Image
text/html 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202311280101&jk=3793351759215310&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame D89E 0
10 B 15ms
13ms Image
text/plain 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?8mpURg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:44 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012310301456000/ Frame C26C 196 KB
56 KB 624ms
12ms Script
text/javascript 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6077711ce3174050ccebe6559eb5f0e251942c2cad21900d1c3ef316065565b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 02 Dec 2023 18:16:58 GMT
age: 157907
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56081
x-xss-protection: 0
server: sffe
etag: "6a17d296884b026a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 01 Dec 2024 18:16:58 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame C26C 15 KB
5 KB 651ms
39ms Script
text/javascript 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b53b6ad23b258ce11eed97786741510819a369348afcf1260856fe3041fc33de

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 04 Dec 2023 08:48:02 GMT
age: 19243
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5225
x-xss-protection: 0
server: sffe
etag: "0b7142e00666043e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 03 Dec 2024 08:48:02 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame C26C 95 KB
29 KB 644ms
32ms Script
text/javascript 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3907cc5ed9d4a0cdb316d069614220b55fccd5624ac173592a7a4c2c3aae0636

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 02 Dec 2023 05:29:28 GMT
age: 203957
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29077
x-xss-protection: 0
server: sffe
etag: "7b1f1965b6cd6fda"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 01 Dec 2024 05:29:28 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame C26C 5 KB
2 KB 642ms
31ms Script
text/javascript 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

516f5e4c2dc5c69f3e1707e76695f866f8e62468aca15c1a9ddb165eb684f6f0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 01 Dec 2023 15:45:15 GMT
age: 253410
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1911
x-xss-protection: 0
server: sffe
etag: "5b0a82507b260c6e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 30 Nov 2024 15:45:15 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame C26C 40 KB
13 KB 647ms
37ms Script
text/javascript 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18ebc36644e10f87e20812c15e329c1b25848c62cd6cdfe74427cdf8995bc3a9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 02 Dec 2023 11:38:04 GMT
age: 181841
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12952
x-xss-protection: 0
server: sffe
etag: "9817e561a46c70fa"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 01 Dec 2024 11:38:04 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame C26C 4 KB
1 KB 644ms
34ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3d2b34675fd418a1b23c652fa791f4875ccc12860d9b4b6ec8ae4aa09d51ec1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 04 Dec 2023 14:08:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 12:45:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 04 Dec 2023 14:08:45 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame C26C 2 KB
2 KB 7ms
5ms Image
image/png 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 04:57:17 GMT
x-content-type-options: nosniff
server: cafe
age: 33087
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Tue, 05 Dec 2023 04:57:17 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame C26C 295 B
319 B 8ms
6ms Image
image/png 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 12:05:14 GMT
x-content-type-options: nosniff
server: cafe
age: 7410
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Tue, 05 Dec 2023 12:05:14 GMT

GET
H2 200 container.html Show response
d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C413 6 KB
3 KB 25ms
14ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://loan.freemod.link/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 14:08:43 GMT
expires: Tue, 03 Dec 2024 14:08:43 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 46ms
46ms Image
text/html 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202311280101&jk=3793351759215310&bg=!nZ6lntHNAAY3kmNgF5I7ADQBe5WfOIQt0JSG-gAnXQQr50ktZZAKRpY_e7rROrHrQswzgcRK6Tg3rqnSNk7ZfTvYtc4oAgAAAGBSAAAAAmgBBwoArVwkxnpR3BVdLu8juuOXF9WOWxO47S5fRQuWhMd7iX_gXxlWADo6tDQa7-BTxbZdInQTE0Ecd91zFKfCTccDpj_TSOK9ZVld8ROjrAtFdRGu6prHJdpI3Bb0QdXG-xYht-EUQF6rxV_mXtL0AMaJsmdYA_aR98yz6MQ_2a6ivStfh8CWOIFr7EUmRjeFWws_D6gfEnCYsffwEK8VSTe9j4pRu5jK4q1gyTUTsbfomQK6hMF3bJmex9pGF1q4m_FCnqkOpJErGubmOkGIfCOPEtsmm2A3Z-tQsdZX8I_iLnSxwFJPq7W21EzzoL8H3isXecp5vRXwYlf5DJi9dCzf1lguZPntSb0YqGRLeGRCqVHo6t9_4VhQXuuvpU_P8bZmh0Ti2pVPkW5rREH7cN_diZXec7xLV0zVPlMPXqi1O-GoCom5C3-SXV2YQxT-voBKsT_ptY4-og_Dizzh807LpZwxZRCAaMZPo2kn1-ixWM-2VoFcKNlfKK7JbL8PX9bdyk7M46669tC8X7v80fFNG7S4_fhpHpZ9MZ62Tb39ULsjvoAGWyQqoKF5NrDfq4sFAUpOVSHpUXzI2ATlxbPFQ2TmXfciWNTIzDA2Uychn2pgZ9f55nICIBkm7nj7vxVByZSHa9gZrQlftgPk36F4TBLYhn1N0RopCUEUFVeDPo6J5Wt57jj_ylvPr7eQSU_zo1vL1vZkwIsKmeCfWtLB_dVM1Ko2RP4t_GFwoFf9OqMZPV3MCWXDxsy6yw4U703ftiFX8mMBQ4V7mGFBDAatO0_JCFiF8Bk73RUoSJZ1mMPjP5odfXcHcNOk4g5Jui1ZDFLQUFaVgNdFo1cItC8jWC15XtGQJFEYrC1C_M-X9wmLThGYzy07USfj9XF-1QTQKP_W4t3Cm66soBS-sWd3GsWG2B7-mzWqpXXhDPZE2ArkDpjveYW9x6X2WCsJbWV7VJdloM2TQVHrCujLd_vICfKR7eA6j9rx_9KAzuEHfPCoGMFWiSUvPWHQGL2jxa4wtFPVcibnxP6e-oFe0rzXD8LIxCTbXge9P0kSglBouZPyo2Wyt91LhnbFBZ2UGGIbO7wOrni9Js4N9ZrS_y4mvyAlYLF_il4e_JInT2KqT_mI3uCpocK1ghCD2o_7Dh-AVYlUY0MB9abcJOc
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

POST
H2 204 csi
csi.gstatic.com/ 0
234 B 112ms
30ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=1~lpqzloz0&c=3793351759215310&e=31061691%2C31061692&ctx=1&met.9=1.md~2.oi~9.0~9.0~9.0~9.0~9.0~3_1.qe~3_2.qe~3_4.qe~3_7.qe~3_11.qe~7_1.0~7_2.0~7_4.0~7_7.0~7_11.0~4_2.1a0~5_2.1a8~6_2.1aa~4_4.1mm~5_4.1mq&met.10=1_7.CMjBDBAAGICYdSC8BygA~1_11.CPD_AxDw_wMYgJh1ILwHKAE~1_4.CKjAAhCowAIYgJh1ILwHKAE&met.3=112.ra_1~113.ve_3&met.1=1.lpqzlo7q~6.0~7.19~8.19~9.19~10.5j~11.3c~12.5j~13.9q~14.c2~15.9t~16.ig~17.ih~18.ik~19.v8~20.v8~21.va~22.hz~23.hz&qqid.2=CN-p87769YIDFZWeWgUdUKEPcw&qqid.4=CMrZl7_69YIDFfayWgUdeJMMfA
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://loan.freemod.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:45 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 38bcf84a6c98f8ab5c7e5b9a6f0eaec8.js Show response
www.gstatic.com/mysidia/ Frame C413 9 KB
4 KB 58ms
12ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/38bcf84a6c98f8ab5c7e5b9a6f0eaec8.js?tag=client_fast_engine_2019

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

70602b2d4f8fd19b95f522d3f3334ada3b3ff4647b4e81c7285b885977fd9ac4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 05:55:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202373
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4046
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 19:21:37 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 01 Mar 2024 05:55:52 GMT

GET
H2 200 07977d2b7ee0aecb6f84611ef43cb16f.js Show response
www.gstatic.com/mysidia/ Frame C413 145 KB
53 KB 59ms
13ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/07977d2b7ee0aecb6f84611ef43cb16f.js?tag=video_mra/web_raspberry_ms

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

983de16021c17f275be68a5ad52f44a35b33d2cc6441f030c8e062550194f283

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 21:00:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 407316
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54254
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:10:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 27 Feb 2024 21:00:09 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame C413 14 KB
1 KB 42ms
41ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 04 Dec 2023 14:08:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 12:14:21 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 04 Dec 2023 14:08:45 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/v0/ Frame C413 110 KB
32 KB 38ms
36ms Script
text/javascript 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-analytics-0.1.js

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fcc44c1f86ee04baf5c9f6282f887200d328a419667d1d1e5cd3a3423a057e6e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 14:08:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32240
x-xss-protection: 0
server: sffe
etag: "6c561bf69fb7c6ef"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 04 Dec 2023 14:08:45 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame C413 2 KB
822 B 5ms
3ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 19:53:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 65730
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Dec 2023 19:53:15 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/ Frame C413 24 KB
9 KB 6ms
5ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/abg_lite_fy2021.js

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b67ad968ba3668562f331df45b73501e17c7c166bcf7e5443c33633cbc9d5783

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 19:53:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 65730
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9305
x-xss-protection: 0
server: cafe
etag: 13635642240219548939
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Dec 2023 19:53:15 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame C413 3 KB
1 KB 6ms
6ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/window_focus_fy2021.js

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:55:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 820
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 13:55:05 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame C413 20 KB
8 KB 5ms
5ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 20:01:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 65218
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8544
x-xss-protection: 0
server: cafe
etag: 17124069415086231762
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Dec 2023 20:01:47 GMT

GET
H2 200 a6de5423b7c632060e8f86136bd5d27a.js Show response
www.gstatic.com/mysidia/ Frame C413 37 KB
15 KB 15ms
14ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a6de5423b7c632060e8f86136bd5d27a.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c21f21f7b1658ed6ab5c0461020a21d62f9e0a7cd7cf3d9e6ef61a2c481f31e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 09:45:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 188568
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15478
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 19:21:37 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 01 Mar 2024 09:45:57 GMT

GET
H2 200 rda_video_bg_pattern.png
googleads.g.doubleclick.net/pagead/images/ Frame C413 2 KB
2 KB 18ms
15ms Image
image/png 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/images/rda_video_bg_pattern.png

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7f42fd7e961148cbacb3643b669d55768ded74e587cd30d429a4e8112c05a5c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 15:52:33 GMT
x-content-type-options: nosniff
server: cafe
age: 80172
etag: 9923804599063086578
vary: Accept-Encoding
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2033
x-xss-protection: 0
expires: Mon, 04 Dec 2023 15:52:33 GMT

GET
H3 200 8091751645468367741
tpc.googlesyndication.com/simgad/ Frame C413 4 KB
4 KB 9ms
9ms Image
image/png 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8091751645468367741?w=100&h=100&tw=1&q=75

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf42ba8858dd09c4d9dd56206bb42435a99ab53b7c539b2302c86dcd192de209

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 11:55:47 GMT
x-content-type-options: nosniff
age: 267178
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3603
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 23:13:55 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 30 Nov 2024 11:55:47 GMT

GET
DATA 200
OK truncated
/ Frame C413 216 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 81cacd6b187878c8eb795e61e66c648ee76c410dafc63852de35290c1e56f9f1

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H2 204 csi
csi.gstatic.com/ Frame C26C 0
54 B 30ms
30ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?s=ampad&ctx=2&puid=1~1701698925127&c=3793351759215310&qqid=CN-p87769YIDFZWeWgUdUKEPcw&rt=any.link.c.hx.l.c.gj.0.17i5.179t~any.script.d.i4.1.13.0.0.49h.415~any.script.d.hw.1.w.0.0.1pf.1h3~any.script.d.i2.5.x.0.0.mo1.mfp~any.script.d.i2.2.12.0.0.a84.9zs~any.link.e.hy.1.y.gp.0.pr.hf~any.img.g.9.1.5.0.0.25u.1xi~any.img.g.d.4.6.0.0.gj.87&met.a4a=dcl.0~ol.0~nvs.1701698924375~ini.1701698925128
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012310301456000/v0/amp-analytics-0.1.mjs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://loan.freemod.link/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:45 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame C413 0
54 B 30ms
29ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~lpqzlq3t&c=6921438415787&slotId=3460719207893.5&qqid=CMrZl7_69YIDFfayWgUdeJMMfA&sei=44752538%2C44807615%2C75259414%2C420706098&nsei=44714510%2C44729911%2C44730425%2C44730426%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=rda&ulv=1&ua_e=1
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/07977d2b7ee0aecb6f84611ef43cb16f.js?tag=video_mra/web_raspberry_ms
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:45 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/2359349301445845367/ Frame C413 86 KB
86 KB 5ms
5ms Image
image/jpeg 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2359349301445845367/14763004658117789537

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83d80613d0332064822c6b9ce1aa1359c5616191d945205233aadffd27234e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 09:52:01 GMT
x-content-type-options: nosniff
age: 274604
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 88049
x-xss-protection: 0
last-modified: Fri, 04 Aug 2023 20:33:58 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 30 Nov 2024 09:52:01 GMT

GET
DATA 200
OK truncated
/ Frame C413 70 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 475e3e88a99b6570a8da6f06080b3a99fe56a7ba144972f9a51db44a70f33597

Request headers

Referer
Origin: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET

videoplayback
r4---sn-ab5sznzl.gvt1.com/ Frame C413
Redirect Chain

https://redirector.gvt1.com/videoplayback?id=7546ef93d137e68d&itag=18&source=web_video_ads&requiressl=yes&cmo=secure_transport=yes&ip=0.0.0.0&ipbits=0&expire=1701706124&sparams=ip,ipbits,expire,id,...
https://r4---sn-ab5sznzl.gvt1.com/videoplayback?id=7546ef93d137e68d&itag=18&source=web_video_ads&requiressl=yes&ip=0.0.0.0&ipbits=0&expire=1701706124&sparams=expire,id,ip,ipbits,itag,mh,mip,mm,mn,m...

0
0

GET
DATA 200
OK truncated
/ Frame C413 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fd444fb0c3764815b041c3d276b52e239fa1bffc2b3ab7a885fbb404949319c9

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame C413
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=CybqzbN1tZcrzEvbl6toP-Kay4AfN4v_PdLC0j9X7Eb-eqL_vQBABIN_Rz58BYMnGqYvApNgPoAGJlK35KcgBCakCjOQ1Kug5sj7gAgCoAwHIAwqqBJkCT9A67OqeIzEOEsspUtW21tSG...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x20d698364f4f9ff20000000000000000%22,%222%22:%220x4b49d7607859c3790000000000000000%22,%223%22:%220x6f6c37...

0
0

115ms
81ms

Fetch
text/css

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x20d698364f4f9ff20000000000000000%22,%222%22:%220x4b49d7607859c3790000000000000000%22,%223%22:%220x6f6c37b778bc7e90000000000000000%22,%224%22:%220xbf1be347ae1c09c60000000000000000%22,%225%22:%220x7fda68335258fc590000000000000000%22},%22debug_key%22:%2215840613169565304641%22,%22debug_reporting%22:true,%22destination%22:%22https://aldiscover.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211260348937%22],%224%22:[%2212-04%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%224677547938694286577%22}&andc=true

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:45 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x20d698364f4f9ff20000000000000000","2":"0x4b49d7607859c3790000000000000000","3":"0x6f6c37b778bc7e90000000000000000","4":"0xbf1be347ae1c09c60000000000000000","5":"0x7fda68335258fc590000000000000000"},"debug_key":"15840613169565304641","debug_reporting":true,"destination":"https://aldiscover.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11260348937"],"4":["12-04"],"6":["true"]},"priority":"500","source_event_id":"4677547938694286577"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: null
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 04 Dec 2023 14:08:45 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 04 Dec 2023 14:08:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x20d698364f4f9ff20000000000000000","2":"0x4b49d7607859c3790000000000000000","3":"0x6f6c37b778bc7e90000000000000000","4":"0xbf1be347ae1c09c60000000000000000","5":"0x7fda68335258fc590000000000000000"},"debug_key":"15840613169565304641","debug_reporting":true,"destination":"https://aldiscover.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11260348937"],"4":["12-04"],"6":["true"]},"priority":"500","source_event_id":"4677547938694286577"}&andc=true
access-control-allow-origin: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame C413 33 KB
34 KB 126ms
3ms Font
font/woff2 2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 22:46:12 GMT
x-content-type-options: nosniff
age: 141753
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 01 Dec 2024 22:46:12 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame C413 0
17 B 30ms
29ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~lpqzlq4c&c=6921438415787&slotId=3460719207893.5&qqid=CMrZl7_69YIDFfayWgUdeJMMfA&umsem=0&ape=1&ple=1&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fwww.gstatic.com%252Fmysidia%252F38bcf84a6c98f8ab5c7e5b9a6f0eaec8.js%253Ftag%253Dclient_fast_engine_2019&encoded_body_size=0&transfer_size=0
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/07977d2b7ee0aecb6f84611ef43cb16f.js?tag=video_mra/web_raspberry_ms
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:45 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame C413 0
17 B 30ms
29ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=3~lpqzlq5t&c=6921438415787&slotId=3460719207893.5&qqid=CMrZl7_69YIDFfayWgUdeJMMfA&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fwww.gstatic.com%252Fmysidia%252F07977d2b7ee0aecb6f84611ef43cb16f.js%253Ftag%253Dvideo_mra%252Fweb_raspberry_ms&encoded_body_size=0&transfer_size=0
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/07977d2b7ee0aecb6f84611ef43cb16f.js?tag=video_mra/web_raspberry_ms
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:45 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame C413 0
17 B 30ms
29ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=4~lpqzlq5t&c=6921438415787&slotId=3460719207893.5&qqid=CMrZl7_69YIDFfayWgUdeJMMfA&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fwww.gstatic.com%252Fmysidia%252Fa6de5423b7c632060e8f86136bd5d27a.js%253Ftag%253Dmysidia_one_click_handler_one_afma_2019&encoded_body_size=0&transfer_size=0
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/07977d2b7ee0aecb6f84611ef43cb16f.js?tag=video_mra/web_raspberry_ms
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:45 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D8E2 6 KB
3 KB 15ms
13ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://loan.freemod.link/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 14:08:43 GMT
expires: Tue, 03 Dec 2024 14:08:43 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H3 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 72ms
43ms Preflight
text/html 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=CybqzbN1tZcrzEvbl6toP-Kay4AfN4v_PdLC0j9X7Eb-eqL_vQBABIN_Rz58BYMnGqYvApNgPoAGJlK35KcgBCakCjOQ1Kug5sj7gAgCoAwHIAwqqBJkCT9A67OqeIzEOEsspUtW21tSGH13PhAEM8HslZvLzwMgkNHMziRk75bqGRifUfauMs4exfpWRdXywrJLFV28SsMda5FCfSFDpK7shvVHE2R9X54g69M4mK5xUqNcoRmYQZLOG0KcdY6jsFWnuLjHUDkezlgy5CBNGTq7633bFlqVq4MhNFaZbTBxwHd3_Sjz80-przfWdm0tXnEiNPr2iNavmmRxmFNkZnmqbVoT_ZUpnXk5JqWPsN7DmPj7DQLNf-r8MXiHeefb0W35c3HQJtwVZk8SxBdk3KHhSmxc331bnwZnJ4mXcwmjdVohsK3PQlEi39t3uBHT8mNfDX31QncghY6OzZd-MkBLd2hkLN83eZZcHMeG85pHABM-MqdGzBOAEAYgFza7Qi0ySBQQIBBgBkgUECAUYBKAGLoAHicz92ASoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAPIHBRCJvpIB0ggdCIBhEAEYHTICigI6AoBASL39wTpY8_vxvvr1ggOaCa0BaHR0cHM6Ly91cy5hbGRpc2NvdmVyLmNvbS9kc3I_cT1iZXN0JTIwY2FyJTIwYWNjaWRlbnQlMjBpbmp1cnklMjBsYXd5ZXJzJTIwbmVhciUyMG1lJmFzaWQ9YWRfY2g2MSZkZT1jJnJhYz1iZXN0JTIwY2FyJTIwYWNjaWRlbnQlMjBpbmp1cnklMjBsYXd5ZXJzJTIwbmVhciUyMG1lJnNjbGlkPTAtMjQyOTGACgPICwGiDBAqDgoM5LSxAu61sQK1uLEC2gwQCgoQ8ObyiPjnwa42EgIBA-INEwjQqvK--vWCAxX2sloFHXiTDHy4E5wb2BMM0BUBgBcBshcfCh0IABIUcHViLTYyNzY4NDc3MjU4MzUxOTIYxJeaAQ&sigh=a-mLeo1VBmA&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTgDICaaNa7aJEsqj0caoWx2McfaN5W0BYSw0HKGggAodnlw0gzqs1TJNLSSQyU53uFE8tuiycTET7nBvLcAg_L-KrupnYuvCK-gB6MeiYhgB&template_id=3484&cbvp=2&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 04 Dec 2023 14:08:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 152ms
74ms Preflight
text/html 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 04 Dec 2023 14:08:45 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 css2
fonts.googleapis.com/ Frame D8E2 4 KB
671 B 41ms
40ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 04 Dec 2023 14:08:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 13:53:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 04 Dec 2023 14:08:45 GMT

