adv-ref-was-sed.sad-net-q8.buzz Open in urlscan Pro
2606:4700:3030::6815:1276 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://sapq-was-sad.sapq-net-q8.buzz/msajed/
Effective URL:
http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Submission Tags: falconsandbox
Submission: On June 16 via api (June 16th 2021, 9:54:54 am UTC) from US

Summary HTTP 122 Redirects Links 35 Behaviour Indicators

Summary

This website contacted 35 IPs in 6 countries across 25 domains to perform 122 HTTP transactions. The main IP is 2606:4700:3030::6815:1276, located in United States and belongs to CLOUDFLARENET, US. The main domain is adv-ref-was-sed.sad-net-q8.buzz.

This is the only time adv-ref-was-sed.sad-net-q8.buzz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:303... 2606:4700:3030::6815:2ca5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
4	2606:4700:303... 2606:4700:3030::6815:1276	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
19	2606:4700::68... 2606:4700::6812:1a20	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:10:... 2606:4700:10::6816:46c5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	46.105.201.240 46.105.201.240	16276 (OVH) (OVH)
20	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
1	158.69.248.123 158.69.248.123	16276 (OVH) (OVH)
1	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700:20:... 2606:4700:20::ac43:4a0f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.224.195.69 13.224.195.69	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1	13.224.195.114 13.224.195.114	16509 (AMAZON-02) (AMAZON-02)
1 1	54.203.78.123 54.203.78.123	16509 (AMAZON-02) (AMAZON-02)
1	13.224.89.170 13.224.89.170	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:828::2001	15169 (GOOGLE) (GOOGLE)
2 17	2a00:1450:400... 2a00:1450:4001:82a::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::200e	15169 (GOOGLE) (GOOGLE)
2	2620:116:800d... 2620:116:800d:21:f916:5049:f87f:108e	16509 (AMAZON-02) (AMAZON-02)
2 2	34.246.227.69 34.246.227.69	16509 (AMAZON-02) (AMAZON-02)
10	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
1	34.98.67.61 34.98.67.61	15169 (GOOGLE) (GOOGLE)
3 3	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
3 3	185.64.189.115 185.64.189.115	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 2	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
4	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:811::200e	15169 (GOOGLE) (GOOGLE)
1	2a05:d01c:1d8... 2a05:d01c:1d8:8100:2200:547c:51ca:c51e	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2004	15169 (GOOGLE) (GOOGLE)
122	35

2 2606:4700:3030::6815:2ca5 (United States)

ASN13335 (CLOUDFLARENET, US)

sapq-was-sad.sapq-net-q8.buzz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com.sa	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3030::6815:1276 (United States)

ASN13335 (CLOUDFLARENET, US)

adv-ref-was-sed.sad-net-q8.buzz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2606:4700::6812:1a20 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.sabq.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6816:46c5 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.105.201.240 (France)

ASN16276 (OVH, FR)

s10.histats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 158.69.248.123 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: ns542881.ip-158-69-248.net

s4.histats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::ac43:4a0f (United States)

ASN13335 (CLOUDFLARENET, US)

js.foxpush.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.195.69 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-195-69.fra2.r.cloudfront.net

d31qbv1cthcecs.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.195.114 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-195-114.fra2.r.cloudfront.net

certify.alexametrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.203.78.123 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-203-78-123.us-west-2.compute.amazonaws.com

redirect.prod.experiment.routing.cloudfront.aws.a2z.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.89.170 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-89-170.zrh50.r.cloudfront.net

a07e87a585a02691910df08ee17a1614f.profile.zrh50-c1.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:828::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

encrypted-tbn2.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

encrypted-tbn0.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

encrypted-tbn1.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:f916:5049:f87f:108e (United States)

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.246.227.69 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-246-227-69.eu-west-1.compute.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.67.61 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 61.67.98.34.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.227.252.103 (Kansas City, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.64.189.115 (United Kingdom) 3 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.144.139 (Frankfurt am Main, Germany) 2 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

encrypted-tbn3.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d01c:1d8:8100:2200:547c:51ca:c51e (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
34	googlesyndication.com 2 redirects pagead2.googlesyndication.com tpc.googlesyndication.com	407 KB
19	doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	80 KB
19	sabq.org cdn.sabq.org
17	gstatic.com www.gstatic.com encrypted-tbn2.gstatic.com encrypted-tbn0.gstatic.com encrypted-tbn1.gstatic.com fonts.gstatic.com encrypted-tbn3.gstatic.com	379 KB
4	googletagservices.com www.googletagservices.com	139 KB
4	sad-net-q8.buzz adv-ref-was-sed.sad-net-q8.buzz	21 KB
3	pubmatic.com 3 redirects image6.pubmatic.com	1 KB
3	openx.net 3 redirects rtb.openx.net	993 B
3	googleapis.com fonts.googleapis.com	2 KB
3	google.com adservice.google.com www.google.com	1 KB
2	rubiconproject.com 2 redirects pixel.rubiconproject.com	924 B
2	everesttech.net 2 redirects pixel.everesttech.net	754 B
2	quantserve.com cms.quantserve.com	675 B
2	cloudfront.net d31qbv1cthcecs.cloudfront.net a07e87a585a02691910df08ee17a1614f.profile.zrh50-c1.cloudfront.net	2 KB
2	google.de adservice.google.de	287 B
2	histats.com s10.histats.com s4.histats.com	5 KB
2	addtoany.com static.addtoany.com	60 KB
2	sapq-net-q8.buzz sapq-was-sad.sapq-net-q8.buzz	11 KB
1	innovid.com ag.innovid.com	297 B
1	mookie1.com odr.mookie1.com	324 B
1	a2z.com 1 redirects redirect.prod.experiment.routing.cloudfront.aws.a2z.com	238 B
1	alexametrics.com certify.alexametrics.com	551 B
1	foxpush.com js.foxpush.com	8 KB
1	googleadservices.com partner.googleadservices.com	662 B
1	google.com.sa www.google.com.sa	960 B
122	25

	Domain	Requested by
22	tpc.googlesyndication.com	2 redirects googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
19	cdn.sabq.org	adv-ref-was-sed.sad-net-q8.buzz
12	pagead2.googlesyndication.com	adv-ref-was-sed.sad-net-q8.buzz pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
10	cm.g.doubleclick.net	adv-ref-was-sed.sad-net-q8.buzz googleads.g.doubleclick.net
9	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
4	encrypted-tbn3.gstatic.com	googleads.g.doubleclick.net
4	encrypted-tbn2.gstatic.com	googleads.g.doubleclick.net
4	www.gstatic.com	googleads.g.doubleclick.net
4	www.googletagservices.com	pagead2.googlesyndication.com googleads.g.doubleclick.net
4	adv-ref-was-sed.sad-net-q8.buzz	www.google.com.sa adv-ref-was-sed.sad-net-q8.buzz
3	fonts.gstatic.com	fonts.googleapis.com
3	image6.pubmatic.com	3 redirects
3	rtb.openx.net	3 redirects
3	fonts.googleapis.com	googleads.g.doubleclick.net
2	pixel.rubiconproject.com	2 redirects
2	pixel.everesttech.net	2 redirects
2	cms.quantserve.com	googleads.g.doubleclick.net
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
2	static.addtoany.com	adv-ref-was-sed.sad-net-q8.buzz static.addtoany.com
2	sapq-was-sad.sapq-net-q8.buzz	sapq-was-sad.sapq-net-q8.buzz
1	www.google.com	tpc.googlesyndication.com
1	ag.innovid.com	googleads.g.doubleclick.net
1	odr.mookie1.com	googleads.g.doubleclick.net
1	encrypted-tbn1.gstatic.com	googleads.g.doubleclick.net
1	encrypted-tbn0.gstatic.com	googleads.g.doubleclick.net
1	a07e87a585a02691910df08ee17a1614f.profile.zrh50-c1.cloudfront.net	adv-ref-was-sed.sad-net-q8.buzz
1	redirect.prod.experiment.routing.cloudfront.aws.a2z.com	1 redirects
1	certify.alexametrics.com	adv-ref-was-sed.sad-net-q8.buzz
1	d31qbv1cthcecs.cloudfront.net	adv-ref-was-sed.sad-net-q8.buzz
1	js.foxpush.com	adv-ref-was-sed.sad-net-q8.buzz
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	s4.histats.com	s10.histats.com
1	s10.histats.com	adv-ref-was-sed.sad-net-q8.buzz
1	www.google.com.sa
122	35

This site contains links to these domains. Also see Links.

Domain
mobile.sabq.org
www.addtoany.com
www.arabiaweather.com
www.facebook.com
www.twitter.com
plus.google.com
www.youtube.com
www.instagram.com
www.telegram.me
ibtikar.net.sa
www.dimofinf.net

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-02-04` - `2022-02-03`	a year	crt.sh
*.google.com.sa GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
histats.com R3	`2021-05-21` - `2021-08-19`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2021-02-22` - `2022-02-21`	a year	crt.sh
certify.alexametrics.com Amazon	`2021-06-14` - `2022-07-13`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-05-17` - `2021-08-09`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.mookie1.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-22` - `2022-03-25`	a year	crt.sh
*.innovid.com RapidSSL RSA CA 2018	`2020-02-07` - `2022-04-07`	2 years	crt.sh
www.google.com GTS CA 1C3	`2021-05-17` - `2021-08-09`	3 months	crt.sh

This page contains 14 frames:

Primary Page: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Frame ID: A9A710A0B4B82A25FE3B9809E996D1E0
Requests: 48 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210610/r20190131/zrt_lookup.html
Frame ID: 87672C003033E1E42F7A954033E5B075
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&adk=1812271804&adf=3025194257&lmt=1623837276&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&ea=0&flash=0&pra=5&wgl=1&dt=1623837276786&bpp=3&bdt=55&idt=60&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2799827146837&frm=20&pv=2&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=1&uci=a!1&fsb=1&dtd=75
Frame ID: 0876DC72F73E36111B76CE7323B3EA65
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&h=250&slotname=2240994306&adk=635374232&adf=41369079&pi=t.ma~as.2240994306&w=300&lmt=1623837276&psa=0&format=300x250&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&wgl=1&dt=1623837276789&bpp=2&bdt=57&idt=77&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1250&ady=-2&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CfeE%7C&abl=CF&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=S92l37msKq&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=82
Frame ID: AE49C9CB54520165810EA10E177265B5
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&h=280&slotname=7165497559&adk=2610098543&adf=3321146140&pi=t.ma~as.7165497559&w=1200&fwrn=4&fwrnh=100&lmt=1623837277&rafmt=1&psa=0&format=1200x280&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1623837276988&bpp=20&bdt=257&idt=20&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db58f2c807188b9a9-2274e0f5fec80084%3AT%3D1623837276%3ART%3D1623837276%3AS%3DALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA&prev_fmts=0x0%2C300x250&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=8&ady=1652&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=T1wnAheYyK&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=25
Frame ID: B0B38ECC538C408CD85A003B5466BC98
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&h=280&slotname=4153775738&adk=1928710064&adf=3693776556&pi=t.ma~as.4153775738&w=1200&fwrn=4&fwrnh=100&lmt=1623837277&rafmt=1&psa=0&format=1200x280&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1623837277029&bpp=2&bdt=298&idt=2&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db58f2c807188b9a9-2274e0f5fec80084%3AT%3D1623837276%3ART%3D1623837276%3AS%3DALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA&prev_fmts=0x0%2C300x250%2C1200x280&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=8&ady=2162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=vdFCFO2Me5&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=5
Frame ID: A609D5D9D97CF1C6EE2F427F07E524BB
Requests: 20 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&h=280&slotname=3018039299&adk=2684985498&adf=1811898368&pi=t.ma~as.3018039299&w=1200&fwrn=4&fwrnh=100&lmt=1623837277&rafmt=1&psa=0&format=1200x280&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1623837277038&bpp=2&bdt=307&idt=2&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db58f2c807188b9a9-2274e0f5fec80084%3AT%3D1623837276%3ART%3D1623837276%3AS%3DALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA&prev_fmts=0x0%2C300x250%2C1200x280%2C1200x280&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=8&ady=2664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tc4WcmWQhA&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=4
Frame ID: D29EEE33AEF783AB320EE611BA67281C
Requests: 18 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 8F4190A86AC2F3D35F3F1A60CEFD83F2
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/JiIq58Y5baSygHo2f1FPIoBWCTei6k9nc_G1t4uToEM.js
Frame ID: 15917048B962200E48C6D60FFDE9C1A8
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 00599AC81BF48CADA8C71C16FC35F908
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/JiIq58Y5baSygHo2f1FPIoBWCTei6k9nc_G1t4uToEM.js
Frame ID: 01D69D172AFBDB56ACC58F0A75776914
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/JiIq58Y5baSygHo2f1FPIoBWCTei6k9nc_G1t4uToEM.js
Frame ID: EB2D94FD4CE486F48C2C4BB7A85D8965
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html
Frame ID: 3989D2FCFDA3F3C63EACEECD5509736A
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: D7A8042F5825578AC9D0F669794127E3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://sapq-was-sad.sapq-net-q8.buzz/msajed/ Page URL
https://www.google.com.sa/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjjlIjr1prx... Page URL
http://adv-ref-was-sed.sad-net-q8.buzz/msajed/ Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Page Statistics

122
Requests

91 %
HTTPS

67 %
IPv6

25
Domains

35
Subdomains

35
IPs

6
Countries

1120 kB
Transfer

2210 kB
Size

10
Cookies

35 Outgoing links

These are links going to different origins than the main page.

