tr.im Open in urlscan Pro
2606:4700:3032::681b:a2f8 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://speedflow.io/adult/?a=rr
Effective URL:
https://tr.im/1X3wO
Submission Tags: demotag1 demotag2 Search All
Submission: On November 15 via api (November 15th 2020, 12:29:18 am UTC) from US

Summary HTTP 42 Redirects Behaviour Indicators

Summary

This website contacted 20 IPs in 4 countries across 20 domains to perform 42 HTTP transactions. The main IP is 2606:4700:3032::681b:a2f8, located in United States and belongs to CLOUDFLARENET, US. The main domain is tr.im.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 10th 2020. Valid for: a year.

This is the only time tr.im was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	198.54.116.135 198.54.116.135	22612 (NAMECHEAP...) (NAMECHEAP-NET)
2 7	107.170.39.103 107.170.39.103	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	213.239.209.209 213.239.209.209	24940 (HETZNER-AS) (HETZNER-AS)
2	34.235.104.230 34.235.104.230	14618 (AMAZON-AES) (AMAZON-AES)
1	35.190.72.161 35.190.72.161	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:1b:... 2a04:4e42:1b::621	54113 (FASTLY) (FASTLY)
1 5	2606:4700:303... 2606:4700:3032::681b:a2f8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:81f::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:820::2008	15169 (GOOGLE) (GOOGLE)
3	216.58.207.66 216.58.207.66	15169 (GOOGLE) (GOOGLE)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:2a	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:806::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81a::200e	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:817::2002	15169 (GOOGLE) (GOOGLE)
1	172.217.22.66 172.217.22.66	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81c::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:801::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80b::2001	15169 (GOOGLE) (GOOGLE)
42	20

1 198.54.116.135 (Los Angeles, United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server193-5.web-hosting.com

speedflow.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 107.170.39.103 (New York, United States) 2 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

traffdaq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.239.209.209 (Nuremberg, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: 213-239-209-209.clients.your-server.de

acceptable.a-ads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.235.104.230 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-235-104-230.compute-1.amazonaws.com

cors-anywhere.herokuapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.72.161 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 161.72.190.35.bc.googleusercontent.com

c.securepaths.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:1b::621 (Ascension Island)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:3032::681b:a2f8 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tr.im	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 216.58.207.66 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra16s25-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:817::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.22.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s17-in-f66.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

2cf0360927c04e88a6bc77a18772e743.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	googlesyndication.com pagead2.googlesyndication.com 2cf0360927c04e88a6bc77a18772e743.safeframe.googlesyndication.com tpc.googlesyndication.com	146 KB
7	traffdaq.com 2 redirects traffdaq.com	6 KB
5	doubleclick.net securepubads.g.doubleclick.net googleads.g.doubleclick.net	120 KB
5	tr.im 1 redirects tr.im	24 KB
2	google-analytics.com www.google-analytics.com	18 KB
2	gstatic.com fonts.gstatic.com	15 KB
2	herokuapp.com cors-anywhere.herokuapp.com	2 KB
1	googletagservices.com www.googletagservices.com	28 KB
1	google.com adservice.google.com	803 B
1	google.de adservice.google.de	803 B
1	googleadservices.com partner.googleadservices.com	637 B
1	googleapis.com fonts.googleapis.com	596 B
1	bootstrapcdn.com stackpath.bootstrapcdn.com	23 KB
1	googletagmanager.com www.googletagmanager.com	38 KB
1	jsdelivr.net cdn.jsdelivr.net	10 KB
1	securepaths.com c.securepaths.com
1	a-ads.com acceptable.a-ads.com
1	speedflow.io speedflow.io	1 KB
0	weallin2.com Failed prestige.weallin2.com Failed
0	jads.co Failed poweredby.jads.co Failed
42	20

	Domain	Requested by
7	traffdaq.com	2 redirects speedflow.io traffdaq.com
5	tr.im	1 redirects traffdaq.com tr.im
4	pagead2.googlesyndication.com	tr.im pagead2.googlesyndication.com
3	2cf0360927c04e88a6bc77a18772e743.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
3	securepubads.g.doubleclick.net	tr.im securepubads.g.doubleclick.net
2	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
2	googleads.g.doubleclick.net	pagead2.googlesyndication.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	fonts.gstatic.com	fonts.googleapis.com
2	cors-anywhere.herokuapp.com	speedflow.io
1	www.googletagservices.com	pagead2.googlesyndication.com
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	fonts.googleapis.com	tr.im
1	stackpath.bootstrapcdn.com	tr.im
1	www.googletagmanager.com	tr.im
1	cdn.jsdelivr.net	traffdaq.com
1	c.securepaths.com	traffdaq.com
1	acceptable.a-ads.com	speedflow.io
1	speedflow.io
0	prestige.weallin2.com Failed	tr.im
0	poweredby.jads.co Failed	speedflow.io
42	23

This site contains no links.

Subject Issuer	Validity	Valid
traffdaq.com Let's Encrypt Authority X3	`2020-10-31` - `2021-01-29`	3 months	crt.sh
*.herokuapp.com DigiCert SHA2 High Assurance Server CA	`2020-06-15` - `2021-07-07`	a year	crt.sh
*.securepaths.com Let's Encrypt Authority X3	`2020-09-22` - `2020-12-21`	3 months	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-10-26` - `2021-04-17`	6 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-10` - `2021-07-10`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-10-28` - `2021-01-20`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-10-28` - `2021-01-20`	3 months	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-09-22` - `2021-10-12`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-10-28` - `2021-01-20`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-10-28` - `2021-01-20`	3 months	crt.sh
*.googleadservices.com GTS CA 1O1	`2020-10-28` - `2021-01-20`	3 months	crt.sh
*.google.de GTS CA 1O1	`2020-10-28` - `2021-01-20`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-10-28` - `2021-01-20`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-10-28` - `2021-01-20`	3 months	crt.sh

This page contains 8 frames:

Frame: http://prestige.weallin2.com/?utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1X3wO&utm_content=direct_input
Frame ID: 906286173C74758AB1EEAEB828BA459B
Requests: 34 HTTP requests in this frame

Frame: http://acceptable.a-ads.com/1508167
Frame ID: B381508153463394330FE7BFC31AF351
Requests: 1 HTTP requests in this frame

Frame: https://traffdaq.com/delivery/dl/47382?category=general
Frame ID: 9E4C3797CC14E6C82AE8BF9864981EC6
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20201111/r20190131/zrt_lookup.html
Frame ID: 11C21049A75EADAFF5C7CD33EB463145
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-1229858928340193&output=html&adk=1812271804&adf=3025194257&lmt=1605400142&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Ftr.im%2F1X3wO&ea=0&flash=0&pra=5&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1605400142039&bpp=13&bdt=101&idt=73&shv=r20201111&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2138544974175&frm=20&pv=2&ga_vid=723068156.1605400142&ga_sid=1605400142&ga_hid=64176765&ga_fc=0&iag=0&icsg=8746&dssz=16&mdo=0&mso=0&u_tz=60&u_his=3&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21068083&oid=3&pvsid=2769429149256959&pem=389&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=95
Frame ID: BA36E0DE5DF505894018A11A8917D2A2
Requests: 1 HTTP requests in this frame