GET
H3 200 b1fdc9f83bbec90a172a8086cc6d7abe.js Show response
www.gstatic.com/mysidia/ Frame 07F4 9 KB
4 KB 28ms
24ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/b1fdc9f83bbec90a172a8086cc6d7abe.js?tag=client_fast_engine_2019

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bbde0fd637840b04806e70ee7610047e1cfe5568854929dc58c310a861d93ca6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 19:42:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 152770
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4047
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 19:10:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 01 Mar 2024 19:42:35 GMT

GET
H3 200 1a0210261676d783efd39d95dc61a484.js Show response
www.gstatic.com/mysidia/ Frame 07F4 144 KB
53 KB 32ms
27ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/1a0210261676d783efd39d95dc61a484.js?tag=video_mra/web_interstitial_raspberry_ms_cta_adjustment

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b3cd100d513361651e02aa5d0ab524a76a2483fcd6b7e0942f7895c47557728

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 18:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 156092
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54176
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 19:10:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 01 Mar 2024 18:47:13 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 07F4 21 KB
1 KB 48ms
44ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500%2C600

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

76740b2a7b0a35eed6ceb509cefd8ddd6955bd5c656b0581f2dcdb48040ced8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 04 Dec 2023 14:08:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 13:37:02 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 04 Dec 2023 14:08:45 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 07F4 2 KB
822 B 17ms
13ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 19:53:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 65730
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Dec 2023 19:53:15 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/ Frame 07F4 24 KB
9 KB 18ms
14ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/abg_lite_fy2021.js

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b67ad968ba3668562f331df45b73501e17c7c166bcf7e5443c33633cbc9d5783

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 19:53:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 65730
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9305
x-xss-protection: 0
server: cafe
etag: 13635642240219548939
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Dec 2023 19:53:15 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 07F4 3 KB
1 KB 17ms
14ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/window_focus_fy2021.js

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:55:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 820
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 13:55:05 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 07F4 20 KB
8 KB 18ms
15ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 20:01:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 65218
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8544
x-xss-protection: 0
server: cafe
etag: 17124069415086231762
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Dec 2023 20:01:47 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 07F4 202 KB
64 KB 61ms
28ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65067
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701261208926228"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Dec 2023 14:08:45 GMT

GET
H3 200 7a8419aef3683f04c437bd15cecf843d.js Show response
www.gstatic.com/mysidia/ Frame 07F4 37 KB
15 KB 36ms
34ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7a8419aef3683f04c437bd15cecf843d.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

949b3cde1a46caf4f55bb496f58a44af641a4b9fed64f95057bb5eeff142170b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 19:36:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 239521
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15452
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 19:10:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 29 Feb 2024 19:36:44 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/elements/html/ Frame D8E2 22 KB
9 KB 17ms
16ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bbbf189ee0fd46edc91bdc96aeac86c78c35c8d497ecd9a786ef318ccb62e985

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 22:39:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55734
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9189
x-xss-protection: 0
server: cafe
etag: 14682237860056745894
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Dec 2023 22:39:51 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame D8E2 205 B
229 B 24ms
23ms Image
image/png 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 18:16:57 GMT
x-content-type-options: nosniff
age: 157908
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 01 Dec 2024 18:16:57 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame D8E2 604 B
628 B 26ms
24ms Image
image/png 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 00:15:29 GMT
x-content-type-options: nosniff
age: 222796
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 01 Dec 2024 00:15:29 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame C413 42 B
64 B 49ms
47ms Image
image/gif 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=C1t16bN1tZcrzEvbl6toP-Kay4AfN4v_PdLC0j9X7Eb-eqL_vQBABIN_Rz58BYMnGqYvApNgPoAGJlK35KcgBCakCjOQ1Kug5sj7gAgCoAwHIAwqqBJwCT9A67OqeIzEOEsspUtW21tSGH13PhAEM8HslZvLzwMgkNHMziRk75bqGRifUfauMs4exfpWRdXywrJLFV28SsMda5FCfSFDpK7shvVHE2R9X54g69M4mK5xUqNcoRmYQZLOG0KcdY6jsFWnuLjHUDkezlgy5CBNGTq7633bFlqVq4MhNFaZbTBxwHd3_Sjz80-przfWdm0tXnEiNPr2iNavmmRxmFNkZnmqbVoT_ZUpnXk5JqWPsN7DmPj7DQLNf-r8MXiHeefb0W35c3HQJtwVZk8SxBdk3KHhSmxc331bnwZnJ4mXcwmjdVohsK3PQlEi39p_sJOY4Xyv5noEbekdxhgRdafeFvgpqHY5b0mA5S7sf9wJY3FCrh27ABM-MqdGzBOAEAYgFza7Qi0ygBi6AB4nM_dgEqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAqgHyqmxAqgH66WxAtgHANIIHQiAYRABGB0yAooCOgKAQEi9_cE6WPP78b769YIDsQm9BtTbyIDthoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQLaDBAKChDw5vKI-OfBrjYSAgEDqg0CVVPIDQHiDRMI0Kryvvr1ggMV9rJaBR14kwx8uBOcG9gTDNAVAfgWAYAXAQ&sigh=4PFge4aye50&cid=CAQSTgDICaaNa7aJEsqj0caoWx2McfaN5W0BYSw0HKGggAodnlw0gzqs1TJNLSSQyU53uFE8tuiycTET7nBvLcAg_L-KrupnYuvCK-gB6MeiYg&label=videoplayfailed400

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame C413 0
17 B 33ms
30ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=5~lpqzlq5t&c=6921438415787&slotId=3460719207893.5&qqid=CMrZl7_69YIDFfayWgUdeJMMfA&event_name=first_play&asset_bytes=149705&video_bytes=0&cached_data_bytes=0&js_cached=false&css_cached=false&num_assets=12&num_assets_cached=0&num_assets_cache_validated=0&num_assets_unmeasurable=3&video_played_seconds=0.00&video_muted=true&video_seconds_loaded=0.00&met.4=err.lpqzlqd8&aec=400
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/07977d2b7ee0aecb6f84611ef43cb16f.js?tag=video_mra/web_raspberry_ms
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:45 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame C413 0
17 B 34ms
31ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=6~lpqzlqdc&c=6921438415787&slotId=3460719207893.5&qqid=CMrZl7_69YIDFfayWgUdeJMMfA&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fwww.gstatic.com%252Fmysidia%252F38bcf84a6c98f8ab5c7e5b9a6f0eaec8.js%253Ftag%253Dclient_fast_engine_2019&encoded_body_size=0&transfer_size=0
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/07977d2b7ee0aecb6f84611ef43cb16f.js?tag=video_mra/web_raspberry_ms
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:45 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame C413 0
17 B 37ms
34ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=7~lpqzlqdc&c=6921438415787&slotId=3460719207893.5&qqid=CMrZl7_69YIDFfayWgUdeJMMfA&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fwww.gstatic.com%252Fmysidia%252F07977d2b7ee0aecb6f84611ef43cb16f.js%253Ftag%253Dvideo_mra%252Fweb_raspberry_ms&encoded_body_size=0&transfer_size=0
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/07977d2b7ee0aecb6f84611ef43cb16f.js?tag=video_mra/web_raspberry_ms
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:45 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame C413 0
17 B 37ms
34ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=8~lpqzlqdc&c=6921438415787&slotId=3460719207893.5&qqid=CMrZl7_69YIDFfayWgUdeJMMfA&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fwww.gstatic.com%252Fmysidia%252Fa6de5423b7c632060e8f86136bd5d27a.js%253Ftag%253Dmysidia_one_click_handler_one_afma_2019&encoded_body_size=0&transfer_size=0
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/07977d2b7ee0aecb6f84611ef43cb16f.js?tag=video_mra/web_raspberry_ms
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:45 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame C413 0
17 B 37ms
35ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=9~lpqzlqdd&c=6921438415787&slotId=3460719207893.5&qqid=CMrZl7_69YIDFfayWgUdeJMMfA&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fredirector.gvt1.com%252Fvideoplayback%253Fid%253D7546ef93d137e68d%2526itag%253D18%2526source%253Dweb_video_ads%2526requiressl%253Dyes%2526cmo%253Dsecure_transport%253Dyes%2526ip%253D0.0.0.0%2526ipbits%253D0%2526expire%253D1701706124%2526sparams%253Dip%252Cipbits%252Cexpire%252Cid%252Citag%252Csource%252Crequiressl%2526signature%253D215883CEB106BAA7D2FB7028DA19CCA35E8C4352.76B6ED4CDD639B2726288172F7A38B6C5309B8CC%2526key%253Dck2&encoded_body_size=0&transfer_size=0
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/07977d2b7ee0aecb6f84611ef43cb16f.js?tag=video_mra/web_raspberry_ms
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:45 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame C413 42 B
64 B 48ms
46ms Image
image/gif 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gPTZx8Qg5YtqHYATuVEq7wiNXgGYJLmNtV6Q-nRIA0Y.js Show response
pagead2.googlesyndication.com/bg/ Frame B802 50 KB
19 KB 28ms
23ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gPTZx8Qg5YtqHYATuVEq7wiNXgGYJLmNtV6Q-nRIA0Y.js

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80f4d9c7c420e58b6a1d8013b9512aef088d5e019824b98db55e90fa74480346

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 21:47:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 231667
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19632
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 30 Nov 2024 21:47:38 GMT

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 07F4 64 KB
24 KB 17ms
13ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a09ba825877d567e6cca03a8eaa2583f9e76a0f6d3ec64ead89048db668a82d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:04:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 281
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24457
x-xss-protection: 0
server: cafe
etag: 7553420222452197197
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 04 Dec 2023 15:04:04 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 07F4 0
17 B 31ms
31ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lpqzlqgt&chm=1&c=3793351759215310&ctx=2&qqid=CPHQsr_69YIDFbSeWgUdzBoIng&met.4=fb.i~lb.2w~ol.5h~idt.-y4~dt.-1ct&met.3=492.2r_1~555.50~556.50_2~113.6n_6~113.6t_2~112.6l_b&met.1=1.lpqzlqa8~14.0~15.0~16.0~17.0~18.0~19.1~20.1~21.1~1.lpqzlq6s~6.24~7.25~8.25~9.25~10.25~11.25~12.27~13.2k~14.2k~15.2o~16.6g~17.6g~18.6g~19.8w~20.8w~21.8w&met.7=CBsQCBgBMAE4AQ~CBsQBxgBIBEoETBEODM~CBsQBxgBIBIoEjBKODk~CBIQBxgBIBQoFDBUOEBoKHBTeNIMgAGmCogBw6QBqgEZChdHb29nbGUgU2Fuczo0MDAsNTAwLDYwMLABAbgBAw~CBwQChgBIBUoFTBBOCxoKHA1eMcIgAGbBogBiA2wAQG4AQM~CAkQChgBIBUoFTBBOCxoKHA1eIVLgAHZSIgBg7wBsAEBuAED~CB4QChgBIBUoFTBBOCxoKHA2eIAMgAHUCYgBgRWwAQG4AQM~CBwQChgBIBUoFTBCOC1oKHA3eIxFgAHgQogBgKIBsAEBuAED~CCoQChgBIBUoFTBzOF5QK1hCYDRoRnBjeNf-A4ABq_wDiAG-0AywAQG4AQM~CBsQChgBIBUoFTBVOD8~CCgQChgBIMgBKMgBMOoBOCJozwFw2wF4tcEBgAGJvwGIAd-ABLABAbgBAw~CBsQCBgBKEwwXTjBAmhPcFx4iReAAd0UiAGSMKABhP__________AbABAbgBAw~CBIQBxgBIHsoezClATgqaHtwpAF4rweAAYMFiAG8I6ABhP__________AaoBFQoTUm9ib3RvOndnaHRANDAwOzcwMLABAbgBAw~CEsQChgBIJgBKJgBMMABOChopQFwtAF4kUqAAeVHiAHbrgGgAYT__________wGwAQG4AQM~CBsQBhgBIJoBKJoBMMABOCY~CBsQBhgBIJoBKJoBMMEBOCY
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:45 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 07F4 0
17 B 30ms
30ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=2~lpqzlqh4&chm=1&c=3793351759215310&ctx=2&qqid=CPHQsr_69YIDFbSeWgUdzBoIng&met.6=6.1_CgsY9QIgNCoECAgSAA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:45 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 01E2 6 KB
3 KB 15ms
13ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://loan.freemod.link/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 14:08:43 GMT
expires: Tue, 03 Dec 2024 14:08:43 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 nmedianet.js Show response
contextual.media.net/ Frame 01E2 100 KB
38 KB 103ms
65ms Script
text/javascript 23.47.168.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/nmedianet.js?cid=8CU7Q771E&ydspr=1

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.47.168.66 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

3f12b5c04f4157799b80434524624b6c330d8970549bdb4d35bfda8a6daf207e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-mnt-h: 21-g4dd
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Mon, 04 Dec 2023 14:08:46 GMT
server: Apache
etag: "ee27c7be455f1ab2b17dfd1aee36bfb3"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
x-mnt-w: 22-5h9m
timing-allow-origin: *
content-length: 38719
expires: Mon, 04 Dec 2023 14:13:46 GMT

GET
H2 200 release-20231121-135-adperformance.js Show response
warp.media.net/rtb/resources/ Frame 01E2 72 KB
25 KB 51ms
11ms Script
application/javascript 23.205.72.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://warp.media.net/rtb/resources/release-20231121-135-adperformance.js

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.72.21 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

UploadServer /

Resource Hash

1616c8cd083e6b17f6a75ab0695bd4a4573b31ae8398ffb43758288028f6a773

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
date: Mon, 04 Dec 2023 14:08:46 GMT
x-guploader-uploadid: ABPtcPrHbBlvEvxV9JZPdIuPUtSPCyDx2B_gprnpiJvmF4oXtmicvDd_rZM-PbNyxluXDNTlTynqrlmceQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 25147
server: UploadServer
etag: "841dabce0b477a93d9cf7379b9eb1368"
vary: Accept-Encoding
x-goog-hash: md5=hB2rzgtHepPZz3N5uesTaA==, crc32c=iBXD1A==
content-type: application/javascript
x-goog-generation: 1700562102250666
cache-control: max-age=3600
x-goog-stored-content-length: 73447
expires: Mon, 04 Dec 2023 15:08:46 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 01E2 3 KB
1 KB 5ms
4ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/window_focus_fy2021.js

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:55:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 820
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 13:55:05 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 01E2 20 KB
8 KB 7ms
6ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 20:01:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 65218
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8544
x-xss-protection: 0
server: cafe
etag: 17124069415086231762
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Dec 2023 20:01:47 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 01E2 24 KB
6 KB 17ms
16ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:55:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 820
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 03 Dec 2024 13:55:05 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 01E2 202 KB
64 KB 27ms
26ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65067
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701261208926228"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Dec 2023 14:08:46 GMT

GET
H/1.1 200
OK browserfp.min.js Show response
pxlclnmdecom-a.akamaihd.net/javascripts/ Frame 01E2 131 KB
42 KB 72ms
30ms Script
text/javascript 23.200.0.8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU7Q771E&noCookies=true
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CU7Q771E&ydspr=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.0.8 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-0-8.deploy.static.akamaitechnologies.com
Software: / Express
Resource Hash: 05c76e341e1ea519336edb653dd170b86fd6f182a2939892afa804044edbd901

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Mon, 04 Dec 2023 14:08:46 GMT
Content-Encoding: gzip
x-powered-by: Express
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=300
Access-Control-Max-Age: 1800
Connection: keep-alive, Transfer-Encoding
Transfer-Encoding: chunked
Expires: Mon, 04 Dec 2023 14:13:46 GMT

