www.itinforok.com Open in urlscan Pro
104.18.24.100 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.itinforok.com/game/flames_&_fortune.html
Effective URL:
https://www.itinforok.com/game/flames_&_fortune.html
Submission: On August 20 via api (August 20th 2024, 7:37:49 am UTC) from US — Scanned from US

Summary HTTP 48 Redirects Behaviour Indicators

Summary

This website contacted 13 IPs in 2 countries across 7 domains to perform 48 HTTP transactions. The main IP is 104.18.24.100, located in and belongs to CLOUDFLARENET, US. The main domain is www.itinforok.com.
TLS certificate: Issued by WE1 on July 6th 2024. Valid for: 3 months.

This is the only time www.itinforok.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
14	104.18.24.100 104.18.24.100	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a04:4e42:600... 2a04:4e42:600::485	54113 (FASTLY) (FASTLY)
4	142.251.40.98 142.251.40.98	15169 (GOOGLE) (GOOGLE)
11	172.66.42.247 172.66.42.247	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2607:f8b0:400... 2607:f8b0:4006:824::200e	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:81c::2001	15169 (GOOGLE) (GOOGLE)
1	142.250.176.194 142.250.176.194	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:81d::2001	15169 (GOOGLE) (GOOGLE)
7	142.251.32.110 142.251.32.110	15169 (GOOGLE) (GOOGLE)
1	142.250.64.98 142.250.64.98	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:80d::2001	15169 (GOOGLE) (GOOGLE)
1	142.250.80.36 142.250.80.36	15169 (GOOGLE) (GOOGLE)
48	13

14 104.18.24.100 (None, )

ASN13335 (CLOUDFLARENET, US)

www.itinforok.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:600::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.40.98 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s79-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 172.66.42.247 (United States)

ASN13335 (CLOUDFLARENET, US)

gamein.heiheigame.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:824::200e (United States)

ASN15169 (GOOGLE, US)

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81c::2001 (United States)

ASN15169 (GOOGLE, US)

9fc6319d7febffe36a4127fcf6171ec7.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.176.194 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s37-in-f2.1e100.net

ep1.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81d::2001 (United States)

ASN15169 (GOOGLE, US)

ep2.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.251.32.110 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s77-in-f14.1e100.net

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.64.98 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s31-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80d::2001 (United States)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.80.36 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s34-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	itinforok.com www.itinforok.com	121 KB
11	google.com fundingchoicesmessages.google.com — Cisco Umbrella Rank: 662 www.google.com — Cisco Umbrella Rank: 10	76 KB
11	heiheigame.com gamein.heiheigame.com	692 KB
4	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 280	181 KB
3	googlesyndication.com 9fc6319d7febffe36a4127fcf6171ec7.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 157 tpc.googlesyndication.com — Cisco Umbrella Rank: 203	67 B
2	adtrafficquality.google ep1.adtrafficquality.google ep2.adtrafficquality.google	19 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 410	9 KB
48	7

	Domain	Requested by
14	www.itinforok.com	www.itinforok.com
11	gamein.heiheigame.com	www.itinforok.com
10	fundingchoicesmessages.google.com	securepubads.g.doubleclick.net
4	securepubads.g.doubleclick.net	www.itinforok.com securepubads.g.doubleclick.net
2	cdn.jsdelivr.net	www.itinforok.com
1	www.google.com	ep2.adtrafficquality.google
1	tpc.googlesyndication.com	ep2.adtrafficquality.google
1	pagead2.googlesyndication.com
1	ep2.adtrafficquality.google	securepubads.g.doubleclick.net
1	ep1.adtrafficquality.google	securepubads.g.doubleclick.net
1	9fc6319d7febffe36a4127fcf6171ec7.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
48	11

This site contains no links.

Subject Issuer	Validity	Valid
itinforok.com WE1	`2024-07-06` - `2024-10-04`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
heiheigame.com WE1	`2024-08-10` - `2024-11-08`	3 months	crt.sh
*.google.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
adtrafficquality.google WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
tpc.googlesyndication.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.itinforok.com/game/flames_&_fortune.html
Frame ID: 08F7FAB390C6DFBA883C4ACECC2A9301
Requests: 44 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: 0070789F113BDBD1E06FBB836E333E31
Requests: 1 HTTP requests in this frame

Frame: https://9fc6319d7febffe36a4127fcf6171ec7.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 829A523E5899FBAAA1A5C67775052335
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: DC6FC0CBDE84026E1F2239FA2D0D4162
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 6A313377C96D32AB954E92BF8B39BB9A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Html5 Games - Flames & Fortune

Page URL History Show full URLs

http://www.itinforok.com/game/flames_&_fortune.html HTTP 307
https://www.itinforok.com/game/flames_&_fortune.html Page URL

Detected technologies

Clipboard.js (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

clipboard(?:-([\d.]+))?(?:\.min)?\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Osano (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cookieconsent\.min\.js

Swiper Slider (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

swiper(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

48
Requests

98 %
HTTPS

42 %
IPv6

7
Domains

11
Subdomains

13
IPs

2
Countries

1098 kB
Transfer

1877 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.itinforok.com/game/flames_&_fortune.html HTTP 307
https://www.itinforok.com/game/flames_&_fortune.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

48 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request flames_&_fortune.html Show response
www.itinforok.com/game/
Redirect Chain

http://www.itinforok.com/game/flames_&_fortune.html
https://www.itinforok.com/game/flames_&_fortune.html

14 KB
4 KB

1920ms
1843ms

Document
text/html

104.18.24.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84006618cd714b086493649f498fe83df4bf7f795459bc86899f60635cbf7cc7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=86400
cf-cache-status: EXPIRED
cf-ray: 8b60b8370ab508ab-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 20 Aug 2024 07:37:44 GMT
expires: Wed, 21 Aug 2024 07:37:43 GMT
last-modified: Tue, 20 Aug 2024 07:37:43 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

Location: https://www.itinforok.com/game/flames_&_fortune.html
Non-Authoritative-Reason: HttpsUpgrades

GET
H3 200 public.css
www.itinforok.com/static/themes/gametemp-q7/assets/css/ 3 KB
1 KB 152ms
151ms Stylesheet
text/css 104.18.24.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itinforok.com/static/themes/gametemp-q7/assets/css/public.css
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dbafe77fe4ba49d10b50e2d35e37673260f6ef054512edf9ea9013532afa289a

Request headers

Referer: https://www.itinforok.com/game/flames_&_fortune.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 01 Jun 2022 10:30:44 GMT
server: cloudflare
cf-polished: origSize=4154
etag: W/"62973fd4-103a"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=86400
cf-ray: 8b60b842bebe08ab-LAX
alt-svc: h3=":443"; ma=86400
expires: Wed, 21 Aug 2024 07:37:44 GMT

GET
H3 200 swiper.min.css
www.itinforok.com/static/themes/gametemp-q7/assets/css/ 19 KB
4 KB 153ms
150ms Stylesheet
text/css 104.18.24.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itinforok.com/static/themes/gametemp-q7/assets/css/swiper.min.css
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c207e653a1b44030d371cae76dbc884cfa7d6936525798d06be58b4cf45a9a5a

Request headers

Referer: https://www.itinforok.com/game/flames_&_fortune.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 03 Aug 2020 06:20:52 GMT
server: cloudflare
etag: W/"5f27acc4-4d4d"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=86400
cf-ray: 8b60b842cec508ab-LAX
alt-svc: h3=":443"; ma=86400
expires: Wed, 21 Aug 2024 07:37:44 GMT

GET
H3 200 iconfont.js Show response
www.itinforok.com/static/themes/gametemp-q7/assets/font/ 52 KB
19 KB 152ms
150ms Script
application/javascript 104.18.24.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itinforok.com/static/themes/gametemp-q7/assets/font/iconfont.js
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10bb72b14e202fffb0eb6dfb7fae8a91fc9c9c4f52429f2a3a281503454ad566

Request headers

Referer: https://www.itinforok.com/game/flames_&_fortune.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Thu, 14 Nov 2019 09:41:52 GMT
server: cloudflare
etag: W/"5dcd2160-ce10"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86400
cf-ray: 8b60b842cec608ab-LAX
alt-svc: h3=":443"; ma=86400
expires: Wed, 21 Aug 2024 07:37:44 GMT

GET
H3 200 swiper.min.js Show response
www.itinforok.com/static/themes/gametemp-q7/assets/js/ 125 KB
38 KB 153ms
151ms Script
application/javascript 104.18.24.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itinforok.com/static/themes/gametemp-q7/assets/js/swiper.min.js
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ebd5d7878133be396f3f8338dafd4dd18e9147c49281573d431bda4a41600e5e

Request headers

Referer: https://www.itinforok.com/game/flames_&_fortune.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 03 Aug 2020 06:20:52 GMT
server: cloudflare
age: 82076
etag: W/"5f27acc4-1f3cb"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86400
cf-ray: 8b60b842cec708ab-LAX
alt-svc: h3=":443"; ma=86400
expires: Wed, 21 Aug 2024 07:37:44 GMT

GET
H3 200 lazyload.min.js Show response
www.itinforok.com/static/themes/gametemp-q7/assets/js/ 2 KB
1 KB 85ms
83ms Script
application/javascript 104.18.24.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itinforok.com/static/themes/gametemp-q7/assets/js/lazyload.min.js
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b3baa10ac55f4eece0c7e666eaddd51872b8ce9273671626bcccec8f86ead78

Request headers

Referer: https://www.itinforok.com/game/flames_&_fortune.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
server: cloudflare
age: 82076
etag: W/"1dc09d84-8a2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86400
cf-ray: 8b60b842cec808ab-LAX
alt-svc: h3=":443"; ma=86400
expires: Wed, 21 Aug 2024 07:37:44 GMT

GET
H3 200 clipboard.js Show response
www.itinforok.com/static/themes/gametemp-q7/assets/js/ 10 KB
4 KB 286ms
284ms Script
application/javascript 104.18.24.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itinforok.com/static/themes/gametemp-q7/assets/js/clipboard.js
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7a10a5cf1574ff5efbe38630ff3bd4fbf6fbc4a587393ff7cf3f7bbb985dc03

Request headers

Referer: https://www.itinforok.com/game/flames_&_fortune.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Thu, 26 Sep 2019 07:58:28 GMT
server: cloudflare
cf-polished: origSize=10759
etag: W/"5d8c6fa4-2a07"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86400
cf-ray: 8b60b842cec908ab-LAX
alt-svc: h3=":443"; ma=86400
expires: Wed, 21 Aug 2024 07:37:44 GMT

GET
H3 200 fastclick.js Show response
www.itinforok.com/static/themes/gametemp-q7/assets/js/ 11 KB
3 KB 84ms
82ms Script
application/javascript 104.18.24.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itinforok.com/static/themes/gametemp-q7/assets/js/fastclick.js
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3fe6546296a0a64c38f102a952b0e3d2cef6f8b99dc4f162dbb2b8baad21b190

Request headers

Referer: https://www.itinforok.com/game/flames_&_fortune.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 26 Jan 2015 21:18:30 GMT
server: cloudflare
age: 82076
cf-polished: origSize=25965
etag: W/"54c6af26-656d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86400
cf-ray: 8b60b842ceca08ab-LAX
alt-svc: h3=":443"; ma=86400
expires: Wed, 21 Aug 2024 07:37:44 GMT

GET
H3 200 jquery.min.js Show response
www.itinforok.com/static/themes/gametemp-q7/assets/js/ 82 KB
33 KB 85ms
83ms Script
application/javascript 104.18.24.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itinforok.com/static/themes/gametemp-q7/assets/js/jquery.min.js
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 333c29e8bc3e1ab7b66e03bec3f64469da990700b9ace77b36c0f37f2f3b30b5

Request headers

Referer: https://www.itinforok.com/game/flames_&_fortune.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 12 Mar 2021 02:48:12 GMT
server: cloudflare
age: 82076
etag: W/"604ad66c-14988"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86400
cf-ray: 8b60b842cecc08ab-LAX
alt-svc: h3=":443"; ma=86400
expires: Wed, 21 Aug 2024 07:37:44 GMT

GET
H2 200 cookieconsent.min.css
cdn.jsdelivr.net/npm/cookieconsent@3/build/ 5 KB
2 KB 210ms
70ms Stylesheet
text/css 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.css

Requested by

Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cd0d0b6e50ff01ff2f3a9a70d7cfb66a7c6cb9acf7a566325568be6d3bd31fc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 20 Aug 2024 07:37:44 GMT
x-content-type-options: nosniff
content-encoding: br
age: 31626
x-jsd-version: 3.1.1
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1363
x-served-by: cache-fra-eddf8230078-FRA, cache-bur-kbur8200179-BUR
x-jsd-version-type: version
etag: W/"135e-3nthfC1sCV/yhiNebPZMMo2hpL8"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 detail.css
www.itinforok.com/static/themes/gametemp-q7/assets/css/ 3 KB
1 KB 286ms
285ms Stylesheet
text/css 104.18.24.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itinforok.com/static/themes/gametemp-q7/assets/css/detail.css
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 34de5d6ff81c0ebe478dce8adfd2c34442ff53850c9fdc0b1eb3aac585cb0c77

Request headers

Referer: https://www.itinforok.com/game/flames_&_fortune.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 15 Apr 2020 03:36:56 GMT
server: cloudflare
age: 51912
cf-polished: origSize=4406
etag: W/"5e968158-1136"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=86400
cf-ray: 8b60b842cece08ab-LAX
alt-svc: h3=":443"; ma=86400
expires: Wed, 21 Aug 2024 07:37:44 GMT

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 102 KB
32 KB 507ms
222ms Script
text/javascript 142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s79-in-f2.1e100.net

Software

cafe /

Resource Hash

8405b1a1485e893b297dbcc25e22c45c0734f6384e782c53dc9e3bf11aaf05d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32547
x-xss-protection: 0
server: cafe
etag: 79 / 19955 / m202408150101 / config-hash: 16900804115967644429
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 20 Aug 2024 07:37:44 GMT

GET
H3 200 cd6b57315d8a9607e9a61c1c6e24996d.jpg
gamein.heiheigame.com/uploads/gamepic/20240729/ 79 KB
80 KB 232ms
146ms Image
image/webp 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gamein.heiheigame.com/uploads/gamepic/20240729/cd6b57315d8a9607e9a61c1c6e24996d.jpg
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f3075b18e90816a9404b9c9afd7293c5f2f8cbe7bd01f7e6308f716d550a4848

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=121163
content-disposition: inline; filename="cd6b57315d8a9607e9a61c1c6e24996d.webp"
alt-svc: h3=":443"; ma=86400
content-length: 81036
cf-bgj: imgq:85,h2pri
last-modified: Mon, 29 Jul 2024 03:05:49 GMT
server: cloudflare
etag: "66a7070d-1d94b"
vary: Accept
access-control-allow-methods: GET,POST,OPTIONS
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 8b60b84348000ffd-LAX
access-control-allow-headers: X-Requested-With
expires: Fri, 20 Sep 2024 07:37:44 GMT

GET
H3 200 5.png
www.itinforok.com/static/themes/gametemp-q7/assets/img/ 1 KB
1 KB 286ms
285ms Image
image/webp 104.18.24.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itinforok.com/static/themes/gametemp-q7/assets/img/5.png
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7aae1d24d24692b1d2fde2bc323b385e8c694b2b77d8f482de30112e4948ca8

Request headers

Referer: https://www.itinforok.com/game/flames_&_fortune.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
cf-cache-status: HIT
age: 51912
cf-polished: origFmt=png, origSize=2477
content-disposition: inline; filename="5.webp"
alt-svc: h3=":443"; ma=86400
content-length: 1088
cf-bgj: imgq:85,h2pri
last-modified: Sat, 10 Aug 2019 13:25:36 GMT
server: cloudflare
etag: "5d4ec5d0-9ad"
vary: Accept
content-type: image/webp
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 8b60b842cecf08ab-LAX
expires: Thu, 19 Sep 2024 07:37:44 GMT

GET
H3 200 7013b6d5de598eea30d29dd40a909e90.jpg
gamein.heiheigame.com/uploads/gamepic/20240620/ 29 KB
29 KB 103ms
103ms Image
image/webp 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gamein.heiheigame.com/uploads/gamepic/20240620/7013b6d5de598eea30d29dd40a909e90.jpg
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e863c9477ef5a1b412152990d4a12905044dc06fdddf274e35db88089ce1463

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
cf-cache-status: HIT
age: 51912
cf-polished: qual=85, origFmt=jpeg, origSize=35756
content-disposition: inline; filename="7013b6d5de598eea30d29dd40a909e90.webp"
alt-svc: h3=":443"; ma=86400
content-length: 29630
cf-bgj: imgq:85,h2pri
last-modified: Thu, 20 Jun 2024 07:40:20 GMT
server: cloudflare
etag: "6673dce4-8bac"
vary: Accept
access-control-allow-methods: GET,POST,OPTIONS
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 8b60b84489610ffd-LAX
access-control-allow-headers: X-Requested-With
expires: Fri, 20 Sep 2024 07:37:44 GMT

GET
H3 200 8020e4c32c8b97580fa4bb95a1421bfd.png
gamein.heiheigame.com/uploads/gamepic/20230612/ 39 KB
39 KB 133ms
130ms Image
image/webp 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gamein.heiheigame.com/uploads/gamepic/20230612/8020e4c32c8b97580fa4bb95a1421bfd.png
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cfff605a0f94bf7e3fbc96ba73e4c4fb6c24c7fb1d0f9ffd04966a6ebf499374

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
cf-cache-status: HIT
age: 51912
cf-polished: origFmt=png, origSize=44640
content-disposition: inline; filename="8020e4c32c8b97580fa4bb95a1421bfd.webp"
alt-svc: h3=":443"; ma=86400
content-length: 40086
cf-bgj: imgq:85,h2pri
last-modified: Mon, 12 Jun 2023 07:53:47 GMT
server: cloudflare
etag: "6486cf0b-ae60"
vary: Accept
access-control-allow-methods: GET,POST,OPTIONS
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 8b60b844a97e0ffd-LAX
access-control-allow-headers: X-Requested-With
expires: Fri, 20 Sep 2024 07:37:44 GMT

GET
H3 200 3598a818d835b6c8fa5713ff50a1d6fc.png
gamein.heiheigame.com/uploads/gamepic/20230628/ 50 KB
51 KB 391ms
388ms Image
image/webp 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gamein.heiheigame.com/uploads/gamepic/20230628/3598a818d835b6c8fa5713ff50a1d6fc.png
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72b72a221a7a506f0ffc940ce6ed064e6b0389150ebc79c9f85a9f1e7bf96368

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=56325
content-disposition: inline; filename="3598a818d835b6c8fa5713ff50a1d6fc.webp"
alt-svc: h3=":443"; ma=86400
content-length: 51364
cf-bgj: imgq:85,h2pri
last-modified: Wed, 28 Jun 2023 05:58:56 GMT
server: cloudflare
etag: "649bcc20-dc05"
vary: Accept
access-control-allow-methods: GET,POST,OPTIONS
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 8b60b844a9830ffd-LAX
access-control-allow-headers: X-Requested-With
expires: Fri, 20 Sep 2024 07:37:44 GMT

GET
H3 200 193e134a206507e5052aa824d2aa31d5.jpg
gamein.heiheigame.com/uploads/gamepic/20231106/ 8 KB
9 KB 132ms
130ms Image
image/webp 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gamein.heiheigame.com/uploads/gamepic/20231106/193e134a206507e5052aa824d2aa31d5.jpg
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e908d3e0f8cd093f8aae4243182c748220c107980dd3f8dc7f04accb902d338

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
cf-cache-status: HIT
age: 19937
cf-polished: qual=85, origFmt=jpeg, origSize=14418
content-disposition: inline; filename="193e134a206507e5052aa824d2aa31d5.webp"
alt-svc: h3=":443"; ma=86400
content-length: 8424
cf-bgj: imgq:85,h2pri
last-modified: Mon, 06 Nov 2023 07:49:43 GMT
server: cloudflare
etag: "65489a97-3852"
vary: Accept
access-control-allow-methods: GET,POST,OPTIONS
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 8b60b844a9840ffd-LAX
access-control-allow-headers: X-Requested-With
expires: Fri, 20 Sep 2024 07:37:44 GMT

GET
H3 200 8917e02491300b87d5f4764ba4720f3a.jpg
gamein.heiheigame.com/uploads/gamepic/20240808/ 16 KB
16 KB 132ms
130ms Image
image/webp 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gamein.heiheigame.com/uploads/gamepic/20240808/8917e02491300b87d5f4764ba4720f3a.jpg
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9db3c24d8858efa5e46b8bd9023a3f89165279995916469992dbea668f66ba70

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
cf-cache-status: HIT
age: 76165
cf-polished: qual=85, origFmt=jpeg, origSize=16351
content-disposition: inline; filename="8917e02491300b87d5f4764ba4720f3a.webp"
alt-svc: h3=":443"; ma=86400
content-length: 16304
cf-bgj: imgq:85,h2pri
last-modified: Thu, 08 Aug 2024 08:52:24 GMT
server: cloudflare
etag: "66b48748-3fdf"
vary: Accept
access-control-allow-methods: GET,POST,OPTIONS
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 8b60b844a9870ffd-LAX
access-control-allow-headers: X-Requested-With
expires: Fri, 20 Sep 2024 07:37:44 GMT

GET
H3 200 e5f87483844f3b8b16824244114d2261.jpg
gamein.heiheigame.com/uploads/gamepic/20230706/ 24 KB
24 KB 131ms
129ms Image
image/webp 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gamein.heiheigame.com/uploads/gamepic/20230706/e5f87483844f3b8b16824244114d2261.jpg
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ae4497cbcec783a2f144757d88d99f3292bd30ba0d96421a9857978ae8d57430

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=28068
content-disposition: inline; filename="e5f87483844f3b8b16824244114d2261.webp"
alt-svc: h3=":443"; ma=86400
content-length: 24448
cf-bgj: imgq:85,h2pri
last-modified: Thu, 06 Jul 2023 04:55:46 GMT
server: cloudflare
etag: "64a64952-6da4"
vary: Accept
access-control-allow-methods: GET,POST,OPTIONS
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 8b60b844a98a0ffd-LAX
access-control-allow-headers: X-Requested-With
expires: Fri, 20 Sep 2024 07:37:44 GMT

GET
H3 200 5a71105d0feb6d327e5ddf7f58bb714d.jpeg
gamein.heiheigame.com/uploads/gamepic/20240428/ 52 KB
53 KB 199ms
197ms Image
image/webp 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gamein.heiheigame.com/uploads/gamepic/20240428/5a71105d0feb6d327e5ddf7f58bb714d.jpeg
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 69ee6563704dc9c208ee2a4d8b9d8921784ce150f8c36aad2668c26fe8918a0c

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=68519
content-disposition: inline; filename="5a71105d0feb6d327e5ddf7f58bb714d.webp"
alt-svc: h3=":443"; ma=86400
content-length: 53418
cf-bgj: imgq:85,h2pri
last-modified: Sun, 28 Apr 2024 07:42:56 GMT
server: cloudflare
etag: "662dfe00-10ba7"
vary: Accept
access-control-allow-methods: GET,POST,OPTIONS
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 8b60b844a98b0ffd-LAX
access-control-allow-headers: X-Requested-With
expires: Fri, 20 Sep 2024 07:37:44 GMT

GET
H3 200 38d6ea8053217ca6cc00df669d2be378.jpeg
gamein.heiheigame.com/uploads/gamepic/20231010/ 28 KB
29 KB 217ms
215ms Image
image/webp 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gamein.heiheigame.com/uploads/gamepic/20231010/38d6ea8053217ca6cc00df669d2be378.jpeg
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 818f9db51b5a4fc1ffe02fc66a28c1c5cfebf42d902a3c5ff20bf2d7d2a3b211

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=40509
content-disposition: inline; filename="38d6ea8053217ca6cc00df669d2be378.webp"
alt-svc: h3=":443"; ma=86400
content-length: 29112
cf-bgj: imgq:85,h2pri
last-modified: Tue, 10 Oct 2023 10:18:43 GMT
server: cloudflare
etag: "65252503-9e3d"
vary: Accept
access-control-allow-methods: GET,POST,OPTIONS
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 8b60b844a98c0ffd-LAX
access-control-allow-headers: X-Requested-With
expires: Fri, 20 Sep 2024 07:37:44 GMT

GET
H3 200 0688ed21ccbe002fc6c6f7be927986cf.png
gamein.heiheigame.com/uploads/gamepic/20230619/ 17 KB
18 KB 266ms
265ms Image
image/webp 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gamein.heiheigame.com/uploads/gamepic/20230619/0688ed21ccbe002fc6c6f7be927986cf.png
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3569ece954db13321193f6142109c9f773001fd5bc23a796145fb98c9b07857d

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
cf-cache-status: HIT
age: 51912
cf-polished: origFmt=png, origSize=19231
content-disposition: inline; filename="0688ed21ccbe002fc6c6f7be927986cf.webp"
alt-svc: h3=":443"; ma=86400
content-length: 17774
cf-bgj: imgq:85,h2pri
last-modified: Mon, 19 Jun 2023 06:22:31 GMT
server: cloudflare
etag: "648ff427-4b1f"
vary: Accept
access-control-allow-methods: GET,POST,OPTIONS
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 8b60b844a98e0ffd-LAX
access-control-allow-headers: X-Requested-With
expires: Fri, 20 Sep 2024 07:37:44 GMT

GET
H3 200 logo-mini.png
www.itinforok.com/static/themes/gametemp-q7/assets/img/ 2 KB
2 KB 85ms
83ms Image
image/webp 104.18.24.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itinforok.com/static/themes/gametemp-q7/assets/img/logo-mini.png
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed32928001b662f8b75a5bd243d7d47f302cc1aebad177e4f8864b200e552e2c

Request headers

Referer: https://www.itinforok.com/game/flames_&_fortune.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
cf-cache-status: HIT
age: 82076
cf-polished: origFmt=png, origSize=5653
content-disposition: inline; filename="logo-mini.webp"
alt-svc: h3=":443"; ma=86400
content-length: 2260
cf-bgj: imgq:85,h2pri
last-modified: Sat, 10 Aug 2019 13:25:36 GMT
server: cloudflare
etag: "5d4ec5d0-1615"
vary: Accept
content-type: image/webp
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 8b60b844a90108ab-LAX
expires: Thu, 19 Sep 2024 07:37:44 GMT

GET
H2 200 cookieconsent.min.js Show response
cdn.jsdelivr.net/npm/cookieconsent@3/build/ 20 KB
7 KB 72ms
67ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.js

Requested by

Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e55842a856a6d829feca3c3ad736c136b6c7549e9247274f78aa296259e06e24

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 20 Aug 2024 07:37:44 GMT
x-content-type-options: nosniff
content-encoding: br
age: 43156
x-jsd-version: 3.1.1
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 7125
x-served-by: cache-fra-etou8220134-FRA, cache-bur-kbur8200179-BUR
x-jsd-version-type: version
etag: W/"50d5-nLraS9YXyGxjjPLr3exyStWWkHs"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 iconfont.woff2
www.itinforok.com/static/themes/gametemp-q7/assets/font/ 6 KB
6 KB 104ms
104ms Font
font/woff2 104.18.24.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itinforok.com/static/themes/gametemp-q7/assets/font/iconfont.woff2
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/static/themes/gametemp-q7/assets/css/public.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 78200390d6155fc70fa4469c1d49ed2a56375d426471f78c4ce6e1c629e7e84a

Request headers

Referer: https://www.itinforok.com/static/themes/gametemp-q7/assets/css/public.css
Origin: https://www.itinforok.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
cf-cache-status: HIT
last-modified: Thu, 14 Nov 2019 09:41:52 GMT
server: cloudflare
etag: "5dcd2160-17a8"
vary: Accept-Encoding
content-type: font/woff2
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 8b60b844b91308ab-LAX
alt-svc: h3=":443"; ma=86400
content-length: 6056
expires: Wed, 21 Aug 2024 07:37:44 GMT

GET
H3 200 4bcfa8e0c0582f2c917bb34371ac57cd.png
gamein.heiheigame.com/uploads/games/20240729/ 344 KB
345 KB 196ms
195ms Image
image/webp 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gamein.heiheigame.com/uploads/games/20240729/4bcfa8e0c0582f2c917bb34371ac57cd.png
Requested by: Host: www.itinforok.com
URL: https://www.itinforok.com/game/flames_&_fortune.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e7d6b4b0bcbf38e54e782cdfdcde1363802f3cdd578c165dc6935af0484dcb32

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:44 GMT
cf-cache-status: REVALIDATED
cf-polished: origFmt=png, origSize=375826
content-disposition: inline; filename="4bcfa8e0c0582f2c917bb34371ac57cd.webp"
alt-svc: h3=":443"; ma=86400
content-length: 352482
cf-bgj: imgq:85,h2pri
last-modified: Mon, 29 Jul 2024 03:37:54 GMT
server: cloudflare
etag: "66a70e92-5bc12"
vary: Accept
access-control-allow-methods: GET,POST,OPTIONS
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 8b60b8453a210ffd-LAX
access-control-allow-headers: X-Requested-With
expires: Fri, 20 Sep 2024 07:37:44 GMT

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202408150101/ 477 KB
149 KB 135ms
134ms Script
text/javascript 142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202408150101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s79-in-f2.1e100.net

Software

cafe /

Resource Hash

c8783c15855fdad3b79a8878f5cc9a1c048c5b55cfc65cc9de266b915e5ab81c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:18:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1171
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 152053
x-xss-protection: 0
server: cafe
etag: 6480962962318068084
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Wed, 20 Aug 2025 07:18:14 GMT

GET
H2 200 22847393195 Show response
fundingchoicesmessages.google.com/i/ 202 KB
67 KB 468ms
175ms Script
application/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/22847393195?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202408150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

90bb85dbab4de35fd695c9b5b707778bf82fd262d4ef4384b916fd20c5033b2b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-L4e-lmtREBZniGLrdO3xTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:45 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-L4e-lmtREBZniGLrdO3xTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmJw1JBiOO90h-k6EEt8fcmkBcRO6TNYQ4DYp34GaxwQt948xzodiJP-nWctAWJ3rYus_kC8JOIi65HEi6yGCpdYnYH4_rpLrM-BeO_HS6xHgViIh-Nk_8RtbAIzuo63MytpJOUXxifn55UUZSaVluQXpSWnpRanFpWlFsUbGRiZGFgYWugZGMUXGAAA6vU93w"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 AGSKWxVVobCTaRKQqqWBH7nL5noSttUMosYQferrF58BrVePSIvqmqbGQQ9ty3-YWGvYKhvmOOWCqfT7YfYoYc5OAk03NS_nZR6glIonOlis399YBi52NABERHYSGwFKBvfYrI9A3X3-fA== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 167ms
166ms Script
application/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVVobCTaRKQqqWBH7nL5noSttUMosYQferrF58BrVePSIvqmqbGQQ9ty3-YWGvYKhvmOOWCqfT7YfYoYc5OAk03NS_nZR6glIonOlis399YBi52NABERHYSGwFKBvfYrI9A3X3-fA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI0MTM5NDY2LDE4NDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly93d3cuaXRpbmZvcm9rLmNvbS9nYW1lL2ZsYW1lc18mX2ZvcnR1bmUuaHRtbCIsbnVsbCxbWzgsIk9HQmhuZGhtOHNrIl0sWzksImVuLVVTIl0sWzIyLCJ0cnVlIl0sWzE5LCIyIl0sWzE3LCJbMF0iXV1d

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.OGBhndhm8sk.es5.O/am=rGA/d=1/rs=AJlcJMzse410J7gj8iRCTUlpklD4-9qYsw/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

582a3c6ccad8a3744c937ae22c9db57687290d29af54f964f3dd56662168e639

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-AlQ-0WCgvzJxN60Xk6nPyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:46 GMT
content-security-policy: script-src 'report-sample' 'nonce-AlQ-0WCgvzJxN60Xk6nPyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjytDikmII0pBiOHHrNtMFID7vdIfpOhBLfH3JpAXETukzWEOA2Kd-BmscELfePMc6HYiT_p1nLQFid62LrP5AvCTiIuuRxIushgqXWJ2B-P66S6zPgXjvx0usR4FYiIfjVP_EbWwCK85NbWZU0kjKL4xPzs8rKcpMKi3JL0pLTkstTi0qSy2KNzIwMjGwMLTQMzCKLzAAAPY7Qxs"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 0070 0
0 396ms
133ms Document
text/html 142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202408150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s79-in-f2.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 694
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29261
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 20 Aug 2024 07:26:12 GMT
expires: Tue, 20 Aug 2024 08:16:12 GMT
last-modified: Mon, 19 Aug 2024 19:44:00 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 896 B
471 B 438ms
438ms Fetch
text/plain 142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1544121635921193&correlator=3222714073929428&eid=44809527&output=ldjh&gdfp_req=1&vrg=202408150101&ptt=17&impl=fif&gdpr=0&iu_parts=22847393195%2Citinforok401h4%2Citinforok401h4-xq01&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250&ifi=1&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1724139466200&lmt=1724139463&adxs=650&adys=242&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.itinforok.com%2Fgame%2Fflames_%26_fortune.html&vis=1&psz=1200x266&msz=300x250&fws=4&ohw=1200&topics=9&tps=9&htps=10&nt=1&psd=WzE0LG51bGwsbnVsbCwzXQ..&dlt=1724139464083&idt=1310&adks=1999778536&frm=20&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202408150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s79-in-f2.1e100.net

Software

cafe /

Resource Hash

d7e96f2a021a752947a385a07dc7a534853185840c39cc3a87750cfa44e25ef9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:46 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 440
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.itinforok.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
9fc6319d7febffe36a4127fcf6171ec7.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 829A 0
0 436ms
147ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9fc6319d7febffe36a4127fcf6171ec7.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202408150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 20 Aug 2024 07:37:46 GMT
expires: Tue, 20 Aug 2024 07:37:46 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 AGSKWxUhHpUuCw8GPNiCwCOxf0B0fKSvW8-pX3uol6qz4IENT1V-llxRQZ7Lw11wUuIG0DUBVqBcTGzVzr_YIm13xlVoeWMVfcMnVOrfg5fNp9zUTzny9hC5Ay9g7wopPiVqdgHSvkDZqw== Show response
fundingchoicesmessages.google.com/f/ 10 KB
5 KB 167ms
167ms Script
application/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUhHpUuCw8GPNiCwCOxf0B0fKSvW8-pX3uol6qz4IENT1V-llxRQZ7Lw11wUuIG0DUBVqBcTGzVzr_YIm13xlVoeWMVfcMnVOrfg5fNp9zUTzny9hC5Ay9g7wopPiVqdgHSvkDZqw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI0MTM5NDY2LDM1NjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vd3d3Lml0aW5mb3Jvay5jb20vZ2FtZS9mbGFtZXNfJl9mb3J0dW5lLmh0bWwiLG51bGwsW1s4LCJPR0JobmRobThzayJdLFs5LCJlbi1VUyJdLFsyMiwidHJ1ZSJdLFsxOSwiMiJdLFsxNywiWzBdIl1dXQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ecbc1340e859418402cbe96ff7c6e1233d3b44c95fa06648c47c066e701ca659

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-2bgH1EYZKHntWjFcxjd8ow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:46 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-2bgH1EYZKHntWjFcxjd8ow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjStDikmII0JBiOO90h-k6EEt8fcmkBcRO6TNYQ4DYp34GaxwQt948xzodiJP-nWctAWJ3rYus_kC8JOIi65HEi6yGCpdYnYH4_rpLrM-BeO_HS6xHgViIh-NU_8RtbAIHNi64yqikkZRfGJ-cn1dSlJlUWpJflJacllqcWlSWWhRvZGBkYmBhaKFnYBRfYAAACHY-Yw"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ 16 KB
12 KB 358ms
216ms XHR
application/json 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202408150101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202408150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

bfc7e605f38a197441347c640dba8f9898a396d09c6cdd24ba6278e98e038d04

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12725
x-xss-protection: 0

GET
H3 200 favicon.png
www.itinforok.com/static/themes/gametemp-q7/assets/img/ 2 KB
2 KB 90ms
89ms Other
image/webp 104.18.24.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itinforok.com/static/themes/gametemp-q7/assets/img/favicon.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.100 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed32928001b662f8b75a5bd243d7d47f302cc1aebad177e4f8864b200e552e2c

Request headers

Referer: https://www.itinforok.com/game/flames_&_fortune.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:46 GMT
cf-cache-status: HIT
age: 10118
cf-polished: origFmt=png, origSize=5653
content-disposition: inline; filename="favicon.webp"
alt-svc: h3=":443"; ma=86400
content-length: 2260
cf-bgj: imgq:85,h2pri
last-modified: Sat, 10 Aug 2019 13:25:36 GMT
server: cloudflare
etag: "5d4ec5d0-1615"
vary: Accept
content-type: image/webp
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 8b60b85309f108ab-LAX
expires: Thu, 19 Sep 2024 07:37:46 GMT

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ 17 KB
7 KB 434ms
154ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202408150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 20 Aug 2024 07:37:47 GMT

GET
H3 200 chaturbatebest.js_ad_125x125. Show response
fundingchoicesmessages.google.com/f/AGSKWxUbZHEgmETBpWTfakExdD7UzH5eKqYbeACAyn1QXmHnCf0n3ZURRdudbtbtN9aRy-XwjfJcQGVkB9zl6izJxWGU_YABuW31qP4xlKYjNW0fJdGlR810Y7UvGFgmu2VqQNJBhrBGirmqpITcXDD4nCeBc1z3l... 54 B
109 B 159ms
158ms Script
application/javascript 142.251.32.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUbZHEgmETBpWTfakExdD7UzH5eKqYbeACAyn1QXmHnCf0n3ZURRdudbtbtN9aRy-XwjfJcQGVkB9zl6izJxWGU_YABuW31qP4xlKYjNW0fJdGlR810Y7UvGFgmu2VqQNJBhrBGirmqpITcXDD4nCeBc1z3ll20Jmaz9VWUrq2dwBHQJ6Yuc0GaXDzo/_.ad-cloud..com/doubleclick/-advertise01./chaturbatebest.js_ad_125x125.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.OGBhndhm8sk.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMyOp-vQirou1oKwOBNFWlsi2tM_cQ/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.110 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f14.1e100.net

Software

ESF /

Resource Hash

39818b028136d516f93cc38d2e774345a03280d1239966ad36cadd7b98ed3070

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-2-4qFm_ZM-scKKi3ATYK7g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:47 GMT
content-security-policy: script-src 'report-sample' 'nonce-2-4qFm_ZM-scKKi3ATYK7g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjStDikmII1pBiOO90h-k6EEt8fcmkBcRO6TNYQ4DYp34GaxwQt948xzodiJP-nWctAWJ3rYus_kC8JOIi65HEi6yGCpdYnYH4_rpLrM-BeO_HS6xHgViIm-N0_8RtbAIvVvamK2kk5RfGJ-fnlRRlJpWW5BelJaelFqcWlaUWxRsZGJkYWBha6BkYxRcYAADJ8z4E"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 google_top_exp.js Show response
pagead2.googlesyndication.com/pagead/js/ 47 B
67 B 403ms
135ms Script
text/javascript 142.250.64.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/google_top_exp.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s31-in-f2.1e100.net

Software

cafe /

Resource Hash

ccecd185ac16ba0a538840f37701053fbb861f7fbbdd86039c7415fcd924d1f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 06:28:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4134
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
server: cafe
etag: 13036835877489095579
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Sep 2024 06:28:53 GMT

POST
H3 204 AGSKWxUwvuMW9AEGHMPTenp_5yX2mnBAVkZiUTuxdiElYJv1XrkcbF3ms2khO6D5-9GSitywRRN4intTQLMD8OslYOMOoNvAvc3ol9KYgUqHttRffG4R5hy7zofX415kd-VbUpn-0c7A1w== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 422ms
155ms XHR
text/html 142.251.32.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUwvuMW9AEGHMPTenp_5yX2mnBAVkZiUTuxdiElYJv1XrkcbF3ms2khO6D5-9GSitywRRN4intTQLMD8OslYOMOoNvAvc3ol9KYgUqHttRffG4R5hy7zofX415kd-VbUpn-0c7A1w==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.110 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-JnPgq06zcdEXhtXIFpHf-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 20 Aug 2024 07:37:47 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-JnPgq06zcdEXhtXIFpHf-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmJw15BicEqfwRoExO5aF1n9gXhJxEXWQ4kXWfd-vMR6FIiFeDhO90_cxiZw4O2dJ4xKLkn5hfHJ-XklqXkluokpxbogdlFmUmlJfhEKO7UMpCInPz09My893sjAyMTAwtBCz8A8vsAAAHb3Loo"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.itinforok.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUwvuMW9AEGHMPTenp_5yX2mnBAVkZiUTuxdiElYJv1XrkcbF3ms2khO6D5-9GSitywRRN4intTQLMD8OslYOMOoNvAvc3ol9KYgUqHttRffG4R5hy7zofX415kd-VbUpn-0c7A1w==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.110 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-tIJATp2b9-FPAcQBe7fyyg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 20 Aug 2024 07:37:47 GMT
content-security-policy: script-src 'report-sample' 'nonce-tIJATp2b9-FPAcQBe7fyyg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmLw0JBicEqfwRoExO5aF1n9gXhJxEXWQ4kXWfd-vMR6FIiFeDhO90_cxibw4dXqp4xKLkn5hfHJ-XklqXkluokpxbogdlFmUmlJfhEKO7UMpCInPz09My893sjAyMTAwtBCz8A8vsAAAHbwLog"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.itinforok.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame DC6F 0
0 403ms
132ms Document
text/html 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1170
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 20 Aug 2024 07:18:17 GMT
expires: Wed, 20 Aug 2025 07:18:17 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame 6A31 0
0 422ms
157ms Document
text/html 142.250.80.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.36 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f4.1e100.net

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-YZl9AWMoAAtQn8dG-lJQAw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.itinforok.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-YZl9AWMoAAtQn8dG-lJQAw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 20 Aug 2024 07:37:47 GMT
expires: Tue, 20 Aug 2024 07:37:47 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUwvuMW9AEGHMPTenp_5yX2mnBAVkZiUTuxdiElYJv1XrkcbF3ms2khO6D5-9GSitywRRN4intTQLMD8OslYOMOoNvAvc3ol9KYgUqHttRffG4R5hy7zofX415kd-VbUpn-0c7A1w==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.110 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-8EKPfDsLtz6Xde-RMc56wg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 20 Aug 2024 07:37:47 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-8EKPfDsLtz6Xde-RMc56wg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmLw15BicEqfwRoExO5aF1n9gXhJxEXWQ4kXWfd-vMR6FIiFeDhO90_cxiZw4u3c5UxKLkn5hfHJ-XklqXkluokpxbogdlFmUmlJfhEKO7UMpCInPz09My893sjAyMTAwtBCz8A8vsAAAFo3Lh8"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.itinforok.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUwvuMW9AEGHMPTenp_5yX2mnBAVkZiUTuxdiElYJv1XrkcbF3ms2khO6D5-9GSitywRRN4intTQLMD8OslYOMOoNvAvc3ol9KYgUqHttRffG4R5hy7zofX415kd-VbUpn-0c7A1w==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.110 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-br2CSGYfZgAYMS1ZFubvsw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 20 Aug 2024 07:37:47 GMT
content-security-policy: script-src 'report-sample' 'nonce-br2CSGYfZgAYMS1ZFubvsw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmII0pBicEqfwRoExO5aF1n9gXhJxEXWQ4kXWfd-vMR6FIiFeDhO90_cxibQ8OvLciYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGJgYWihZ2AeX2AAAGMYLj4"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.itinforok.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxUwblD-mM8SKrGoaTeEFgxvyBj73n43EcwMp45BY-5lmzGx3FuRIk05hUhLz-HA6_fqhnbOeaHWBap4BqnQ2ar24Z_8lg5LbPoPafpabyk-hLR8nkEAthh_m9yXF1huOTLsc0D6xQ== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 177ms
177ms Script
application/javascript 142.251.32.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUwblD-mM8SKrGoaTeEFgxvyBj73n43EcwMp45BY-5lmzGx3FuRIk05hUhLz-HA6_fqhnbOeaHWBap4BqnQ2ar24Z_8lg5LbPoPafpabyk-hLR8nkEAthh_m9yXF1huOTLsc0D6xQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI0MTM5NDY3LDU0MTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly93d3cuaXRpbmZvcm9rLmNvbS9nYW1lL2ZsYW1lc18mX2ZvcnR1bmUuaHRtbCIsbnVsbCxbWzgsIk9HQmhuZGhtOHNrIl0sWzksImVuLVVTIl0sWzIyLCJ0cnVlIl0sWzE5LCIyIl0sWzE3LCJbMF0iXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.110 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f14.1e100.net

Software

ESF /

Resource Hash

226eaef9640c9e68bce822e5b94f346195a728ce53e7679463aa1580d090315f

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-1eD_g0mVjblSeI5p3l8dWA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 07:37:47 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-1eD_g0mVjblSeI5p3l8dWA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjytDikmLw1pBiOHHrNtMFID7vdIfpOhBLfH3JpAXETukzWEOA2Kd-BmscELfePMc6HYiT_p1nLQFid62LrP5AvCTiIuuRxIushgqXWJ2B-P66S6zPgXjvx0usR4FYiIfjdP_EbWwCDd8aNzEpaSTlF8Yn5-eVFGUmlZbkF6Ulp6UWpxaVpRbFGxkYmRhYGFroGRjFFxgAAPa_QzE"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxWXxQszLCjqAb1R2ieGV5QX8_N8qAVjQKR2USS6kd5xHeDP_MyVtu7GG06R4R2UK5y_aZVyv8pigfU4JaB_HELLHyZNNiBS-AXxgUOsmcS_n4MNcxqnp3v8yolvSGdevQpn0tY77g== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 157ms
156ms XHR
text/html 142.251.32.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWXxQszLCjqAb1R2ieGV5QX8_N8qAVjQKR2USS6kd5xHeDP_MyVtu7GG06R4R2UK5y_aZVyv8pigfU4JaB_HELLHyZNNiBS-AXxgUOsmcS_n4MNcxqnp3v8yolvSGdevQpn0tY77g==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.110 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-fRDc7j3pQJ3ri7OaqOkZSQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.itinforok.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 20 Aug 2024 07:37:47 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-fRDc7j3pQJ3ri7OaqOkZSQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmLw0ZBicEqfwRoExO5aF1n9gXhJxEXWQ4kXWfd-vMR6FIiFeDhO90_cxibw4s_Bf0xKLkn5hfHJ-XklqXkluokpxbogdlFmUmlJfhEKO7UMpCInPz09My893sjAyMTAwtBCz8A8vsAAAIlBLsY"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.itinforok.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET sodar
pagead2.googlesyndication.com/pagead/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202408150101&jk=1544121635921193&bg=!OzilOHfNAAag2_gngNs7ADQBe5WfOE0IJbcEyJmMsXre-8TGjFXOu8qrzsBjcGJxefXeWRNxNuYc2dvid2J7YVx71QvLAgAAAGxSAAAAA2gBB34ANo6ksLJpP3620iGVczJDWWm1vFL-ggo_ctFW_tJi6PFdrCetgiI8zGLN0RIcv3yIbVvfPh8LWAoAZmXcA_vClIMMqWfQAhtD6y-0vE4ZVsZukjb2jGaoQblK54E85xJEWcXw5SrzTIXZuF_haDCEBdo1r06u8u2Yi0KaL2YHocmop78Tqvn3JhLCV4UzB7pqh9K7orlwKVVBRXx6AM0gwZkCtEIqn5i526jChqjoRqSA0pEMZQMEf_grWPei5KAvDP-IKv8pT6ur7IwFs588VAZlj1AJsYePcu3Nd_koz8e8512VLhIyDmeAF7AGTvbgZd3doEZR2rEHPBpj0cHlMLDw7G-rQ0b0Bd7uyDFSCte7poo7B5GP_Xq-lc6Hu0X6kemuv0Sa3G60SYC-GD98wX2ZrU-PYMl3UyDkks1qOmmIgY7GLg4svpTFQSmoaWPY3VgfNr9lfk4KGe3Wkyz1EDx7qtrlAs70JCdzp7tec3kSRdTkkRlf8zoLn5KIw3X0hK-oIgNUpGU8zXAC6ZgQqicN8xxjW1rNKpKhHgsV9EB-0nhGaQTIN4p2l_YIAAHBj-dICE8G3PwFwiy_D6GSixKuHobt6ovUmrtQJP_JQCZo6MaK7qyR2vC9v0j_-r5JBfxmDe7rNMSrV0Q0h9WiGUfqSWPWdaN15rVzbQyzDZp-uC2pL_dL4n-JVdw5J-F0unszX9ucz3c2_5JxFHu9d6ngr_mRbT6OaQdZc0drLtQ9ZD4z6AbZ5YfmKRU8-c3n60IcxKtI-eWkXTMRQkjdCcSqliR6STHElyKlvnrIvCCNpFIi7EkeOJZ6G0ymQ9BEdhyb6-cpD9es7DfjgywLGALzqjAUN2IWVdyXt1IWPnRJJ4MTNQcqSScstSXGvI0QPseShfT1z1M6XwJZWtjmUgxDh__ctdtsc03kJEg8u_KN9A1v8K56BbJRi3tMIncxp2HFVb5ARbrUT0HYHT77KteeY3MDiDG9LgQPKb0V2FpckDGSjENZuM4tfjQcAI0UHYXaTdOuwQtRWRfU3eivJbeHQeLuqSRW0I_4_CdU14lPr1hAD4UadFzujrklMfZ0gGXf-6QC2tRSwx4g9nvNRt8q7ruZEdhgTYNDZHtuoKgP4SWFWsrb