URL: https://mobile.sabq.org/
Title:

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/set-view-cookie?value=full&redirectToUrl=https%3A%2F%2Fsabq.org%2F
Title:

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/share#url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&title=%D9%85%D9%81%D8%AA%D9%8A%20%D8%A7%D9%84%D9%85%D9%85%D9%84%D9%83%D8%A9%20%D9%8A%D8%AD%D8%B3%D9%85%20%D8%AC%D8%AF%D9%84%20%D8%A3%D8%B5%D9%88%D8%A7%D8%AA%20%D9%85%D9%83%D8%A8%D8%B1%D8%A7%D8%AA%20%D8%A7%D9%84%D8%B5%D9%88%D8%AA%20%D8%A8%D8%A7%D9%84%D9%85%D8%B3%D8%A7%D8%AC%D8%AF%20%D9%88%D9%8A%D9%8F%D9%82%D8%B1%D8%B1%20%D8%B9%D9%88%D8%AF%D8%AA%D9%87%D8%A7
Title: Share

Search URL Search Domain Scan URL

URL: http://www.arabiaweather.com/
Title:

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D9%84%D8%AD%D8%B8%D9%87-%D8%A8%D9%84%D8%AD%D8%B8%D9%87
Title: لحظة بلحظة

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D8%A7%D9%84%D9%85%D9%85%D9%84%D9%83%D8%A9
Title: المملكة

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D8%B1%D9%8A%D8%A7%D8%B6%D8%A9
Title: رياضة

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D9%85%D8%AD%D8%B7%D8%A7%D8%AA
Title: محطات

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D8%B3%D9%8A%D8%A7%D8%AD%D8%A9
Title: سياحة

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D8%B3%D9%8A%D8%A7%D8%B1%D8%A7%D8%AA
Title: سيارات

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D8%AA%D9%82%D9%86%D9%8A%D8%A9
Title: تقنية

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B9%D8%A7%D9%84%D9%85
Title: أخبار العالم

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D8%A7%D9%84%D8%A3%D8%B3%D8%AA%D8%AF%D9%8A%D9%88
Title: الأستديو

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D8%B3%D8%A8%D9%82-%D8%AA%D9%82%D9%88%D9%84-%D9%84%D9%84%D9%85%D8%B3%D8%A4%D9%88%D9%84
Title: سبق تقول للمسؤول

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D8%AD%D9%88%D8%A7%D8%B1%D8%A7%D8%AA
Title: حوارات

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D9%86%D8%A7%D8%B5%D8%B9
Title: ناصع

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D9%83%D8%A7%D8%B1%D9%8A%D9%83%D8%A7%D8%AA%D9%8A%D8%B1
Title: كاريكاتير

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D8%A8%D8%B1%D9%88%D9%81%D8%A7%D9%8A%D9%84
Title: بروفايل

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D8%A8%D8%A7%D9%84%D8%A3%D8%B1%D9%82%D8%A7%D9%85
Title: بالأرقام

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D8%A5%D9%86%D9%81%D9%88%D8%AC%D8%B1%D8%A7%D9%81%D9%8A%D9%83
Title: إنفوجرافيك

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D8%AA%D8%AD%D9%82%D9%8A%D9%82%D8%A7%D8%AA
Title: تحقيقات

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D9%85%D9%82%D8%A7%D9%84%D8%A7%D8%AA
Title: مقالات

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/poll
Title: التصويتات

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/%D9%81%D8%B9%D8%A7%D9%84%D9%8A%D8%A7%D8%AA
Title: الفعاليات

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/contactmessage/create
Title: اتصل بنا

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sabq.org
Title:

Search URL Search Domain Scan URL

URL: https://www.twitter.com/sabqorg
Title:

Search URL Search Domain Scan URL

URL: https://plus.google.com/+sabqorgnews
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/sabqorg
Title:

Search URL Search Domain Scan URL

URL: https://www.instagram.com/sabqorg
Title:

Search URL Search Domain Scan URL

URL: https://www.telegram.me/sabqorg
Title:

Search URL Search Domain Scan URL

URL: https://mobile.sabq.org/rss
Title:

Search URL Search Domain Scan URL

URL: http://ibtikar.net.sa/?utm_source=Sabq&utm_medium=FooterLink&utm_campaign=Partnerships
Title:

Search URL Search Domain Scan URL

URL: http://www.dimofinf.net/
Title:

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/
Title: AddToAny

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sapq-was-sad.sapq-net-q8.buzz/msajed/ Page URL
https://www.google.com.sa/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjjlIjr1prxAhUaOuwKHWO5C4oQFjABegQIAxAE&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&usg=AOvVaw0H2sipiReR6S9cbIjUmdBT Page URL
http://adv-ref-was-sed.sad-net-q8.buzz/msajed/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 48

http://redirect.prod.experiment.routing.cloudfront.aws.a2z.com/x.png HTTP 302
http://a07e87a585a02691910df08ee17a1614f.profile.zrh50-c1.cloudfront.net/test.png

Request Chain 65

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgKDr64iePBCwCRiwCTIINoIjV4alR1E HTTP 301
https://tpc.googlesyndication.com/simgad/12292211746583241485

Request Chain 69

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPIWNfmEF94wi3kwT7-ueyN5-nhbmu4X9Q-yfrVdRmRxYBiNpExNVaxgSL0LVWqYkEw4GfV6toUYCtQyB9F3oNBvt4yE3rZDVQ&google_gid=CAESEPhsfO1_-pUHOGpWSwTygLQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU1uS1hRQUFBYUNUNVh3cA&google_push=AYg5qPIWNfmEF94wi3kwT7-ueyN5-nhbmu4X9Q-yfrVdRmRxYBiNpExNVaxgSL0LVWqYkEw4GfV6toUYCtQyB9F3oNBvt4yE3rZDVQ

Request Chain 71

https://rtb.openx.net/sync/dds?google_gid=CAESENqrtvGIKew4XD-iFI0Y8lo&google_cver=1&google_push=AYg5qPJevPvipK4LG6HTk1Yl7-P-rxuQxxi2ts7V-lAAtEjsYmol3sl6MjgAVL5oXZyU4EiDuuyGrCUTaTGOw_gcc2TixpZ7WopWVA HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESENqrtvGIKew4XD-iFI0Y8lo&google_cver=1&google_push=AYg5qPJevPvipK4LG6HTk1Yl7-P-rxuQxxi2ts7V-lAAtEjsYmol3sl6MjgAVL5oXZyU4EiDuuyGrCUTaTGOw_gcc2TixpZ7WopWVA&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJevPvipK4LG6HTk1Yl7-P-rxuQxxi2ts7V-lAAtEjsYmol3sl6MjgAVL5oXZyU4EiDuuyGrCUTaTGOw_gcc2TixpZ7WopWVA&google_hm=YoGsBljtxP02rk4D8Vublg==

Request Chain 72

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEHd52qJ1u3gZpCsVNf3td6M&google_cver=1&google_push=AYg5qPJ_CKjKdsrCbZhcoTIHTeBGHFYjTpm9dk4ll2kHLlobbfu3d6CgJg6fb_Gn-NtUvtVmKIolaw9LlT97D1DNqDab8qJM6GVVaA HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEHd52qJ1u3gZpCsVNf3td6M&google_cver=1&google_push=AYg5qPJ_CKjKdsrCbZhcoTIHTeBGHFYjTpm9dk4ll2kHLlobbfu3d6CgJg6fb_Gn-NtUvtVmKIolaw9LlT97D1DNqDab8qJM6GVVaA&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=owlDQea9QJmn0ieNOwlPVA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJ_CKjKdsrCbZhcoTIHTeBGHFYjTpm9dk4ll2kHLlobbfu3d6CgJg6fb_Gn-NtUvtVmKIolaw9LlT97D1DNqDab8qJM6GVVaA

Request Chain 73

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDZrG5g-Br9zfsEGqV0N6rI&google_cver=1&google_push=AYg5qPJhJpVdiaQHEmB4FjXI3aQdPrxB9iG7YEcP2w4cT__RiaoAZrhc5eHdKjfnh6283pgIU3L2NeMWhjFL91JvVm1xqcxHJvqu4Q HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BaQVNFOUktMVotNE9aQQ==&google_push=AYg5qPJhJpVdiaQHEmB4FjXI3aQdPrxB9iG7YEcP2w4cT__RiaoAZrhc5eHdKjfnh6283pgIU3L2NeMWhjFL91JvVm1xqcxHJvqu4Q

Request Chain 74

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1

Request Chain 92

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgKD3kbfNeRCwCRiwCTIIIV2ndAd2FLA HTTP 301
https://tpc.googlesyndication.com/simgad/12939242301588677835

Request Chain 97

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPI8pgikEjEVnekHM1ZUdKaVS_ErOnWTNe_2MdhUUBBDC1EW7NSVNdGzhs9ndi3JdLE4tSjoPWVEUZFVEqrZP5tVPsiMb3uK&google_gid=CAESELMlaiTmibmVDbr9TrP7SfM&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU1uS1hRQUFBRkZINmhrcA&google_push=AYg5qPI8pgikEjEVnekHM1ZUdKaVS_ErOnWTNe_2MdhUUBBDC1EW7NSVNdGzhs9ndi3JdLE4tSjoPWVEUZFVEqrZP5tVPsiMb3uK

Request Chain 98

https://rtb.openx.net/sync/dds?google_gid=CAESEPk_TRiCCmigVefm1Z1lYNM&google_cver=1&google_push=AYg5qPL29jDwgXs_skBEUc3rU6Sl9XWDK2lq9904erziuWsHOQhBvcjl-w3EjtLXG16LanmD-3pMdsM7fWMmNhJjyd9QA4bRWINT HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPL29jDwgXs_skBEUc3rU6Sl9XWDK2lq9904erziuWsHOQhBvcjl-w3EjtLXG16LanmD-3pMdsM7fWMmNhJjyd9QA4bRWINT&google_hm=YoGsBljtxP02rk4D8Vublg==

Request Chain 99

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEE19BUgdytq2-3y38V_tw8o&google_cver=1&google_push=AYg5qPLbG8UfPyI_M7LGCpbeG-hmnjEFa6DUAVWOfqHd1r-t5MDwUd0KHbpH0DC0eJtIPod9eA1NumhOFe1BPMuwvaWA6bwu7a-i HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=owlDQea9QJmn0ieNOwlPVA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLbG8UfPyI_M7LGCpbeG-hmnjEFa6DUAVWOfqHd1r-t5MDwUd0KHbpH0DC0eJtIPod9eA1NumhOFe1BPMuwvaWA6bwu7a-i

Request Chain 100

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESECKPMzTxrTRmymu4IfuI4Sk&google_cver=1&google_push=AYg5qPKvhHZg9aOKDSSSz-B8Ph9atO2Mtp8fsqWqA26Y8s6-zJtXO7yWBUqUyy8rCC6WRMSIqx_IBHWfC9XIKGMJfOfI5F0AFh7X HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BaQVNFQzQtMjEtOVdLRQ==&google_push=AYg5qPKvhHZg9aOKDSSSz-B8Ph9atO2Mtp8fsqWqA26Y8s6-zJtXO7yWBUqUyy8rCC6WRMSIqx_IBHWfC9XIKGMJfOfI5F0AFh7X

Request Chain 101

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1

122 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
sapq-was-sad.sapq-net-q8.buzz/msajed/ 661 B
1 KB 102ms
67ms Document
text/html 2606:4700:3030::6815:2ca5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sapq-was-sad.sapq-net-q8.buzz/msajed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:2ca5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7785eca5e02d44e93672c7da26af9926f754aaab9bad7a5e68411dc9d25e4157

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: sapq-was-sad.sapq-net-q8.buzz
:scheme: https
:path: /msajed/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:54:36 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cf-cache-status: DYNAMIC
cf-request-id: 0ab5d7911900004e0dbd2e5000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=x46YEQRJBBpGao3run49IsmffBAdDTPBD76iJm6bz9rdxCerWil6EeZBv0J%2BplVUv91KA5v5P5v1SiJ76rNvOZJZU4R8O%2BEwSfRo4ufwxRcsrsP%2BZRPJilOb3hip3TML0K6H8ZxTgXqgDXKOv429fAqa%2Bl6SP80%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 66032861c93c4e0d-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H3-29 200 api.js Show response
sapq-was-sad.sapq-net-q8.buzz/cdn-cgi/bm/cv/669835187/ 35 KB
10 KB 25ms
15ms Script
text/javascript 2606:4700:3030::6815:2ca5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sapq-was-sad.sapq-net-q8.buzz/cdn-cgi/bm/cv/669835187/api.js

Requested by

Host: sapq-was-sad.sapq-net-q8.buzz
URL: https://sapq-was-sad.sapq-net-q8.buzz/msajed/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:2ca5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

:path: /cdn-cgi/bm/cv/669835187/api.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: sapq-was-sad.sapq-net-q8.buzz
referer: https://sapq-was-sad.sapq-net-q8.buzz/msajed/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://sapq-was-sad.sapq-net-q8.buzz/msajed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:54:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Xvcs3brFRBhdoV5mZVPon%2F2sdMTOutt9SOmvQ0Js9DHqenq4ChsYSyLPD7661KIRzQht9%2F6SVz1zNiiUJ6IIARvIsE%2FuN5U9Na61soqNZDM9E79Bn%2FUFAwGxLScRSdoUeb0QjUT0P5c82KH34huQq%2F4woVkpZu8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=604800, public
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6603286249114a79-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0ab5d7916c00004a79ff8d4000000001

GET
H2 200 url
www.google.com.sa/ 947 B
960 B 57ms
36ms Document
text/html 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com.sa/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjjlIjr1prxAhUaOuwKHWO5C4oQFjABegQIAxAE&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&usg=AOvVaw0H2sipiReR6S9cbIjUmdBT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.google.com.sa
:scheme: https
:path: /url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjjlIjr1prxAhUaOuwKHWO5C4oQFjABegQIAxAE&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&usg=AOvVaw0H2sipiReR6S9cbIjUmdBT
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://sapq-was-sad.sapq-net-q8.buzz/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://sapq-was-sad.sapq-net-q8.buzz/

Response headers

date: Wed, 16 Jun 2021 09:54:36 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000
bfcache-opt-in: unload
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-encoding: br
server: gws
content-length: 476
x-xss-protection: 0
set-cookie: CONSENT=PENDING+393; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.google.com.sa; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST result
sapq-was-sad.sapq-net-q8.buzz/cdn-cgi/bm/cv/ 0
0

GET
H/1.1 200
OK Primary Request / Show response
adv-ref-was-sed.sad-net-q8.buzz/msajed/ 37 KB
10 KB 109ms
84ms Document
text/html 2606:4700:3030::6815:1276
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://adv-ref-was-sed.sad-net-q8.buzz/msajed/

Requested by

Host: www.google.com.sa
URL: https://www.google.com.sa/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjjlIjr1prxAhUaOuwKHWO5C4oQFjABegQIAxAE&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&usg=AOvVaw0H2sipiReR6S9cbIjUmdBT

Protocol

HTTP/1.1

Server

2606:4700:3030::6815:1276 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dcad2aa52d747ced13258f1ba1ef838b55b359418d8e0b4658871e5c0b90a8c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Host: adv-ref-was-sed.sad-net-q8.buzz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: https://www.google.com.sa/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.google.com.sa/