GET
H2 200 SAFEFRAME.html Show response
contextual.media.net/sr/2722522032/ Frame 0C3E 74 KB
31 KB 278ms
277ms Document
text/html 23.47.168.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=3322&&kkdd=*u%7C!%7C*u9WAHnh3&Bk=0*D0d5M5pdd5p00DiM4&J2uv=D&ZHuz=D&Y2B=00p*&_HY3=n44*&Yk2=MOy*U**0s&YuY2=UY1JaGeblKseq0llTvvKYh%3D%3D&Yvk2=pri0rM0dp&Hkt3=*pMG5D&YY=yx&HY=L6&YF-Z=.QX~!L6&uk2=M)!XiPj*L&_uk2=mKridx5&F__uH=0&vvv=_tXTFnYcTn5UfZ0DsqlKiuXz727s*N6XLcm0TNq5XfY%3D&-H3=r&ch=0&bJ2=i&z2_0=MOyy5KfM.&z2_p=4*ddrMMM*&N2z_z=H2p%3D-bcc(kbvclc%3D0D(aJ3vuZ%3DDI4M(2aZlN%3DDIr4(HY2%3D-q(vz3%3DD%2CD(2aZlc%3DpD(BcpvlH2%3DpDp40pDiDi(kbvclN%3D5rMID*(bvcl_AY%3DD(bvclvpzlN%3DD(H_2%3D5pdM0p0dD(Z-lN3FlNaaH_%3DDIM*(vz_%3DDIDDD%2CD(ku%3D0FcnxObXzruFr~xqVsi_)k(ENN%3D0i(NFlkZ%3Di0(vkkubz%3D5%2C5(vY%3Dp%2C0i4i(vuHlH2%3DpDp40pDiDr(vz2B%3DDIDDD%2CD(bvclN%3D0I0p(BcpvlbvclN%3DD(bvclc%3D0D(HcB%3Dp4Ii4(JYz_%3DrDD50p(NN%3D05d(3vuZ%3DDI4M(BcpvlbvclAY%3DDsD(uHklY%3D05%2Cp%2CD%2CD%2CD%2CD%2CD%2Ci(NZ%3D0(uHkl2%3D0*i4(vA3%3DD%2CD(z4ulN%3DMIdd%2Cd0IM(H2%3DD(bk2%3DpgzRcFesz0L7!b8gB1(YBcpvlN%3DdIp(N_2%3D00055iD554Mrirp5M4DpDMri*MM*D0*ipMr4*4r*5r540rDMMd5M0M**D00rMr50M4rM05*rp*p0454DD*0rpd*dD5p*5p0riMMd0ii(bkZ%3DD(vA_%3DDIDDD%2CD(aJ2pulN%3DDI5M(HH%3DLQ(YY%3Dyx(ANl2c%3D3-(bkh%3DT0(Y3%3DD(vYB%3Di0I4M(Og%3D4Dr0(ANlbY%3D0(-_H%3D0(ANlbc%3D3-(ANlYYAH%3D0(Y_%3D-3h%20qavA(NHHlVmj%3DLQ%2CLQ(NzHkHp%3D05d(NzHkH0%3D05d(ANl__%3DD(NFlH2%3DpDp40pDpD0(2Y%3DM(BcpvlN%3DMIdd(__%3D0*i4(bcZlu%3DDI05(Bhl3GY%3DDIM*(BkHlH2%3D0D0(bvclvuHlN%3D0pIpM(NFlYa%3DD(2Yp%3D0(BlzH-%3D5DD5(czH_%3D(YBaJ%3DdIp(BkHlbvclN%3DDIiM(BcpvlklH2%3DpDp40pDiDi(BkHlbvclc%3DD(3_%3Dpi(BcpvlklN%3DDIDi(BkHlN%3D*DMId4(BcpvlbvclBk%3D0sT0d(bvcl_Bk%3DD(BB%3DD(YBcpvlH2%3D0DD(vEB%3Di0I4M(cpvlN%3D0DDD(hvlN%3DdI54%2CD(vz2u%3DDIDDD%2CD(Hk2%3Dpri0rM0dp(bvclvuHlAY%3DD(ANlHvY%3DANN(Bhb%3DDIM*(2pulc%3D0D(YBcp%3DdIp(4uYE%3D555Ir*(2ZZlH_vJ%3DFzvZa-q(2pulN%3DDI5M(vuHlN%3Dd0IM(bvclHvuHlN%3D0pIpM(vAhu%3DDIDDD%2CD(vAh2%3DDIDDD%2CD(kHX3E%3DD(kHkE%3DD(bvclvuYlN%3DD(Nk2%3DDI4M(ANlu_%3DQv_kYc3(bvclvuHlvB%3DD(YN2u%3DDID50(k_qu3lk2%3D0*(H3cc3vl_zJlk2%3D5pdM0p0dD(Hbuucql_zJlk2%3D(23_3Y_32l_zJlk2%3D(Bk3hzNkck_q%3DDIM*(uaH%3D0(zYl_qu3%3D0(z2NcA%3D5pdM0p0dD(zZu%3D0(aJNk2%3DDI4MD(NEcv%3DDID0D(Hbk2%3D(2_Y%3D3zH_lHY(2ZZl3vuZ%3DEzcH3(2ZZ%3DFzvZa-q(N2uYzu2%3DD(2zcJ%3D23Ezbc_(HJZ_%3DFaZ3uzJ3l_vzB3c(HaNu%3D(Gk2%3DQ7oTubNTiddpDdMp40*MD454(F_Zc%3D0(2Yb_%3D*r(2aJN%3DDT0(3YulbH32%3D10r(3YuluDr%3DDID5M5M*0ipi4Dri44i(3Yulu0D%3DDIp45pdDdpMp0r5M4M*(3Yulu0r%3DDI4ir40*dr0irM0MMDr(3YulupD%3DDIirrpMM0D*rpMd45id(3Yulupr%3DDIrrMdi0d55*i0M50r(3Yulu4D%3DDIdMip40Dr*i0pdD**(3Yulu4r%3DDIM0*i4M**dp5*iDd*(3YuluiD%3DDI5*id0p0Dd0Mdrrdp(3Yuluir%3D0I0iMr45D4d4r4pMdM(3YulurD%3D0I4dp5rMpD4*pip05M(3Yulurr%3D0Id4p5dii*i5r40r04(3YuludD%3D0I5pi500p0040ri44d(3Yuludr%3DpIpddMi*4M0p5*M00i(3Yulu*D%3DpI*r4rrr4r0D**M0(3Yulu*r%3D4IippD0dMd5ddd55rr(3YuluMD%3DiIi**rr4di0M4000p(3YuluMr%3DdI0i*pDrprr4ppMDM(3Yulu5D%3D5ID*05DiriM5d5pDd(3Yulu5r%3D0*Id*pD5p00pi4pD*r(3Yulu55%3D*iIp44d0i*4p*iD54(kNY%3D0(-Ht%3D0(_JH%3D*pMG5D(NHN%3DD(NHu%3DD(_ZG%3Dpir&-_B=D&ZZZ=boaHLEg71sA%3D&kh=*pM&k-gEv=0&N2vg2=idD&Nk2=4i5Ddr&ZYE=d*005&q2Huv=0&Nz3=eG3eizztJt&Az_uv3=0&Yz2aZzk-=_tXTFnYcTnT.xFLipTbbE2-r!oFpkODLd124pqigxYCP!.ClAqCatJ%3D%3D&qucu=0&kHk2=r&z2B=g-B3H_av%20faYbH&HHZYvlB3v=r&uJk2=uD0r0prdpMpr_pDp40pDi0iDM&HHc2=%7B%22HHku%22%3A%22pzD2%3ArdDD%3ADDpi%3ADDDD%3ADDDD%3ADDDD%3ADDDD%3ADDDD%22%2C%22HHYY%22%3A%22yx%22%2C%22HHHY%22%3A%22L6%22%2C%22HHY_q%22%3A%22L3h%206avA%22%7D&F_ZcHvY=0&sflct=8975839&ure=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CU7Q771E&ydspr=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.47.168.66 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

6ce041c7d895b7b6ad857d67276d825df8e0eae499c279ce80c9ede4bf90eacf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 31438
content-type: text/html
date: Mon, 04 Dec 2023 14:08:46 GMT
expires: Mon, 04 Dec 2023 14:08:46 GMT
pragma: no-cache
strict-transport-security: max-age=31536000
timing-allow-origin: *
vary: Accept-Encoding
x-sc-h: 22-tf5s

GET
H2 200 bping.php
lg3.media.net/ Frame 01E2 35 B
176 B 34ms
30ms Image
image/gif 23.205.72.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=3062&&vgd_cdv=1127&vgd_cage=3&vgd_tsce=L337&vgd_mcf=67119&gdpr=0&mspa=0&prid=8PRVCXX19&cid=8CU7Q771E&crid=254158162&vi=1701698926692110483&ugd=4&lf=6&cc=US&sc=NY&lper=100&wsip=170785101&r=1701698926122&rrr=tzR-hLcl-L9QFm10Ey_J4pRaDdDE7bYRNlT1-by9RFc%3D&requrl=https%3A%2F%2Floan.freemod.link%2F&vgde_bdata=QOfvzxjj~8xLjMjvu9~myJLEYv9.AW~OmYMGv9.XA~QNOvz5~L1Jv9%2C9~OmYMjvf9~ejfLMQOvf9fAuf9H9H~8xLjMGviXW.9h~xLjM7UNv9~xLjMLf1MGv9~Q7OvifFWufuF9~YzMGJwMGmmQ7v9.Wh~L17v9.999%2C9~8EvuwjTb%3DxD1XEwXcb5C4H708~kGGvuH~GwM8YvHu~L88Ex1vi%2Ci~LNvf%2CuHAH~LEQMQOvf9fAuf9H9X~L1Oev9.999%2C9~xLjMGvu.uf~ejfLMxLjMGv9~xLjMjvu9~QjevfA.HA~yN17vX99iuf~GGvuiF~JLEYv9.AW~ejfLMxLjMUNv949~EQ8MNvui%2Cf%2C9%2C9%2C9%2C9%2C9%2CH~GYvu~EQ8MOvuhHA~LUJv9%2C9~1AEMGvW.FF%2CFu.W~QOv9~x8OvfV1ZjwR41uIrax2Ve%20~NejfLMGvF.f~G7OvuuuiiH9iiAWXHXfiWA9f9WXHhWWh9uhHfWXAhAXhiXiAuX9WWFiWuWhh9uuXWXiuWAXWuihXfhfuAiA99huXfFhF9ifhifuXHWWFuHH~x8Yv9~LU7v9.999%2C9~myOfEMGv9.iW~QQvIK~NNvPb~UGMOjvJz~x8Bvou~NJv9~LNevHu.AW~%3DVvA9Xu~UGMxNvu~z7Qvu~UGMxjvJz~UGMNNUQvu~N7vzJBn5mLU~GQQMC_pvIK%2CIK~G1Q8QfvuiF~G1Q8QuvuiF~UGM77v9~GwMQOvf9fAuf9f9u~ONvW~ejfLMGvW.FF~77vuhHA~xjYMEv9.ui~eBMJ-Nv9.Wh~e8QMQOvu9u~xLjMLEQMGvuf.fW~GwMNmv9~ONfvu~eM1Qzvi99i~j1Q7v~NemyvF.f~e8QMxLjMGv9.HW~ejfLM8MQOvf9fAuf9H9H~e8QMxLjMjv9~J7vfH~ejfLM8MGv9.9H~e8QMGvh9W.FA~ejfLMxLjMe8vu4ouF~xLjM7e8v9~eev9~NejfLMQOvu99~LkevHu.AW~jfLMGvu999~BLMGvF.iA%2C9~L1OEv9.999%2C9~Q8OvfXHuXWuFf~xLjMLEQMUNv9~UGMQLNvUGG~eBxv9.Wh~OfEMjvu9~NejfvF.f~AENkviii.Xh~OYYMQ7Lyvw1LYmz5~OfEMGv9.iW~LEQMGvFu.W~xLjMQLEQMGvuf.fW~LUBEv9.999%2C9~LUBOv9.999%2C9~8QDJkv9~8Q8kv9~xLjMLENMGv9~G8Ov9.AW~UGME7vKL78NjJ~xLjMLEQMLev9~NGOEv9.9iu~875EJM8Ovuh~QJjjJLM71yM8OvifFWufuF9~QxEEj5M71yM8Ov~OJ7JN7JOM71yM8Ov~e8JB1G8j875v9.Wh~EmQvu~1NM75EJvu~1OGjUvifFWufuF9~1YEvu~myG8Ov9.AW9~GkjLv9.9u9~Qx8Ov~O7NvJ1Q7MQN~OYYMJLEYvk1jQJ~OYYvw1LYmz5~GOEN1EOv9~O1jyvOJk1xj7~QyY7vwmYJE1yJM7L1eJj~QmGEv~-8OvKrtoExGoHFFf9FWfAuhW9AiA~w7Yjvu~ONx7vhX~OmyGv9ou~JNEMxQJOv%20uX~JNEME9Xv9.9iWiWhuHfHA9XHAAH~JNEMEu9v9.fAifF9FfWfuXiWAWh~JNEMEuXv9.AHXAuhFXuHXWuWW9X~JNEMEf9v9.HXXfWWu9hXfWFAiHF~JNEMEfXv9.XXWFHuFiihHuWiuX~JNEMEA9v9.FWHfAu9XhHufF9hh~JNEMEAXv9.WuhHAWhhFfihH9Fh~JNEMEH9v9.ihHFufu9FuWFXXFf~JNEMEHXvu.uHWXAi9AFAXAfWFW~JNEMEX9vu.AFfiXWf9AhfHfuiW~JNEMEXXvu.FAfiFHHhHiXAuXuA~JNEMEF9vu.ifHiuufuuAuXHAAF~JNEMEFXvf.fFFWHhAWufihWuuH~JNEMEh9vf.hXAXXXAXu9hhWu~JNEMEhXvA.Hff9uFWFiFFFiiXX~JNEMEW9vH.HhhXXAFHuWAuuuf~JNEMEWXvF.uHhf9XfXXAffW9W~JNEMEi9vi.9hui9HXHWiFif9F~JNEMEiXvuh.Fhf9ifuufHAf9hX~JNEMEiivhH.fAAFuHhAfhH9iA~8GNvu~zQlvu~7yQvhfW-i9~GQGv9~GQEv9~7Y-vfHX&ssld=%7B%22QQ8E%22%3A%22f19O%3AXF99%3A99fH%3A9999%3A9999%3A9999%3A9999%3A9999%22%2C%22QQNN%22%3A%22Pb%22%2C%22QQQN%22%3A%22I3%22%2C%22QQN75%22%3A%22IJBn3mLU%22%7D&vgd_bid=349065&vgd_ydspr=1&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_rakh=1701698926156126639&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fnmedianet.js&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=376658887&vgd_pgid=p01512562825t202312041408&vgd_pgids=1&vgd_uspa=0&vgda_l1btm=%5B%22SPAMPXL%22%5D&hvsid=00000170169892611800958081324726&gdpr=0&mspa=0&vgd_l2type=scs_newfl&vgd_end=2

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.72.21 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
date: Mon, 04 Dec 2023 14:08:46 GMT
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Mon, 04 Dec 2023 14:08:46 GMT

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 2398 27 KB
10 KB 257ms
256ms Document
text/html 23.47.168.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=6&cv=31&https=1&cid=8CUU9JF8H&prvid=99%2C77%2C20000%2C294%2C262%2C460%2C461%2C462%2C4%2C313%2C10000%2C459%2C229%2C9%2C319&itype=ADX&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.47.168.66 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-199-48-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

5eead67e8a06eee515a7126d544630c4a0eef8913e86a5b4cdb4c8ca771db7d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 9623
content-type: text/html; charset=UTF-8
date: Mon, 04 Dec 2023 14:08:46 GMT
expires: Wed, 06 Dec 2023 14:08:46 GMT
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 clog
hblg.media.net/ Frame 01E2 35 B
191 B 78ms
59ms Image
image/gif 23.199.48.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/clog?pixel_len_bucket=6543&logid=awlog&lper=1&itypeid=17&itype=ADX&cc=US&cid=8CUU9JF8H&reqid=nucvRSjKvmvJsHUfvRcGkQ&vid=nucvRSjKvmvJsHUfvRcGkQ&dn=loan.freemod.link&rawDn=loan.freemod.link&requrl_dn=loan.freemod.link&pid=8PR113JGC&ugd=4&fleet=appnexus&requrl=https%3A%2F%2Floan.freemod.link&cliIPV6=2a0d%3A5600%3A0024%3A0000%3A0000%3A0000%3A0000%3A0000&cliIPType=v6&coppa_enf=true&lmt_status=N&lmt_applied=N&lmt_enf=true&dnt_enf=false&geo_source=2&sc=NY&ct=New+York&zip=10013&pubid=pub-ADX-116310109131&tgtval=pub-ADX-116310109131&csip=rtb-appnexus-54477f9df5-2pt9p.SC&dtc=east_sc&zone=d&ptype=23&tmax=300&xtmax=300&gdpr=0&gpp_present=false&app=0&sat=1&device_id=4&sckfl=0&sckfl2=0&smbrid=adx-1&cxtSgmt=homepage_travel&usp_status=0&usp_enf=1&mspa_enforced=true&gqid=AD8Fdm6q8nQz2QibYO7OXmC40hwxZVHx4kxNEZgwHCaft566MXo0gbC7d9vaU2ESuzq3o1tX&pexid=ADX-pub-4662068231780393&geoll=true&is_ortb=false&commit_id=3abc4605&ocurr=USD&omul=1.0&currsrc=NEXUS&currsrc_date=2023-12-01+00%3A00%3A00&schain_cmpl=1&schain_nodes_count=1&dummy_vsid=false&amptype=1&second_call=false&supply_cc=US&ipcc=US&is_msnnative_src=false&proxy=envoy&rtttime=49&req_tid_present=false&pvid=460&prvAccId=254158162&prvApiId=8CU7Q771E&adj0=0.0&adj1=0.0&adj2=0.0&pst=0&crid=376658887&prspt=headerBid&prvReqId=13978981563701_575892740_3766588874601&size=728x90&chnl=HARMONY&bdp=0.380&bid_uuid=38f03b2d33fc3410841f1611ac0c146f&cbdp=0.091&og_cbdp=0.380&ogbdp=0.38&pv_adtype=0&res_mtype=0&mnet_ckfl=0&ckfl=0&be=0&advUrl=https%3A%2F%2Frelated.investorfocus.net&dfpBd=0.091&dsrc=-2&dp=0&dbf=1&epc=254158162&s=1&snm=SUCCESS&pcrid=8CU7Q771E-254158162-49-15&tpbTkn=false&exid=218&bidflr=0.010&pbidflr=0.010&opbidflr=0.010&spbf=0&viewability=87&sbdrid=196&exp=ssProfile%3D0%7Csfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Csch%3D1%7Cclt%3D3%7Ctpi%3D1%7Cfl_rl%3D1%7Cdbr%3D1%7Csfl%3Dfalse%7Cbfl%3D-100%7Ctpi%3D1&mnrf=0&ortbseat=BID_API&brsrclk=0&bidrestime=1701698925309&fpuReq=1&bfs=103&acsn=1&ybnca_erpm=0.38&dmm_erpm=true&dmm_ogerpm=false&bcrid=1700080807684000728009000059500&strg=HARMONY&pgcatiab=IAB19-34&pgcatiab2=663&pgcatsprig=422&vls=0&scrid=1700080807684000728009000059500&mang=1&pvdTmax=245&fpusp=false&ae=false&epcexp=false&moau=true&ucrid_ver=2&omid=0&mnet_static_share=0.0&dt=O&mx_svc_mode=http&incentive_type=0&aogbdp=0.0&spIvt=3&spSource=0&spTo=3&spIsReq=3&spFst=0&spCst=0&mx_sdr=false&mx_sbp=-10.0&mx_sua_cvg=1111111&mx_tid_sent=false&mx_epbc=8CU7Q771E&mx_SPRIG=1&mx_bsBucket=0&mx_ssProfile=0&mx_sua_os_n=Windows+NT&mx_lr=0&mx_TAS=1&mx_ep_sent%3C%3E=badv&mx_g_one_uid_sent=None&mx_uid_sent=0&mx_sua_os_v=10.0&mx_bsBucketRa=0&mx_sid=8CUU9JF8H&mx_SC=0&mx_lr_seg_deal=0&mx_aqcpl_crid=0&mx_nsz=1&mx_GCID=0&mx_maq_call=false&mx_aurt=0&mx_sua_model=x64&mx_bsBucketKtwRl=0&mx_tgs=728x90&mx_bsProfileRa=0&mx_IAB2=1&mx_bss_algos%3C%3E=0&mx_aurl_hc=0&mx_aabpc=0&mx_PC=1&mx_UCC=2&mx_isLossNtf=false&mx_bsProfileKtwRl=0&mx_bsProfile=0&mx_ssBucket=0&mx_TAF=3&mx_gpid_sent=false&mx_commit_id=c41da5497d&mx_exp_tokens%3C%3E=IPBLOCK_DM%3AGCS%23%23launchexp%3Atoken1%23%23NedCkflWithData%3ANoBlk%23%23prll_req%3Atrue%23%23NedCkfl%3ANoBlk%23%23BssTgtMig%3ADEFAULT&acid=1e30906958f76863c9497a9655c1a4c0&rtime=26.0&wsip=mowx-lite-6c6d6644d4-tt989&ltime=33.0&act=headerBid&abs=0%7C0%7Cxtmax%3D300%7Cbrr%3D0&adtypes=0&adblk=926812160&impId=1&reftime=0&reftype=0&psrc=fail&mowxReqId=1e30906958f76863c9497a9655c1a4c0_1&policy_enf=2&pub_blk_enf=1&req_size=728x90&renderer=0&ifst=0&iframingState=0&ifdp=0&slotVisibility=1&adpos=1&media=0&native_asset=0&req_mtype%3C%3E=0&ctr=-1.0&rfc=-1&skadidfl=0&feedback_id=nucvRSjKvmvJsHUfvRcGkQ_1&supplyTagId=926812160&mnrfc=-1&viewability_vendor=EXCHANGE&vcmplrt=-1.0&imp_tid_present=false&mp_seg%3C%3E=100109%23%23100090%23%2360766%23%2360524%23%23100154%23%23100273%23%2360766%23%2360524&debug_ts=2023-12-04+14%3A08%3A45&__expireat=1701699525565&mview=1&lo_pvid=%5B460%5D&lo_dp=0&lo_bdp=0.380&lo_cbdp=0.091&actltime=33&rme=adm&bdata=sd2%3Dnull~iurl_l%3D10~ogerpm%3D0.38~dom_b%3D0.53~scd%3Dny~rae%3D0%2C0~dom_l%3D20~vl2r_sd%3D2023120404~iurl_b%3D958.07~url_tkc%3D0~url_r2a_b%3D0~std%3D926812160~mn_beh_boost%3D0.87~rat%3D0.000%2C0~ip%3D1hlLSCuRa5ph5MSyKE4tPi~fbb%3D14~bh_im%3D41~riipua%3D9%2C9~rc%3D2%2C1434~rps_sd%3D2023120405~radv%3D0.000%2C0~url_b%3D1.12~vl2r_url_b%3D0~url_l%3D10~slv%3D23.43~gcat%3D500912~bb%3D196~erpm%3D0.38~vl2r_url_kc%3D0E0~psi_c%3D19%2C2%2C0%2C0%2C0%2C0%2C0%2C4~bm%3D1~psi_d%3D1743~rke%3D0%2C0~a3p_b%3D8.66%2C61.8~sd%3D0~uid%3D2IaGlhBEa1NDOuZIvq~cvl2r_b%3D6.2~btd%3D1119940993854529830208547887017428537357959315088698187701158591835819752721393007152676092792154886144~uim%3D0~rkt%3D0.000%2C0~ogd2p_b%3D0.98~ss%3DNA~cc%3DUS~kb_dl%3Den~uiw%3D-1~ce%3D0~rcv%3D41.38~CI%3D3051~kb_uc%3D1~nts%3D1~kb_ul%3Den~kb_ccks%3D1~ct%3Dnew%20york~bss_KTW%3DNA%2CNA~basis2%3D196~basis1%3D196~kb_tt%3D0~bh_sd%3D2023120201~dc%3D8~vl2r_b%3D8.66~tt%3D1743~ulm_p%3D0.19~vw_exc%3D0.87~vis_sd%3D101~url_rps_b%3D12.28~bh_co%3D0~dc2%3D1~v_asn%3D9009~last%3D~cvog%3D6.2~vis_url_b%3D0.48~vl2r_i_sd%3D2023120404~vis_url_l%3D0~et%3D24~vl2r_i_b%3D0.04~vis_b%3D708.63~vl2r_url_vi%3D1E-16~url_tvi%3D0~vv%3D0~cvl2r_sd%3D100~rfv%3D41.38~l2r_b%3D1000~wr_b%3D6.93%2C0~radp%3D0.000%2C0~sid%3D254158162~url_rps_kc%3D0~kb_src%3Dkbb~vwu%3D0.87~d2p_l%3D10~cvl2%3D6.2~3pcf%3D999.57~dmm_strg%3Dharmony~d2p_b%3D0.98~rps_b%3D61.8~url_srps_b%3D12.28~rkwp%3D0.000%2C0~rkwd%3D0.000%2C0~isRef%3D0~isif%3D0~url_rpc_b%3D0~bid%3D0.38~kb_pt%3DArticle~url_rps_rv%3D0~cbdp%3D0.091%7Eitype_id%3D17%7Eseller_tag_id%3D926812160%7Esupply_tag_id%3D%7Edetected_tag_id%3D%7Eviewability%3D0.87%7Epos%3D1%7Eac_type%3D1%7Eadblk%3D926812160%7Eamp%3D1%7Eogbid%3D0.380%7Ebflr%3D0.010%7Esuid%3D%7Edtc%3Deast_sc%7Edmm_erpm%3Dfalse%7Edmm%3Dharmony%7Ebdpcapd%3D0%7Edalg%3Ddefault%7Esgmt%3Dhomepage_travel%7Esobp%3D%7Exid%3DADX-pub-4662068231780393%7Ehtml%3D1%7Edcut%3D75%7Edogb%3D0-1%7Eecp_used%3Dq15%7Eecp_p05%3D0.09898714243054334%7Eecp_p10%3D0.23926062821598387%7Eecp_p15%3D0.34531765145818805%7Eecp_p20%3D0.45528810752863946%7Eecp_p25%3D0.5586416997418915%7Eecp_p30%3D0.6842310574126077%7Eecp_p35%3D0.8174387762974067%7Eecp_p40%3D0.9746121061865562%7Eecp_p45%3D1.1485390363532868%7Eecp_p50%3D1.3629582037242198%7Eecp_p55%3D1.6329644749531513%7Eecp_p60%3D1.9249112113154336%7Eecp_p65%3D2.2668473812978114%7Eecp_p70%3D2.75355535107781%7Eecp_p75%3D3.4220168696669955%7Eecp_p80%3D4.477553641831112%7Eecp_p85%3D6.147205255322808%7Eecp_p90%3D9.071904548969206%7Eecp_p95%3D17.672092112432075%7Eecp_p99%3D74.23361473274093~ibc%3D1~nsz%3D1~tgs%3D728x90~bsb%3D0~bsp%3D0~tmx%3D245&utime=834&sf=0&cpr=0.1468568097153975