Frame: https://2cf0360927c04e88a6bc77a18772e743.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 9F445A2818C260B817C0D2EE09C6A3FA
Requests: 1 HTTP requests in this frame

Frame: https://2cf0360927c04e88a6bc77a18772e743.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: BB40791D6093B9A0E3306BB091E2D13F
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html
Frame ID: BB8BB17F3C1862AF25BAD4F1FA95DC8C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://speedflow.io/adult/?a=rr Page URL
https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlpBNTIycnNHVFh6alpsaGxnZitnTlE9PSIsI... Page URL
https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlwvR3RBa1FiREtSXC9COGtjdVV2a0JOQT09I... Page URL
http://tr.im/1X3wO HTTP 308
https://tr.im/1X3wO Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

42
Requests

90 %
HTTPS

63 %
IPv6

20
Domains

23
Subdomains

20
IPs

4
Countries

434 kB
Transfer

1191 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://speedflow.io/adult/?a=rr Page URL
https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlpBNTIycnNHVFh6alpsaGxnZitnTlE9PSIsInZhbHVlIjoiRTFqT05LN2tcL3dSYUpvSmpcLzNwaTVkNzIwdDlxbXBVVzN4RmFleGN1aEkxWDJxakdjTzVUQVo4MnQyOEFIY2RFRzEySmc1SXF0UlViXC9qZHExYVZsM1dmUVFvM1NZcm0zMGlEVFJZQjVjNGM0NHpuSGFFa3dOSVVDTStNcHlQRktDMDZ3d2Jta21HYjZcL0FJZkxoVlZCdlwvQnNBalEzWGtwOXkraW1YNGxvXC8ydU82Rms0cEFXY2JlUXNVOEpJOUlIaitmTWw5ZEpyeEpwK0U2K0t0TU9CQT09IiwibWFjIjoiOGZhMjFhYmE3MzAyODE1YjI4NjRiY2YyYWEwNmU2YjgyZWYzNjU0N2E1ZjBjM2Q5YjNlZGVjMGExZTg1MTQyMiJ9 Page URL
https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlwvR3RBa1FiREtSXC9COGtjdVV2a0JOQT09IiwidmFsdWUiOiIxWXU1dkxKcDNqVENLUHh2TjNLaXU2SlBnZ0xMVmhva0IwTlRPekR4bWt3cjlqMHh3a05OUk1ZaXN3eFwvbDhFemFFaUpuUVpEejR1YklhbHRtNkFLR3lYZnppZVJGUW1XbXhZOWFxYVhpcjNWZ0ErTzVQUllGcysyamJMd25FU2w2dTkwcE12bUpaQktXaXUwMVRTczlZVUdmQitCM1ZwdWRzYnFEVitOOUM1Y2p6ajJKbnR4dUZuMnlla2pOMERCY3VpWE05ZzdpbjliMytMTWMycXowVndxYllieGc3dnJ3QXkxUGdLeWI0b3RIVUg3Rm9PMmUxUzdiblRuWURTYytUbEFHRDIyZGZEWUY5bEFsdlNlRnRtb1RtanI4RWY1ZFVjelNiaHh1RFFqUjZhVjBoR2dRNnhcL1ZKMW1YTnpLIiwibWFjIjoiZTIzNDliODZlOGQ2MjdiNjcyZGI2NTA2OTE3MjQ3ZTBlMzM2MDFhZGUyZWUyOGVkNWQzZGZiMjQzYTAzY2IyMSJ9&fp=66abd220fd1aeed21a48c2d9b60f0bf8 Page URL
http://tr.im/1X3wO HTTP 308
https://tr.im/1X3wO Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

http://traffdaq.com/delivery/pu/47382?category=general HTTP 301
https://traffdaq.com/delivery/pu/47382?category=general

Request Chain 4

http://traffdaq.com/delivery/dl/47382?category=general HTTP 301
https://traffdaq.com/delivery/dl/47382?category=general

42 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
speedflow.io/adult/ 2 KB
1 KB 202ms
202ms Document
text/html 198.54.116.135
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://speedflow.io/adult/?a=rr
Protocol: HTTP/1.1
Server: 198.54.116.135 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server193-5.web-hosting.com
Software: Apache / PHP/7.1.33
Resource Hash: 6d543c8e115fdf217b58e35a469a38eae98936da7f4b983c2787644cfbb7cf96

Request headers

Host: speedflow.io
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr

Response headers

date: Sun, 15 Nov 2020 00:28:53 GMT
server: Apache
x-powered-by: PHP/7.1.33
set-cookie: visits_todaya=1; expires=Sun, 15-Nov-2020 22:59:00 GMT; Max-Age=81007; path=/ country=PT visits_todayi=0; expires=Sun, 15-Nov-2020 22:59:00 GMT; Max-Age=81007; path=/
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
content-length: 852
content-type: text/html; charset=UTF-8

GET
H/1.1

200
OK

47382 Show response
traffdaq.com/delivery/pu/
Redirect Chain

http://traffdaq.com/delivery/pu/47382?category=general
https://traffdaq.com/delivery/pu/47382?category=general

5 KB
2 KB

154ms
153ms

Script
text/html

107.170.39.103
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://traffdaq.com/delivery/pu/47382?category=general
Requested by: Host: speedflow.io
URL: http://speedflow.io/adult/?a=rr
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.170.39.103 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.16.1 (Ubuntu) /
Resource Hash: ae7e01e27045ad144b76f11452d24884ed48eda63fcf9c044fbd7ad7d6b81ff4

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 15 Nov 2020 00:28:54 GMT
Content-Encoding: gzip
Server: nginx/1.16.1 (Ubuntu)
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Location: https://traffdaq.com/delivery/pu/47382?category=general
Connection: close
Content-length: 0

GET jads.js
poweredby.jads.co/js/ 0
0

GET
H/1.1 200
OK 1508167
acceptable.a-ads.com/ Frame B381 0
0 49ms
48ms Document
text/html 213.239.209.209
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://acceptable.a-ads.com/1508167

Requested by

Host: speedflow.io
URL: http://speedflow.io/adult/?a=rr

Protocol

HTTP/1.1

Server

213.239.209.209 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

213-239-209-209.clients.your-server.de

Software

nginx/1.14.0 (Ubuntu) / Phusion Passenger

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: acceptable.a-ads.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://speedflow.io/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: http://speedflow.io/

Response headers

Server: nginx/1.14.0 (Ubuntu)
Date: Sun, 15 Nov 2020 00:28:54 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding Accept-Encoding
Status: 200 OK
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Powered-By: Phusion Passenger
X-Original-Referer: http://speedflow.io/
Content-Encoding: gzip

GET
H/1.1

200
OK

47382
traffdaq.com/delivery/dl/ Frame 9E4C
Redirect Chain

http://traffdaq.com/delivery/dl/47382?category=general
https://traffdaq.com/delivery/dl/47382?category=general