Response headers

Date: Wed, 16 Jun 2021 09:54:36 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
CF-Cache-Status: DYNAMIC
cf-request-id: 0ab5d791e300004ab5741c5000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=W%2FoHinRnaJ3qPrmeytSlDyRYAmSrYdAGEI7QAUMQKzVISvHqRXUgxTuzGnrRX4hNq9bPf4jT%2FoOGrXUyAb8XSPSMAUBpLC9g%2BqJnsTapbIQd0aA68WeEvSR0L2CiRolaNrxEPySBHV3bZu9mJk0PA9lVCgt2iBtfJw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
X-Content-Type-Options: nosniff
Server: cloudflare
CF-RAY: 660328630c6d4ab5-FRA
Content-Encoding: gzip
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 135 KB
48 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

456293a11b90033d05493697676f323da46e6426c88a287b0aa4a6a817a01458

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:54:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48826
x-xss-protection: 0
server: cafe
etag: 13465898845601436117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 16 Jun 2021 09:54:36 GMT

GET
H2 403 bootstrap.css
cdn.sabq.org/design/sabq-light/css/ 0
0 58ms
25ms Stylesheet
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.sabq.org/design/sabq-light/css/bootstrap.css?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 bootstrap-rtl.css
cdn.sabq.org/design/sabq-light/css/ 0
0 67ms
34ms Stylesheet
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.sabq.org/design/sabq-light/css/bootstrap-rtl.css?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 main.css
cdn.sabq.org/assets/frontend/Lite/css/ 0
0 59ms
26ms Stylesheet
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.sabq.org/assets/frontend/Lite/css/main.css?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 opta.css
cdn.sabq.org/assets/frontend/Lite/css/ 0
0 58ms
26ms Stylesheet
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.sabq.org/assets/frontend/Lite/css/opta.css?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 base-header.js
cdn.sabq.org/assets/js/ 0
0 60ms
27ms Script
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.sabq.org/assets/js/base-header.js?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 base.js
cdn.sabq.org/assets/js/ 0
0 59ms
27ms Script
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.sabq.org/assets/js/base.js?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 chat-style.css
cdn.sabq.org/design/sabq-new/css/ 0
0 70ms
38ms Stylesheet
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.sabq.org/design/sabq-new/css/chat-style.css?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 200
OK api.js Show response
adv-ref-was-sed.sad-net-q8.buzz/cdn-cgi/bm/cv/669835187/ 35 KB
10 KB 15ms
15ms Script
text/javascript 2606:4700:3030::6815:1276
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://adv-ref-was-sed.sad-net-q8.buzz/cdn-cgi/bm/cv/669835187/api.js

Requested by

Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/

Protocol

HTTP/1.1

Server

2606:4700:3030::6815:1276 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: adv-ref-was-sed.sad-net-q8.buzz
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: */*
Referer: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 16 Jun 2021 09:54:36 GMT
Content-Encoding: gzip
x-content-type-options: nosniff
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=dbONWAkKJ0FiF1of%2FyJXE59YkRfW9tz8Rti51C0UEyR0ncLbKqgcEqRBp21tj4dT1imha4%2FDpLLoOaARClPT0ApfkFa3AXjqrqpprp43rGaTXfJ%2FwDvHxCjYaLGOfUSiABU%2F5nfPcoCK%2BQk%2FWgcsyhIKR3fcXC%2BYSw%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/javascript
Vary: Accept-Encoding
cache-control: max-age=604800, public
Connection: keep-alive
CF-RAY: 66032863ae544ab5-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0ab5d7924500004ab580956000000001

GET
H2 403 logo.png
cdn.sabq.org/design/sabq-light/img/ 0
0 34ms
34ms Image
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.sabq.org/design/sabq-light/img/logo.png?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 page.js Show response
static.addtoany.com/menu/ 84 KB
27 KB 53ms
36ms Script
application/javascript 2606:4700:10::6816:46c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f909a31bfd7a13b9dd53e98b5652f13f4782fdfd1653dc4befade7386c087371

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:54:36 GMT
via: e1s
x-content-type-options: nosniff
cf-cache-status: HIT
age: 97908
p3p: CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0ab5d792540000175a2008c000000001
last-modified: Fri, 14 May 2021 06:41:59 GMT
server: cloudflare
etag: W/"14f2c-5c2448a7281f2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=172800
cf-ray: 66032863be42175a-FRA
cf-bgj: minify

GET
H/1.1 200
OK weatherLogoblack.png
adv-ref-was-sed.sad-net-q8.buzz/img/ 271 B
271 B 71ms
65ms Image
text/html 2606:4700:3030::6815:1276
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://adv-ref-was-sed.sad-net-q8.buzz/img/weatherLogoblack.png

Requested by

Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/

Protocol

HTTP/1.1

Server

2606:4700:3030::6815:1276 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: adv-ref-was-sed.sad-net-q8.buzz
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 16 Jun 2021 09:54:36 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
CF-Cache-Status: HIT
NEL: {"report_to":"cf-nel","max_age":604800}
Age: 5376
Transfer-Encoding: chunked
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0ab5d7924800004dbe61a4f000000001
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=uo29TMHtIe%2FoyfSAN7ql5pM%2FlZU6T9BIkRPcQGpOXjxARFUpo7QfiGZ9Le6Gt22XOGh99DCObF9c1mwnhKxnSB7prtH%2BEYgIDVf%2BgpR9OUbxNYdLZyH9gEC%2FVrU6PKovNJyhPVctb9nuvhJFLfSCh86w5dwIK1fiug%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=31536000
CF-RAY: 66032863ac8f4dbe-FRA

GET
H2 403 58790677e9d74.jpg
cdn.sabq.org/uploads/media-cache/resize_800_relative/uploads/material-file/587906a051a773ad392d288b/ 0
0 39ms
39ms Image
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.sabq.org/uploads/media-cache/resize_800_relative/uploads/material-file/587906a051a773ad392d288b/58790677e9d74.jpg
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 5634d71e4024c.png
cdn.sabq.org/uploads/media-cache/resize_120_120/uploads/users-profile-images/ 0
0 32ms
31ms Image
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.sabq.org/uploads/media-cache/resize_120_120/uploads/users-profile-images/5634d71e4024c.png
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 logofoot.jpg
cdn.sabq.org/design/sabq-light/img/ 0
0 39ms
38ms Image
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.sabq.org/design/sabq-light/img/logofoot.jpg?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 ibtikar.jpg
cdn.sabq.org/design/sabq-light/img/ 0
0 25ms
24ms Image
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.sabq.org/design/sabq-light/img/ibtikar.jpg?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 dimofinf.png
cdn.sabq.org/design/sabq-light/img/ 0
0 26ms
25ms Image
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.sabq.org/design/sabq-light/img/dimofinf.png?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 200
OK js15_as.js Show response
s10.histats.com/ 11 KB
5 KB 66ms
42ms Script
text/javascript 46.105.201.240
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://s10.histats.com/js15_as.js
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: HTTP/1.1
Server: 46.105.201.240 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash: 2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 16 Jun 2021 09:50:22 GMT
Content-Encoding: gzip
Last-Modified: Thu, 16 Apr 2020 10:44:16 GMT
X-CDN-Pop-IP
ETag: "-375139978"
X-Cacheable: Matched cache
Vary: Accept-Encoding
X-IPLB-Instance: 40744
Content-Type: text/javascript
X-CDN-Pop: sbg
Accept-Ranges: bytes
X-IPLB-Request-ID: 52661272:6088_2E69C9F0:0050_60C9CA5C_FC154:2C219
Content-Length: 4547
X-Request-ID: 923142055

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210610/r20190131/ 233 KB
86 KB 37ms
35ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210610/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-5290359410522938&plah=adv-ref-was-sed.sad-net-q8.buzz&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86d6eda306cb7a8ec61843d32a597bef4a680844987e12bbfabce3a8c66b3786

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:54:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87957
x-xss-protection: 0
server: cafe
etag: 17726926907594691985
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 16 Jun 2021 09:54:36 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210610/r20190131/ Frame 8767 10 KB
5 KB 6ms
5ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210610/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210610/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://adv-ref-was-sed.sad-net-q8.buzz/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://adv-ref-was-sed.sad-net-q8.buzz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 15 Jun 2021 11:38:22 GMT
expires: Tue, 29 Jun 2021 11:38:22 GMT
content-type: text/html; charset=UTF-8
etag: 15579341980913220427
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4579
x-xss-protection: 0
age: 80174
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 403 bootstrap-rtl.css
cdn.sabq.org/design/sabq-light/css/ 0
0 33ms
22ms Stylesheet
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.sabq.org/design/sabq-light/css/bootstrap-rtl.css?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 200
OK 0.php Show response
s4.histats.com/stats/ 52 B
186 B 344ms
114ms Script
text/html 158.69.248.123
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://s4.histats.com/stats/0.php?4555371&@f16&@g1&@h1&@i1&@j1623837276814&@k0&@l1&@m%D9%85%D9%81%D8%AA%D9%8A%20%D8%A7%D9%84%D9%85%D9%85%D9%84%D9%83%D8%A9%20%D9%8A%D8%AD%D8%B3%D9%85%20%D8%AC%D8%AF%D9%84%20%D8%A3%D8%B5%D9%88%D8%A7%D8%AA%20%D9%85%D9%83%D8%A8%D8%B1%D8%A7%D8%AA%20%D8%A7%D9%84%D8%B5%D9%88%D8%AA%20%D8%A8%D8%A7%D9%84%D9%85%D8%B3%D8%A7%D8%AC%D8%AF%20%D9%88%D9%8A%D9%8F%D9%82%D8%B1%D8%B1%20%D8%B9%D9%88%D8%AF%D8%AA%D9%87%D8%A7&@n0&@ohttps%3A%2F%2Fwww.google.com.sa%2F&@q0&@r0&@s0&@ten-US&@u1600&@b1:177976942&@b3:1623837277&@b4:js15_as.js&@b5:120&@a-_0.2.1&@vhttp%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&@w
Requested by: Host: s10.histats.com
URL: http://s10.histats.com/js15_as.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 158.69.248.123 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ns542881.ip-158-69-248.net
Software: /
Resource Hash: bd2b6b0e8049f42f006bfc06c575cb2124f61e8c4cbf37ef180bcf66c934e241

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 16 Jun 2021 09:54:37 GMT
Connection: close
Content-Length: 52
Content-Type: text/html;charset=UTF-8

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 205 B
662 B 100ms
36ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=adv-ref-was-sed.sad-net-q8.buzz&callback=_gfp_s_&client=ca-pub-5290359410522938

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210610/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-5290359410522938&plah=adv-ref-was-sed.sad-net-q8.buzz&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

466db04ec98d70a17c6e5ec4d3be56efe9a4260045ae6e212fbe56bf912b4de4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:54:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 196
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=adv-ref-was-sed.sad-net-q8.buzz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 16 Jun 2021 09:54:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 14ms
14ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=adv-ref-was-sed.sad-net-q8.buzz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 16 Jun 2021 09:54:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0876 0
19 B 56ms
55ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&adk=1812271804&adf=3025194257&lmt=1623837276&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&ea=0&flash=0&pra=5&wgl=1&dt=1623837276786&bpp=3&bdt=55&idt=60&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2799827146837&frm=20&pv=2&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=1&uci=a!1&fsb=1&dtd=75

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5290359410522938&output=html&adk=1812271804&adf=3025194257&lmt=1623837276&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&ea=0&flash=0&pra=5&wgl=1&dt=1623837276786&bpp=3&bdt=55&idt=60&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2799827146837&frm=20&pv=2&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=1&uci=a!1&fsb=1&dtd=75
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://adv-ref-was-sed.sad-net-q8.buzz/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://adv-ref-was-sed.sad-net-q8.buzz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 16 Jun 2021 09:54:36 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 16-Jun-2021 10:09:36 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 16 Jun 2021 09:54:36 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f4b8d2def1fa5e09bafacbb8ac66e614d74f1cdbace1417cedef55c0d9a83db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:54:36 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623410781212720"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28237
x-xss-protection: 0
expires: Wed, 16 Jun 2021 09:54:36 GMT

GET
H/1.1 204
No Content gen_204
pagead2.googlesyndication.com/pagead/ 0
459 B 44ms
38ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://pagead2.googlesyndication.com/pagead/gen_204?id=adfil-imp&wp=ca-pub-5290359410522938&c=5&n=0&t=0&w=0&x=1

Requested by

Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/

Protocol

HTTP/1.1

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 16 Jun 2021 09:54:36 GMT
X-Content-Type-Options: nosniff
Server: cafe
Timing-Allow-Origin: *
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: no-cache, must-revalidate
Cross-Origin-Resource-Policy: cross-origin
Content-Type: image/gif
Content-Length: 0
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AE49 65 KB
23 KB 776ms
775ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&h=250&slotname=2240994306&adk=635374232&adf=41369079&pi=t.ma~as.2240994306&w=300&lmt=1623837276&psa=0&format=300x250&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&wgl=1&dt=1623837276789&bpp=2&bdt=57&idt=77&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1250&ady=-2&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CfeE%7C&abl=CF&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=S92l37msKq&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=82

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

91778375c114413372ff2ef2dd652c8de068f49f3682d0c947fab98cb5e5eb86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5290359410522938&output=html&h=250&slotname=2240994306&adk=635374232&adf=41369079&pi=t.ma~as.2240994306&w=300&lmt=1623837276&psa=0&format=300x250&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&wgl=1&dt=1623837276789&bpp=2&bdt=57&idt=77&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1250&ady=-2&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CfeE%7C&abl=CF&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=S92l37msKq&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=82
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://adv-ref-was-sed.sad-net-q8.buzz/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://adv-ref-was-sed.sad-net-q8.buzz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 16 Jun 2021 09:54:37 GMT
server: cafe
content-length: 23874
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 16-Jun-2021 10:09:36 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 16 Jun 2021 09:54:37 GMT
cache-control: private

GET
H3-29 403 main.css
cdn.sabq.org/assets/frontend/Lite/css/ 0
0 21ms
20ms Stylesheet
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.sabq.org/assets/frontend/Lite/css/main.css?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 403 opta.css
cdn.sabq.org/assets/frontend/Lite/css/ 0
0 17ms
17ms Stylesheet
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.sabq.org/assets/frontend/Lite/css/opta.css?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 403 base-header.js
cdn.sabq.org/assets/js/ 0
0 18ms
17ms Script
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.sabq.org/assets/js/base-header.js?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 403 base.js
cdn.sabq.org/assets/js/ 0
0 16ms
16ms Script
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.sabq.org/assets/js/base.js?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 200
OK sabq.js Show response
js.foxpush.com/ 30 KB
8 KB 48ms
33ms Script
application/javascript 2606:4700:20::ac43:4a0f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://js.foxpush.com/sabq.js?v=0.1872993611853544
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: HTTP/1.1
Server: 2606:4700:20::ac43:4a0f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd752994ea1e6d1f4a6be69971491f58b4612c2425bc5cacdaa5980448c1228e