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.199.48.23 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Mon, 04 Dec 2023 14:08:46 GMT

GET
DATA 200
OK truncated
/ Frame 01E2 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bc32d8f7f41694957a485cb551bbde7bf99c2d2ab35731c2d53311a2414283a4

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 01E2 0
0 54ms
53ms Image
text/html 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C7IVAbd1tZbKOCqu76toP6ayJgA--laSvbPfa0tOsDMCNtwEQASAAYMnGqYvApNgPggEXY2EtcHViLTQ2NjIwNjgyMzE3ODAzOTPIAQngAgCoAwHIAwKqBP4BT9AuT8sH61hqIov-RMtiYrY-8h766kPY-YryuEB2UGvoMoE6aehV08H-lygU4G_PT_AoLFvdU5-t0nh-glTXNM2A2WoAO01gnGutzcY87VpMbU6FKKZ3lxpTXf3cNbt08Dc7P4pNaNYZhZMe5MUrhH6Ckv3xyLDbxrsE9LLI_3TotovAsKJQKkvBiHVR1TmZLfEZNcjfgymc1ZOsKT_D7lYW2gyQJiWaeXVPrisXLFLNLpdpp5nTGrDMkISidUVTK93v0mqGaN2aBcmHD_gjie-9n6wIC-c7K0zjnvKbblfg_A-nqKquyILzElETWf6Kz66e6HcOz8DW1DXbMk_gBAGABofxr5Or-JijOaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBsIgGEQATICigI6AoBASL39wTpYzKTyvvr1ggOACgP6CwIIAYAMAeINEwi62_K--vWCAxWrnVoFHWlWAvDQFQGAFwGyFx0KGxIUcHViLTQ2NjIwNjgyMzE3ODAzOTMYxJeaAQ&sigh=9rKLgZ_NXtw&uach_m=%5BUACH%5D&cid=CAQSTgDICaaNsDU6HuvBsXl9xx9VQKW3yt2yNegSym0h_iha4OwcueStfq7Tkh7Ebg1bT-07KOKEri15rCdks0G5mT6LNyM78GcDCze0yiIgehgB&cbvp=2&vis=1
Requested by: Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H2 200 log
hblg.media.net/ Frame 01E2 35 B
191 B 37ms
35ms Image
image/gif 23.199.48.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfke&evtid=plutol1&__q=AYYEIwKELwQCAAABAAAAAgAAAABAAAEABgAAQIABAAgAMNAATDEzOTc4OTgxNTYzNzAxXzU3NTg5Mjc0MF8zNzY2NTg4ODc0NjAxQDFlMzA5MDY5NThmNzY4NjNjOTQ5N2E5NjU1YzFhNGMwmAdSuB6F61HYPzJodHRwczovL2xvYW4uZnJlZW1vZC5saW5rBFVTAOgBTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExOS4wLjYwNDUuMTk5IFNhZmFyaS81MzcuMzYibG9hbi5mcmVlbW9kLmxpbmsSOENVVTlKRjhICAw3Mjh4OTAKMC4wOTEOZWFzdF9zYwZBRFgICG51cmwAAAAAAADAVUD6y8fShmMCMQAAAAAAAPC_QHJ0Yi1hcHBuZXh1cy01NDQ3N2Y5ZGY1LTJwdDlwLlNDPjE3MDAwODA4MDc2ODQwMDA3MjgwMDkwMDAwNTk1MDACEDNhYmM0NjA1AmQC&cbvp=2

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.199.48.23 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-199-48-23.deploy.static.akamaitechnologies.com

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Mon, 04 Dec 2023 14:08:46 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame 01E2 35 B
296 B 66ms
4ms Image
image/gif 23.44.201.209
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=dmmra&acid=1e30906958f76863c9497a9655c1a4c0&algo=default&bdp=0.3800&bidfp=0.0100&capd=0&cc=US&cid=8CUU9JF8H&crid=376658887&ct=New%20York&dc=east_sc&dfpbd=0.0912&dn=loan.freemod.link&iwb=1&ogcbdp=0.3800&other_bids=0.38&other_prv=460&pbshr=100.0000&prdp=0.0912&requrl=loan.freemod.link%2F&sat=1&sc=NY&sc_pvid=460&send_erpm=true&server=1&size=728x90&strg=harmony&totalTime=5610969&ugd=4&ver=9.6.4&cliIP=0&time_stamp=2023-12-04%2014%3A08%3A45&seat=BID_API&itype=adx&req_id=nucvRSjKvmvJsHUfvRcGkQ&dfp_bucket=0.0&level_base=0&bdp_bucket=0.4&app_type=adx_test&br_id=265&o_id=101&ua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F119.0.6045.199%20Safari%2F537.36&br_ver=119.0.6045.199&o_ver=NT%2010.0&second_bid=0.0&second_bidder=%2A&seg=homepage_travel%2Clong_tail_homepage_catchall%2CTravel%2CTravel_Preparation_and_Advice&f_seg=homepage_travel&model_key=generic_adx_1-cid_0&ogerpm=0.3800&ogerpm_used=false&rawbid=0.3800&totalTimeBucket=5&as_cache=0&sub_bidder=196&current_day=1.0&current_hour=14&cut=76&floor_bucket=0.00&model_version=202312040640_generic_adx_1-cid_0&erpm_bucket=0.40&mul_ratio=0.0000&dmm_m4=0.0000&ogerpm_wd_bkt=0-1&visibility=1&viewability=0.8700&pvid_seat=460_BID_API&ckfl=0&mnckfl=0&sd=0&predicted_wr=48.0852&bdp_wider_bucket=1&adblk=926812160&dim10=false&dmm_m9=0.0000&dmm_m10=2390487&log_less=true&cut_bkt=75&advurl=related.investorfocus.net%2F&dmm_d10=0.0000&bdmm_m5=0.0000&bdmm_m6=0.0000&bdmm_m7=0.0000&bdmm_m12=0.0000&dmm_l=0.0000&dmm_r=0.0000&e_rpm=0.0000&bdr_typ=1&clisp=rtb-appnexus-54477f9df5-2pt9p.SC&dmm_m1=2023-12-04%2014%3A08%3A45.310599391&bd_m1=0.0000&bd_m2=0.0000&bd_m3=0.0000&ss=NA&ss_d1=0&ss_d2=0&dmm_m22=0.3800&adtyp=0&gpid_sent=false&pst=EMS&bcrid=1700080807684000728009000059500&erpm_mult=1.000000&zone=d&rc=-1&ecp_p50=1.3629582037242198&ecp_p75=3.4220168696669955&ecp_avg=0.02&ecp_status=Success&ecp_used=q15&ecp_rtime=1061.0&sfm_key=mowx_8CUU9JF8H_460&content_context=-1&video_mindur=-1&video_maxdur=-1&vskip=-1&ctr=-1.0&vcmplrt=-1.0&vplcmtt=-1&itype_id=17&wsip=mowx-lite-6c6d6644d4-tt989&rel_cut_bkt=80&ecp_ver=multiquantile&djvm=9.5.8&ecp_p25=0.5586416997418915&ecp_p60=1.9249112113154336&ecp_p70=2.75355535107781&ecp_p80=4.477553641831112&ecp_p85=6.147205255322808&ecp_p90=9.071904548969206&ecp_p95=17.672092112432075&ecp_p99=74.23361473274093&optimal_cut=0.0&cut_cluster=0.0&cbvp=2
Requested by: Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.201.209 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-44-201-209.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 04 Dec 2023 14:08:46 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Mon, 04 Dec 2023 14:08:46 GMT

GET
H/1.1 200
OK bfp_ssn.js Show response
pxlclnmdecom-a.akamaihd.net/javascripts/ Frame 9998 12 KB
4 KB 17ms
17ms Document
text/html 23.200.0.8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/bfp_ssn.js?templateId=3
Requested by: Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU7Q771E&noCookies=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.0.8 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-0-8.deploy.static.akamaitechnologies.com
Software: / Express
Resource Hash: 7ec5561af74114c3b4b8e0a3e4e2d6f0718e60449f99d4266d8c026bfba8ddcc

Request headers

Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Cache-Control: max-age=300
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 3751
Content-Type: text/html; charset=utf-8
Date: Mon, 04 Dec 2023 14:08:46 GMT
Expires: Mon, 04 Dec 2023 14:13:46 GMT
Vary: Accept-Encoding
x-powered-by: Express

POST
H2 200 ptmdP
dts.clnmde.com/ Frame 01E2 7 B
366 B 68ms
22ms Ping
text/html 34.111.96.116
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dts.clnmde.com/ptmdP
Requested by: Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU7Q771E&noCookies=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.96.116 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 116.96.111.34.bc.googleusercontent.com
Software: / Express
Resource Hash: aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Request headers

Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 04 Dec 2023 14:08:46 GMT
via: 1.1 google
accept-ch: Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-powered-by: Express
etag: W/"7-Jgyp3YpFd/wAt71YECmAdg"
access-control-max-age: 1800
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
content-length: 7
alt-svc: clear

POST
H2 200 ptmdP
dts.clnmde.com/ Frame 01E2 7 B
63 B 59ms
23ms Ping
text/html 34.111.96.116
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dts.clnmde.com/ptmdP
Requested by: Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU7Q771E&noCookies=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.96.116 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 116.96.111.34.bc.googleusercontent.com
Software: / Express
Resource Hash: aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Request headers

Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 04 Dec 2023 14:08:46 GMT
via: 1.1 google
accept-ch: Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-powered-by: Express
etag: W/"7-Jgyp3YpFd/wAt71YECmAdg"
access-control-max-age: 1800
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
content-length: 7
alt-svc: clear

GET
H2 200 ptmdDual
dts6.clnmde.com/ Frame 01E2 70 B
122 B 78ms
22ms Image
image/gif 34.111.96.116
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dts6.clnmde.com/ptmdDual?t=%7B%22gh%22%3A%22170169892623133993147248%22%2C%22za%22%3A1%2C%22gcd%22%3A1701698926267%2C%22al%22%3A3%2C%22bcnd%22%3A1%7D
Requested by: Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.96.116 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 116.96.111.34.bc.googleusercontent.com
Software: / Express
Resource Hash: c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:46 GMT
via: 1.1 google
x-powered-by: Express
access-control-max-age: 1800
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
alt-svc: clear

POST
H3 204 csi
csi.gstatic.com/ Frame 07F4 0
17 B 31ms
30ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=3~lpqzlqio&chm=1&c=3793351759215310&ctx=2&qqid=CPHQsr_69YIDFbSeWgUdzBoIng&met.6=6.1_CgsYuAcgPyoECAgSAA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ptmd
dts.clnmde.com/ Frame 01E2 70 B
131 B 43ms
24ms Image
image/gif 34.111.96.116
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dts.clnmde.com/ptmd?t=170169892623133993147248_N4IgtgniBcDasEYA0AGJB2ATADlUgnCgLpFIgDuAjjLKeBAE410DGDYADjSAuiggDZ82fJgFDMCBCgAs2AMwB9MAEMAlgDtFCEHRUAbAC41iZAM4B7GMhAsWACwDW3TAFYZCV9kGZdZDmoAJsZwICh+IAwApgBmAKoMRtwRZgwsCUmh9oaGHGYApPIAgvmYAGKlZfoWKhoAdDHRUWAWgXX6mo6VEQBuZopBIbAaAK76+nT2fQPB3Cjz87z8QiJiUtjz+F4o3vKYMlgCESwjZoYzQyDYAMJx6ACK6OgIAKLHDD3cwAA6IG4eXh8v2gPxAhggHCiwN+bBmvyQvx6ajhMF+S0EwlE4lEUlkCnhvym-SC0LCC34fAxqwE602212+0OvwAvsyIhoVDQZJh8DJ8AJDjIkAh5DIdnx5PgkK55PNsHJZXQOWYYDyyGoVGATHQNSroLgQGcVIZTjR5EghfJzaKkPJXLaBLb0LbcJKkDy6AAvTnQGwcADmMBAnzI-vsQfRKyxmHkIsl+FjB322BAZD6QYEdRQdVcQlTIAMMHNIBiLBgAFobFFDGoI5So2J83ZAkG4gBlfNnQPQNCG5zQHj1zFiRTobmihTiFCYXxkKJqLgD1x1BDeOoxmQrvb5npRJgDjgMVr5qIjH02Ea131znr6GigDlgKJBgBGQUCe5m+cCxp9oDfgQfgwX4DjIAjhGmyJBHWyzDtikjSAqICskgD6as+A4qCw0FkD+hh-gW2EtgOCBRLKhBCF4MToAI2ACPILC8vg6AqPyriuCwCAqDILAQcGUHEYOsHUhIuJIaydAcOmcB0GY+hnDBVLRpgfH6DE1hkC+mQymQJxnCBVy3A8TyvDuAmKQ28FiQo+b+mWvpDtSPIGpQGE2DEV7yMyQA
Requested by: Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.96.116 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 116.96.111.34.bc.googleusercontent.com
Software: / Express
Resource Hash: c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:46 GMT
via: 1.1 google
accept-ch: Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-powered-by: Express
access-control-max-age: 1800
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
alt-svc: clear

GET
H2 200 cenw.js Show response
dts.clnmde.com/ Frame 9998 36 B
346 B 33ms
24ms XHR
text/html 34.111.96.116
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dts.clnmde.com/cenw.js
Requested by: Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/bfp_ssn.js?templateId=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.96.116 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 116.96.111.34.bc.googleusercontent.com
Software: / Express
Resource Hash: ced4739d5c7dacf0a71697d4f2ea3bcaa8bcd698ff92a46644f67d2ea0c80f3a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pxlclnmdecom-a.akamaihd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:46 GMT
via: 1.1 google
etag: W/"24-z2wfDwnSf4NYcNqOk623bw"
x-powered-by: Express
access-control-max-age: 1800
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
content-length: 36
alt-svc: clear

GET
H2

200

cksync
cs.media.net/ Frame 2398
Redirect Chain

https://cm.g.doubleclick.net/pixel?cs=6&google_nid=media&google_cm=1&google_hm=MzQ0NzAwNTI2MDgxMzI3MTAwMFYxMA%3D%3D&google_sc=1
https://cs.media.net/cksync?type=g&cs=6&google_gid=CAESEJoljCT0GAbma9GCW1gwTcQ&google_cver=1

53 B
444 B

82ms
48ms

Image
image/gif

23.205.72.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?type=g&cs=6&google_gid=CAESEJoljCT0GAbma9GCW1gwTcQ&google_cver=1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=6&cv=31&https=1&cid=8CUU9JF8H&prvid=99%2C77%2C20000%2C294%2C262%2C460%2C461%2C462%2C4%2C313%2C10000%2C459%2C229%2C9%2C319&itype=ADX&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1
Protocol: H2
Server: 23.205.72.21 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-72-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 53
x-mnet-hl2: E
expires: Mon, 04 Dec 2023 14:08:46 GMT

Redirect headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cs.media.net/cksync?type=g&cs=6&google_gid=CAESEJoljCT0GAbma9GCW1gwTcQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6D7B 6 KB
3 KB 18ms
16ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://loan.freemod.link/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 14:08:43 GMT
expires: Tue, 03 Dec 2024 14:08:43 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 d85d29d5-df70-4ec0-bf36-4af408d48be6.jpg
contextual.media.net/kimg/new/140x110/2/188/163/133/ Frame 0C3E 16 KB
16 KB 256ms
252ms Image
image/jpeg 23.47.168.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/kimg/new/140x110/2/188/163/133/d85d29d5-df70-4ec0-bf36-4af408d48be6.jpg?v=9