0
0

1221ms
986ms

Document
text/html

107.170.39.103
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://traffdaq.com/delivery/dl/47382?category=general
Requested by: Host: speedflow.io
URL: http://speedflow.io/adult/?a=rr
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.170.39.103 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.16.1 (Ubuntu) /
Resource Hash

Request headers

Host: traffdaq.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://speedflow.io/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: http://speedflow.io/

Response headers

Server: nginx/1.16.1 (Ubuntu)
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: no-cache
Date: Sun, 15 Nov 2020 00:28:55 GMT
Content-Encoding: gzip

Redirect headers

Content-length: 0
Location: https://traffdaq.com/delivery/dl/47382?category=general
Connection: close

OPTIONS
H/1.1 200
OK 47382
cors-anywhere.herokuapp.com///traffdaq.com/delivery/pu/ Frame 0
0 118ms
117ms Other 34.235.104.230
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cors-anywhere.herokuapp.com///traffdaq.com/delivery/pu/47382?category=general
Protocol: HTTP/1.1
Server: 34.235.104.230 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-104-230.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-requested-with
Origin: http://speedflow.io
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Server: Cowboy
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Access-Control-Allow-Headers: x-requested-with
Access-Control-Expose-Headers: access-control-allow-origin,access-control-allow-methods,access-control-allow-headers
Date: Sun, 15 Nov 2020 00:28:54 GMT
Transfer-Encoding: chunked
Via: 1.1 vegur

GET
H/1.1 200
OK 47382
cors-anywhere.herokuapp.com///traffdaq.com/delivery/pu/ 5 KB
2 KB 204ms
204ms XHR
text/html 34.235.104.230
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cors-anywhere.herokuapp.com///traffdaq.com/delivery/pu/47382?category=general
Requested by: Host: speedflow.io
URL: http://speedflow.io/adult/?a=rr
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.235.104.230 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-104-230.compute-1.amazonaws.com
Software: nginx/1.16.1 (Ubuntu) /
Resource Hash

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
X-Requested-With: XMLHttpRequest

Response headers

Date: Sun, 15 Nov 2020 00:28:54 GMT
Content-Encoding: gzip
Server: nginx/1.16.1 (Ubuntu)
X-Request-Url: http://traffdaq.com/delivery/pu/47382?category=general
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: server,date,content-type,transfer-encoding,connection,content-encoding,x-final-url,access-control-allow-origin
Connection: keep-alive
X-Cors-Redirect-1: 301 https://traffdaq.com/delivery/pu/47382?category=general
X-Final-Url: https://traffdaq.com/delivery/pu/47382?category=general
Via: 1.1 vegur

GET
H/1.1 200
OK 47382 Show response
traffdaq.com/delivery/directlink/ 3 KB
2 KB 1327ms
1092ms Document
text/html 107.170.39.103
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlpBNTIycnNHVFh6alpsaGxnZitnTlE9PSIsInZhbHVlIjoiRTFqT05LN2tcL3dSYUpvSmpcLzNwaTVkNzIwdDlxbXBVVzN4RmFleGN1aEkxWDJxakdjTzVUQVo4MnQyOEFIY2RFRzEySmc1SXF0UlViXC9qZHExYVZsM1dmUVFvM1NZcm0zMGlEVFJZQjVjNGM0NHpuSGFFa3dOSVVDTStNcHlQRktDMDZ3d2Jta21HYjZcL0FJZkxoVlZCdlwvQnNBalEzWGtwOXkraW1YNGxvXC8ydU82Rms0cEFXY2JlUXNVOEpJOUlIaitmTWw5ZEpyeEpwK0U2K0t0TU9CQT09IiwibWFjIjoiOGZhMjFhYmE3MzAyODE1YjI4NjRiY2YyYWEwNmU2YjgyZWYzNjU0N2E1ZjBjM2Q5YjNlZGVjMGExZTg1MTQyMiJ9
Requested by: Host: speedflow.io
URL: http://speedflow.io/adult/?a=rr
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.170.39.103 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.16.1 (Ubuntu) /
Resource Hash: 1b174325abf58e45fc6963c91702f15c105cbe8763e5c13710319335d718f904

Request headers

Host: traffdaq.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: http://speedflow.io/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: http://speedflow.io/

Response headers

Server: nginx/1.16.1 (Ubuntu)
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: no-cache
Date: Sun, 15 Nov 2020 00:28:55 GMT
Content-Encoding: gzip

GET
H/1.1 200
OK eyJpdiI6Ilk2VjZYNGpoTEZBdjRacm95dVpIOUE9PSIsInZhbHVlIjoiZU93dnRDVW0wTTRrMFdFc3d4ZDJOKzFGYTliXC9cLzlnSll4cGN5K1l3RjVZdU5FZncwZk1CTUNZa0dacFNvdzFLMUlRS29UVSt6bEQ4SDVNSnh4Sm95UT09IiwibWFjIjoiYmM4ZDQzY...
traffdaq.com/users/track/ 0
852 B 1381ms
1146ms Image
text/html 107.170.39.103
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://traffdaq.com/users/track/eyJpdiI6Ilk2VjZYNGpoTEZBdjRacm95dVpIOUE9PSIsInZhbHVlIjoiZU93dnRDVW0wTTRrMFdFc3d4ZDJOKzFGYTliXC9cLzlnSll4cGN5K1l3RjVZdU5FZncwZk1CTUNZa0dacFNvdzFLMUlRS29UVSt6bEQ4SDVNSnh4Sm95UT09IiwibWFjIjoiYmM4ZDQzYTc5M2FkZDlhODFkN2ExMDNiZWY5ZGIzZWJjNmRkZWQ5MDlmYmEwYWU2ODk1YWRlMDg1Zjk1MzMxYiJ9
Requested by: Host: traffdaq.com
URL: https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlpBNTIycnNHVFh6alpsaGxnZitnTlE9PSIsInZhbHVlIjoiRTFqT05LN2tcL3dSYUpvSmpcLzNwaTVkNzIwdDlxbXBVVzN4RmFleGN1aEkxWDJxakdjTzVUQVo4MnQyOEFIY2RFRzEySmc1SXF0UlViXC9qZHExYVZsM1dmUVFvM1NZcm0zMGlEVFJZQjVjNGM0NHpuSGFFa3dOSVVDTStNcHlQRktDMDZ3d2Jta21HYjZcL0FJZkxoVlZCdlwvQnNBalEzWGtwOXkraW1YNGxvXC8ydU82Rms0cEFXY2JlUXNVOEpJOUlIaitmTWw5ZEpyeEpwK0U2K0t0TU9CQT09IiwibWFjIjoiOGZhMjFhYmE3MzAyODE1YjI4NjRiY2YyYWEwNmU2YjgyZWYzNjU0N2E1ZjBjM2Q5YjNlZGVjMGExZTg1MTQyMiJ9
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.170.39.103 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.16.1 (Ubuntu) /
Resource Hash