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 16 Jun 2021 09:54:37 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
NEL: {"report_to":"cf-nel","max_age":604800}
Transfer-Encoding: chunked
Connection: keep-alive
cf-request-id: 0ab5d7933200001f39e7bbc000000001
Last-Modified: Sun, 04 Aug 2019 13:16:08 GMT
Server: cloudflare
ETag: W/"780b-16c5cc5e1c0"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=AJ4xs0Fdb%2FonAasy7i3EgKurABgx2gDXLvsE1mU01KAdEHyVl0BPbvQ1AEOhLFvg81uHJM2X7swmjuCetYpa7RtzTspJXNKeR%2Bow2eu7yd2l1MljdFnw%2BGFPFiRsL9m4FzdNJ%2FiShg%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=86400
CF-RAY: 660328651d911f39-FRA
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK atrk.js Show response
d31qbv1cthcecs.cloudfront.net/ 4 KB
2 KB 94ms
28ms Script
application/javascript 13.224.195.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d31qbv1cthcecs.cloudfront.net/atrk.js
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.195.69 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-195-69.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5e84ce936bc3e3844a5d9efb3ac7d28107fa17234fa2a6c2bf3491fc284f0d4f

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 27 Apr 2021 18:07:27 GMT
Content-Encoding: gzip
Connection: keep-alive
Last-Modified: Tue, 27 Apr 2021 18:03:54 GMT
Server: AmazonS3
Age: 4290431
ETag: W/"d89453438fbf10dcf4c13265c40d5160"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 0b9e85cfe8fe19b385db56d32b4ce802.cloudfront.net (CloudFront)
Cache-Control: max-age=26920000
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA2-C1
X-Amz-Cf-Id: 79txGXQenoyFp1yhviQrQczgN_G-MaqbLNxXzmSsrIyB638kru1Ahw==

GET
H3-29 403 chat-style.css
cdn.sabq.org/design/sabq-new/css/ 0
0 14ms
14ms Stylesheet
text/html 2606:4700::6812:1a20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.sabq.org/design/sabq-new/css/chat-style.css?version=1.283
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1a20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ 34 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3-29 200 icons.29.svg.js Show response
static.addtoany.com/menu/svg/ 78 KB
33 KB 41ms
30ms Script
application/javascript 2606:4700:10::6816:46c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons.29.svg.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e30f848c353b8ab801c18d2109527cb32a27f145262dccb3cd4db9f309cc53bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:54:37 GMT
via: e1s
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7390724
p3p: CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0ab5d7934700004e5cc623d000000001
last-modified: Mon, 31 Dec 2018 23:29:11 GMT
server: cloudflare
etag: W/"13937-57e59c7b88bd6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cache-control: max-age=315360000, immutable
cf-ray: 660328653cc04e5c-FRA
cf-bgj: minify

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 23ms
22ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=adv-ref-was-sed.sad-net-q8.buzz

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 16 Jun 2021 09:54:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 25ms
23ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=adv-ref-was-sed.sad-net-q8.buzz

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 16 Jun 2021 09:54:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B0B3 436 B
237 B 1048ms
1048ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&h=280&slotname=7165497559&adk=2610098543&adf=3321146140&pi=t.ma~as.7165497559&w=1200&fwrn=4&fwrnh=100&lmt=1623837277&rafmt=1&psa=0&format=1200x280&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1623837276988&bpp=20&bdt=257&idt=20&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db58f2c807188b9a9-2274e0f5fec80084%3AT%3D1623837276%3ART%3D1623837276%3AS%3DALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA&prev_fmts=0x0%2C300x250&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=8&ady=1652&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=T1wnAheYyK&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=25

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d53ad1f85f1cae7f16795784a6cf1699452186a49ea656180bf323085cd51a53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5290359410522938&output=html&h=280&slotname=7165497559&adk=2610098543&adf=3321146140&pi=t.ma~as.7165497559&w=1200&fwrn=4&fwrnh=100&lmt=1623837277&rafmt=1&psa=0&format=1200x280&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1623837276988&bpp=20&bdt=257&idt=20&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db58f2c807188b9a9-2274e0f5fec80084%3AT%3D1623837276%3ART%3D1623837276%3AS%3DALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA&prev_fmts=0x0%2C300x250&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=8&ady=1652&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=T1wnAheYyK&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=25
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://adv-ref-was-sed.sad-net-q8.buzz/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://adv-ref-was-sed.sad-net-q8.buzz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 16 Jun 2021 09:54:38 GMT
server: cafe
content-length: 213
x-xss-protection: 0
set-cookie: IDE=AHWqTUnKXfXEaqt_Y8BNiFZIDmH6JdYGTkPLRULoqN3IIU4JynIB9YFrKWNrg3Es_DU; expires=Mon, 11-Jul-2022 09:54:37 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 16 Jun 2021 09:54:38 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A609 87 KB
23 KB 297ms
295ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&h=280&slotname=4153775738&adk=1928710064&adf=3693776556&pi=t.ma~as.4153775738&w=1200&fwrn=4&fwrnh=100&lmt=1623837277&rafmt=1&psa=0&format=1200x280&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1623837277029&bpp=2&bdt=298&idt=2&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db58f2c807188b9a9-2274e0f5fec80084%3AT%3D1623837276%3ART%3D1623837276%3AS%3DALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA&prev_fmts=0x0%2C300x250%2C1200x280&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=8&ady=2162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=vdFCFO2Me5&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=5

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6e84cbedbdef08b142d0249d5cb3855c26c669082b7a8fbfa8d41720619c27d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5290359410522938&output=html&h=280&slotname=4153775738&adk=1928710064&adf=3693776556&pi=t.ma~as.4153775738&w=1200&fwrn=4&fwrnh=100&lmt=1623837277&rafmt=1&psa=0&format=1200x280&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1623837277029&bpp=2&bdt=298&idt=2&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db58f2c807188b9a9-2274e0f5fec80084%3AT%3D1623837276%3ART%3D1623837276%3AS%3DALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA&prev_fmts=0x0%2C300x250%2C1200x280&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=8&ady=2162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=vdFCFO2Me5&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=5
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://adv-ref-was-sed.sad-net-q8.buzz/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://adv-ref-was-sed.sad-net-q8.buzz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 16 Jun 2021 09:54:37 GMT
server: cafe
content-length: 23447
x-xss-protection: 0
set-cookie: IDE=AHWqTUmIKs31FW3WkeheOXP-yebkRRqcTIDDx21-Jqw7maKm0lZqMPgy1wt39mmILFc; expires=Mon, 11-Jul-2022 09:54:37 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 16 Jun 2021 09:54:37 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame D29E 94 KB
27 KB 334ms
333ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&h=280&slotname=3018039299&adk=2684985498&adf=1811898368&pi=t.ma~as.3018039299&w=1200&fwrn=4&fwrnh=100&lmt=1623837277&rafmt=1&psa=0&format=1200x280&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1623837277038&bpp=2&bdt=307&idt=2&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db58f2c807188b9a9-2274e0f5fec80084%3AT%3D1623837276%3ART%3D1623837276%3AS%3DALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA&prev_fmts=0x0%2C300x250%2C1200x280%2C1200x280&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=8&ady=2664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tc4WcmWQhA&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=4

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b1bb78b3cbd633ad5bb352028bd734aab2d18331e6b820b32b1732feb54a39e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-5290359410522938&output=html&h=280&slotname=3018039299&adk=2684985498&adf=1811898368&pi=t.ma~as.3018039299&w=1200&fwrn=4&fwrnh=100&lmt=1623837277&rafmt=1&psa=0&format=1200x280&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1623837277038&bpp=2&bdt=307&idt=2&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db58f2c807188b9a9-2274e0f5fec80084%3AT%3D1623837276%3ART%3D1623837276%3AS%3DALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA&prev_fmts=0x0%2C300x250%2C1200x280%2C1200x280&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=8&ady=2664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tc4WcmWQhA&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=4
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://adv-ref-was-sed.sad-net-q8.buzz/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://adv-ref-was-sed.sad-net-q8.buzz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 16 Jun 2021 09:54:37 GMT
server: cafe
content-length: 27854
x-xss-protection: 0
set-cookie: IDE=AHWqTUlc-zeVNUOG8dmSxg-jqssECrPjWNLqHGmvSVDCMvYccIIKnIyxwOdECnoB5DA; expires=Mon, 11-Jul-2022 09:54:37 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 16 Jun 2021 09:54:37 GMT
cache-control: private

GET
H/1.1 200
OK atrk.gif
certify.alexametrics.com/ 43 B
551 B 92ms
29ms Image
image/gif 13.224.195.114
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://certify.alexametrics.com/atrk.gif?frame_height=1200&frame_width=1600&iframe=0&title=%D9%85%D9%81%D8%AA%D9%8A%20%D8%A7%D9%84%D9%85%D9%85%D9%84%D9%83%D8%A9%20%D9%8A%D8%AD%D8%B3%D9%85%20%D8%AC%D8%AF%D9%84%20%D8%A3%D8%B5%D9%88%D8%A7%D8%AA%20%D9%85%D9%83%D8%A8%D8%B1%D8%A7%D8%AA%20%D8%A7%D9%84%D8%B5%D9%88%D8%AA%20%D8%A8%D8%A7%D9%84%D9%85%D8%B3%D8%A7%D8%AC%D8%AF%20%D9%88%D9%8A%D9%8F%D9%82%D8%B1%D8%B1%20%D8%B9%D9%88%D8%AF%D8%AA%D9%87%D8%A7&time=1623837277066&time_zone_offset=-120&screen_params=1600x1200x24&java_enabled=0&cookie_enabled=1&ref_url=https%3A%2F%2Fwww.google.com.sa%2F&host_url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&random_number=18586197068&sess_cookie=0557ec8e17a143e7b8a8bc675e0&sess_cookie_flag=1&user_cookie=0557ec8e17a143e7b8a8bc675e0&user_cookie_flag=1&dynamic=true&domain=sabq.org&account=YSOWe1aMw6002K&jsv=20130128&user_lang=en-US
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.195.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-195-114.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 16 Jun 2021 05:39:41 GMT
Via: 1.1 cb33a7a4640adbb55df3e0d143601559.cloudfront.net (CloudFront)
Last-Modified: Mon, 17 Jan 2011 20:41:40 GMT
Server: AmazonS3
Age: 15296
ETag: "221d8352905f2c38b3cb2bd191d630b0"
X-Cache: Hit from cloudfront
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
X-Amz-Cf-Pop: FRA2-C1
x-amz-meta-alexa-last-modified: 20110117123941
Content-Length: 43
X-Amz-Cf-Id: 3psYjqN-yG49DEteanjS2W7rumRJ4x_z2O3WdVgBZ6vLaP19_QLcGw==

GET
H/1.1

200
OK

test.png
a07e87a585a02691910df08ee17a1614f.profile.zrh50-c1.cloudfront.net/
Redirect Chain

http://redirect.prod.experiment.routing.cloudfront.aws.a2z.com/x.png
http://a07e87a585a02691910df08ee17a1614f.profile.zrh50-c1.cloudfront.net/test.png

58 B
58 B

88ms
61ms

Image
text/plain

13.224.89.170
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://a07e87a585a02691910df08ee17a1614f.profile.zrh50-c1.cloudfront.net/test.png
Requested by: Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Protocol: HTTP/1.1
Server: 13.224.89.170 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-170.zrh50.r.cloudfront.net
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 16 Jun 2021 09:54:37 GMT
Via: 1.1 af287426c130b47dba79bf825f91ebbb.cloudfront.net (CloudFront)
Server: CloudFront
X-Cache: RoutingProfileExp from cloudfront
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: max-age=0
Connection: keep-alive
Content-Length: 58
X-Amz-Cf-Id: IXgd-GhEdaAyVJ4vNHEJCcrg60Im9UCAria4GWsDUCwwXWQ38AI_Zg==
Expires: Wed, 16 Jun 2021 09:54:37 GMT

Redirect headers

Access-Control-Allow-Origin: *
Date: Wed, 16 Jun 2021 09:54:37 GMT
Server: Server
Connection: keep-alive
Content-Length: 0
Location: http://a07e87a585a02691910df08ee17a1614f.profile.zrh50-c1.cloudfront.net/test.png

POST
H/1.1 204
No Content Cookie set result Show response
adv-ref-was-sed.sad-net-q8.buzz/cdn-cgi/bm/cv/ 0
1013 B 14ms
13ms XHR
text/plain 2606:4700:3030::6815:1276
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://adv-ref-was-sed.sad-net-q8.buzz/cdn-cgi/bm/cv/result?req_id=660328630c6d4ab5

Requested by

Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/cdn-cgi/bm/cv/669835187/api.js

Protocol

HTTP/1.1

Server

2606:4700:3030::6815:1276 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Origin: http://adv-ref-was-sed.sad-net-q8.buzz
Accept-Encoding: gzip, deflate
Host: adv-ref-was-sed.sad-net-q8.buzz
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json
Accept: */*
Cache-Control: no-cache
Referer: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
Cookie: HstCfa4555371=1623837276814; HstCla4555371=1623837276814; HstCmu4555371=1623837276814; HstPn4555371=1; HstPt4555371=1; HstCnv4555371=1; HstCns4555371=1; c_ref_4555371=https%3A%2F%2Fwww.google.com.sa%2F; __gads=ID=b58f2c807188b9a9-2274e0f5fec80084:T=1623837276:RT=1623837276:S=ALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA
Connection: keep-alive
Content-Length: 424
Referer: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