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=3322&&kkdd=*u%7C!%7C*u9WAHnh3&Bk=0*D0d5M5pdd5p00DiM4&J2uv=D&ZHuz=D&Y2B=00p*&_HY3=n44*&Yk2=MOy*U**0s&YuY2=UY1JaGeblKseq0llTvvKYh%3D%3D&Yvk2=pri0rM0dp&Hkt3=*pMG5D&YY=yx&HY=L6&YF-Z=.QX~!L6&uk2=M)!XiPj*L&_uk2=mKridx5&F__uH=0&vvv=_tXTFnYcTn5UfZ0DsqlKiuXz727s*N6XLcm0TNq5XfY%3D&-H3=r&ch=0&bJ2=i&z2_0=MOyy5KfM.&z2_p=4*ddrMMM*&N2z_z=H2p%3D-bcc(kbvclc%3D0D(aJ3vuZ%3DDI4M(2aZlN%3DDIr4(HY2%3D-q(vz3%3DD%2CD(2aZlc%3DpD(BcpvlH2%3DpDp40pDiDi(kbvclN%3D5rMID*(bvcl_AY%3DD(bvclvpzlN%3DD(H_2%3D5pdM0p0dD(Z-lN3FlNaaH_%3DDIM*(vz_%3DDIDDD%2CD(ku%3D0FcnxObXzruFr~xqVsi_)k(ENN%3D0i(NFlkZ%3Di0(vkkubz%3D5%2C5(vY%3Dp%2C0i4i(vuHlH2%3DpDp40pDiDr(vz2B%3DDIDDD%2CD(bvclN%3D0I0p(BcpvlbvclN%3DD(bvclc%3D0D(HcB%3Dp4Ii4(JYz_%3DrDD50p(NN%3D05d(3vuZ%3DDI4M(BcpvlbvclAY%3DDsD(uHklY%3D05%2Cp%2CD%2CD%2CD%2CD%2CD%2Ci(NZ%3D0(uHkl2%3D0*i4(vA3%3DD%2CD(z4ulN%3DMIdd%2Cd0IM(H2%3DD(bk2%3DpgzRcFesz0L7!b8gB1(YBcpvlN%3DdIp(N_2%3D00055iD554Mrirp5M4DpDMri*MM*D0*ipMr4*4r*5r540rDMMd5M0M**D00rMr50M4rM05*rp*p0454DD*0rpd*dD5p*5p0riMMd0ii(bkZ%3DD(vA_%3DDIDDD%2CD(aJ2pulN%3DDI5M(HH%3DLQ(YY%3Dyx(ANl2c%3D3-(bkh%3DT0(Y3%3DD(vYB%3Di0I4M(Og%3D4Dr0(ANlbY%3D0(-_H%3D0(ANlbc%3D3-(ANlYYAH%3D0(Y_%3D-3h%20qavA(NHHlVmj%3DLQ%2CLQ(NzHkHp%3D05d(NzHkH0%3D05d(ANl__%3DD(NFlH2%3DpDp40pDpD0(2Y%3DM(BcpvlN%3DMIdd(__%3D0*i4(bcZlu%3DDI05(Bhl3GY%3DDIM*(BkHlH2%3D0D0(bvclvuHlN%3D0pIpM(NFlYa%3DD(2Yp%3D0(BlzH-%3D5DD5(czH_%3D(YBaJ%3DdIp(BkHlbvclN%3DDIiM(BcpvlklH2%3DpDp40pDiDi(BkHlbvclc%3DD(3_%3Dpi(BcpvlklN%3DDIDi(BkHlN%3D*DMId4(BcpvlbvclBk%3D0sT0d(bvcl_Bk%3DD(BB%3DD(YBcpvlH2%3D0DD(vEB%3Di0I4M(cpvlN%3D0DDD(hvlN%3DdI54%2CD(vz2u%3DDIDDD%2CD(Hk2%3Dpri0rM0dp(bvclvuHlAY%3DD(ANlHvY%3DANN(Bhb%3DDIM*(2pulc%3D0D(YBcp%3DdIp(4uYE%3D555Ir*(2ZZlH_vJ%3DFzvZa-q(2pulN%3DDI5M(vuHlN%3Dd0IM(bvclHvuHlN%3D0pIpM(vAhu%3DDIDDD%2CD(vAh2%3DDIDDD%2CD(kHX3E%3DD(kHkE%3DD(bvclvuYlN%3DD(Nk2%3DDI4M(ANlu_%3DQv_kYc3(bvclvuHlvB%3DD(YN2u%3DDID50(k_qu3lk2%3D0*(H3cc3vl_zJlk2%3D5pdM0p0dD(Hbuucql_zJlk2%3D(23_3Y_32l_zJlk2%3D(Bk3hzNkck_q%3DDIM*(uaH%3D0(zYl_qu3%3D0(z2NcA%3D5pdM0p0dD(zZu%3D0(aJNk2%3DDI4MD(NEcv%3DDID0D(Hbk2%3D(2_Y%3D3zH_lHY(2ZZl3vuZ%3DEzcH3(2ZZ%3DFzvZa-q(N2uYzu2%3DD(2zcJ%3D23Ezbc_(HJZ_%3DFaZ3uzJ3l_vzB3c(HaNu%3D(Gk2%3DQ7oTubNTiddpDdMp40*MD454(F_Zc%3D0(2Yb_%3D*r(2aJN%3DDT0(3YulbH32%3D10r(3YuluDr%3DDID5M5M*0ipi4Dri44i(3Yulu0D%3DDIp45pdDdpMp0r5M4M*(3Yulu0r%3DDI4ir40*dr0irM0MMDr(3YulupD%3DDIirrpMM0D*rpMd45id(3Yulupr%3DDIrrMdi0d55*i0M50r(3Yulu4D%3DDIdMip40Dr*i0pdD**(3Yulu4r%3DDIM0*i4M**dp5*iDd*(3YuluiD%3DDI5*id0p0Dd0Mdrrdp(3Yuluir%3D0I0iMr45D4d4r4pMdM(3YulurD%3D0I4dp5rMpD4*pip05M(3Yulurr%3D0Id4p5dii*i5r40r04(3YuludD%3D0I5pi500p0040ri44d(3Yuludr%3DpIpddMi*4M0p5*M00i(3Yulu*D%3DpI*r4rrr4r0D**M0(3Yulu*r%3D4IippD0dMd5ddd55rr(3YuluMD%3DiIi**rr4di0M4000p(3YuluMr%3DdI0i*pDrprr4ppMDM(3Yulu5D%3D5ID*05DiriM5d5pDd(3Yulu5r%3D0*Id*pD5p00pi4pD*r(3Yulu55%3D*iIp44d0i*4p*iD54(kNY%3D0(-Ht%3D0(_JH%3D*pMG5D(NHN%3DD(NHu%3DD(_ZG%3Dpir&-_B=D&ZZZ=boaHLEg71sA%3D&kh=*pM&k-gEv=0&N2vg2=idD&Nk2=4i5Ddr&ZYE=d*005&q2Huv=0&Nz3=eG3eizztJt&Az_uv3=0&Yz2aZzk-=_tXTFnYcTnT.xFLipTbbE2-r!oFpkODLd124pqigxYCP!.ClAqCatJ%3D%3D&qucu=0&kHk2=r&z2B=g-B3H_av%20faYbH&HHZYvlB3v=r&uJk2=uD0r0prdpMpr_pDp40pDi0iDM&HHc2=%7B%22HHku%22%3A%22pzD2%3ArdDD%3ADDpi%3ADDDD%3ADDDD%3ADDDD%3ADDDD%3ADDDD%22%2C%22HHYY%22%3A%22yx%22%2C%22HHHY%22%3A%22L6%22%2C%22HHY_q%22%3A%22L3h%206avA%22%7D&F_ZcHvY=0&sflct=8975839&ure=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.47.168.66 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx /

Resource Hash

3e095223e7412ee29b21eee2907bd72bf5b8bdf92d02c95af6566b2b23496db0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=3322&&kkdd=*u%7C!%7C*u9WAHnh3&Bk=0*D0d5M5pdd5p00DiM4&J2uv=D&ZHuz=D&Y2B=00p*&_HY3=n44*&Yk2=MOy*U**0s&YuY2=UY1JaGeblKseq0llTvvKYh%3D%3D&Yvk2=pri0rM0dp&Hkt3=*pMG5D&YY=yx&HY=L6&YF-Z=.QX~!L6&uk2=M)!XiPj*L&_uk2=mKridx5&F__uH=0&vvv=_tXTFnYcTn5UfZ0DsqlKiuXz727s*N6XLcm0TNq5XfY%3D&-H3=r&ch=0&bJ2=i&z2_0=MOyy5KfM.&z2_p=4*ddrMMM*&N2z_z=H2p%3D-bcc(kbvclc%3D0D(aJ3vuZ%3DDI4M(2aZlN%3DDIr4(HY2%3D-q(vz3%3DD%2CD(2aZlc%3DpD(BcpvlH2%3DpDp40pDiDi(kbvclN%3D5rMID*(bvcl_AY%3DD(bvclvpzlN%3DD(H_2%3D5pdM0p0dD(Z-lN3FlNaaH_%3DDIM*(vz_%3DDIDDD%2CD(ku%3D0FcnxObXzruFr~xqVsi_)k(ENN%3D0i(NFlkZ%3Di0(vkkubz%3D5%2C5(vY%3Dp%2C0i4i(vuHlH2%3DpDp40pDiDr(vz2B%3DDIDDD%2CD(bvclN%3D0I0p(BcpvlbvclN%3DD(bvclc%3D0D(HcB%3Dp4Ii4(JYz_%3DrDD50p(NN%3D05d(3vuZ%3DDI4M(BcpvlbvclAY%3DDsD(uHklY%3D05%2Cp%2CD%2CD%2CD%2CD%2CD%2Ci(NZ%3D0(uHkl2%3D0*i4(vA3%3DD%2CD(z4ulN%3DMIdd%2Cd0IM(H2%3DD(bk2%3DpgzRcFesz0L7!b8gB1(YBcpvlN%3DdIp(N_2%3D00055iD554Mrirp5M4DpDMri*MM*D0*ipMr4*4r*5r540rDMMd5M0M**D00rMr50M4rM05*rp*p0454DD*0rpd*dD5p*5p0riMMd0ii(bkZ%3DD(vA_%3DDIDDD%2CD(aJ2pulN%3DDI5M(HH%3DLQ(YY%3Dyx(ANl2c%3D3-(bkh%3DT0(Y3%3DD(vYB%3Di0I4M(Og%3D4Dr0(ANlbY%3D0(-_H%3D0(ANlbc%3D3-(ANlYYAH%3D0(Y_%3D-3h%20qavA(NHHlVmj%3DLQ%2CLQ(NzHkHp%3D05d(NzHkH0%3D05d(ANl__%3DD(NFlH2%3DpDp40pDpD0(2Y%3DM(BcpvlN%3DMIdd(__%3D0*i4(bcZlu%3DDI05(Bhl3GY%3DDIM*(BkHlH2%3D0D0(bvclvuHlN%3D0pIpM(NFlYa%3DD(2Yp%3D0(BlzH-%3D5DD5(czH_%3D(YBaJ%3DdIp(BkHlbvclN%3DDIiM(BcpvlklH2%3DpDp40pDiDi(BkHlbvclc%3DD(3_%3Dpi(BcpvlklN%3DDIDi(BkHlN%3D*DMId4(BcpvlbvclBk%3D0sT0d(bvcl_Bk%3DD(BB%3DD(YBcpvlH2%3D0DD(vEB%3Di0I4M(cpvlN%3D0DDD(hvlN%3DdI54%2CD(vz2u%3DDIDDD%2CD(Hk2%3Dpri0rM0dp(bvclvuHlAY%3DD(ANlHvY%3DANN(Bhb%3DDIM*(2pulc%3D0D(YBcp%3DdIp(4uYE%3D555Ir*(2ZZlH_vJ%3DFzvZa-q(2pulN%3DDI5M(vuHlN%3Dd0IM(bvclHvuHlN%3D0pIpM(vAhu%3DDIDDD%2CD(vAh2%3DDIDDD%2CD(kHX3E%3DD(kHkE%3DD(bvclvuYlN%3DD(Nk2%3DDI4M(ANlu_%3DQv_kYc3(bvclvuHlvB%3DD(YN2u%3DDID50(k_qu3lk2%3D0*(H3cc3vl_zJlk2%3D5pdM0p0dD(Hbuucql_zJlk2%3D(23_3Y_32l_zJlk2%3D(Bk3hzNkck_q%3DDIM*(uaH%3D0(zYl_qu3%3D0(z2NcA%3D5pdM0p0dD(zZu%3D0(aJNk2%3DDI4MD(NEcv%3DDID0D(Hbk2%3D(2_Y%3D3zH_lHY(2ZZl3vuZ%3DEzcH3(2ZZ%3DFzvZa-q(N2uYzu2%3DD(2zcJ%3D23Ezbc_(HJZ_%3DFaZ3uzJ3l_vzB3c(HaNu%3D(Gk2%3DQ7oTubNTiddpDdMp40*MD454(F_Zc%3D0(2Yb_%3D*r(2aJN%3DDT0(3YulbH32%3D10r(3YuluDr%3DDID5M5M*0ipi4Dri44i(3Yulu0D%3DDIp45pdDdpMp0r5M4M*(3Yulu0r%3DDI4ir40*dr0irM0MMDr(3YulupD%3DDIirrpMM0D*rpMd45id(3Yulupr%3DDIrrMdi0d55*i0M50r(3Yulu4D%3DDIdMip40Dr*i0pdD**(3Yulu4r%3DDIM0*i4M**dp5*iDd*(3YuluiD%3DDI5*id0p0Dd0Mdrrdp(3Yuluir%3D0I0iMr45D4d4r4pMdM(3YulurD%3D0I4dp5rMpD4*pip05M(3Yulurr%3D0Id4p5dii*i5r40r04(3YuludD%3D0I5pi500p0040ri44d(3Yuludr%3DpIpddMi*4M0p5*M00i(3Yulu*D%3DpI*r4rrr4r0D**M0(3Yulu*r%3D4IippD0dMd5ddd55rr(3YuluMD%3DiIi**rr4di0M4000p(3YuluMr%3DdI0i*pDrprr4ppMDM(3Yulu5D%3D5ID*05DiriM5d5pDd(3Yulu5r%3D0*Id*pD5p00pi4pD*r(3Yulu55%3D*iIp44d0i*4p*iD54(kNY%3D0(-Ht%3D0(_JH%3D*pMG5D(NHN%3DD(NHu%3DD(_ZG%3Dpir&-_B=D&ZZZ=boaHLEg71sA%3D&kh=*pM&k-gEv=0&N2vg2=idD&Nk2=4i5Ddr&ZYE=d*005&q2Huv=0&Nz3=eG3eizztJt&Az_uv3=0&Yz2aZzk-=_tXTFnYcTnT.xFLipTbbE2-r!oFpkODLd124pqigxYCP!.ClAqCatJ%3D%3D&qucu=0&kHk2=r&z2B=g-B3H_av%20faYbH&HHZYvlB3v=r&uJk2=uD0r0prdpMpr_pDp40pDi0iDM&HHc2=%7B%22HHku%22%3A%22pzD2%3ArdDD%3ADDpi%3ADDDD%3ADDDD%3ADDDD%3ADDDD%3ADDDD%22%2C%22HHYY%22%3A%22yx%22%2C%22HHHY%22%3A%22L6%22%2C%22HHY_q%22%3A%22L3h%206avA%22%7D&F_ZcHvY=0&sflct=8975839&ure=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:46 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 12 Apr 2018 14:03:28 GMT
server: nginx
etag: "5acf6730-3f58"
content-type: image/jpeg
accept-ranges: bytes
content-length: 16216

GET
DATA 200
OK truncated
/ Frame 0C3E 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 6c58f37a-ebe9-4cbd-992d-5eeffb112fcc.jpg
contextual.media.net/kimg/new/140x110/2/199/63/229/ Frame 0C3E 18 KB
18 KB 257ms
254ms Image
image/jpeg 23.47.168.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/kimg/new/140x110/2/199/63/229/6c58f37a-ebe9-4cbd-992d-5eeffb112fcc.jpg?v=9

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.47.168.66 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx /

Resource Hash

672d12052b8a8cab59f4a2b2e273e132cf02ea4cc6f1f9fc0e41869c6403129b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=3322&&kkdd=*u%7C!%7C*u9WAHnh3&Bk=0*D0d5M5pdd5p00DiM4&J2uv=D&ZHuz=D&Y2B=00p*&_HY3=n44*&Yk2=MOy*U**0s&YuY2=UY1JaGeblKseq0llTvvKYh%3D%3D&Yvk2=pri0rM0dp&Hkt3=*pMG5D&YY=yx&HY=L6&YF-Z=.QX~!L6&uk2=M)!XiPj*L&_uk2=mKridx5&F__uH=0&vvv=_tXTFnYcTn5UfZ0DsqlKiuXz727s*N6XLcm0TNq5XfY%3D&-H3=r&ch=0&bJ2=i&z2_0=MOyy5KfM.&z2_p=4*ddrMMM*&N2z_z=H2p%3D-bcc(kbvclc%3D0D(aJ3vuZ%3DDI4M(2aZlN%3DDIr4(HY2%3D-q(vz3%3DD%2CD(2aZlc%3DpD(BcpvlH2%3DpDp40pDiDi(kbvclN%3D5rMID*(bvcl_AY%3DD(bvclvpzlN%3DD(H_2%3D5pdM0p0dD(Z-lN3FlNaaH_%3DDIM*(vz_%3DDIDDD%2CD(ku%3D0FcnxObXzruFr~xqVsi_)k(ENN%3D0i(NFlkZ%3Di0(vkkubz%3D5%2C5(vY%3Dp%2C0i4i(vuHlH2%3DpDp40pDiDr(vz2B%3DDIDDD%2CD(bvclN%3D0I0p(BcpvlbvclN%3DD(bvclc%3D0D(HcB%3Dp4Ii4(JYz_%3DrDD50p(NN%3D05d(3vuZ%3DDI4M(BcpvlbvclAY%3DDsD(uHklY%3D05%2Cp%2CD%2CD%2CD%2CD%2CD%2Ci(NZ%3D0(uHkl2%3D0*i4(vA3%3DD%2CD(z4ulN%3DMIdd%2Cd0IM(H2%3DD(bk2%3DpgzRcFesz0L7!b8gB1(YBcpvlN%3DdIp(N_2%3D00055iD554Mrirp5M4DpDMri*MM*D0*ipMr4*4r*5r540rDMMd5M0M**D00rMr50M4rM05*rp*p0454DD*0rpd*dD5p*5p0riMMd0ii(bkZ%3DD(vA_%3DDIDDD%2CD(aJ2pulN%3DDI5M(HH%3DLQ(YY%3Dyx(ANl2c%3D3-(bkh%3DT0(Y3%3DD(vYB%3Di0I4M(Og%3D4Dr0(ANlbY%3D0(-_H%3D0(ANlbc%3D3-(ANlYYAH%3D0(Y_%3D-3h%20qavA(NHHlVmj%3DLQ%2CLQ(NzHkHp%3D05d(NzHkH0%3D05d(ANl__%3DD(NFlH2%3DpDp40pDpD0(2Y%3DM(BcpvlN%3DMIdd(__%3D0*i4(bcZlu%3DDI05(Bhl3GY%3DDIM*(BkHlH2%3D0D0(bvclvuHlN%3D0pIpM(NFlYa%3DD(2Yp%3D0(BlzH-%3D5DD5(czH_%3D(YBaJ%3DdIp(BkHlbvclN%3DDIiM(BcpvlklH2%3DpDp40pDiDi(BkHlbvclc%3DD(3_%3Dpi(BcpvlklN%3DDIDi(BkHlN%3D*DMId4(BcpvlbvclBk%3D0sT0d(bvcl_Bk%3DD(BB%3DD(YBcpvlH2%3D0DD(vEB%3Di0I4M(cpvlN%3D0DDD(hvlN%3DdI54%2CD(vz2u%3DDIDDD%2CD(Hk2%3Dpri0rM0dp(bvclvuHlAY%3DD(ANlHvY%3DANN(Bhb%3DDIM*(2pulc%3D0D(YBcp%3DdIp(4uYE%3D555Ir*(2ZZlH_vJ%3DFzvZa-q(2pulN%3DDI5M(vuHlN%3Dd0IM(bvclHvuHlN%3D0pIpM(vAhu%3DDIDDD%2CD(vAh2%3DDIDDD%2CD(kHX3E%3DD(kHkE%3DD(bvclvuYlN%3DD(Nk2%3DDI4M(ANlu_%3DQv_kYc3(bvclvuHlvB%3DD(YN2u%3DDID50(k_qu3lk2%3D0*(H3cc3vl_zJlk2%3D5pdM0p0dD(Hbuucql_zJlk2%3D(23_3Y_32l_zJlk2%3D(Bk3hzNkck_q%3DDIM*(uaH%3D0(zYl_qu3%3D0(z2NcA%3D5pdM0p0dD(zZu%3D0(aJNk2%3DDI4MD(NEcv%3DDID0D(Hbk2%3D(2_Y%3D3zH_lHY(2ZZl3vuZ%3DEzcH3(2ZZ%3DFzvZa-q(N2uYzu2%3DD(2zcJ%3D23Ezbc_(HJZ_%3DFaZ3uzJ3l_vzB3c(HaNu%3D(Gk2%3DQ7oTubNTiddpDdMp40*MD454(F_Zc%3D0(2Yb_%3D*r(2aJN%3DDT0(3YulbH32%3D10r(3YuluDr%3DDID5M5M*0ipi4Dri44i(3Yulu0D%3DDIp45pdDdpMp0r5M4M*(3Yulu0r%3DDI4ir40*dr0irM0MMDr(3YulupD%3DDIirrpMM0D*rpMd45id(3Yulupr%3DDIrrMdi0d55*i0M50r(3Yulu4D%3DDIdMip40Dr*i0pdD**(3Yulu4r%3DDIM0*i4M**dp5*iDd*(3YuluiD%3DDI5*id0p0Dd0Mdrrdp(3Yuluir%3D0I0iMr45D4d4r4pMdM(3YulurD%3D0I4dp5rMpD4*pip05M(3Yulurr%3D0Id4p5dii*i5r40r04(3YuludD%3D0I5pi500p0040ri44d(3Yuludr%3DpIpddMi*4M0p5*M00i(3Yulu*D%3DpI*r4rrr4r0D**M0(3Yulu*r%3D4IippD0dMd5ddd55rr(3YuluMD%3DiIi**rr4di0M4000p(3YuluMr%3DdI0i*pDrprr4ppMDM(3Yulu5D%3D5ID*05DiriM5d5pDd(3Yulu5r%3D0*Id*pD5p00pi4pD*r(3Yulu55%3D*iIp44d0i*4p*iD54(kNY%3D0(-Ht%3D0(_JH%3D*pMG5D(NHN%3DD(NHu%3DD(_ZG%3Dpir&-_B=D&ZZZ=boaHLEg71sA%3D&kh=*pM&k-gEv=0&N2vg2=idD&Nk2=4i5Ddr&ZYE=d*005&q2Huv=0&Nz3=eG3eizztJt&Az_uv3=0&Yz2aZzk-=_tXTFnYcTnT.xFLipTbbE2-r!oFpkODLd124pqigxYCP!.ClAqCatJ%3D%3D&qucu=0&kHk2=r&z2B=g-B3H_av%20faYbH&HHZYvlB3v=r&uJk2=uD0r0prdpMpr_pDp40pDi0iDM&HHc2=%7B%22HHku%22%3A%22pzD2%3ArdDD%3ADDpi%3ADDDD%3ADDDD%3ADDDD%3ADDDD%3ADDDD%22%2C%22HHYY%22%3A%22yx%22%2C%22HHHY%22%3A%22L6%22%2C%22HHY_q%22%3A%22L3h%206avA%22%7D&F_ZcHvY=0&sflct=8975839&ure=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:46 GMT
strict-transport-security: max-age=31536000
last-modified: Wed, 21 Mar 2018 23:11:49 GMT
server: nginx
etag: "5ab2e6b5-4921"
content-type: image/jpeg
accept-ranges: bytes
content-length: 18721

GET
DATA 200
OK truncated
/ Frame 0C3E 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 0C3E 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 OpenSans_Bold.woff
contextual.media.net/__media__/fonts/OpenSans_Bold/ Frame 0C3E 25 KB
25 KB 254ms
251ms Font
font/woff 23.47.168.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/__media__/fonts/OpenSans_Bold/OpenSans_Bold.woff

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.47.168.66 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

1973bb0e810b8f54792d7ea56c03749f6792541876847b085f58d64fb7adfc07

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=3322&&kkdd=*u%7C!%7C*u9WAHnh3&Bk=0*D0d5M5pdd5p00DiM4&J2uv=D&ZHuz=D&Y2B=00p*&_HY3=n44*&Yk2=MOy*U**0s&YuY2=UY1JaGeblKseq0llTvvKYh%3D%3D&Yvk2=pri0rM0dp&Hkt3=*pMG5D&YY=yx&HY=L6&YF-Z=.QX~!L6&uk2=M)!XiPj*L&_uk2=mKridx5&F__uH=0&vvv=_tXTFnYcTn5UfZ0DsqlKiuXz727s*N6XLcm0TNq5XfY%3D&-H3=r&ch=0&bJ2=i&z2_0=MOyy5KfM.&z2_p=4*ddrMMM*&N2z_z=H2p%3D-bcc(kbvclc%3D0D(aJ3vuZ%3DDI4M(2aZlN%3DDIr4(HY2%3D-q(vz3%3DD%2CD(2aZlc%3DpD(BcpvlH2%3DpDp40pDiDi(kbvclN%3D5rMID*(bvcl_AY%3DD(bvclvpzlN%3DD(H_2%3D5pdM0p0dD(Z-lN3FlNaaH_%3DDIM*(vz_%3DDIDDD%2CD(ku%3D0FcnxObXzruFr~xqVsi_)k(ENN%3D0i(NFlkZ%3Di0(vkkubz%3D5%2C5(vY%3Dp%2C0i4i(vuHlH2%3DpDp40pDiDr(vz2B%3DDIDDD%2CD(bvclN%3D0I0p(BcpvlbvclN%3DD(bvclc%3D0D(HcB%3Dp4Ii4(JYz_%3DrDD50p(NN%3D05d(3vuZ%3DDI4M(BcpvlbvclAY%3DDsD(uHklY%3D05%2Cp%2CD%2CD%2CD%2CD%2CD%2Ci(NZ%3D0(uHkl2%3D0*i4(vA3%3DD%2CD(z4ulN%3DMIdd%2Cd0IM(H2%3DD(bk2%3DpgzRcFesz0L7!b8gB1(YBcpvlN%3DdIp(N_2%3D00055iD554Mrirp5M4DpDMri*MM*D0*ipMr4*4r*5r540rDMMd5M0M**D00rMr50M4rM05*rp*p0454DD*0rpd*dD5p*5p0riMMd0ii(bkZ%3DD(vA_%3DDIDDD%2CD(aJ2pulN%3DDI5M(HH%3DLQ(YY%3Dyx(ANl2c%3D3-(bkh%3DT0(Y3%3DD(vYB%3Di0I4M(Og%3D4Dr0(ANlbY%3D0(-_H%3D0(ANlbc%3D3-(ANlYYAH%3D0(Y_%3D-3h%20qavA(NHHlVmj%3DLQ%2CLQ(NzHkHp%3D05d(NzHkH0%3D05d(ANl__%3DD(NFlH2%3DpDp40pDpD0(2Y%3DM(BcpvlN%3DMIdd(__%3D0*i4(bcZlu%3DDI05(Bhl3GY%3DDIM*(BkHlH2%3D0D0(bvclvuHlN%3D0pIpM(NFlYa%3DD(2Yp%3D0(BlzH-%3D5DD5(czH_%3D(YBaJ%3DdIp(BkHlbvclN%3DDIiM(BcpvlklH2%3DpDp40pDiDi(BkHlbvclc%3DD(3_%3Dpi(BcpvlklN%3DDIDi(BkHlN%3D*DMId4(BcpvlbvclBk%3D0sT0d(bvcl_Bk%3DD(BB%3DD(YBcpvlH2%3D0DD(vEB%3Di0I4M(cpvlN%3D0DDD(hvlN%3DdI54%2CD(vz2u%3DDIDDD%2CD(Hk2%3Dpri0rM0dp(bvclvuHlAY%3DD(ANlHvY%3DANN(Bhb%3DDIM*(2pulc%3D0D(YBcp%3DdIp(4uYE%3D555Ir*(2ZZlH_vJ%3DFzvZa-q(2pulN%3DDI5M(vuHlN%3Dd0IM(bvclHvuHlN%3D0pIpM(vAhu%3DDIDDD%2CD(vAh2%3DDIDDD%2CD(kHX3E%3DD(kHkE%3DD(bvclvuYlN%3DD(Nk2%3DDI4M(ANlu_%3DQv_kYc3(bvclvuHlvB%3DD(YN2u%3DDID50(k_qu3lk2%3D0*(H3cc3vl_zJlk2%3D5pdM0p0dD(Hbuucql_zJlk2%3D(23_3Y_32l_zJlk2%3D(Bk3hzNkck_q%3DDIM*(uaH%3D0(zYl_qu3%3D0(z2NcA%3D5pdM0p0dD(zZu%3D0(aJNk2%3DDI4MD(NEcv%3DDID0D(Hbk2%3D(2_Y%3D3zH_lHY(2ZZl3vuZ%3DEzcH3(2ZZ%3DFzvZa-q(N2uYzu2%3DD(2zcJ%3D23Ezbc_(HJZ_%3DFaZ3uzJ3l_vzB3c(HaNu%3D(Gk2%3DQ7oTubNTiddpDdMp40*MD454(F_Zc%3D0(2Yb_%3D*r(2aJN%3DDT0(3YulbH32%3D10r(3YuluDr%3DDID5M5M*0ipi4Dri44i(3Yulu0D%3DDIp45pdDdpMp0r5M4M*(3Yulu0r%3DDI4ir40*dr0irM0MMDr(3YulupD%3DDIirrpMM0D*rpMd45id(3Yulupr%3DDIrrMdi0d55*i0M50r(3Yulu4D%3DDIdMip40Dr*i0pdD**(3Yulu4r%3DDIM0*i4M**dp5*iDd*(3YuluiD%3DDI5*id0p0Dd0Mdrrdp(3Yuluir%3D0I0iMr45D4d4r4pMdM(3YulurD%3D0I4dp5rMpD4*pip05M(3Yulurr%3D0Id4p5dii*i5r40r04(3YuludD%3D0I5pi500p0040ri44d(3Yuludr%3DpIpddMi*4M0p5*M00i(3Yulu*D%3DpI*r4rrr4r0D**M0(3Yulu*r%3D4IippD0dMd5ddd55rr(3YuluMD%3DiIi**rr4di0M4000p(3YuluMr%3DdI0i*pDrprr4ppMDM(3Yulu5D%3D5ID*05DiriM5d5pDd(3Yulu5r%3D0*Id*pD5p00pi4pD*r(3Yulu55%3D*iIp44d0i*4p*iD54(kNY%3D0(-Ht%3D0(_JH%3D*pMG5D(NHN%3DD(NHu%3DD(_ZG%3Dpir&-_B=D&ZZZ=boaHLEg71sA%3D&kh=*pM&k-gEv=0&N2vg2=idD&Nk2=4i5Ddr&ZYE=d*005&q2Huv=0&Nz3=eG3eizztJt&Az_uv3=0&Yz2aZzk-=_tXTFnYcTnT.xFLipTbbE2-r!oFpkODLd124pqigxYCP!.ClAqCatJ%3D%3D&qucu=0&kHk2=r&z2B=g-B3H_av%20faYbH&HHZYvlB3v=r&uJk2=uD0r0prdpMpr_pDp40pDi0iDM&HHc2=%7B%22HHku%22%3A%22pzD2%3ArdDD%3ADDpi%3ADDDD%3ADDDD%3ADDDD%3ADDDD%3ADDDD%22%2C%22HHYY%22%3A%22yx%22%2C%22HHHY%22%3A%22L6%22%2C%22HHY_q%22%3A%22L3h%206avA%22%7D&F_ZcHvY=0&sflct=8975839&ure=1
Origin: https://contextual.media.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:46 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 16 May 2016 10:39:41 GMT
server: Apache
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 25720
expires: Tue, 05 Dec 2023 14:08:46 GMT

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 0C3E 15 B
178 B 42ms
41ms Script
text/javascript 23.205.72.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?vgd_len=5856&&vgd_canary=0&vgd_l2type=scs_newfl&fp=b17_x88SO-JTwfokB6LNlEV7DCCZfzxcd3EV6nCMLEyNBtkiPc6qL0CT5_8mXYbr3aJxMCjfaoQLZYR9YORfZYrUzKBu3R37D3jBgyzezC70ioN5PLSKc1hOmSXATRrmjCUmAZuDt_EzhbWQpHx8SQ%3D%3D&cme=pR5kR8xvhrZIHXywtHI1LkNbz3ePkNX57OZ7cFariuYRSl-gUrGKdbWMofv_VSlMfnR-4mRwZqYR8t1KTmViAvKstLPZ9UelQFzqqhqBXJnwFEIoAgWyJwdpU8D4P0srLemK3gMymTyY5OF2pLml_5qRpWRZdgybWkEldAZV5IHCzD9jPC5Ms9ezDP-M0yi68WXXgvn2gYcfrYTB-_QSkz9RHaW_P9uVd-_oh6c-S8o%3D%7C%7CdsA6EMpZ47R6ljdz__nQtthZoUpm2bb5%7Ca0AmFUYXmD4lCsVHiszm-Im_jU9rwS-OcbhqzKVSBXjQGFXXMVwo3A%3D%3D%7CcPcb3VhU0BVjXgWFWEAzinttU1oq1ouO%7Ch6HNZ7UFX4CWw5XhynuukksF6zzM10Vr1Gh-wPNigGdzsoId4lORRvZoEEu4n2JSN62EEVBikExCpd-SPkRlQNd-Zua1lbtpr30q_iMLhIOKuG2RUl3YS-BiXwxmpJG6My9VE0chp_RQqjSxmSXHmdgdRB_ZCdS8bY83fL-BlIaziy2y09s13Z04Nm-Qj70EUabwK4wQZJW2M8GE33ILF2gB8dgvH5-Zcix3b_OlaXG_ngpowJMFUvvTUX8YqpoXZKc9cGdRcEAS_9agaX82vqwUtKlHHndX%7Cu8A6SM53vAcxkZY9VHWafLSuY-HKDieQ%7CiI7qbtbxP2zY3ZvbKUPzHvfEI9Qpt6wV%7C&subBdr=196&bdrid=460&ksu=224&fdkt=379&vgde_kbbh=ffoyxQJuO&kwd[]=Personal+Loans&kwt[]=379&kbc[]=1203655530&kwp[]=1&kid[]=22161725&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0004%7C8%3D120320%7C13%3D0.1734%7C14%3D120408%7Cokt%3D379%7Cbkt%3D379%7Cir%3D1%7Ciid%3D1553840%7Cps%3D1.200%7C12%3D1.57%7C74%3D2.14%7C53%3D3.06%7C80%3D0.74%7C60%3D1.56%7C1%3D2.68%7C2%3D12.47&ktd[]=275716768000&kwd[]=Walmart+Job+Opportunities&kwt[]=307&kbc[]=57220&kwp[]=2&kid[]=30287679&kbc2[]=0%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0005%7C8%3D120320%7C13%3D0.1073%7C14%3D120408%7Cokt%3D307%7Cbkt%3D307%7Cir%3D1%7Ciid%3D2507604%7Cps%3D0.840%7C12%3D1.47%7C74%3D2.14%7C53%3D2.07%7C80%3D1.16%7C60%3D1.07%7C1%3D2.04%7C2%3D3.36&ktd[]=4506074367590656&v=1&geo=40.24%7C-100.42&dlper=20&lper=100&lpid=&tsid=4&hint=&cc=US&wsip=170774697&bca=0&ugd=4&vgde_setid=Nff&ssld=%7B%22QQNN%22%3A%22Pb%22%2C%22QQN75%22%3A%22IJBn3mLU%22%2C%22QQ8E%22%3A%22f19O%3AXF99%3A99fH%3A9999%3A9999%3A9999%3A9999%3A9999%22%2C%22QQQN%22%3A%22I3%22%7D&cid=8CU7Q771E&vi=1701698926692110483&vsid=3447005260813271&tdAdd[]=asnum%3D9009&vgde_test_data_struct=%7B%22EO7E8O%22%3Au%7D&vgd_adprefflag=11&vgd_adpref_diff=0100&vgd_fm_lang=EN&vgd_implt=3&vgd_cage=4&vgd_tsce=L337-S337&vgd_imdtl=1&vgd_l3_sc=NY&vgd_chost=contextual.media.net&vgd_sslb=1111&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=376658887&vgd_pdtid=1&vgd_nrrv=37575&vgd_nrrmf=3001ca2a&vgd_nrrsf=scrr&vgd_cty=indianola&vgd_ifrmode=14&sttm=1701698926118&upk=1701698926.2009&hvsid=00000170169892611800958081324726&verid=3111299&sbdrId=196&tsrc=entity&tdAdd[]=%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&vgd_l1rakh=1701698926156126639&vgd_ecrid=1700080807684000728009000059500&vgd_isiolc=1&kbbq=%26asn%3D9009&vgde_ydsp=%7B%22QEx%22%3A%22%2FKTP4nXuWX%22%7D&vgd_mcf=67119&vgd_vstrid=3447005260813271&vgde_bdata=QOfvzxjj~8xLjMjvu9~myJLEYv9.AW~OmYMGv9.XA~QNOvz5~L1Jv9%2C9~OmYMjvf9~ejfLMQOvf9fAuf9H9H~8xLjMGviXW.9h~xLjM7UNv9~xLjMLf1MGv9~Q7OvifFWufuF9~YzMGJwMGmmQ7v9.Wh~L17v9.999%2C9~8EvuwjTb%3DxD1XEwXcb5C4H708~kGGvuH~GwM8YvHu~L88Ex1vi%2Ci~LNvf%2CuHAH~LEQMQOvf9fAuf9H9X~L1Oev9.999%2C9~xLjMGvu.uf~ejfLMxLjMGv9~xLjMjvu9~QjevfA.HA~yN17vX99iuf~GGvuiF~JLEYv9.AW~ejfLMxLjMUNv949~EQ8MNvui%2Cf%2C9%2C9%2C9%2C9%2C9%2CH~GYvu~EQ8MOvuhHA~LUJv9%2C9~1AEMGvW.FF%2CFu.W~QOv9~x8OvfV1ZjwR41uIrax2Ve%20~NejfLMGvF.f~G7OvuuuiiH9iiAWXHXfiWA9f9WXHhWWh9uhHfWXAhAXhiXiAuX9WWFiWuWhh9uuXWXiuWAXWuihXfhfuAiA99huXfFhF9ifhifuXHWWFuHH~x8Yv9~LU7v9.999%2C9~myOfEMGv9.iW~QQvIK~NNvPb~UGMOjvJz~x8Bvou~NJv9~LNevHu.AW~%3DVvA9Xu~UGMxNvu~z7Qvu~UGMxjvJz~UGMNNUQvu~N7vzJBn5mLU~GQQMC_pvIK%2CIK~G1Q8QfvuiF~G1Q8QuvuiF~UGM77v9~GwMQOvf9fAuf9f9u~ONvW~ejfLMGvW.FF~77vuhHA~xjYMEv9.ui~eBMJ-Nv9.Wh~e8QMQOvu9u~xLjMLEQMGvuf.fW~GwMNmv9~ONfvu~eM1Qzvi99i~j1Q7v~NemyvF.f~e8QMxLjMGv9.HW~ejfLM8MQOvf9fAuf9H9H~e8QMxLjMjv9~J7vfH~ejfLM8MGv9.9H~e8QMGvh9W.FA~ejfLMxLjMe8vu4ouF~xLjM7e8v9~eev9~NejfLMQOvu99~LkevHu.AW~jfLMGvu999~BLMGvF.iA%2C9~L1OEv9.999%2C9~Q8OvfXHuXWuFf~xLjMLEQMUNv9~UGMQLNvUGG~eBxv9.Wh~OfEMjvu9~NejfvF.f~AENkviii.Xh~OYYMQ7Lyvw1LYmz5~OfEMGv9.iW~LEQMGvFu.W~xLjMQLEQMGvuf.fW~LUBEv9.999%2C9~LUBOv9.999%2C9~8QDJkv9~8Q8kv9~xLjMLENMGv9~G8Ov9.AW~UGME7vKL78NjJ~xLjMLEQMLev9~NGOEv9.9iu~875EJM8Ovuh~QJjjJLM71yM8OvifFWufuF9~QxEEj5M71yM8Ov~OJ7JN7JOM71yM8Ov~e8JB1G8j875v9.Wh~EmQvu~1NM75EJvu~1OGjUvifFWufuF9~1YEvu~myG8Ov9.AW9~GkjLv9.9u9~Qx8Ov~O7NvJ1Q7MQN~OYYMJLEYvk1jQJ~OYYvw1LYmz5~GOEN1EOv9~O1jyvOJk1xj7~QyY7vwmYJE1yJM7L1eJj~QmGEv~-8OvKrtoExGoHFFf9FWfAuhW9AiA~w7Yjvu~ONx7vhX~OmyGv9ou~JNEMxQJOv%20uX~JNEME9Xv9.9iWiWhuHfHA9XHAAH~JNEMEu9v9.fAifF9FfWfuXiWAWh~JNEMEuXv9.AHXAuhFXuHXWuWW9X~JNEMEf9v9.HXXfWWu9hXfWFAiHF~JNEMEfXv9.XXWFHuFiihHuWiuX~JNEMEA9v9.FWHfAu9XhHufF9hh~JNEMEAXv9.WuhHAWhhFfihH9Fh~JNEMEH9v9.ihHFufu9FuWFXXFf~JNEMEHXvu.uHWXAi9AFAXAfWFW~JNEMEX9vu.AFfiXWf9AhfHfuiW~JNEMEXXvu.FAfiFHHhHiXAuXuA~JNEMEF9vu.ifHiuufuuAuXHAAF~JNEMEFXvf.fFFWHhAWufihWuuH~JNEMEh9vf.hXAXXXAXu9hhWu~JNEMEhXvA.Hff9uFWFiFFFiiXX~JNEMEW9vH.HhhXXAFHuWAuuuf~JNEMEWXvF.uHhf9XfXXAffW9W~JNEMEi9vi.9hui9HXHWiFif9F~JNEMEiXvuh.Fhf9ifuufHAf9hX~JNEMEiivhH.fAAFuHhAfhH9iA~8GNvu~zQlvu~7yQvhfW-i9~GQGv9~GQEv9~7Y-vfHX&vgd_bhv_kbb=-1&vgd_cfud=230323&vgd_scsver=266&vgd_optout=0&vgd_ydspr=1&vgd_l2shld=1&vgd_rensize=728_90&vgd_scr_h=1200&vgd_scr_w=1600&vgd_dma=501&vgd_ect=4g&vgde_ydata=duh%25Aru&vgd_l1cdv=1127&vgd_l1rpth=%2Fnmedianet.js&vgd_lbt=500&vgd_mbr=1&vgd_pgids=1&tdAdd[]=uiparams%3D%3Brend_w%3A728%3Brend_h%3A90&vgd_uspa=0&vgd_sc=NY&vgd_l1rhst=contextual.media.net&hvsid=00000170169892611800958081324726&rc=0&rand=1701698926465&acid=1e30906958f76863c9497a9655c1a4c0&matm=1701698926465&vgd_ltimesrc=1&vgd_ltime=489&vgd_rtime=487&vgd_etm=13&vgd_l1hcsd=Og4dd%7C7975&vgda_l1btm=%5B%22SPAMPXL%22%5D&vgd_l1ch=1&vgd_lhl=6738&vgd_pgid=p01512562825t202312041408&vgd_kclkp_d=%26sgmt%3D100090%252C100109&vgd_csip=rtb-appnexus-54477f9df5-2pt9p.SC&vgd_sbSup=1&vgd_nrrs=37575&vgd_cntrdt=SF%7Cd875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com&vgd_eadm=1&vgd_matchstr=hr%3D0%7C&vgd_end=2