Verdicts & Comments Add Verdict or Comment

52 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-20 22:55:40	Name: test_cookie Value: CheckForPermission
.itinforok.com/	1970-01-21 08:17:15	Name: __gads Value: ID=a523d5d449a27225:T=1724139466:RT=1724139466:S=ALNI_MZhXq6hJLTu0GwdJrPxY2Dp_P3FXg
.itinforok.com/	1970-01-21 08:17:15	Name: __gpi Value: UID=00000a4d3a4b8b2c:T=1724139466:RT=1724139466:S=ALNI_Ma1apevZYQVvdGYY0YxYkW-mfD-Tg
.itinforok.com/	1970-01-21 03:14:51	Name: __eoi Value: ID=92b0ec450ac4a934:T=1724139466:RT=1724139466:S=AA-Afja1ld50Aey-r2Xe5p5WPazB
.itinforok.com/	1970-01-21 07:41:15	Name: FCNEC Value: %5B%5B%22AKsRol-V7FnyxUYZdKWMKlhUyHDcyDBEQzZDCaNQGj9zmP7ElFD19OtNkPDK97_48Vo169SCshwlDFNMInWEBXWdiNJJ6CiH2Hh1W4yJ-xlwe6ctlNlL2rpap4d38AWfV1njj1_ORVLRaa3tE3L_IH0esZjNuM4oHQ%3D%3D%22%5D%5D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9fc6319d7febffe36a4127fcf6171ec7.safeframe.googlesyndication.com
cdn.jsdelivr.net
ep1.adtrafficquality.google
ep2.adtrafficquality.google
fundingchoicesmessages.google.com
gamein.heiheigame.com
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
www.google.com
www.itinforok.com
pagead2.googlesyndication.com
104.18.24.100
142.250.176.194
142.250.64.98
142.250.80.36
142.251.32.110
142.251.40.98
172.66.42.247
2607:f8b0:4006:80d::2001
2607:f8b0:4006:81c::2001
2607:f8b0:4006:81d::2001
2607:f8b0:4006:824::200e
2a04:4e42:600::485
10bb72b14e202fffb0eb6dfb7fae8a91fc9c9c4f52429f2a3a281503454ad566
226eaef9640c9e68bce822e5b94f346195a728ce53e7679463aa1580d090315f
2e863c9477ef5a1b412152990d4a12905044dc06fdddf274e35db88089ce1463
333c29e8bc3e1ab7b66e03bec3f64469da990700b9ace77b36c0f37f2f3b30b5
34de5d6ff81c0ebe478dce8adfd2c34442ff53850c9fdc0b1eb3aac585cb0c77
3569ece954db13321193f6142109c9f773001fd5bc23a796145fb98c9b07857d
39818b028136d516f93cc38d2e774345a03280d1239966ad36cadd7b98ed3070
3e908d3e0f8cd093f8aae4243182c748220c107980dd3f8dc7f04accb902d338
3fe6546296a0a64c38f102a952b0e3d2cef6f8b99dc4f162dbb2b8baad21b190
582a3c6ccad8a3744c937ae22c9db57687290d29af54f964f3dd56662168e639
5b3baa10ac55f4eece0c7e666eaddd51872b8ce9273671626bcccec8f86ead78
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
69ee6563704dc9c208ee2a4d8b9d8921784ce150f8c36aad2668c26fe8918a0c
72b72a221a7a506f0ffc940ce6ed064e6b0389150ebc79c9f85a9f1e7bf96368
78200390d6155fc70fa4469c1d49ed2a56375d426471f78c4ce6e1c629e7e84a
818f9db51b5a4fc1ffe02fc66a28c1c5cfebf42d902a3c5ff20bf2d7d2a3b211
84006618cd714b086493649f498fe83df4bf7f795459bc86899f60635cbf7cc7
8405b1a1485e893b297dbcc25e22c45c0734f6384e782c53dc9e3bf11aaf05d2
90bb85dbab4de35fd695c9b5b707778bf82fd262d4ef4384b916fd20c5033b2b
9db3c24d8858efa5e46b8bd9023a3f89165279995916469992dbea668f66ba70
a7aae1d24d24692b1d2fde2bc323b385e8c694b2b77d8f482de30112e4948ca8
ae4497cbcec783a2f144757d88d99f3292bd30ba0d96421a9857978ae8d57430
bfc7e605f38a197441347c640dba8f9898a396d09c6cdd24ba6278e98e038d04
c207e653a1b44030d371cae76dbc884cfa7d6936525798d06be58b4cf45a9a5a
c7a10a5cf1574ff5efbe38630ff3bd4fbf6fbc4a587393ff7cf3f7bbb985dc03
c8783c15855fdad3b79a8878f5cc9a1c048c5b55cfc65cc9de266b915e5ab81c
ccecd185ac16ba0a538840f37701053fbb861f7fbbdd86039c7415fcd924d1f2
cd0d0b6e50ff01ff2f3a9a70d7cfb66a7c6cb9acf7a566325568be6d3bd31fc4
cfff605a0f94bf7e3fbc96ba73e4c4fb6c24c7fb1d0f9ffd04966a6ebf499374
d7e96f2a021a752947a385a07dc7a534853185840c39cc3a87750cfa44e25ef9
dbafe77fe4ba49d10b50e2d35e37673260f6ef054512edf9ea9013532afa289a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e55842a856a6d829feca3c3ad736c136b6c7549e9247274f78aa296259e06e24
e7d6b4b0bcbf38e54e782cdfdcde1363802f3cdd578c165dc6935af0484dcb32
ebd5d7878133be396f3f8338dafd4dd18e9147c49281573d431bda4a41600e5e
ecbc1340e859418402cbe96ff7c6e1233d3b44c95fa06648c47c066e701ca659
ed32928001b662f8b75a5bd243d7d47f302cc1aebad177e4f8864b200e552e2c
f3075b18e90816a9404b9c9afd7293c5f2f8cbe7bd01f7e6308f716d550a4848

www.itinforok.com Open in urlscan Pro 104.18.24.100 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

48 Requests

98 %HTTPS

42 %IPv6

7 Domains

11 Subdomains

13 IPs

2 Countries

1098 kBTransfer

1877 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

48 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.itinforok.com Open in urlscan Pro
104.18.24.100 Public Scan

Screenshot
Live screenshot

Full Image

48
Requests

98 %
HTTPS

42 %
IPv6

7
Domains

11
Subdomains

13
IPs

2
Countries

1098 kB
Transfer

1877 kB
Size

5
Cookies

48 HTTP transactions
0 data transactions