Date: Wed, 16 Jun 2021 09:54:37 GMT
X-Content-Type-Options: nosniff
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=aF7EvOW%2BNjXT049VTjNeNAag%2Fe8HFHytbF%2Bk63OIh51bvinEXAu5L%2BpRguXk1KO7fyXpowQzCuREaVKmbNZYvXsBhjxg8v8Kie999tfeCsK4Ta%2Fyk0RzR9NEkah42YczwNXNitEmUC1R2038DGD6f3sIm4T71wHckw%3D%3D"}],"group":"cf-nel","max_age":604800}
Set-Cookie: __cf_bm=80943a9bc6c30af897a5ad6e64281d6ea9f7d302-1623837277-1800-AWpAQtWD/yXJ4IyYTgREZWctmEhy5TWk3V4Jj46Tvo+4avn1DBCCSEEk+fHmqMMeyg6Hgx21hv7VfmSlYs7t9j7+w5uiX4q153eKDytc/iISFGvJJuJmul7fb7vyqeNohR46+SF2jTj0JV1ZyjzKIT4=; path=/; expires=Wed, 16-Jun-21 10:24:37 GMT; domain=.sad-net-q8.buzz; HttpOnly; SameSite=None
Connection: keep-alive
CF-RAY: 660328660b354dbe-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0ab5d793ca00004dbe42b23000000001

GET
H2 200 css
fonts.googleapis.com/ Frame A609 2 KB
631 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&h=280&slotname=4153775738&adk=1928710064&adf=3693776556&pi=t.ma~as.4153775738&w=1200&fwrn=4&fwrnh=100&lmt=1623837277&rafmt=1&psa=0&format=1200x280&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1623837277029&bpp=2&bdt=298&idt=2&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db58f2c807188b9a9-2274e0f5fec80084%3AT%3D1623837276%3ART%3D1623837276%3AS%3DALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA&prev_fmts=0x0%2C300x250%2C1200x280&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=8&ady=2162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=vdFCFO2Me5&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e89a316ebf1c63ea09e2b7b5889fb55e1ffb326c7b2b172027da0948f5709f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 16 Jun 2021 09:32:36 GMT
server: ESF
date: Wed, 16 Jun 2021 09:54:37 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 16 Jun 2021 09:54:37 GMT

GET
H2 200 bgl_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210610/r20110914/elements/html/ Frame A609 5 KB
2 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210610/r20110914/elements/html/bgl_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc1bac0198708f3ae4ecb371ae09aa49dc440444045bc6a97fa9623d109d848

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Jun 2021 13:56:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71905
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2253
x-xss-protection: 0
server: cafe
etag: 4664251554667481328
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 29 Jun 2021 13:56:12 GMT

GET
H2 200 spam_signals_bundle_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210610/r20110914/elements/html/spam_signals/ Frame A609 6 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210610/r20110914/elements/html/spam_signals/spam_signals_bundle_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f0787c3c7e5c140cbc850a79735184859f7a26a455c788ebcdf0cae2f197958f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:19:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2094
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3018
x-xss-protection: 0
server: cafe
etag: 13523348275520225788
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Jun 2021 09:19:43 GMT

GET
H2 200 bg_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210610/r20110914/elements/html/ Frame A609 6 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210610/r20110914/elements/html/bg_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c3328d94071c26637fa9de964b25c26388df0391ea89295527c6451e881ab526

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Jun 2021 12:58:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75376
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2724
x-xss-protection: 0
server: cafe
etag: 9308872209241704880
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 29 Jun 2021 12:58:21 GMT

GET
H3-29 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/ Frame A609 1 KB
909 B 15ms
13ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:50:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 219
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Jun 2021 09:50:58 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210610/r20110914/ Frame A609 17 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210610/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

85822f2cdfbdc5f578b262c1956ed9c1f069faae23050da46a23e5ee0632c632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:46:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 498
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7078
x-xss-protection: 0
server: cafe
etag: 256548204583862073
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Jun 2021 09:46:19 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/ Frame A609 3 KB
1 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:53:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 78
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Jun 2021 09:53:19 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A609 122 KB
37 KB 31ms
14ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

34b6e9936a2f024eef4f545bf4a1e717141704b00a75167fc7080fc6789e3881

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:54:37 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623410775224219"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38028
x-xss-protection: 0
expires: Wed, 16 Jun 2021 09:54:37 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/ Frame A609 13 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6e0099e4558eac7516502eaf705eda715aaed18678bca9bdea641cd6b03ab2a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:49:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 324
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5713
x-xss-protection: 0
server: cafe
etag: 13708678322133093319
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Jun 2021 09:49:13 GMT

GET
H2 200 ef1eb58ff665bb7a112fcf12029c3c9f.js Show response
www.gstatic.com/mysidia/ Frame A609 25 KB
10 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ef1eb58ff665bb7a112fcf12029c3c9f.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6abc2434abfe8bbfe104529364729f23d4de16bcf260ff1513d6f6a1937d3fa1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:34:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1193
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10553
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 05:15:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 14 Sep 2021 09:34:44 GMT

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame A609 13 KB
13 KB 36ms
14ms Image
image/jpeg 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcQNf04tlUxazqC_RmHNZxx_s_xmXNmUeRzxerYtF9kjbxod8sSK&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bd943d26eea5dc249f38f446211025c0484659af18c195f4557a321cccd888b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 02:56:39 GMT
x-content-type-options: nosniff
last-modified: Thu, 18 Feb 2021 01:42:16 GMT
server: sffe
age: 370678
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
content-type: image/jpeg
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13266
x-xss-protection: 0
expires: Sun, 12 Jun 2022 02:56:39 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame A609 13 KB
14 KB 7ms
6ms Image
image/jpeg 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcRC8wq3P8q6YgW0mKg71_icL8KNe4wkbGmoCqT8mxwo7E_xZQA&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e86b65b00e3d563139f7c6d89fa9ffcea8449b0c9fb9e5ef3e198407bc1ccbac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 08:28:35 GMT
x-content-type-options: nosniff
last-modified: Thu, 05 Nov 2020 23:14:58 GMT
server: sffe
age: 350762
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
content-type: image/jpeg
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13776
x-xss-protection: 0
expires: Sun, 12 Jun 2022 08:28:35 GMT

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame A609 17 KB
17 KB 28ms
6ms Image
image/jpeg 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcTSIyYPRcKcdjQyBiWxn2SPGb1ytoJeCGps-PXn3Ed4nS7U868&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e5e013c8289698cbe69050a6bdb7de3ed90ae6d965b763dde8b8de9cd09df0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 08:03:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 29 Oct 2020 06:57:13 GMT
server: sffe
age: 352245
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
content-type: image/jpeg
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17311
x-xss-protection: 0
expires: Sun, 12 Jun 2022 08:03:52 GMT

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame A609 23 KB
23 KB 33ms
11ms Image
image/jpeg 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcRE4jGpIbUBSrBr72msYvLqYimoeiytIj5PDcXf80b8-gxBybqF2xV1WtW6PQ&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0f905875d084d23746c5d70106f64990d22fd7bcaf9e967c3ec57b95e18b954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 10:56:58 GMT
x-content-type-options: nosniff
last-modified: Tue, 02 Mar 2021 03:27:39 GMT
server: sffe
age: 341859
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
content-type: image/jpeg
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23335
x-xss-protection: 0
expires: Sun, 12 Jun 2022 10:56:58 GMT

GET
H2 200 shopping
encrypted-tbn1.gstatic.com/ Frame A609 19 KB
20 KB 27ms
6ms Image
image/jpeg 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcRJFzw1CgZR31OCYEEINNI3VsihkUuqp654p3MhAwiYWRFS3K4&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8848d8acb8ece51de431c3cda3682673501833b41488d6cd4a209eb278d5e536

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 15:15:04 GMT
x-content-type-options: nosniff
last-modified: Wed, 10 Mar 2021 18:35:11 GMT
server: sffe
age: 326373
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
content-type: image/jpeg
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19753
x-xss-protection: 0
expires: Sun, 12 Jun 2022 15:15:04 GMT

GET
H3-29

200

12292211746583241485
tpc.googlesyndication.com/simgad/ Frame A609
Redirect Chain

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgKDr64iePBCwCRiwCTIINoIjV4alR1E
https://tpc.googlesyndication.com/simgad/12292211746583241485

30 KB
30 KB

7ms
7ms

Image
image/png

2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12292211746583241485

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

801ffc320183425aad8f1d94a5b76c6cadb00703f12ccd83dd997cd941c520cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 04:45:44 GMT
x-content-type-options: nosniff
age: 364133
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30912
x-xss-protection: 0
last-modified: Mon, 16 Sep 2019 23:08:24 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Jun 2022 04:45:44 GMT

Redirect headers

timing-allow-origin: *
date: Wed, 16 Jun 2021 02:44:25 GMT
x-content-type-options: nosniff
server: cafe
age: 25812
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://tpc.googlesyndication.com/simgad/12292211746583241485
cache-control: public, max-age=2592000
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 16 Jul 2021 02:44:25 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame A609 0
0 18ms
17ms Fetch
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CJ6RIXcrJYL2NA-KSmLAPgpOaQPauiJhjuZSpudQN_KDHquAOEAEgxd2pL2CVAqABuf--7APIAQmpAoozSbr3VrQ-qAMByAPLBKoE9gFP0ANTAZhf6eEQB4KNSsaCtql8ATq9xmk7o-g4kRK50kFuvBHbMWCAad7qJSmdRP3BHYOca9kLObe2z5Xht3bjTmzJUV9Ye9Az9IWKKdqohYUsZPOxbx9YDfGgBrC9NsDZ-o5PSrrhyj1TTzJVT09OpZ1V1ku46fOTV1Cd992gHhfft5hklN73W82ovoMjQ4wRiPixOU6kcVvHG_XO2-kQaX_YQnmcJckMgGoXZK1Ajp-dU-5Mgz6LVFO_ct2zxCsgoCKUdcfk5DS5DlBrXeMWC-H6ytZheoD17Bn4eAJHE0G6WJY32GcQDgNCYveHE84qTuFHuDjABNzLntH-ApIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAf6socWqAeKnLECqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAPIHBBDhqwXSCAkIgOGAEBABGB-ACgHICwHYEwuIFAHQFQGAFwGyFxoKGAgAEhRwdWItNTI5MDM1OTQxMDUyMjkzOA&sigh=Vmlt1e18bQM&template_id=494

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&h=280&slotname=4153775738&adk=1928710064&adf=3693776556&pi=t.ma~as.4153775738&w=1200&fwrn=4&fwrnh=100&lmt=1623837277&rafmt=1&psa=0&format=1200x280&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1623837277029&bpp=2&bdt=298&idt=2&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db58f2c807188b9a9-2274e0f5fec80084%3AT%3D1623837276%3ART%3D1623837276%3AS%3DALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA&prev_fmts=0x0%2C300x250%2C1200x280&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=8&ady=2162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=vdFCFO2Me5&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 16 Jun 2021 09:54:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8F41 1 KB
749 B 7ms
6ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 16 Jun 2021 09:02:58 GMT
expires: Thu, 17 Jun 2021 09:02:58 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 3099
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 dpixel
cms.quantserve.com/ Frame 8F41 35 B
465 B 30ms
10ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEP1sbwp8zmNThO6EBaFkZW4&google_cver=1&google_push=AYg5qPKvlxFvVIKBQAHMAbgUat68MSstdsONFSAlYMRvW3S1QD2cVIIHo5zItMKNadm6RDeILKX2ftzIUILZT0cn9rka9i1l2iBqqg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Jun 2021 09:54:37 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 8F41
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPIWNfmEF94wi3kwT7-ueyN5-nhbmu4X9Q-yfrV...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU1uS1hRQUFBYUNUNVh3cA&google_push=AYg5qPIWNfmEF94wi3kwT7-ueyN5-nhbmu4X9Q-yfrVdRmRxYBiNpExNVaxgSL0LVWqYkEw4GfV6toUYCtQyB9F3oNBvt4yE3r...

170 B
188 B

46ms
45ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU1uS1hRQUFBYUNUNVh3cA&google_push=AYg5qPIWNfmEF94wi3kwT7-ueyN5-nhbmu4X9Q-yfrVdRmRxYBiNpExNVaxgSL0LVWqYkEw4GfV6toUYCtQyB9F3oNBvt4yE3rZDVQ

Requested by

Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Jun 2021 09:54:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU1uS1hRQUFBYUNUNVh3cA&google_push=AYg5qPIWNfmEF94wi3kwT7-ueyN5-nhbmu4X9Q-yfrVdRmRxYBiNpExNVaxgSL0LVWqYkEw4GfV6toUYCtQyB9F3oNBvt4yE3rZDVQ
Date: Wed, 16 Jun 2021 09:54:37 GMT
Server: Apache
Connection: keep-alive
Content-Length: 393
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 8F41 43 B
324 B 98ms
32ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEJGllw75u0vBkDV8rxmCtm4&google_push=AYg5qPKHlhnkoyQZ3sh29IRZniGyQPYn8SX9llvdkeCRhoHj0IvG5a81CJEsToQHgmmYB6r-nJ9BlPkCga9xxEfPttL7fjfdr5cQcg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&h=280&slotname=4153775738&adk=1928710064&adf=3693776556&pi=t.ma~as.4153775738&w=1200&fwrn=4&fwrnh=100&lmt=1623837277&rafmt=1&psa=0&format=1200x280&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1623837277029&bpp=2&bdt=298&idt=2&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db58f2c807188b9a9-2274e0f5fec80084%3AT%3D1623837276%3ART%3D1623837276%3AS%3DALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA&prev_fmts=0x0%2C300x250%2C1200x280&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=8&ady=2162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=vdFCFO2Me5&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Jun 2021 09:54:37 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 8F41
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESENqrtvGIKew4XD-iFI0Y8lo&google_cver=1&google_push=AYg5qPJevPvipK4LG6HTk1Yl7-P-rxuQxxi2ts7V-lAAtEjsYmol3sl6MjgAVL5oXZyU4EiDuuyGrCUTaTGOw_gcc2TixpZ7WopWVA
https://rtb.openx.net/sync/dds?google_gid=CAESENqrtvGIKew4XD-iFI0Y8lo&google_cver=1&google_push=AYg5qPJevPvipK4LG6HTk1Yl7-P-rxuQxxi2ts7V-lAAtEjsYmol3sl6MjgAVL5oXZyU4EiDuuyGrCUTaTGOw_gcc2TixpZ7WopWV...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJevPvipK4LG6HTk1Yl7-P-rxuQxxi2ts7V-lAAtEjsYmol3sl6MjgAVL5oXZyU4EiDuuyGrCUTaTGOw_gcc2TixpZ7WopWVA&google_hm=YoGsBljtxP02rk4D8Vublg==

170 B
188 B

48ms
47ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJevPvipK4LG6HTk1Yl7-P-rxuQxxi2ts7V-lAAtEjsYmol3sl6MjgAVL5oXZyU4EiDuuyGrCUTaTGOw_gcc2TixpZ7WopWVA&google_hm=YoGsBljtxP02rk4D8Vublg==

Requested by

Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Jun 2021 09:54:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 16 Jun 2021 09:54:36 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJevPvipK4LG6HTk1Yl7-P-rxuQxxi2ts7V-lAAtEjsYmol3sl6MjgAVL5oXZyU4EiDuuyGrCUTaTGOw_gcc2TixpZ7WopWVA&google_hm=YoGsBljtxP02rk4D8Vublg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: t0ke8ev8bj79u8q6gg2d78p2q4b7hsvb

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 8F41
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=owlDQea9QJmn0ieNOwlPVA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

47ms
45ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=owlDQea9QJmn0ieNOwlPVA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJ_CKjKdsrCbZhcoTIHTeBGHFYjTpm9dk4ll2kHLlobbfu3d6CgJg6fb_Gn-NtUvtVmKIolaw9LlT97D1DNqDab8qJM6GVVaA

Requested by

Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Jun 2021 09:54:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=owlDQea9QJmn0ieNOwlPVA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJ_CKjKdsrCbZhcoTIHTeBGHFYjTpm9dk4ll2kHLlobbfu3d6CgJg6fb_Gn-NtUvtVmKIolaw9LlT97D1DNqDab8qJM6GVVaA
date: Wed, 16 Jun 2021 09:54:35 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 8F41
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDZrG5g-Br9zfsEGqV0N6rI&google_cver=1&google_push=AYg5qPJhJpVdiaQHEmB4FjXI3aQdPrxB9iG7YEcP2w4cT__RiaoAZrhc5eHdKjfnh6283pgIU3L...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BaQVNFOUktMVotNE9aQQ==&google_push=AYg5qPJhJpVdiaQHEmB4FjXI3aQdPrxB9iG7YEcP2w4cT__RiaoAZrhc5eHdKjfnh6283pgIU3L2NeMWhjFL91JvVm1xqcxHJvqu4Q

170 B
188 B

46ms
45ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BaQVNFOUktMVotNE9aQQ==&google_push=AYg5qPJhJpVdiaQHEmB4FjXI3aQdPrxB9iG7YEcP2w4cT__RiaoAZrhc5eHdKjfnh6283pgIU3L2NeMWhjFL91JvVm1xqcxHJvqu4Q

Requested by

Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Jun 2021 09:54:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BaQVNFOUktMVotNE9aQQ==&google_push=AYg5qPJhJpVdiaQHEmB4FjXI3aQdPrxB9iG7YEcP2w4cT__RiaoAZrhc5eHdKjfnh6283pgIU3L2NeMWhjFL91JvVm1xqcxHJvqu4Q
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 8F41
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oOb...

0
0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 8F41 0
244 B 104ms
36ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ieh4WETUlJC5pwCSWOblJh9hLjPmbJaO23WPD6kFrRTCEOGLwklObwxExul6JpfcosdMIu

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:54:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame A609 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 93d3856f4d154c2f0caeae5ad236ff5644e28bbbf42cc032dcc583e271a1f213

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
fonts.gstatic.com/s/googlesansdisplay/v15/ Frame A609 20 KB
21 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesansdisplay/v15/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

475700259e64d480d1a70023e14741bb298a025e338bb608552e2472d4505a65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 21:07:37 GMT
x-content-type-options: nosniff
age: 305220
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20900
x-xss-protection: 0
last-modified: Mon, 19 Apr 2021 22:53:16 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Jun 2022 21:07:37 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame D29E 2 KB
531 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&h=280&slotname=3018039299&adk=2684985498&adf=1811898368&pi=t.ma~as.3018039299&w=1200&fwrn=4&fwrnh=100&lmt=1623837277&rafmt=1&psa=0&format=1200x280&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1623837277038&bpp=2&bdt=307&idt=2&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db58f2c807188b9a9-2274e0f5fec80084%3AT%3D1623837276%3ART%3D1623837276%3AS%3DALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA&prev_fmts=0x0%2C300x250%2C1200x280%2C1200x280&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=8&ady=2664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tc4WcmWQhA&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=4

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e89a316ebf1c63ea09e2b7b5889fb55e1ffb326c7b2b172027da0948f5709f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 16 Jun 2021 09:30:19 GMT
server: ESF
date: Wed, 16 Jun 2021 09:54:37 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 16 Jun 2021 09:54:37 GMT

GET
H3-29 200 ca23016c49f98432745ca029d6689e88.js Show response
www.gstatic.com/mysidia/ Frame D29E 10 KB
4 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ca23016c49f98432745ca029d6689e88.js?tag=pingback

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0068def42939bd520806f36da962e4be03114bebcf38c76b054c074ae200e0f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 14 Jun 2021 19:10:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 139461
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4256
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 05:15:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 12 Sep 2021 19:10:16 GMT

GET
H3-29 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/ Frame D29E 1 KB
909 B 7ms
6ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:50:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 219
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Jun 2021 09:50:58 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210610/r20110914/ Frame D29E 17 KB
7 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210610/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

85822f2cdfbdc5f578b262c1956ed9c1f069faae23050da46a23e5ee0632c632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:50:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 228
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7078
x-xss-protection: 0
server: cafe
etag: 256548204583862073
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Jun 2021 09:50:49 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/ Frame D29E 3 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:53:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 78
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Jun 2021 09:53:19 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D29E 122 KB
37 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

34b6e9936a2f024eef4f545bf4a1e717141704b00a75167fc7080fc6789e3881

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:54:37 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623410775224219"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38028
x-xss-protection: 0
expires: Wed, 16 Jun 2021 09:54:37 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/ Frame D29E 13 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6e0099e4558eac7516502eaf705eda715aaed18678bca9bdea641cd6b03ab2a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:54:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 25
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5713
x-xss-protection: 0
server: cafe
etag: 13708678322133093319
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Jun 2021 09:54:12 GMT

GET
H3-29 200 ef1eb58ff665bb7a112fcf12029c3c9f.js Show response
www.gstatic.com/mysidia/ Frame D29E 25 KB
10 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ef1eb58ff665bb7a112fcf12029c3c9f.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6abc2434abfe8bbfe104529364729f23d4de16bcf260ff1513d6f6a1937d3fa1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 14 Jun 2021 19:10:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 139461
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10553
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 05:15:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 12 Sep 2021 19:10:16 GMT

GET
H3-29 200 JiIq58Y5baSygHo2f1FPIoBWCTei6k9nc_G1t4uToEM.js Show response
pagead2.googlesyndication.com/bg/ Frame 1591 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JiIq58Y5baSygHo2f1FPIoBWCTei6k9nc_G1t4uToEM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20210610/r20110914/elements/html/bg_fy2019.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

26222ae7c6396da4b2807a367f514f2280560937a2ea4f6773f1b5b78b93a043

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 05:41:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15161
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5757
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 13:38:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 16 Jun 2022 05:41:56 GMT

GET
H3-29 200 shopping
encrypted-tbn2.gstatic.com/ Frame D29E 27 KB
27 KB 20ms
6ms Image
image/jpeg 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcSAneXMOQ1Ck0stbT25F6bcjtX8njbuajjSdGzDt-QPyWzIbOpb&usqp=CAI

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a4120ac1f3bc9777c42f486d0776cb3704f6bb6cc009bdc29464a04ee474577

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 10:27:06 GMT
x-content-type-options: nosniff
last-modified: Mon, 01 Mar 2021 11:36:04 GMT
server: sffe
age: 343651
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
content-type: image/jpeg
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28125
x-xss-protection: 0
expires: Sun, 12 Jun 2022 10:27:06 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame D29E 20 KB
20 KB 36ms
13ms Image
image/jpeg 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcR4Xm_7-uXxZYmSAziwOoeE18rBLS1bP2dGT5T597C5a6hHMPeYuX58HcehYQk&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1205c7e29c59fc035d0d1c0a24e1c03f2875c9d0cb169ba8d9b6d100b9622ab0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 08:46:21 GMT
x-content-type-options: nosniff
last-modified: Fri, 22 Jan 2021 11:14:42 GMT
server: sffe
age: 349696
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
content-type: image/jpeg
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20731
x-xss-protection: 0
expires: Sun, 12 Jun 2022 08:46:21 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame D29E 102 KB
102 KB 40ms
17ms Image
image/jpeg 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcSHRZosEcJ4qXT7FDHOKSCLuItHc04-K6ZIohNUadhaEH6D91ymH3BQ1yvKPQ&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b9e09a9aa0c4cb7f3a0e569ba4994adb8d033a742b09f17985b8fae4967dabe9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 18:53:21 GMT
x-content-type-options: nosniff
last-modified: Wed, 03 Feb 2021 02:18:19 GMT
server: sffe
age: 313276
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
content-type: image/jpeg
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 104291
x-xss-protection: 0
expires: Sun, 12 Jun 2022 18:53:21 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame D29E 15 KB
15 KB 42ms
20ms Image
image/jpeg 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcTFITVP3jxdHrUG-DSqL_mrk7AStnSJIpF3sAGxMKXAT6kn_0QKKwydw0_JNA&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f123f31e0ae0f612ee21555f8d5f3289b229e5f6ad8fe3d46bf01dcbdfe291b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 09:56:49 GMT
x-content-type-options: nosniff
last-modified: Thu, 01 Apr 2021 01:41:16 GMT
server: sffe
age: 345468
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
content-type: image/jpeg
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15097
x-xss-protection: 0
expires: Sun, 12 Jun 2022 09:56:49 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame D29E 36 KB
36 KB 28ms
6ms Image
image/jpeg 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcRXtT-vrdF6ph7XdGMGBklSmocWFnZh2wy70qo4yyGWhW1r7xONXPJEpl_loQ&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

829a87e1ed95fd3481ca6ab328acc332589dde4cf7d8aeec12b8bee24d336a4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 15:02:12 GMT
x-content-type-options: nosniff
last-modified: Thu, 04 Mar 2021 12:05:35 GMT
server: sffe
age: 327145
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
content-type: image/jpeg
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36612
x-xss-protection: 0
expires: Sun, 12 Jun 2022 15:02:12 GMT

GET
H3-29

200

12939242301588677835
tpc.googlesyndication.com/simgad/ Frame D29E
Redirect Chain

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgKD3kbfNeRCwCRiwCTIIIV2ndAd2FLA
https://tpc.googlesyndication.com/simgad/12939242301588677835

77 KB
77 KB

9ms
8ms

Image
image/jpeg

2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12939242301588677835

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ece459a00b3055bfb383faa4f3b45b663e4909788dbd06b9d0e506614cd856a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 12:13:33 GMT
x-content-type-options: nosniff
age: 337264
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 79199
x-xss-protection: 0
last-modified: Thu, 20 May 2021 13:02:43 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Jun 2022 12:13:33 GMT

Redirect headers

timing-allow-origin: *
date: Tue, 15 Jun 2021 11:26:17 GMT
x-content-type-options: nosniff
server: cafe
age: 80900
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://tpc.googlesyndication.com/simgad/12939242301588677835
cache-control: public, max-age=2592000
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 15 Jul 2021 11:26:17 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame D29E 0
0 19ms
18ms Fetch
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C1N2KXcrJYOvPA8qNmLAPgqey6Ay78577YovAzeesDOrI6eeiGhABIMXdqS9glQKgAf_0_ZkDyAEJqQKKM0m691a0PqgDAcgDywSqBPEBT9AVHu6gqfm9dT9wXvVo2n-GE00nFfthP5efc_s-TViT8mjqyy_q-n2EamWwhXvLou-vWjUnaEQGvmleqLZGNL7WpjlL4DyRK3K0opqDKIk6SXeORHhLHWoGik1Y6hqI7_D8QUSVM1uN0xWsb95aM5D-PFmyp6u19NHxqC7QhmMxg69ZzWuQCosEZD3SxP4foh01Y8CdSJ22NmtHMmf1OnOtBWxG4_jP7pwPThohpr7LvH1K09Ts64IwgAix9Rba5WHzX_D92xYTpVAuNO2p-iFgn_lNqVyMena3I6ZzOrLSSmuVjPVV1FVxLP-Ysv_NAMAE1LrA17MDkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBi6AB_yRlzaoB4qcsQKoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEJfNDNIICQiA4YAQEAEYH4AKAcgLAdgTDIgUDNAVAYAXAbIXGgoYCAASFHB1Yi01MjkwMzU5NDEwNTIyOTM4&sigh=Es3SHIvkEHc&template_id=494

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&h=280&slotname=3018039299&adk=2684985498&adf=1811898368&pi=t.ma~as.3018039299&w=1200&fwrn=4&fwrnh=100&lmt=1623837277&rafmt=1&psa=0&format=1200x280&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1623837277038&bpp=2&bdt=307&idt=2&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db58f2c807188b9a9-2274e0f5fec80084%3AT%3D1623837276%3ART%3D1623837276%3AS%3DALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA&prev_fmts=0x0%2C300x250%2C1200x280%2C1200x280&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=8&ady=2664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tc4WcmWQhA&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 16 Jun 2021 09:54:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0059 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 16 Jun 2021 09:02:58 GMT
expires: Thu, 17 Jun 2021 09:02:58 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 3099
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame D29E 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb5947cc5205c9c650f5a6bd0fdb239a66b1fb306fe163dd3c7c88f5372be605

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dpixel
cms.quantserve.com/ Frame 0059 35 B
210 B 12ms
8ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEBqWf1C4OVe2XsWi6LQYpe4&google_cver=1&google_push=AYg5qPJh-xHVHclr-1Zrsz9mi_p9TfpIsiPJQiR6Hho3JbFvPXUo8Q4EXCYkaSkzO6URJJHpGSt5mlFvb7LwFF0_Txarpv4y0To_

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Jun 2021 09:54:37 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0059
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPI8pgikEjEVnekHM1ZUdKaVS_ErOnWTNe_2Mdh...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU1uS1hRQUFBRkZINmhrcA&google_push=AYg5qPI8pgikEjEVnekHM1ZUdKaVS_ErOnWTNe_2MdhUUBBDC1EW7NSVNdGzhs9ndi3JdLE4tSjoPWVEUZFVEqrZP5tVPsiMb3uK

170 B
188 B

37ms
37ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU1uS1hRQUFBRkZINmhrcA&google_push=AYg5qPI8pgikEjEVnekHM1ZUdKaVS_ErOnWTNe_2MdhUUBBDC1EW7NSVNdGzhs9ndi3JdLE4tSjoPWVEUZFVEqrZP5tVPsiMb3uK

Requested by

Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Jun 2021 09:54:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WU1uS1hRQUFBRkZINmhrcA&google_push=AYg5qPI8pgikEjEVnekHM1ZUdKaVS_ErOnWTNe_2MdhUUBBDC1EW7NSVNdGzhs9ndi3JdLE4tSjoPWVEUZFVEqrZP5tVPsiMb3uK
Date: Wed, 16 Jun 2021 09:54:37 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0059
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEPk_TRiCCmigVefm1Z1lYNM&google_cver=1&google_push=AYg5qPL29jDwgXs_skBEUc3rU6Sl9XWDK2lq9904erziuWsHOQhBvcjl-w3EjtLXG16LanmD-3pMdsM7fWMmNhJjyd9QA4bRWINT
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPL29jDwgXs_skBEUc3rU6Sl9XWDK2lq9904erziuWsHOQhBvcjl-w3EjtLXG16LanmD-3pMdsM7fWMmNhJjyd9QA4bRWINT&google_hm=YoGsBljtxP02rk4D8Vublg==

170 B
188 B

39ms
38ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPL29jDwgXs_skBEUc3rU6Sl9XWDK2lq9904erziuWsHOQhBvcjl-w3EjtLXG16LanmD-3pMdsM7fWMmNhJjyd9QA4bRWINT&google_hm=YoGsBljtxP02rk4D8Vublg==

Requested by

Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Jun 2021 09:54:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 16 Jun 2021 09:54:37 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPL29jDwgXs_skBEUc3rU6Sl9XWDK2lq9904erziuWsHOQhBvcjl-w3EjtLXG16LanmD-3pMdsM7fWMmNhJjyd9QA4bRWINT&google_hm=YoGsBljtxP02rk4D8Vublg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 5a2td23s21h1fstrbeeajb8lmiarpq9j

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0059
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=owlDQea9QJmn0ieNOwlPVA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

40ms
39ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=owlDQea9QJmn0ieNOwlPVA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLbG8UfPyI_M7LGCpbeG-hmnjEFa6DUAVWOfqHd1r-t5MDwUd0KHbpH0DC0eJtIPod9eA1NumhOFe1BPMuwvaWA6bwu7a-i

Requested by

Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Jun 2021 09:54:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=owlDQea9QJmn0ieNOwlPVA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLbG8UfPyI_M7LGCpbeG-hmnjEFa6DUAVWOfqHd1r-t5MDwUd0KHbpH0DC0eJtIPod9eA1NumhOFe1BPMuwvaWA6bwu7a-i
date: Wed, 16 Jun 2021 09:54:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0059
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESECKPMzTxrTRmymu4IfuI4Sk&google_cver=1&google_push=AYg5qPKvhHZg9aOKDSSSz-B8Ph9atO2Mtp8fsqWqA26Y8s6-zJtXO7yWBUqUyy8rCC6WRMSIqx_...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BaQVNFQzQtMjEtOVdLRQ==&google_push=AYg5qPKvhHZg9aOKDSSSz-B8Ph9atO2Mtp8fsqWqA26Y8s6-zJtXO7yWBUqUyy8rCC6WRMSIqx_IBHWfC9XIKGMJfOfI5F0AFh7X

170 B
188 B

39ms
39ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BaQVNFQzQtMjEtOVdLRQ==&google_push=AYg5qPKvhHZg9aOKDSSSz-B8Ph9atO2Mtp8fsqWqA26Y8s6-zJtXO7yWBUqUyy8rCC6WRMSIqx_IBHWfC9XIKGMJfOfI5F0AFh7X

Requested by

Host: adv-ref-was-sed.sad-net-q8.buzz
URL: http://adv-ref-was-sed.sad-net-q8.buzz/msajed/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Jun 2021 09:54:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BaQVNFQzQtMjEtOVdLRQ==&google_push=AYg5qPKvhHZg9aOKDSSSz-B8Ph9atO2Mtp8fsqWqA26Y8s6-zJtXO7yWBUqUyy8rCC6WRMSIqx_IBHWfC9XIKGMJfOfI5F0AFh7X
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 0059
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dc...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 0059 43 B
297 B 62ms
20ms Image
image/gif 2a05:d01c:1d8:8100:2200:547c:51ca:c51e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEF7_NG3FZHqOdhKtVbHwDYc&google_cver=1&google_push=AYg5qPKMxa8qjVzDAsfVCh3J-FYQYgmQ-ctm1MogqGhby1uU8Rvk1YtyS2d0swLRE_LwVXdo8XDmxa3mdVWnMbEva_WQhh3b7IU
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&h=280&slotname=3018039299&adk=2684985498&adf=1811898368&pi=t.ma~as.3018039299&w=1200&fwrn=4&fwrnh=100&lmt=1623837277&rafmt=1&psa=0&format=1200x280&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1623837277038&bpp=2&bdt=307&idt=2&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db58f2c807188b9a9-2274e0f5fec80084%3AT%3D1623837276%3ART%3D1623837276%3AS%3DALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA&prev_fmts=0x0%2C300x250%2C1200x280%2C1200x280&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=8&ady=2664&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tc4WcmWQhA&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8100:2200:547c:51ca:c51e London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Jun 2021 09:54:37 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 1
expires: -1

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 0059 0
12 B 38ms
37ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JQ2X1jlCwmPkD9JMLJ3lXfQ0X4l8F5J1FPwsbef21Zj4seA1HLPKFgvREDKQ5sn3VsgHAd

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:54:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
fonts.gstatic.com/s/googlesansdisplay/v15/ Frame D29E 20 KB
20 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesansdisplay/v15/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

475700259e64d480d1a70023e14741bb298a025e338bb608552e2472d4505a65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 13:27:23 GMT
x-content-type-options: nosniff
age: 332834
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20900
x-xss-protection: 0
last-modified: Mon, 19 Apr 2021 22:53:16 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Jun 2022 13:27:23 GMT

GET
H3-29 200 JiIq58Y5baSygHo2f1FPIoBWCTei6k9nc_G1t4uToEM.js Show response
pagead2.googlesyndication.com/bg/ Frame 01D6 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JiIq58Y5baSygHo2f1FPIoBWCTei6k9nc_G1t4uToEM.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

26222ae7c6396da4b2807a367f514f2280560937a2ea4f6773f1b5b78b93a043

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 05:41:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15161
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5757
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 13:38:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 16 Jun 2022 05:41:56 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame AE49 2 KB
536 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&h=250&slotname=2240994306&adk=635374232&adf=41369079&pi=t.ma~as.2240994306&w=300&lmt=1623837276&psa=0&format=300x250&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&wgl=1&dt=1623837276789&bpp=2&bdt=57&idt=77&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1250&ady=-2&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CfeE%7C&abl=CF&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=S92l37msKq&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=82

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

99155f31d46dc469aa872ce824309fae9210fb9357f463b889d617b85b35eb61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 16 Jun 2021 09:27:26 GMT
server: ESF
date: Wed, 16 Jun 2021 09:54:37 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 16 Jun 2021 09:54:37 GMT

GET
H3-29 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/ Frame AE49 1 KB
909 B 6ms
6ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:50:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 219
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Jun 2021 09:50:58 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210610/r20110914/ Frame AE49 17 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210610/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

85822f2cdfbdc5f578b262c1956ed9c1f069faae23050da46a23e5ee0632c632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:50:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 228
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7078
x-xss-protection: 0
server: cafe
etag: 256548204583862073
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Jun 2021 09:50:49 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/ Frame AE49 3 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:53:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 78
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Jun 2021 09:53:19 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AE49 122 KB
37 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

34b6e9936a2f024eef4f545bf4a1e717141704b00a75167fc7080fc6789e3881

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:54:37 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623410775224219"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38028
x-xss-protection: 0
expires: Wed, 16 Jun 2021 09:54:37 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/ Frame AE49 13 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210610/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6e0099e4558eac7516502eaf705eda715aaed18678bca9bdea641cd6b03ab2a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:54:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 25
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5713
x-xss-protection: 0
server: cafe
etag: 13708678322133093319
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Jun 2021 09:54:12 GMT

GET
H3-29 200 ef1eb58ff665bb7a112fcf12029c3c9f.js Show response
www.gstatic.com/mysidia/ Frame AE49 25 KB
10 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ef1eb58ff665bb7a112fcf12029c3c9f.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6abc2434abfe8bbfe104529364729f23d4de16bcf260ff1513d6f6a1937d3fa1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 14 Jun 2021 19:10:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 139461
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10553
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 05:15:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 12 Sep 2021 19:10:16 GMT

GET
H3-29 200 2076313506083323656
tpc.googlesyndication.com/simgad/4930285787493589818/ Frame AE49 70 KB
70 KB 10ms
8ms Image
image/jpeg 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4930285787493589818/2076313506083323656

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

046d47da1a6e8ed1b9c2bc9c828c5edc81db66ef39f8a4ff29d90722706ea9f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 04:18:23 GMT
x-content-type-options: nosniff
age: 365774
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 71504
x-xss-protection: 0
last-modified: Mon, 07 Jun 2021 14:16:42 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Jun 2022 04:18:23 GMT

GET
DATA 200
OK truncated
/ Frame AE49 221 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6ea14c9bf6d7f1985b48f161c02abb515aac0b39607efcc48ce7dc429491071a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame AE49 0
0 16ms
16ms Fetch
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CUazJXMrJYKWGNt-OmLAP5bqzYI3o5Jdj3cPs4OcN2tkeEAEgxd2pL2CVAqAB5orfxQHIAQmpAoozSbr3VrQ-qAMByAPLBKoE9wFP0DvJ04U58aSwMSgpnoq5e0dPYo1vPkU5IdSjqXpv4X6zN2kFcXvHy3sFWn2JJei_o1lR4swm4fZSXrT6baSOAgWLtDPGZ3aS-GfDvNEFnWz--fGuvIlytI31Xrh_yrO3qBD5Iuiw_PQpS_R7rarFGTtTcWMfLH7jh9QaL2USJ3YFYUDbu7aoIT63knNrKA_FcUj4PZ4HeHXWKNdVFL3fsRoZbcI5mA6EQtX7w37fay9N2S0TPastr0IuK4mYc2f4Pu4KVmxxjkwsR1ou-CKkAqN6EHXb5S2aPlE6og3n3_BFZCtybqIF-vPhiiy7ymOoU8rJOTrDwASlnMilywOSBQQIBBgBkgUECAUYBKAGLoAHgvWgugKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwDyBwQQ-PgG0ggJCIDhgBAQARgfgAoByAsB2BMN0BUBgBcBshcaChgIABIUcHViLTUyOTAzNTk0MTA1MjI5Mzg&sigh=Aofd4W7mGik&template_id=484

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5290359410522938&output=html&h=250&slotname=2240994306&adk=635374232&adf=41369079&pi=t.ma~as.2240994306&w=300&lmt=1623837276&psa=0&format=300x250&url=http%3A%2F%2Fadv-ref-was-sed.sad-net-q8.buzz%2Fmsajed%2F&flash=0&wgl=1&dt=1623837276789&bpp=2&bdt=57&idt=77&shv=r20210610&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2799827146837&frm=20&pv=1&ga_vid=1097549505.1623837277&ga_sid=1623837277&ga_hid=349376927&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1250&ady=-2&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31060972%2C31060973&oid=3&pvsid=2138279939982077&ref=https%3A%2F%2Fwww.google.com.sa%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CfeE%7C&abl=CF&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=S92l37msKq&p=http%3A//adv-ref-was-sed.sad-net-q8.buzz&dtd=82
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 16 Jun 2021 09:54:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame AE49 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4659796e57a547ec506908fa7a1abfd9b2e41792a763d31efa2839d4e047bf06

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame AE49 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 12 Jun 2021 07:18:32 GMT
x-content-type-options: nosniff
age: 354965
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Jun 2022 07:18:32 GMT

GET
H3-29 200 JiIq58Y5baSygHo2f1FPIoBWCTei6k9nc_G1t4uToEM.js Show response
pagead2.googlesyndication.com/bg/ Frame EB2D 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JiIq58Y5baSygHo2f1FPIoBWCTei6k9nc_G1t4uToEM.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

26222ae7c6396da4b2807a367f514f2280560937a2ea4f6773f1b5b78b93a043

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 05:41:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15161
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5757
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 13:38:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 16 Jun 2022 05:41:56 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 10 KB
8 KB 34ms
20ms XHR
application/json 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210610&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

30f7168e762f69677b544f298130fb5668a893c2837fa82eceecfd7fb9345bb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 16 Jun 2021 09:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7901
x-xss-protection: 0

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e684839cbcef6b16753dae73e92a49b7115f55e83662ead12d5e05bf7b9915fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 09:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622653785071769"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Wed, 16 Jun 2021 09:54:38 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/223/ Frame 3989 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de7dd7e8a5f2257d16c23c395b9262c6fa04689c81b0e2b8bf7f5bae9f4177dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/223/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://adv-ref-was-sed.sad-net-q8.buzz/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://adv-ref-was-sed.sad-net-q8.buzz/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Wed, 16 Jun 2021 09:53:23 GMT
expires: Thu, 16 Jun 2022 09:53:23 GMT
last-modified: Wed, 17 Mar 2021 18:24:30 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 75
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame D7A8 783 B
760 B 15ms
15ms Document
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

dbb30cbe3b0ed5286b1e7768fcbb5bb0f7bb3bda2c42d27e0e2401100baa1822

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KNveZvxQpdFPil66JolbXg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://adv-ref-was-sed.sad-net-q8.buzz/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://adv-ref-was-sed.sad-net-q8.buzz/

Response headers

expires: Wed, 16 Jun 2021 09:54:38 GMT
date: Wed, 16 Jun 2021 09:54:38 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-KNveZvxQpdFPil66JolbXg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 511
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 JiIq58Y5baSygHo2f1FPIoBWCTei6k9nc_G1t4uToEM.js Show response
pagead2.googlesyndication.com/bg/ Frame 3989 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JiIq58Y5baSygHo2f1FPIoBWCTei6k9nc_G1t4uToEM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