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.72.21 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
date: Mon, 04 Dec 2023 14:08:46 GMT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
timing-allow-origin: *
content-length: 15
expires: Mon, 04 Dec 2023 14:08:46 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 79B1 624 B
245 B 49ms
49ms Document
text/html 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMT2JhCV7LYBGMPjrMsBMAE&v=APEucNXRp0DKoq04kzktzbxXBpu5XvLMo_-vEAkZUfjtVgI6e-LG9nzdrcSR_aqF7u0_Maqy6CSiref_tI9jffMwOXyyhCEOTg

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 14:08:46 GMT
expires: Mon, 04 Dec 2023 14:08:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/ Frame 6D7B 24 KB
9 KB 17ms
17ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/abg_lite_fy2021.js

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b67ad968ba3668562f331df45b73501e17c7c166bcf7e5443c33633cbc9d5783

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 18:58:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69017
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9305
x-xss-protection: 0
server: cafe
etag: 13635642240219548939
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Dec 2023 18:58:29 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/elements/html/ Frame 6D7B 7 KB
3 KB 18ms
17ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 15:52:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80178
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Dec 2023 15:52:28 GMT

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 6D7B 0
0 258ms
79ms Fetch
image/gif 142.250.81.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssLsttKrZZLIn5cEO2ImbbTJAPkFNy7oqeS5cM-7Ws3BEBV6U4LaRfm-RiBzhjzPYt58QOgfAzld08M3CLpUj15Py7szoEOB70ajw5VrU2AeeuiHceu_fcD2THXZ1KkY0LoS1gE9JWzyq0pbKD2qJG86BK5MIMFRthJ1uA6ven67vDaZLcDUlcowEgwRLippxT_ZET5cOnk41QS6zrQdtEkOt5jwANZu_EcsqTMuDar2uvshsHTYqXTpbIvffbXLImeV0Se9skwlAy9t9Y2oOTOM019bkEZAtakYmgEapMirmmaWhjnJqtaXyxQCZX_W8i5jhBK7gPHBK6LcNFMxrAWj2RE8oo3W9d6QTiRcrMdqG8tufpbpt18l7ZR_VDhXn2QmJ0gnLyk6W16JBdu7jvejpONvT4kstT5JQKZKh8Tr0-xx1Pwc8u4avAhVQZjDRyThVM_OkGyDB-rMo65uXPM06WJKwTYCWfA-QZJ7s4W0NZGSWRsOMOCGPluTMDGK8uPThx5epdmy0WcC7qycaKQ_gkx1bTMijS0MEvT4u7OE5c4paPtLfBD7KOmZAzFEF2xcfdK_Qqzcr_Z_fmcbmYuwgLuBkaYiDuSWBp8Q-zsIVof5SMZLY0VYVkh1wCkiseQCT-MMOxROKAd3Yjipa7CnUkCJo39o5LnVe-f2X8HtqehlcI0LBX5yBPPStuChhcYVOb96xz4417YfT4CcPVXsedMe35adzemg41ZR9X2cUp1ITh2maxChwIaE3baGKaGSiWnITrp8ATBBu2KfyO2nhK27liP3RV6wIyK36HRKhWmTJg6Ku7wVqACIKUv3gWogaoMdhwHXURyA1ovCq0U7_rS3mTg-8OPgdqQxSzJIVV3bnErUW8cVIA9BvfETe6sB9TwlVisdTpCwU_SBt_CbfhkNrepY7uYZ6eSrNlsfFr7mpNx4UUJzA4BxPd1ebUthgYTqsLk-5VHumnqgl8obYnPCSwEHSlhBHB4e-42qMZCg9LPHqsBUVgQ7f9oy-udissvdX-FpHcjY6MWdWV9sXpt4RWPq4WyLFnf6XjKYKYS-bS_C-40gamp31aWJa0ieda0U62aMoeyVHfJ6Qs17ZZ18YKWn0PPhYMun5xDPyjBTq9gkW4XQ-upxaZoMQ0rc3-qKdHO-GOQZbbK6BG4m_jY_EpxIfxHez-Jqf3z2ke7LVRHo43cXkk_JYE3SNFEIOQl3rpCc1-Hr9UR9LSjmVpnX6GdZ9E3UXADXMlH40_jvXLufEnYg80gniENbqLvOk1YCanY8WDTgjukZP0vpBW1JnBsBuxoXRAJnbpGjxk3rnSXvHSYidwAV-YccH-lO73yE5G14XzKpLmyjmU9-w6_zZS693q-fwhtz2JRqPXCPLSiU4xaChedkbLZwT2i_7QVQZegG-GLMvO-4gRn-eJn5ohC98_s0oM0SAMlgdTflRlTGI8Gj7flqsYweE3gr2hPi_YCFQwOoCN7URk&sai=AMfl-YQTvUQv1HZufciI-h5TLdf28mZbUhFtaJPhnLgHrwOWRH16vuvplMr3a0-u3fnXiXo3OEebyx9wl5kEu4Yv4NxnLFEZP1XXLwq2A0d6z-AnTGDmdOF67glwNLAC-d-KOjSEG8gmbzLjVPDx42HPTbp2bcA6x74Jby6IslfHchjNHjkQXJ-t4_6mW0_T6ld9umZxsa46OuwDIp4rM4jvwjRe_Ihq92hvDmXjyLCgYv48e2o_vKWbEobergAHY3XsxGtjJEIUl_9Q3vQlGGzNRcrN0N5axCAu6TpqmbQfDRZpIrRx1LfeT33gPSuTHuzVO4FL-U_T9JjMCH80KeSuxpURqvHy5fUJEuWY11BzdCQ7bL3CueRxGWrLvAwaGszHLbgFLOPEuzPIlWd0qCa18wj0ya2-XSbvfCFYkdCrewo_BMoqdmZW1HII34pLocCFG3WiSVDM13wusSmZQseZHAnsWRpLKEqBMGJYjo_0HkTX1t-PQ1ZdoZs6xbzqZx3cV1w41w&sig=Cg0ArKJSzLuwy4ZsBgEwEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9wcmVtaXNlaGVhbHRoLmNvbQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20231129.74567&arae=0&ftch=1&adurl=

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.81.230 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 04 Dec 2023 14:08:46 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 6D7B 41 KB
14 KB 8ms
7ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 17:20:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 420497
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 28 Nov 2024 17:20:29 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 6D7B 3 KB
1 KB 10ms
9ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/window_focus_fy2021.js

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:55:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 821
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 13:55:05 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 6D7B 20 KB
8 KB 11ms
8ms Script
text/javascript 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 20:01:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 65219
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8544
x-xss-protection: 0
server: cafe
etag: 17124069415086231762
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Dec 2023 20:01:47 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6D7B 42 B
63 B 54ms
53ms Image
image/gif 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ChZsKzjj-VE0B7mjH_YFp79JWZAI-5GCK99OMJG0frSDe5ow0VNlBPH0kKJ9tWsihi0JKmd1_yaZQVfXc2-0DDE1dOeVR7JSNV4yPD0WBxb1telCE

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6D7B 202 KB
64 KB 26ms
25ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65067
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701261208926228"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Dec 2023 14:08:46 GMT

GET
H2 200 11805031932113544215
s0.2mdn.net/simgad/ Frame 6D7B 967 KB
968 KB 205ms
23ms Image
image/gif 2607:f8b0:4020:807::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/11805031932113544215

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2006 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ab33032846bff18bb0c6c33941e877b34fa5f21bdfe332f8c05d06db45fd5bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 21:25:35 GMT
x-content-type-options: nosniff
age: 60191
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 989931
x-xss-protection: 0
last-modified: Tue, 24 May 2022 16:31:17 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 02 Dec 2024 21:25:35 GMT

GET
H2 200 ptmd
dts.clnmde.com/ Frame 01E2 70 B
132 B 24ms
24ms Image
image/gif 34.111.96.116
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dts.clnmde.com/ptmd?t=170169892623133993147248_N4IgpgHiBcIAwgDQgM4GMD2MQEYDscOAbAJwAcJATEQPp4AslAzPWU0UXJZUqpgGYwcydBgAu2fIVIVqdRizYculGmQBGlOGTzqcXNCTBMwAVn78wAExxoc9PGWsbHvUWMHRhfcVewA5AEE3TDErTwBaSmQwAGsAQ2x4pj1LLQiqeLAInBwwbPi4InUIvFs8Tkp6ODg0QRjY9SFkNAA3FGxgAB0QABsMNHjemhQxDAAneIBzMB7oHuTUsHTM7Nz8iMLi0vLK6tr+HsQelDAUFABLDAA7EbHJmbmFlJw0uAzKLJy8gqKSsrQFS4+zqRx6mAwsQuYBoVniYniTxAi1ey3eq2+Gy2-12wJqoJAAF83AixABXDrQADazEQWgAusgAF6JLzIAAOU2wrV4UwAFpICMRyFQiMwcEwmCQSEx7HgqmReO1sEQAHRwVWmUi8IYwJjIfhoGA5GJiC6C6Qi6i8NBoPywACqAGUSVzoHARLELcLZLQGMxWOxKjwYhd2dhTKqcGQcKqA1GmCGQK0wONsOzxhg-DEyazvGTzWzwK1ejAqaBrvEALZgbDqC5WKypmgN3hwhEwUD1xvN1uweicJUXFv23BCmSi0iUXJwQNEwmICvV2uweJoVvIdus0Brvu4YxwEhFEimMj8CpkIhMQz0Eh4eIkIimUx2eL0NAIZCtYd7qQ+ydUDOc6EoSjIgOyyrUmBKC9KM3oTtQ3Cfn0njeOovQSNApj6iAaAUmII7YGQADCDp4AAingZQAKJDoRsB-ghHCAfoc4xPE4bUiAkbRrG8YSjwYHjNYMAeiAUxGl445Wk+2HIAAjiu3j8IW9AcpxTA1ISQA
Requested by: Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.96.116 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 116.96.111.34.bc.googleusercontent.com
Software: / Express
Resource Hash: c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:46 GMT
via: 1.1 google
accept-ch: Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-powered-by: Express
access-control-max-age: 1800
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
alt-svc: clear

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 79B1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECywg9ukX6G5NSNIGOTctzw&google_cver=1

43 B
337 B

21ms
21ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECywg9ukX6G5NSNIGOTctzw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMT2JhCV7LYBGMPjrMsBMAE&v=APEucNXRp0DKoq04kzktzbxXBpu5XvLMo_-vEAkZUfjtVgI6e-LG9nzdrcSR_aqF7u0_Maqy6CSiref_tI9jffMwOXyyhCEOTg
Protocol: H2
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jBLdjdxEkmZG7Ats3NVwtasxAz%2FfSNtU5m34LNgcA32KAqRQW2ShwwjjOaPVPFCGJkRh2I8qX8j34Z7NOfs28p7ObzAWCW3V5x6lk8SFeIgqEU7htZMpNHintqj5ckX6L4tPBL%2BVY7SDIg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 83049f941b53437f-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECywg9ukX6G5NSNIGOTctzw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 79B1
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZW3dbgcKPxP1-mFbw9VL6AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECywg9ukX6G5NSNIGOTctzw&google_cver=1

43 B
770 B

28ms
27ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECywg9ukX6G5NSNIGOTctzw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMT2JhCV7LYBGMPjrMsBMAE&v=APEucNXRp0DKoq04kzktzbxXBpu5XvLMo_-vEAkZUfjtVgI6e-LG9nzdrcSR_aqF7u0_Maqy6CSiref_tI9jffMwOXyyhCEOTg
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZfM1xN0iegx2jT6lA5YDz7iML%2B8nNuh7Hh1GbJBceR4vSfVoKmhc9v5wx1Mg45gFMhxcPD3RBSIxG%2B%2FVjIHBX%2BqQax1xncWSgHrOd3fV1McK5ncBrH2ckfRPDXrAE%2BkHO5pwntfucdWCzA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 83049f947c7ec3ff-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECywg9ukX6G5NSNIGOTctzw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 79B1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFwbBSPM_Zl7p9Q_Dx4rP-k&google_cver=1

43 B
837 B

6ms
6ms

Image
image/gif

68.67.179.166
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFwbBSPM_Zl7p9Q_Dx4rP-k&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMT2JhCV7LYBGMPjrMsBMAE&v=APEucNXRp0DKoq04kzktzbxXBpu5XvLMo_-vEAkZUfjtVgI6e-LG9nzdrcSR_aqF7u0_Maqy6CSiref_tI9jffMwOXyyhCEOTg

Protocol

Server

68.67.179.166 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
an-x-request-uuid: acca2aad-52c4-4482-a03e-410b881a053a
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 5.181.234.132; 5.181.234.132; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFwbBSPM_Zl7p9Q_Dx4rP-k&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 79B1
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzczMDI2MDA1MjY4NDMzNDc3Mw%3D%3D

170 B
188 B

39ms
38ms

Image
image/png

172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzczMDI2MDA1MjY4NDMzNDc3Mw%3D%3D

Requested by

Protocol

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
an-x-request-uuid: 278222b1-5e0a-440d-907e-7d66216c99a6
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzczMDI2MDA1MjY4NDMzNDc3Mw%3D%3D
x-proxy-origin: 5.181.234.132; 5.181.234.132; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame C413 0
17 B 29ms
29ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=a~lpqzlqdd&c=6921438415787&slotId=3460719207893.5&qqid=CMrZl7_69YIDFfayWgUdeJMMfA&event_name=first_pause&asset_bytes=149705&video_bytes=0&cached_data_bytes=0&js_cached=false&css_cached=false&num_assets=13&num_assets_cached=0&num_assets_cache_validated=0&num_assets_unmeasurable=4&video_played_seconds=0.00&video_muted=true&video_seconds_loaded=0.00&vqdf=0&vqtf=0&vqfr=NaN
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/07977d2b7ee0aecb6f84611ef43cb16f.js?tag=video_mra/web_raspberry_ms
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 7D64 38 KB
13 KB 6ms
3ms Document
text/html 2607:f8b0:4006:821::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 287756
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 01 Dec 2023 06:12:50 GMT
expires: Sat, 30 Nov 2024 06:12:50 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 01E2 64 KB
24 KB 12ms
12ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a09ba825877d567e6cca03a8eaa2583f9e76a0f6d3ec64ead89048db668a82d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:04:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 282
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24457
x-xss-protection: 0
server: cafe
etag: 7553420222452197197
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 04 Dec 2023 15:04:04 GMT

GET
DATA 200
OK truncated
/ Frame 6D7B 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b4c31cd7296c7b3a38ad92f89b3985a389eb7d9b89c0516ad85c5058f6cd7658