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 15 Nov 2020 00:28:57 GMT
Cache-Control: no-cache
Server: nginx/1.16.1 (Ubuntu)
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3-Q050 401 implement.js
c.securepaths.com/js/ 0
0 55ms
55ms Script
application/javascript 35.190.72.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c.securepaths.com/js/implement.js?org=FziBhN0qA1aE5tBQrQLl&s=5fb0764686ea6&p=TDQ47382&a=47382&cmp=47382&rd=http%3A%2F%2Fspeedflow.io%2F&rt=click&sl=0&stId=0&ty=l

Requested by

Host: traffdaq.com
URL: https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlpBNTIycnNHVFh6alpsaGxnZitnTlE9PSIsInZhbHVlIjoiRTFqT05LN2tcL3dSYUpvSmpcLzNwaTVkNzIwdDlxbXBVVzN4RmFleGN1aEkxWDJxakdjTzVUQVo4MnQyOEFIY2RFRzEySmc1SXF0UlViXC9qZHExYVZsM1dmUVFvM1NZcm0zMGlEVFJZQjVjNGM0NHpuSGFFa3dOSVVDTStNcHlQRktDMDZ3d2Jta21HYjZcL0FJZkxoVlZCdlwvQnNBalEzWGtwOXkraW1YNGxvXC8ydU82Rms0cEFXY2JlUXNVOEpJOUlIaitmTWw5ZEpyeEpwK0U2K0t0TU9CQT09IiwibWFjIjoiOGZhMjFhYmE3MzAyODE1YjI4NjRiY2YyYWEwNmU2YjgyZWYzNjU0N2E1ZjBjM2Q5YjNlZGVjMGExZTg1MTQyMiJ9

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

35.190.72.161 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

161.72.190.35.bc.googleusercontent.com

Software

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Nov 2020 00:28:56 GMT
via: 1.1 google
status: 401
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
x-xss-protection: 0
expires: 0

GET
H2 200 fingerprint2.min.js Show response
cdn.jsdelivr.net/fingerprintjs2/1.4.0/ 33 KB
10 KB 6ms
6ms Script
application/javascript 2a04:4e42:1b::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/fingerprintjs2/1.4.0/fingerprint2.min.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4ef071f26a6a95d20498fa67e78856aebf65e9e06d46046604acac1ac3e87033

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 1484124
x-cache: HIT, HIT
status: 200
cross-origin-resource-policy: cross-origin
content-length: 10191
etag: W/"83f3-ijg3WuTgKQH1Hch06eHdIajrA24"
x-served-by: cache-fra19149-FRA, cache-hhn4029-HHN
date: Sun, 15 Nov 2020 00:28:56 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 200
OK 47382 Show response
traffdaq.com/delivery/directlink/ 2 KB
1 KB 4581ms
4470ms Document
text/html 107.170.39.103
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlwvR3RBa1FiREtSXC9COGtjdVV2a0JOQT09IiwidmFsdWUiOiIxWXU1dkxKcDNqVENLUHh2TjNLaXU2SlBnZ0xMVmhva0IwTlRPekR4bWt3cjlqMHh3a05OUk1ZaXN3eFwvbDhFemFFaUpuUVpEejR1YklhbHRtNkFLR3lYZnppZVJGUW1XbXhZOWFxYVhpcjNWZ0ErTzVQUllGcysyamJMd25FU2w2dTkwcE12bUpaQktXaXUwMVRTczlZVUdmQitCM1ZwdWRzYnFEVitOOUM1Y2p6ajJKbnR4dUZuMnlla2pOMERCY3VpWE05ZzdpbjliMytMTWMycXowVndxYllieGc3dnJ3QXkxUGdLeWI0b3RIVUg3Rm9PMmUxUzdiblRuWURTYytUbEFHRDIyZGZEWUY5bEFsdlNlRnRtb1RtanI4RWY1ZFVjelNiaHh1RFFqUjZhVjBoR2dRNnhcL1ZKMW1YTnpLIiwibWFjIjoiZTIzNDliODZlOGQ2MjdiNjcyZGI2NTA2OTE3MjQ3ZTBlMzM2MDFhZGUyZWUyOGVkNWQzZGZiMjQzYTAzY2IyMSJ9&fp=66abd220fd1aeed21a48c2d9b60f0bf8
Requested by: Host: traffdaq.com
URL: https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlpBNTIycnNHVFh6alpsaGxnZitnTlE9PSIsInZhbHVlIjoiRTFqT05LN2tcL3dSYUpvSmpcLzNwaTVkNzIwdDlxbXBVVzN4RmFleGN1aEkxWDJxakdjTzVUQVo4MnQyOEFIY2RFRzEySmc1SXF0UlViXC9qZHExYVZsM1dmUVFvM1NZcm0zMGlEVFJZQjVjNGM0NHpuSGFFa3dOSVVDTStNcHlQRktDMDZ3d2Jta21HYjZcL0FJZkxoVlZCdlwvQnNBalEzWGtwOXkraW1YNGxvXC8ydU82Rms0cEFXY2JlUXNVOEpJOUlIaitmTWw5ZEpyeEpwK0U2K0t0TU9CQT09IiwibWFjIjoiOGZhMjFhYmE3MzAyODE1YjI4NjRiY2YyYWEwNmU2YjgyZWYzNjU0N2E1ZjBjM2Q5YjNlZGVjMGExZTg1MTQyMiJ9
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.170.39.103 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.16.1 (Ubuntu) /
Resource Hash: fc806a200de15fe3fab4941f1d90c4ed0e8605e0baa4f51fe216be8943e323dd

Request headers

Host: traffdaq.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlpBNTIycnNHVFh6alpsaGxnZitnTlE9PSIsInZhbHVlIjoiRTFqT05LN2tcL3dSYUpvSmpcLzNwaTVkNzIwdDlxbXBVVzN4RmFleGN1aEkxWDJxakdjTzVUQVo4MnQyOEFIY2RFRzEySmc1SXF0UlViXC9qZHExYVZsM1dmUVFvM1NZcm0zMGlEVFJZQjVjNGM0NHpuSGFFa3dOSVVDTStNcHlQRktDMDZ3d2Jta21HYjZcL0FJZkxoVlZCdlwvQnNBalEzWGtwOXkraW1YNGxvXC8ydU82Rms0cEFXY2JlUXNVOEpJOUlIaitmTWw5ZEpyeEpwK0U2K0t0TU9CQT09IiwibWFjIjoiOGZhMjFhYmE3MzAyODE1YjI4NjRiY2YyYWEwNmU2YjgyZWYzNjU0N2E1ZjBjM2Q5YjNlZGVjMGExZTg1MTQyMiJ9
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: tdqct=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlpBNTIycnNHVFh6alpsaGxnZitnTlE9PSIsInZhbHVlIjoiRTFqT05LN2tcL3dSYUpvSmpcLzNwaTVkNzIwdDlxbXBVVzN4RmFleGN1aEkxWDJxakdjTzVUQVo4MnQyOEFIY2RFRzEySmc1SXF0UlViXC9qZHExYVZsM1dmUVFvM1NZcm0zMGlEVFJZQjVjNGM0NHpuSGFFa3dOSVVDTStNcHlQRktDMDZ3d2Jta21HYjZcL0FJZkxoVlZCdlwvQnNBalEzWGtwOXkraW1YNGxvXC8ydU82Rms0cEFXY2JlUXNVOEpJOUlIaitmTWw5ZEpyeEpwK0U2K0t0TU9CQT09IiwibWFjIjoiOGZhMjFhYmE3MzAyODE1YjI4NjRiY2YyYWEwNmU2YjgyZWYzNjU0N2E1ZjBjM2Q5YjNlZGVjMGExZTg1MTQyMiJ9

Response headers

Server: nginx/1.16.1 (Ubuntu)
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: no-cache
Date: Sun, 15 Nov 2020 00:29:00 GMT
Content-Encoding: gzip

GET
H2

200

Primary Request 1X3wO Show response
tr.im/
Redirect Chain

http://tr.im/1X3wO
https://tr.im/1X3wO

9 KB
3 KB

803ms
787ms

Document
text/html

2606:4700:3032::681b:a2f8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.im/1X3wO

Requested by

Host: traffdaq.com
URL: https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlwvR3RBa1FiREtSXC9COGtjdVV2a0JOQT09IiwidmFsdWUiOiIxWXU1dkxKcDNqVENLUHh2TjNLaXU2SlBnZ0xMVmhva0IwTlRPekR4bWt3cjlqMHh3a05OUk1ZaXN3eFwvbDhFemFFaUpuUVpEejR1YklhbHRtNkFLR3lYZnppZVJGUW1XbXhZOWFxYVhpcjNWZ0ErTzVQUllGcysyamJMd25FU2w2dTkwcE12bUpaQktXaXUwMVRTczlZVUdmQitCM1ZwdWRzYnFEVitOOUM1Y2p6ajJKbnR4dUZuMnlla2pOMERCY3VpWE05ZzdpbjliMytMTWMycXowVndxYllieGc3dnJ3QXkxUGdLeWI0b3RIVUg3Rm9PMmUxUzdiblRuWURTYytUbEFHRDIyZGZEWUY5bEFsdlNlRnRtb1RtanI4RWY1ZFVjelNiaHh1RFFqUjZhVjBoR2dRNnhcL1ZKMW1YTnpLIiwibWFjIjoiZTIzNDliODZlOGQ2MjdiNjcyZGI2NTA2OTE3MjQ3ZTBlMzM2MDFhZGUyZWUyOGVkNWQzZGZiMjQzYTAzY2IyMSJ9&fp=66abd220fd1aeed21a48c2d9b60f0bf8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::681b:a2f8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/5.6.28-1+deb.sury.org~xenial+1

Resource Hash

6502b0542bc1aaddc483b417c0d253b0208b1c2cf0b0401a4d3c2a87e3b6199e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: tr.im
:scheme: https
:path: /1X3wO
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=d3f24f0f6cd2e0109faf7a5fa56f06b181605400140
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: https://traffdaq.com/delivery/directlink/47382?hash=eyJpdiI6IlwvR3RBa1FiREtSXC9COGtjdVV2a0JOQT09IiwidmFsdWUiOiIxWXU1dkxKcDNqVENLUHh2TjNLaXU2SlBnZ0xMVmhva0IwTlRPekR4bWt3cjlqMHh3a05OUk1ZaXN3eFwvbDhFemFFaUpuUVpEejR1YklhbHRtNkFLR3lYZnppZVJGUW1XbXhZOWFxYVhpcjNWZ0ErTzVQUllGcysyamJMd25FU2w2dTkwcE12bUpaQktXaXUwMVRTczlZVUdmQitCM1ZwdWRzYnFEVitOOUM1Y2p6ajJKbnR4dUZuMnlla2pOMERCY3VpWE05ZzdpbjliMytMTWMycXowVndxYllieGc3dnJ3QXkxUGdLeWI0b3RIVUg3Rm9PMmUxUzdiblRuWURTYytUbEFHRDIyZGZEWUY5bEFsdlNlRnRtb1RtanI4RWY1ZFVjelNiaHh1RFFqUjZhVjBoR2dRNnhcL1ZKMW1YTnpLIiwibWFjIjoiZTIzNDliODZlOGQ2MjdiNjcyZGI2NTA2OTE3MjQ3ZTBlMzM2MDFhZGUyZWUyOGVkNWQzZGZiMjQzYTAzY2IyMSJ9&fp=66abd220fd1aeed21a48c2d9b60f0bf8

Response headers

status: 200
date: Sun, 15 Nov 2020 00:29:01 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/5.6.28-1+deb.sury.org~xenial+1
cache-control: no-cache
strict-transport-security: max-age=15724800; includeSubDomains
cf-cache-status: DYNAMIC
cf-request-id: 066ae7355a0000c29a4405d000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
set-cookie: __cf_bm=7e873c84e614914a6e94709f8cc82fd5607cd0cb-1605400141-1800-AU6hAW1lgwONId08iDy8HH1uJ5xGUZh6erEJc41Y7pASfo7znkZdnOyP5ftdI7uIWNwfXPp+bp9sd9G1HKHUI+c=; path=/; expires=Sun, 15-Nov-20 00:59:01 GMT; domain=.tr.im; HttpOnly; Secure; SameSite=None
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6y99HrCdmeC2E1sWDS9EE5JESfiFQ%2F8z3hXUaDleqf%2FcOR4euRD2ACEcOMS5YtD7mbLO%2Bol9j5zDoM1v7%2BoBvpufCgMRrPq3ndW2mwsgtLeJDw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 5f24db022fdec29a-FRA
content-encoding: br

Redirect headers

Date: Sun, 15 Nov 2020 00:29:01 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d3f24f0f6cd2e0109faf7a5fa56f06b181605400140; expires=Tue, 15-Dec-20 00:29:00 GMT; path=/; domain=.tr.im; HttpOnly; SameSite=Lax __cf_bm=2aef60e60c9f01a0d52e9106e5840751a87d0929-1605400141-1800-Ab9mVHjYwK3cwpRX2306BnQyu9rS7t8DyumBCl0mAs1x8g+bCyCn0uQ4S9QPiSmqDeh9s1Rt7R+bUuswchceYGA=; path=/; expires=Sun, 15-Nov-20 00:59:01 GMT; domain=.tr.im; HttpOnly; SameSite=None
location: https://tr.im/1X3wO
CF-Cache-Status: DYNAMIC
cf-request-id: 066ae733e200002c4eea869000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=M5miWGwA%2Fi%2Bb%2BX%2BdsQ5xnqbChkNVj76qOSw%2Bny05pt0K0ePumelt7p5soVpUn%2BhTcGZJiHXNcB%2BXsqoU8pBNtOqD7Wccw8FJei7OlDTcjlvLGw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 5f24daffdecb2c4e-FRA

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 130 KB
45 KB 49ms
22ms Script
text/javascript 2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: tr.im
URL: https://tr.im/1X3wO

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e2d9ec1e2cf073a47db5fcc2e0b900e517662fa287e6b71d0f67e8192bc36d2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 15 Nov 2020 00:29:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 45480
x-xss-protection: 0
server: cafe
etag: 943992848640879494
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 15 Nov 2020 00:29:01 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 96 KB
38 KB 21ms
15ms Script
application/javascript 2a00:1450:4001:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-139146315-9

Requested by

Host: tr.im
URL: https://tr.im/1X3wO

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9aadb1c9bd1852dec81f38bebcb584f82b091454231d54624efadfa949bf735c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 15 Nov 2020 00:29:01 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38696
x-xss-protection: 0
last-modified: Sun, 15 Nov 2020 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 15 Nov 2020 00:29:01 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 53 KB
18 KB 150ms
53ms Script
text/javascript 216.58.207.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: tr.im
URL: https://tr.im/1X3wO

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

sffe /

Resource Hash

5f33425babf9368711eb67604b35a3d0d8f6bccf5092909f9d6c9738740a78ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 15 Nov 2020 00:29:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "694 / 346 of 1000 / last-modified: 1605309537"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18110
x-xss-protection: 0
expires: Sun, 15 Nov 2020 00:29:02 GMT

GET
H2 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/ 157 KB
23 KB 12ms
7ms Stylesheet
text/css 2001:4de0:ac19::1:b:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

Requested by

Host: tr.im
URL: https://tr.im/1X3wO

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://tr.im
Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 15 Nov 2020 00:29:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 12 May 2020 17:29:51 GMT
status: 200
etag: "1589304591"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 23841

GET
H3-Q050 200 css2
fonts.googleapis.com/ 2 KB
596 B 17ms
16ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Poppins:wght@400;500&display=swap

Requested by

Host: tr.im
URL: https://tr.im/1X3wO

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a3120d4bddcbcde8e4f0e0088646c6ab2c06e11d21257d238748f6ac76c51417

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 15 Nov 2020 00:29:01 GMT
server: ESF
date: Sun, 15 Nov 2020 00:29:01 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 15 Nov 2020 00:29:01 GMT

GET
H2 200 style.css
tr.im/bundles/trim/ad-page-072020/css/ 2 KB
866 B 23ms
18ms Stylesheet
text/css 2606:4700:3032::681b:a2f8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.im/bundles/trim/ad-page-072020/css/style.css

Requested by

Host: tr.im
URL: https://tr.im/1X3wO

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::681b:a2f8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8234f5e5b2933912bf30cbcff6aade9d5f5a2dbe15d44937c13b46090d1f1498

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 15 Nov 2020 00:29:01 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 4610
status: 200
cf-request-id: 066ae738810000c29a2e29f000000001
last-modified: Tue, 06 Oct 2020 07:24:41 GMT
server: cloudflare
etag: W/"5f7c1bb9-813"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15724800; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=vSTlZEsQPs5viaFsuk5GMKtAiEyTR7MYeVIwXEZI8GoTK8Tay44L3Pz9Aa0WY%2BlxpqbQvB6vtbhQ%2BrXXFRUwQCFTPfFX1d4dxhUR2v8KyEQg6A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 5f24db073d66c29a-FRA

GET
H2 200 logo.png
tr.im/bundles/trim/ad-page-072020/images/ 5 KB
5 KB 17ms
16ms Image
image/png 2606:4700:3032::681b:a2f8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.im/bundles/trim/ad-page-072020/images/logo.png

Requested by

Host: tr.im
URL: https://tr.im/1X3wO

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::681b:a2f8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

317b57b8207135b3223181d14cf2e213bf0b7a0050a3e2f92a48c26f13703365

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 15 Nov 2020 00:29:01 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 4610
status: 200
content-length: 4650
cf-request-id: 066ae738820000c29ae1948000000001
last-modified: Tue, 06 Oct 2020 07:24:41 GMT
server: cloudflare
etag: "5f7c1bb9-122a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15724800; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=oIuXtMreIMC6%2BCUpT7B2GOxpdm6b0%2Fu74%2FYv32kU1gVt5SPXoAsX3OWfxDQeBbzAr8y3gjCVSDZD35b7fwB6fbmX2mUbVsXsqnNy3gteXKWt8g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5f24db073d69c29a-FRA

GET
H2 200 feature.png
tr.im/bundles/trim/ad-page-072020/images/ 14 KB
15 KB 13ms
12ms Image
image/png 2606:4700:3032::681b:a2f8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.im/bundles/trim/ad-page-072020/images/feature.png

Requested by

Host: tr.im
URL: https://tr.im/1X3wO

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::681b:a2f8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3a2ed372eb25f036218e1cf130657ba79eff86384c1292bb16c95e4d34af5d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 15 Nov 2020 00:29:01 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 4609
status: 200
content-length: 14664
cf-request-id: 066ae738820000c29ad89d9000000001
last-modified: Tue, 06 Oct 2020 07:24:41 GMT
server: cloudflare
etag: "5f7c1bb9-3948"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15724800; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=UJx3tfae8kI%2Bp2xCqO8Q%2FD%2FsacQNT%2Fc076L5dWgSThQxAZ8DmYH5CMNGcVf32GqMSicSnj2CQDR3eZfrfv5l0LKIRe2b09qcdj9XxRORrnveOA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5f24db073d6bc29a-FRA

GET
H3-Q050 200 pxiByp8kv8JHgFVrLGT9Z1xlFd2JQEk.woff2
fonts.gstatic.com/s/poppins/v15/ 8 KB
8 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLGT9Z1xlFd2JQEk.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@400;500&display=swap

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ba57e3ccc2e3b2bdf8cc9e613194b802607682bf473293c2e3e29de82c9491

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://tr.im
Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 14 Nov 2020 22:12:56 GMT
x-content-type-options: nosniff
last-modified: Thu, 05 Nov 2020 22:01:44 GMT
server: sffe
age: 8165
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7776
x-xss-protection: 0
expires: Sun, 14 Nov 2021 22:12:56 GMT

GET
H3-Q050 200 pxiEyp8kv8JHgFVrJJfecnFHGPc.woff2
fonts.gstatic.com/s/poppins/v15/ 8 KB
8 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJfecnFHGPc.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@400;500&display=swap

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://tr.im
Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 14 Nov 2020 22:12:56 GMT
x-content-type-options: nosniff
last-modified: Thu, 05 Nov 2020 22:01:13 GMT
server: sffe
age: 8165
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7900
x-xss-protection: 0
expires: Sun, 14 Nov 2021 22:12:56 GMT

GET
H3-Q050 200 analytics.js Show response
www.google-analytics.com/ 46 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-139146315-9

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 23 Oct 2020 03:00:57 GMT
server: Golfe2
age: 4394
date: Sat, 14 Nov 2020 23:15:48 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18817
expires: Sun, 15 Nov 2020 01:15:48 GMT

GET
H3-Q050 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20201111/r20190131/ 231 KB
87 KB 53ms
39ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20201111/r20190131/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c97cace8f7fa9112f2a5e3a3ac34e7b07c429db92b765072816136b7c99aeae7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 15 Nov 2020 00:29:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 88641
x-xss-protection: 0
server: cafe
etag: 13763883164775661416
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 15 Nov 2020 00:29:02 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20201111/r20190131/ Frame 11C2 0
0 6ms
5ms Document
text/html 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20201111/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20201111/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tr.im/1X3wO
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: https://tr.im/1X3wO

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Sat, 14 Nov 2020 19:55:18 GMT
expires: Sat, 28 Nov 2020 19:55:18 GMT
content-type: text/html; charset=UTF-8
etag: 5228831996244654541
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4745
x-xss-protection: 0
age: 16424
cache-control: public, max-age=1209600
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
58 B 13ms
12ms XHR
text/plain 2a00:1450:4001:81a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j87&a=64176765&t=pageview&_s=1&dl=https%3A%2F%2Ftr.im%2F1X3wO&ul=en-us&de=UTF-8&dt=tr.im%20-%20url%20shortener&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=1949115851&gjid=924393601&cid=723068156.1605400142&tid=UA-139146315-9&_gid=379876801.1605400142&_r=1&gtm=2oub41&z=1129662255

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 15 Nov 2020 00:29:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://tr.im
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 195 B
637 B 153ms
54ms Script
text/javascript 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=tr.im&callback=_gfp_s_&client=ca-pub-1229858928340193

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201111/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

cf395a92958f1b6c5e5648601b92bebcf4ba13ec17663db126511762ce97cce9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 15 Nov 2020 00:29:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 188
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
803 B 35ms
15ms Script
application/javascript 2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=tr.im

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201111/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 15 Nov 2020 00:29:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
803 B 35ms
15ms Script
application/javascript 2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=tr.im

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201111/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 15 Nov 2020 00:29:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame BA36 0
0 25ms
24ms Document
text/html 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-1229858928340193&output=html&adk=1812271804&adf=3025194257&lmt=1605400142&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Ftr.im%2F1X3wO&ea=0&flash=0&pra=5&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1605400142039&bpp=13&bdt=101&idt=73&shv=r20201111&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2138544974175&frm=20&pv=2&ga_vid=723068156.1605400142&ga_sid=1605400142&ga_hid=64176765&ga_fc=0&iag=0&icsg=8746&dssz=16&mdo=0&mso=0&u_tz=60&u_his=3&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21068083&oid=3&pvsid=2769429149256959&pem=389&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=95

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201111/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-1229858928340193&output=html&adk=1812271804&adf=3025194257&lmt=1605400142&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Ftr.im%2F1X3wO&ea=0&flash=0&pra=5&wgl=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1605400142039&bpp=13&bdt=101&idt=73&shv=r20201111&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2138544974175&frm=20&pv=2&ga_vid=723068156.1605400142&ga_sid=1605400142&ga_hid=64176765&ga_fc=0&iag=0&icsg=8746&dssz=16&mdo=0&mso=0&u_tz=60&u_his=3&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21068083&oid=3&pvsid=2769429149256959&pem=389&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=0&uci=a!0&fsb=1&dtd=95
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tr.im/1X3wO
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: https://tr.im/1X3wO

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 15 Nov 2020 00:29:02 GMT
server: cafe
content-length: 46
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 15-Nov-2020 00:44:02 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Sun, 15 Nov 2020 00:29:02 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 62ms
42ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201111/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

587843e8250773df7ab65fc848b867dafea14bda7e849b9839500ae19893940e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 15 Nov 2020 00:29:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1605271279018746"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28206
x-xss-protection: 0
expires: Sun, 15 Nov 2020 00:29:02 GMT

GET
H3-Q050 200 pubads_impl_2020111001.js Show response
securepubads.g.doubleclick.net/gpt/ 276 KB
98 KB 120ms
67ms Script
text/javascript 216.58.207.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111001.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

sffe /

Resource Hash

f1b23a6200bdb4728ad055b6439a7055e73c62e61a97804fa6ac13871164c198

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 15 Nov 2020 00:29:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 99726
x-xss-protection: 0
last-modified: Tue, 10 Nov 2020 09:44:01 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Nov 2020 00:29:02 GMT

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 8 KB
4 KB 101ms
101ms XHR
text/plain 216.58.207.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2769429149256959&correlator=1069973743817191&output=ldjh&impl=fifs&adsid=NT&eid=21067447%2C21068418&vrg=2020111001&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201115&iu_parts=7421032%2Ctr.im_top_banner%2Ctr.im_300x250%2Ctr.im_intermediary_ad_unit&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=320x100%7C728x90%7C320x50%2C300x250%2C1x1&cookie=ID%3D44bf9846971cd37b-22bf74516fa600f4%3AT%3D1605400142%3ART%3D1605400142%3AS%3DALNI_MY-qry3_w6-5gu-B_fpwdVfuGClHg&bc=31&abxe=1&lmt=1605400142&dt=1605400142378&dlt=1605400141938&idt=424&frm=20&biw=1600&bih=1200&oid=3&adxs=640%2C650%2C0&adys=128%2C326%2C1473&adks=3911691608%2C2859235672%2C716300676&ucis=1%7C2%7C3&ifi=1&u_tz=60&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftr.im%2F1X3wO&dssz=18&icsg=559274&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x100%7C300x250%7C1600x1473&msz=1600x100%7C300x-1%7C1x-1&ga_vid=723068156.1605400142&ga_sid=1605400142&ga_hid=64176765&fws=0%2C0%2C0&ohw=0%2C0%2C0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111001.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

cafe /

Resource Hash

a64c184d1f685480a87e3e9d211d09bb5171138e663e6f7d98f11d6bd44b7a05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 15 Nov 2020 00:29:02 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
google-lineitem-id: 5459744855,5448126947,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138321056366,138319698993,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://tr.im
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
2cf0360927c04e88a6bc77a18772e743.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 95ms
40ms Other
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://2cf0360927c04e88a6bc77a18772e743.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111001.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 45ms
32ms XHR
application/json 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20201111&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201111/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f55710e1d80a9d738e1979d9b9d48832fa716fccc44b58cd8eb3fde502fc0857

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 15 Nov 2020 00:29:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6439
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 16 KB
6 KB 60ms
39ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201111/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 15 Nov 2020 00:29:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1603823857801521"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6015
x-xss-protection: 0
expires: Sun, 15 Nov 2020 00:29:02 GMT

GET
H3-Q050 200 container.html
2cf0360927c04e88a6bc77a18772e743.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 9F44 0
0 33ms
20ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2cf0360927c04e88a6bc77a18772e743.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111001.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 2cf0360927c04e88a6bc77a18772e743.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tr.im/1X3wO
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: https://tr.im/1X3wO

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2973
date: Sun, 15 Nov 2020 00:29:02 GMT
expires: Mon, 15 Nov 2021 00:29:02 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 container.html
2cf0360927c04e88a6bc77a18772e743.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame BB40 0
0 31ms
21ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2cf0360927c04e88a6bc77a18772e743.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111001.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 2cf0360927c04e88a6bc77a18772e743.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tr.im/1X3wO
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: https://tr.im/1X3wO

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2973
date: Sun, 15 Nov 2020 00:29:02 GMT
expires: Mon, 15 Nov 2021 00:29:02 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/219/ Frame BB8B 0
0 33ms
20ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/219/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tr.im/1X3wO
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
referer: http://speedflow.io/adult/a=rr
Referer: https://tr.im/1X3wO

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 4867
date: Sat, 14 Nov 2020 23:31:33 GMT
expires: Sun, 14 Nov 2021 23:31:33 GMT
last-modified: Mon, 05 Oct 2020 22:33:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3449
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
88 B 15ms
14ms Image
image/gif 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=219&t=2&li=gda_r20201111&jk=2769429149256959&bg=!HR6lHj7NAAVGySeIRlhFOOL9qtPHhgIAAACSUgAAAA9oAQcKAPVmVhmwqtyUfXjoedtuM7QDBFhf8HKES6f2QXg1d9W8gZch-C4S9HJ4uBoiA_az-nrVa4NoeyZBKKMtfd6ylBpTCWe8X5ZU9o5QTdqWQA8fRHOFLpb3aBJoRdr7EgCiQzRpVoRrJqAkew7mUpi3cAgbcOQh9T52E96jRdZqFDcyaYlW7Pg1Dzz7eQtPMp9Fiy8cgE-AaE1oo-kCvqr-BIxYYJPEcXfAaG5bFDOtNdGEG_pM3xDAAi1BfacAlDF-7fKyOB_eUA88-3yrPy9O7qVhqF1bR9sKOipmQ6FPAn58wwsLAoSDd9I1sgOfxm1xRNd-7uHYm5kBrlHv78NYLtmcz-Q5rt1EII1G-bRqt1fnJguH6MhdelXPU-HlZLFngbDsBsM-_n5UBdKYknASy_rYbzQ9t38dmZFkyBq1NLbRbwSoetUJa3q8W-8FnOoSyTyOCricesEA0RyXT-anzcBqHwuyVOXNbtzz1UZ0N9nSfPK6pvpdf413IwoqDLcF1CVYUdtxObXrY1PbFyPdvJ-1NpjlGPK9A77KG7E_mfXO2AhzhtelPrbLAZu6xIVVI6vYAjqoG6NhjZ2IJcmL2AcnEnQauK8HtAgpd9NiYGgbPb7Cv5fKhxiWHSNJ9SQaibaSa4RD3f0NMY5-xoBJuaeRVkC3YZ9Up83yZLlflul3N9oSeAyzwQrJ-y5yUX3NU3YWIBvqBq74z78Y9iv5odBDwv70bHwDJmHenB1oLlxXogppP2giS-gLXwEsOMYNHmC0uBJoUvYfIxZCYB5-qWTXekUt7bXJcbUO8VR9DiyVHPAFqMFXhE3z4HZuS0negvAEcCCKmn7QkyVhH-bpqTR3ePRpr3LAY2w2SlXRb17LVuUizsLk8JD3olcedLN6EQL_85rcucQ

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://speedflow.io/adult/a=rr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Nov 2020 00:29:02 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
status: 204
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET /
prestige.weallin2.com/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: poweredby.jads.co
URL: https://poweredby.jads.co/js/jads.js

Domain: prestige.weallin2.com
URL: http://prestige.weallin2.com/?utm_source=tr.im&utm_medium=no_referer&utm_campaign=tr.im%2F1X3wO&utm_content=direct_input

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2cf0360927c04e88a6bc77a18772e743.safeframe.googlesyndication.com
acceptable.a-ads.com
adservice.google.com
adservice.google.de
c.securepaths.com
cdn.jsdelivr.net
cors-anywhere.herokuapp.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
pagead2.googlesyndication.com
partner.googleadservices.com
poweredby.jads.co
prestige.weallin2.com
securepubads.g.doubleclick.net
speedflow.io
stackpath.bootstrapcdn.com
tpc.googlesyndication.com
tr.im
traffdaq.com
www.google-analytics.com
www.googletagmanager.com
www.googletagservices.com
poweredby.jads.co
prestige.weallin2.com
107.170.39.103
172.217.22.66
198.54.116.135
2001:4de0:ac19::1:b:2a
213.239.209.209
216.58.207.66
2606:4700:3032::681b:a2f8
2a00:1450:4001:801::2001
2a00:1450:4001:801::2003
2a00:1450:4001:806::200a
2a00:1450:4001:80b::2001
2a00:1450:4001:817::2002
2a00:1450:4001:81a::200e
2a00:1450:4001:81c::2002
2a00:1450:4001:81f::2002
2a00:1450:4001:820::2008
2a04:4e42:1b::621
34.235.104.230
35.190.72.161
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
1b174325abf58e45fc6963c91702f15c105cbe8763e5c13710319335d718f904
317b57b8207135b3223181d14cf2e213bf0b7a0050a3e2f92a48c26f13703365
41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c
4ef071f26a6a95d20498fa67e78856aebf65e9e06d46046604acac1ac3e87033
587843e8250773df7ab65fc848b867dafea14bda7e849b9839500ae19893940e
5f33425babf9368711eb67604b35a3d0d8f6bccf5092909f9d6c9738740a78ad
6502b0542bc1aaddc483b417c0d253b0208b1c2cf0b0401a4d3c2a87e3b6199e
66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d543c8e115fdf217b58e35a469a38eae98936da7f4b983c2787644cfbb7cf96
8234f5e5b2933912bf30cbcff6aade9d5f5a2dbe15d44937c13b46090d1f1498
9aadb1c9bd1852dec81f38bebcb584f82b091454231d54624efadfa949bf735c
a3120d4bddcbcde8e4f0e0088646c6ab2c06e11d21257d238748f6ac76c51417
a64c184d1f685480a87e3e9d211d09bb5171138e663e6f7d98f11d6bd44b7a05
ae7e01e27045ad144b76f11452d24884ed48eda63fcf9c044fbd7ad7d6b81ff4
c97cace8f7fa9112f2a5e3a3ac34e7b07c429db92b765072816136b7c99aeae7
cf395a92958f1b6c5e5648601b92bebcf4ba13ec17663db126511762ce97cce9
d7ba57e3ccc2e3b2bdf8cc9e613194b802607682bf473293c2e3e29de82c9491
e2d9ec1e2cf073a47db5fcc2e0b900e517662fa287e6b71d0f67e8192bc36d2f
e3a2ed372eb25f036218e1cf130657ba79eff86384c1292bb16c95e4d34af5d2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
f1b23a6200bdb4728ad055b6439a7055e73c62e61a97804fa6ac13871164c198
f55710e1d80a9d738e1979d9b9d48832fa716fccc44b58cd8eb3fde502fc0857
fc806a200de15fe3fab4941f1d90c4ed0e8605e0baa4f51fe216be8943e323dd

tr.im Open in urlscan Pro 2606:4700:3032::681b:a2f8 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

42 Requests

90 %HTTPS

63 %IPv6

20 Domains

23 Subdomains

20 IPs

4 Countries

434 kBTransfer

1191 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

42 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

tr.im Open in urlscan Pro
2606:4700:3032::681b:a2f8 Public Scan

Screenshot
Live screenshot

Full Image

42
Requests

90 %
HTTPS

63 %
IPv6

20
Domains

23
Subdomains

20
IPs

4
Countries

434 kB
Transfer

1191 kB
Size

0
Cookies

42 HTTP transactions
0 data transactions