26222ae7c6396da4b2807a367f514f2280560937a2ea4f6773f1b5b78b93a043

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 16 Jun 2021 05:41:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15162
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5757
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 13:38:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 16 Jun 2022 05:41:56 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=223&t=2&li=gda_r20210610&jk=2138279939982077&bg=!DwylDEjNAAY2kFOVNpA7ACkAdvg8Wm970hj6u4pix9KcwZdjsNSq2QUOnibuLQjEsleUoVSyYaqIyQIAAAA-UgAAAAxoAQeZAoplaV0STcXilIWcZW6yI1HsYAhJfPxlctFaDowTETnt7W1HF-WlcH6YnLefFmdVP3yJDqLLDf3J-Kezt8OkHvYBqqLGfnmJZl_44n330rRhOJRd33j2G4fXRin3TtZXFjqx1RNPSOTaTVZmfc8vcBvnKS9gxhAGcQlqUdNk6_gJ3nf2RGYlkCz-X2caKswkF3CsYQmP7UrpJokj75I3E3DC0JsXc2GL7LJo2hb1yKjVHq9X8WHlJFCdcQcE3LgiDRJyB3AdJPs-CkYw-1xIHi7IMfrqky3YgmjH9v2t5TTmtoKojjl927wfLJ6UxmFGPr4ovUZq7s1b4RdD_tbGAEE-zQqQoAzGxIta1f46XQGyjI4VkI5ASWX5DceWdCFS7Kb93yK4iOU1A-cXGqoh7z9NJEKy1AHbRvKRwlVNmCLoJkGI2xrbzSXTApOew2s3Tujy9MhPtJhDQC4-8m0lmdQ327WoseGZSuLannDWJ8Bqn4maX3bFDdknkEFBva0LphOkNi5X2vz4Tf8Q1zZh0-Ze9EAz42vcSFCefuOdM3jyl8atQYNqavAyBYWWB0u5NE45Wb1JS3zUKYnZYYBMMH6IeFbzE3sC2EFQe3h_589bEABiQvHyGAepxhSQ32K6qlPOC_6KXLVqoVuPYcLQivo-4gL2OqVBxefyAgXzMKaCPj0ggJrG_lR2vQ3aFNN3jgi_jHt3e_121nLd7OaBNNEhMSB1BGSerKVga7JtHinKDNX1lDAP5zwX14euYCvr9kxilXm4d5RzYgHW6xNHRUPmM60OyPIftDRXRJ8gt26LZaiQ0tasbozIm2V_VOloNh0Ec7_L3dyc7pUnvHdlyXvMvuxDmrEJ8LzHig

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://adv-ref-was-sed.sad-net-q8.buzz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Jun 2021 09:54:38 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AE49 42 B
64 B 40ms
40ms Fetch
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssXTyH6z3Jro2wNqp8B9Ilob79ysG_71yEQrHQBXoH9G3MuKiO1-_-vm63GSCCQh68bkbmdpRWi9769mHcMvX1jN4ByRRJ_Q949nDsJBsPJpe0b9iyU5VSz5HO7PA&sai=AMfl-YSnf0jDtwiS9JDX8LHdcRjQA3MgXlnoDSh_m2dc7lN0zpKPcpd0Fq7laYEXf8nLlC3OT8aI818cG0oJ&sig=Cg0ArKJSzKVFCyVljEOsEAE&id=lidar2&mcvt=1001&p=0,0,250,300&mtos=0,1001,1001,1001,1001&tos=0,1001,0,0,0&v=20210611&bin=7&avms=nio&bs=0,0&mc=0.99&if=1&app=0&itpl=22&adk=635374232&rs=2&met=mue&la=0&cr=0&osd=1&vs=4&eosm=0&rst=1623837276873&dlt=778&rpt=27&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Jun 2021 09:54:38 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: sapq-was-sad.sapq-net-q8.buzz
URL: https://sapq-was-sad.sapq-net-q8.buzz/cdn-cgi/bm/cv/result?req_id=66032861c93c4e0d

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPKFnlFfIXP1FnQwA1zalezT-DUS6kplAhweGozXbfa8sQq22a4jnFb_Exjw71sBSa-3TM3IG1kDQn-a8t6oObR1pXa4bV6X6A&google_gid=CAESEPJU2_ck7BDqvdRtGoBxVxo&google_cver=1

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMnKXQrCCoxyJzLCOvF_uAAABFsAAAAB&google_push=AYg5qPLFtB80BbrCisVLZvW7SCR7CW3_-ZpgwqNnBrcvGgJxCfnEZW5qco2MofTLGgR1aOzaorMWz8cL6-nqpfM2dcfSTAGkiz_G&google_gid=CAESEKPiOFDRMBqgu8ZO9IAHJEA&google_cver=1

Verdicts & Comments Add Verdict or Comment

119 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
adv-ref-was-sed.sad-net-q8.buzz/	1970-01-20 03:49:33	Name: HstCns4555371 Value: 1
adv-ref-was-sed.sad-net-q8.buzz/	1970-01-20 03:49:33	Name: HstPt4555371 Value: 1
adv-ref-was-sed.sad-net-q8.buzz/	1970-01-20 03:49:33	Name: HstPn4555371 Value: 1
.sad-net-q8.buzz/	1970-01-20 04:25:33	Name: __gads Value: ID=b58f2c807188b9a9-2274e0f5fec80084:T=1623837276:RT=1623837276:S=ALNI_Mbb5J8Gptjb1JBzrV38wVOQ8DF_ZA
adv-ref-was-sed.sad-net-q8.buzz/	1970-01-20 03:49:33	Name: c_ref_4555371 Value: https%3A%2F%2Fwww.google.com.sa%2F
adv-ref-was-sed.sad-net-q8.buzz/	1970-01-20 03:49:33	Name: HstCnv4555371 Value: 1
adv-ref-was-sed.sad-net-q8.buzz/	1970-01-20 03:49:33	Name: HstCmu4555371 Value: 1623837276814
adv-ref-was-sed.sad-net-q8.buzz/	1970-01-20 03:49:33	Name: HstCla4555371 Value: 1623837276814
.doubleclick.net/	1970-01-20 04:25:33	Name: IDE Value: AHWqTUnKXfXEaqt_Y8BNiFZIDmH6JdYGTkPLRULoqN3IIU4JynIB9YFrKWNrg3Es_DU
adv-ref-was-sed.sad-net-q8.buzz/	1970-01-20 03:49:33	Name: HstCfa4555371 Value: 1623837276814

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	(Line 1) Message: FoxPush : Sorry please disable (allow native) option on your dashboard. If option disabled and you still got this message please contact foxpush support

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a07e87a585a02691910df08ee17a1614f.profile.zrh50-c1.cloudfront.net
adservice.google.com
adservice.google.de
adv-ref-was-sed.sad-net-q8.buzz
ag.innovid.com
cdn.sabq.org
certify.alexametrics.com
cm.g.doubleclick.net
cms.quantserve.com
d31qbv1cthcecs.cloudfront.net
encrypted-tbn0.gstatic.com
encrypted-tbn1.gstatic.com
encrypted-tbn2.gstatic.com
encrypted-tbn3.gstatic.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
image6.pubmatic.com
js.foxpush.com
odr.mookie1.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.everesttech.net
pixel.rubiconproject.com
redirect.prod.experiment.routing.cloudfront.aws.a2z.com
rtb.openx.net
s10.histats.com
s4.histats.com
sapq-was-sad.sapq-net-q8.buzz
static.addtoany.com
tpc.googlesyndication.com
www.google.com
www.google.com.sa
www.googletagservices.com
www.gstatic.com
cm.g.doubleclick.net
sapq-was-sad.sapq-net-q8.buzz
13.224.195.114
13.224.195.69
13.224.89.170
142.250.185.130
142.250.186.34
158.69.248.123
185.64.189.115
2606:4700:10::6816:46c5
2606:4700:20::ac43:4a0f
2606:4700:3030::6815:1276
2606:4700:3030::6815:2ca5
2606:4700::6812:1a20
2620:116:800d:21:f916:5049:f87f:108e
2a00:1450:4001:800::200e
2a00:1450:4001:802::2002
2a00:1450:4001:808::2004
2a00:1450:4001:808::200e
2a00:1450:4001:809::2002
2a00:1450:4001:80e::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::200e
2a00:1450:4001:811::200e
2a00:1450:4001:812::2003
2a00:1450:4001:828::2001
2a00:1450:4001:828::2002
2a00:1450:4001:829::2003
2a00:1450:4001:829::200a
2a00:1450:4001:82a::2001
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::2003
2a00:1450:4001:82b::2002
2a00:1450:4001:830::2002
2a05:d01c:1d8:8100:2200:547c:51ca:c51e
34.246.227.69
34.98.67.61
35.227.252.103
46.105.201.240
54.203.78.123
69.173.144.139
0068def42939bd520806f36da962e4be03114bebcf38c76b054c074ae200e0f4
046d47da1a6e8ed1b9c2bc9c828c5edc81db66ef39f8a4ff29d90722706ea9f6
0a4120ac1f3bc9777c42f486d0776cb3704f6bb6cc009bdc29464a04ee474577
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bd943d26eea5dc249f38f446211025c0484659af18c195f4557a321cccd888b
0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11
0ece459a00b3055bfb383faa4f3b45b663e4909788dbd06b9d0e506614cd856a
1205c7e29c59fc035d0d1c0a24e1c03f2875c9d0cb169ba8d9b6d100b9622ab0
1e5e013c8289698cbe69050a6bdb7de3ed90ae6d965b763dde8b8de9cd09df0c
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
1fc1bac0198708f3ae4ecb371ae09aa49dc440444045bc6a97fa9623d109d848
20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4
26222ae7c6396da4b2807a367f514f2280560937a2ea4f6773f1b5b78b93a043
2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede
30f7168e762f69677b544f298130fb5668a893c2837fa82eceecfd7fb9345bb4
34b6e9936a2f024eef4f545bf4a1e717141704b00a75167fc7080fc6789e3881
456293a11b90033d05493697676f323da46e6426c88a287b0aa4a6a817a01458
4659796e57a547ec506908fa7a1abfd9b2e41792a763d31efa2839d4e047bf06
466db04ec98d70a17c6e5ec4d3be56efe9a4260045ae6e212fbe56bf912b4de4
475700259e64d480d1a70023e14741bb298a025e338bb608552e2472d4505a65
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
4b1bb78b3cbd633ad5bb352028bd734aab2d18331e6b820b32b1732feb54a39e
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5e84ce936bc3e3844a5d9efb3ac7d28107fa17234fa2a6c2bf3491fc284f0d4f
6abc2434abfe8bbfe104529364729f23d4de16bcf260ff1513d6f6a1937d3fa1
6e0099e4558eac7516502eaf705eda715aaed18678bca9bdea641cd6b03ab2a8
6e84cbedbdef08b142d0249d5cb3855c26c669082b7a8fbfa8d41720619c27d5
6ea14c9bf6d7f1985b48f161c02abb515aac0b39607efcc48ce7dc429491071a
7785eca5e02d44e93672c7da26af9926f754aaab9bad7a5e68411dc9d25e4157
801ffc320183425aad8f1d94a5b76c6cadb00703f12ccd83dd997cd941c520cd
829a87e1ed95fd3481ca6ab328acc332589dde4cf7d8aeec12b8bee24d336a4c
85822f2cdfbdc5f578b262c1956ed9c1f069faae23050da46a23e5ee0632c632
86d6eda306cb7a8ec61843d32a597bef4a680844987e12bbfabce3a8c66b3786
8848d8acb8ece51de431c3cda3682673501833b41488d6cd4a209eb278d5e536
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8f4b8d2def1fa5e09bafacbb8ac66e614d74f1cdbace1417cedef55c0d9a83db
91778375c114413372ff2ef2dd652c8de068f49f3682d0c947fab98cb5e5eb86
93d3856f4d154c2f0caeae5ad236ff5644e28bbbf42cc032dcc583e271a1f213
99155f31d46dc469aa872ce824309fae9210fb9357f463b889d617b85b35eb61
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
b9e09a9aa0c4cb7f3a0e569ba4994adb8d033a742b09f17985b8fae4967dabe9
bb5947cc5205c9c650f5a6bd0fdb239a66b1fb306fe163dd3c7c88f5372be605
bd2b6b0e8049f42f006bfc06c575cb2124f61e8c4cbf37ef180bcf66c934e241
c3328d94071c26637fa9de964b25c26388df0391ea89295527c6451e881ab526
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cd752994ea1e6d1f4a6be69971491f58b4612c2425bc5cacdaa5980448c1228e
d0f905875d084d23746c5d70106f64990d22fd7bcaf9e967c3ec57b95e18b954
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
d53ad1f85f1cae7f16795784a6cf1699452186a49ea656180bf323085cd51a53
dbb30cbe3b0ed5286b1e7768fcbb5bb0f7bb3bda2c42d27e0e2401100baa1822
dcad2aa52d747ced13258f1ba1ef838b55b359418d8e0b4658871e5c0b90a8c7
de7dd7e8a5f2257d16c23c395b9262c6fa04689c81b0e2b8bf7f5bae9f4177dc
e30f848c353b8ab801c18d2109527cb32a27f145262dccb3cd4db9f309cc53bb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e684839cbcef6b16753dae73e92a49b7115f55e83662ead12d5e05bf7b9915fb
e86b65b00e3d563139f7c6d89fa9ffcea8449b0c9fb9e5ef3e198407bc1ccbac
e89a316ebf1c63ea09e2b7b5889fb55e1ffb326c7b2b172027da0948f5709f6a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0787c3c7e5c140cbc850a79735184859f7a26a455c788ebcdf0cae2f197958f
f123f31e0ae0f612ee21555f8d5f3289b229e5f6ad8fe3d46bf01dcbdfe291b9
f909a31bfd7a13b9dd53e98b5652f13f4782fdfd1653dc4befade7386c087371

adv-ref-was-sed.sad-net-q8.buzz Open in urlscan Pro 2606:4700:3030::6815:1276 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

122 Requests

91 %HTTPS

67 %IPv6

25 Domains

35 Subdomains

35 IPs

6 Countries

1120 kBTransfer

2210 kBSize

10 Cookies

35 Outgoing links

Page URL History

Redirected requests

122 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

adv-ref-was-sed.sad-net-q8.buzz Open in urlscan Pro
2606:4700:3030::6815:1276 Public Scan

Screenshot
Live screenshot

Full Image

122
Requests

91 %
HTTPS

67 %
IPv6

25
Domains

35
Subdomains

35
IPs

6
Countries

1120 kB
Transfer

2210 kB
Size

10
Cookies

122 HTTP transactions
5 data transactions