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 7D64 39 KB
15 KB 13ms
13ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 10:30:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 185884
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 01 Dec 2024 10:30:42 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 01E2 0
17 B 36ms
36ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lpqzlrcl&chm=1&c=3793351759215310&ctx=2&qqid=CPL4y7_69YIDFaudWgUdaVYC8A&met.4=fb.11~lb.66~ol.lx~idt.-1d3~dt.-1rs&met.3=492.14_1~492.15~492.15~113.mu_1~112.mu_2&met.1=1.lpqzlqpr~6.1~7.1~8.1~9.1~10.1~12.3~13.g~14.i~15.r~16.7c~17.7c~18.7e~19.lw~20.lw~21.lx~22.79~23.79&met.7=CBsQCBgBKAEwEjiVBmgDcBB4iReAAd0UiAGSMLABAbgBAw~CBsQCiApOGw~CBsQCiAqODk~CB4QChgBICooKjAxOAdoLHAweIAMgAHUCYgBgRWwAQG4AQM~CBwQChgBICooKjA8OBFoLHAyeIxFgAHgQogBgKIBsAEBuAED~CBEQChgBICooKjA9OBNoLHA8eK40gAGCMogBi70BsAEBuAED~CCoQChgBICooKjBVOCtoLHBGeNf-A4ABq_wDiAG-0AywAQG4AQM~CBsQCiCqAThK~CBsQBSC4ATiaAg~CBsQBiC4ATgk~CBsQBSDFATjRAw~CBsQBiDGAThP~CCEQBhgBIIkCKIkCMMACODc~CBsQBiCJAjgm~CBsQBiCJAjhE~CBsQBSCtAjg6~CBsQASDCAjhF~CBsQASDLAjg9~CBsQBiDLAjhQ~CBsQBiDcAjgs~CBsQBiDbBDgZ~CCgQChgBIKIGKKIGMLAGOA5oowZwrwZ4tcEBgAGJvwGIAd-ABLABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 6D7B 0
0 68ms
67ms Fetch
image/gif 142.250.81.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssLsttKrZZLIn5cEO2ImbbTJAPkFNy7oqeS5cM-7Ws3BEBV6U4LaRfm-RiBzhjzPYt58QOgfAzld08M3CLpUj15Py7szoEOB70ajw5VrU2AeeuiHceu_fcD2THXZ1KkY0LoS1gE9JWzyq0pbKD2qJG86BK5MIMFRthJ1uA6ven67vDaZLcDUlcowEgwRLippxT_ZET5cOnk41QS6zrQdtEkOt5jwANZu_EcsqTMuDar2uvshsHTYqXTpbIvffbXLImeV0Se9skwlAy9t9Y2oOTOM019bkEZAtakYmgEapMirmmaWhjnJqtaXyxQCZX_W8i5jhBK7gPHBK6LcNFMxrAWj2RE8oo3W9d6QTiRcrMdqG8tufpbpt18l7ZR_VDhXn2QmJ0gnLyk6W16JBdu7jvejpONvT4kstT5JQKZKh8Tr0-xx1Pwc8u4avAhVQZjDRyThVM_OkGyDB-rMo65uXPM06WJKwTYCWfA-QZJ7s4W0NZGSWRsOMOCGPluTMDGK8uPThx5epdmy0WcC7qycaKQ_gkx1bTMijS0MEvT4u7OE5c4paPtLfBD7KOmZAzFEF2xcfdK_Qqzcr_Z_fmcbmYuwgLuBkaYiDuSWBp8Q-zsIVof5SMZLY0VYVkh1wCkiseQCT-MMOxROKAd3Yjipa7CnUkCJo39o5LnVe-f2X8HtqehlcI0LBX5yBPPStuChhcYVOb96xz4417YfT4CcPVXsedMe35adzemg41ZR9X2cUp1ITh2maxChwIaE3baGKaGSiWnITrp8ATBBu2KfyO2nhK27liP3RV6wIyK36HRKhWmTJg6Ku7wVqACIKUv3gWogaoMdhwHXURyA1ovCq0U7_rS3mTg-8OPgdqQxSzJIVV3bnErUW8cVIA9BvfETe6sB9TwlVisdTpCwU_SBt_CbfhkNrepY7uYZ6eSrNlsfFr7mpNx4UUJzA4BxPd1ebUthgYTqsLk-5VHumnqgl8obYnPCSwEHSlhBHB4e-42qMZCg9LPHqsBUVgQ7f9oy-udissvdX-FpHcjY6MWdWV9sXpt4RWPq4WyLFnf6XjKYKYS-bS_C-40gamp31aWJa0ieda0U62aMoeyVHfJ6Qs17ZZ18YKWn0PPhYMun5xDPyjBTq9gkW4XQ-upxaZoMQ0rc3-qKdHO-GOQZbbK6BG4m_jY_EpxIfxHez-Jqf3z2ke7LVRHo43cXkk_JYE3SNFEIOQl3rpCc1-Hr9UR9LSjmVpnX6GdZ9E3UXADXMlH40_jvXLufEnYg80gniENbqLvOk1YCanY8WDTgjukZP0vpBW1JnBsBuxoXRAJnbpGjxk3rnSXvHSYidwAV-YccH-lO73yE5G14XzKpLmyjmU9-w6_zZS693q-fwhtz2JRqPXCPLSiU4xaChedkbLZwT2i_7QVQZegG-GLMvO-4gRn-eJn5ohC98_s0oM0SAMlgdTflRlTGI8Gj7flqsYweE3gr2hPi_YCFQwOoCN7URk&sai=AMfl-YQTvUQv1HZufciI-h5TLdf28mZbUhFtaJPhnLgHrwOWRH16vuvplMr3a0-u3fnXiXo3OEebyx9wl5kEu4Yv4NxnLFEZP1XXLwq2A0d6z-AnTGDmdOF67glwNLAC-d-KOjSEG8gmbzLjVPDx42HPTbp2bcA6x74Jby6IslfHchjNHjkQXJ-t4_6mW0_T6ld9umZxsa46OuwDIp4rM4jvwjRe_Ihq92hvDmXjyLCgYv48e2o_vKWbEobergAHY3XsxGtjJEIUl_9Q3vQlGGzNRcrN0N5axCAu6TpqmbQfDRZpIrRx1LfeT33gPSuTHuzVO4FL-U_T9JjMCH80KeSuxpURqvHy5fUJEuWY11BzdCQ7bL3CueRxGWrLvAwaGszHLbgFLOPEuzPIlWd0qCa18wj0ya2-XSbvfCFYkdCrewo_BMoqdmZW1HII34pLocCFG3WiSVDM13wusSmZQseZHAnsWRpLKEqBMGJYjo_0HkTX1t-PQ1ZdoZs6xbzqZx3cV1w41w&sig=Cg0ArKJSzLuwy4ZsBgEwEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9wcmVtaXNlaGVhbHRoLmNvbQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=294&vt=11&dtpt=292&dett=2&cstd=0&cisv=r20231129.74567&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: loan.freemod.link
URL: https://loan.freemod.link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.81.230 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:08:46 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 6D7B 64 KB
24 KB 14ms
14ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com
URL: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a09ba825877d567e6cca03a8eaa2583f9e76a0f6d3ec64ead89048db668a82d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:04:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 282
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24457
x-xss-protection: 0
server: cafe
etag: 7553420222452197197
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 04 Dec 2023 15:04:04 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 6D7B 0
17 B 30ms
29ms Ping
image/gif 2607:f8b0:4001:c0c::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lpqzlrf8&chm=1&c=3793351759215310&ctx=2&qqid=CNi7-b_69YIDFaqfWgUdENkJpg&met.4=fb.1g~lb.71~ol.ah~idt.-1r3~dt.-25s&met.3=374.70~113.bl_2~112.bk_2&met.1=1.lpqzlr3o~6.1~7.1~8.1~9.1~10.1~12.4~13.k~14.m~15.12~16.8e~17.8e~18.8e~19.ah~20.ah~21.ah&met.7=CBsQCBgBKAEwFjj5AmgEcBR4iReAAd0UiAGSMLABAbgBAw~CCgQBRgBIDYoNjByOD1oN3BoeIoEgAHeAYgB8ASwAQG4AQM~CAkQChgBIEAoQDBUOBRoQXBSeIVLgAHZSIgBg7wBsAEBuAED~CBwQChgBIEAoQDBUOBRoQXBSeKsagAH_F4gB6DuwAQG4AQM~CBsQBBgBIEMoQzDHAjiEAlBLWPUBYE5o9QFwxQJ4rAKwAQG4AQM~CCcQChgBIEMoQzBQOA1oRHBMeJ1vgAHxbIgB6ckCsAEBuAED~CB4QChgBIEQoRDBROA1oRXBOeIAMgAHUCYgBgRWwAQG4AQM~CBwQChgBIEQoRDBROA5oRnBPeIxFgAHgQogBgKIBsAEBuAED~CBwQBhgBIEUoRTB8ODdoRnB7eNYCgAEqiAEqsAEBuAED~CCoQChgBIEUoRTB0OC9oR3BfeNf-A4ABq_wDiAG-0AywAQG4AQM~CCkQBhgBIEUoRTDjAjieAlBcWPsBYGho_AFwkwJ4l7g8gAHrtTyIAeu1PLABAbgBAw~CCcQBRgBIPoBKPoBMIYCOAxogQJwhQJ4oWiAAfVliAH-sAKwAQG4AQM~CCgQChgBIPoCKPoCMIoDOBBo-wJwiQN4tcEBgAGJvwGIAd-ABLABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c0c::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7D64 0
20 B 47ms
46ms Image
image/gif 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B9-subd1tZZjRN6q_6toPkLKnsAoAAAAAOAHgBAI&bg=!LC-lL2DNAAY3kmNgF5I7ADQBe5WfOA71kljDAd-MINHqogsHHpfIxOf4hBf9ypsMaS2ctXw5LBNf8_7ZdHBjyCEwxgerAgAAAFJSAAAAA2gBB5kC_-wsjj8NdOxug1DYm7IkpWPinVyaGhWPn7afwhGZVfiNX5d9aqKXb9eKi-opNzIPeBiv3deXyNpEQ99_mhmt7zXWvkm5yS2JtMK-pldx6HhmnG6KtZ8tWua1X2TWjz09VlsQhMwVvabvew3rpYFQfCAGoOmOOOSjHF3Le-dlNxo5rokeqE83x2lKxE7nm9gHYnl2ff6HIo-QmfsTfIkUlUn72ummcuP-myJUmaDEr6yZ5wGCnRkGEBYQsqke9HmhIoTV7kRfnXYE_oAuv6STLcuZSvm5QBGeUftdIEpbciRL3ugEr34SYqRgh5mNgz3jybMjldtsiVLb9kewLEeMw6wm7_2pCPDN0KjzRw1IUE52hrXsklbiO9P-DmlOR80GDYrwTjPpOb0lE0iAtlSxwEWsRsqJ_7fGVPKIXyzgtyYD85p_ugc1dluFiVywMlgTPIOeGV6JL2ax5-VWWwbRe7W6EZilSoNunyN2Dxlhk3vYVk_LMT20q1GiQ6R0nHzAtwJPJzbfYq7AHpRDp-yb0UA8I-6XZ1xEQ28ELFIHP2DazA9AoVF6Vn16aKtlCT8xDbYvZYjGreVOE_yvKsu_vfZQ7fJm3ejkjANlxwCJt0Rryu9pJSsvFWYKBfaeVRkSFclG31J0Jp62y1OmvLRXv6THiVZpjid5uXPp01ors9Sqk85vT9X4AY2TncdWvgrA7W9j3NvmLDsBubN8BxQAg-7_9rKRSqyFXNCrEvqob61bdXMqe65nJBGBQkOOilmhW2ErUYThXuKgR6N5HLIWq3rv9Yk6OjEp2cbudzHEyNabhWGBSAqSOdKny_O_LXgy_wAL5gntfsKmZZ9IGtsIxDk9f81wRaP4nLvIt6yZIg-u8QBq_vFvLAZWv_ZigJ-7otqpKkghdn23ON9N_kP5lbQ3zdE4JFPQeyN8BBvLs8aTi6rJVDdNvRIbvaYUVL2jy8n6AtSVvL7wkCHEQIZWWQmrZyH_OV0lmXFgTqxOvtnMAIcdT1GsRULghJXyK-m3

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 01E2 42 B
64 B 47ms
46ms Fetch
image/gif 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstTVk9jprb4y-tusBprOfr85-k3hU1ULjBTBp2xnrpxdgxGP79kJqxiHy2kUvn7tSBW4tBw9OrKsTBZucdJL4BHgqyxVVZycL6FvcLczidN9L0lUXssVg&sig=Cg0ArKJSzB_2okhRz2HuEAE&id=lidar2&mcvt=1001&p=1110,436,1204,1164&mtos=0,1001,1001,1001,1001&tos=0,1001,0,0,0&v=20231129&bin=7&avms=nio&bs=0,0&mc=0.96&if=1&vu=1&app=0&itpl=20&adk=926812160&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701698925951&rpt=250&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 log
hblg.media.net/ Frame 01E2 35 B
191 B 25ms
24ms Image
image/gif 23.199.48.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfke&evtid=adpvlog&__q=AfIFMgCAjAQAAACAAAAAgAEAAAAIAAAEAAEAAAAAAgEEAAAAAAAAIAAAAAAAAAxQwAQAQDFlMzA5MDY5NThmNzY4NjNjOTQ5N2E5NjU1YzFhNGMwju-a5wKYBwRVUyJsb2FuLmZyZWVtb2QubGluaxI4Q1VVOUpGOEgADDcyOHg5MA5lYXN0X3NjBDIzBkFEWBI4UFIxMTNKR0MOQklEX0FQSQAAAjBAcnRiLWFwcG5leHVzLTU0NDc3ZjlkZjUtMnB0OXAuU0M-MTcwMDA4MDgwNzY4NDAwMDcyODAwOTAwMDA1OTUwMAIwACIAEEVYQ0hBTkdFAgJk&evttyp=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.199.48.23 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-199-48-23.deploy.static.akamaitechnologies.com

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://d875b602fd7e54e82bd9d469979adc34.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 14:08:47 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Mon, 04 Dec 2023 14:08:47 GMT

GET
H2 200 bqi.php
lg3.media.net/ Frame 01E2 15 B
15 B 28ms
27ms Image
text/javascript 23.205.72.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bqi.php?vgd_len=3154&lf=3&&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=376658887&vgd_tsce=L337&vgd_l2type=scs_newfl&vgd_ydspr=1&vgd_bid=349065&vgd_cdv=1127&vgd_cage=3&vgd_rensize=728_90&vgde_bdata=QOfvzxjj~8xLjMjvu9~myJLEYv9.AW~OmYMGv9.XA~QNOvz5~L1Jv9%2C9~OmYMjvf9~ejfLMQOvf9fAuf9H9H~8xLjMGviXW.9h~xLjM7UNv9~xLjMLf1MGv9~Q7OvifFWufuF9~YzMGJwMGmmQ7v9.Wh~L17v9.999%2C9~8EvuwjTb%3DxD1XEwXcb5C4H708~kGGvuH~GwM8YvHu~L88Ex1vi%2Ci~LNvf%2CuHAH~LEQMQOvf9fAuf9H9X~L1Oev9.999%2C9~xLjMGvu.uf~ejfLMxLjMGv9~xLjMjvu9~QjevfA.HA~yN17vX99iuf~GGvuiF~JLEYv9.AW~ejfLMxLjMUNv949~EQ8MNvui%2Cf%2C9%2C9%2C9%2C9%2C9%2CH~GYvu~EQ8MOvuhHA~LUJv9%2C9~1AEMGvW.FF%2CFu.W~QOv9~x8OvfV1ZjwR41uIrax2Ve%20~NejfLMGvF.f~G7OvuuuiiH9iiAWXHXfiWA9f9WXHhWWh9uhHfWXAhAXhiXiAuX9WWFiWuWhh9uuXWXiuWAXWuihXfhfuAiA99huXfFhF9ifhifuXHWWFuHH~x8Yv9~LU7v9.999%2C9~myOfEMGv9.iW~QQvIK~NNvPb~UGMOjvJz~x8Bvou~NJv9~LNevHu.AW~%3DVvA9Xu~UGMxNvu~z7Qvu~UGMxjvJz~UGMNNUQvu~N7vzJBn5mLU~GQQMC_pvIK%2CIK~G1Q8QfvuiF~G1Q8QuvuiF~UGM77v9~GwMQOvf9fAuf9f9u~ONvW~ejfLMGvW.FF~77vuhHA~xjYMEv9.ui~eBMJ-Nv9.Wh~e8QMQOvu9u~xLjMLEQMGvuf.fW~GwMNmv9~ONfvu~eM1Qzvi99i~j1Q7v~NemyvF.f~e8QMxLjMGv9.HW~ejfLM8MQOvf9fAuf9H9H~e8QMxLjMjv9~J7vfH~ejfLM8MGv9.9H~e8QMGvh9W.FA~ejfLMxLjMe8vu4ouF~xLjM7e8v9~eev9~NejfLMQOvu99~LkevHu.AW~jfLMGvu999~BLMGvF.iA%2C9~L1OEv9.999%2C9~Q8OvfXHuXWuFf~xLjMLEQMUNv9~UGMQLNvUGG~eBxv9.Wh~OfEMjvu9~NejfvF.f~AENkviii.Xh~OYYMQ7Lyvw1LYmz5~OfEMGv9.iW~LEQMGvFu.W~xLjMQLEQMGvuf.fW~LUBEv9.999%2C9~LUBOv9.999%2C9~8QDJkv9~8Q8kv9~xLjMLENMGv9~G8Ov9.AW~UGME7vKL78NjJ~xLjMLEQMLev9~NGOEv9.9iu~875EJM8Ovuh~QJjjJLM71yM8OvifFWufuF9~QxEEj5M71yM8Ov~OJ7JN7JOM71yM8Ov~e8JB1G8j875v9.Wh~EmQvu~1NM75EJvu~1OGjUvifFWufuF9~1YEvu~myG8Ov9.AW9~GkjLv9.9u9~Qx8Ov~O7NvJ1Q7MQN~OYYMJLEYvk1jQJ~OYYvw1LYmz5~GOEN1EOv9~O1jyvOJk1xj7~QyY7vwmYJE1yJM7L1eJj~QmGEv~-8OvKrtoExGoHFFf9FWfAuhW9AiA~w7Yjvu~ONx7vhX~OmyGv9ou~JNEMxQJOv%20uX~JNEME9Xv9.9iWiWhuHfHA9XHAAH~JNEMEu9v9.fAifF9FfWfuXiWAWh~JNEMEuXv9.AHXAuhFXuHXWuWW9X~JNEMEf9v9.HXXfWWu9hXfWFAiHF~JNEMEfXv9.XXWFHuFiihHuWiuX~JNEMEA9v9.FWHfAu9XhHufF9hh~JNEMEAXv9.WuhHAWhhFfihH9Fh~JNEMEH9v9.ihHFufu9FuWFXXFf~JNEMEHXvu.uHWXAi9AFAXAfWFW~JNEMEX9vu.AFfiXWf9AhfHfuiW~JNEMEXXvu.FAfiFHHhHiXAuXuA~JNEMEF9vu.ifHiuufuuAuXHAAF~JNEMEFXvf.fFFWHhAWufihWuuH~JNEMEh9vf.hXAXXXAXu9hhWu~JNEMEhXvA.Hff9uFWFiFFFiiXX~JNEMEW9vH.HhhXXAFHuWAuuuf~JNEMEWXvF.uHhf9XfXXAffW9W~JNEMEi9vi.9hui9HXHWiFif9F~JNEMEiXvuh.Fhf9ifuufHAf9hX~JNEMEiivhH.fAAFuHhAfhH9iA~8GNvu~zQlvu~7yQvhfW-i9~GQGv9~GQEv9~7Y-vfHX&vgd_lbt=500&vgda_l1btm=%5B%22SPAMPXL%22%5D&gdpr=0&mspa=0&prid=8PRVCXX19&cid=8CU7Q771E&crid=254158162&rrr=tzR-hLcl-L9QFm10Ey_J4pRaDdDE7bYRNlT1-by9RFc%3D&requrl=https%3A%2F%2Floan.freemod.link%2F&vi=1701698926692110483&ugd=4&cc=US&sc=NY&bdrid=460&subBdr=196&startTime=1701698926112&l1ch=1&l1hcsd=l1!Og4dd|7975&mmm=uXosNfIDqEk=&buid=349065&sttm=1701698926118&upk=1701698926.2009&hvsid=00000170169892611800958081324726&acid=1e30906958f76863c9497a9655c1a4c0&verid=3111299&infr=1&twna=1&dma=501&stime=1701698925992&tsrc=entity&tdAdd[]=%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&vgd_l1rhst=contextual.media.net&vgd_l1rakh=1701698926156126639&vgd_sc=NY&vgd_ecrid=1700080807684000728009000059500&vgd_uspa=0&vgd_isiolc=1&vgd_pgid=p01512562825t202312041408&vgd_pgids=1&vgd_end=2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.72.21 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS