urlscan.io logo urlscan.io
SecurityTrails logo

www.mediafire.com Open in urlscan Pro
104.16.113.74  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Submission: On December 01 via manual from CA — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 107 IPs in 13 countries across 132 domains to perform 645 HTTP transactions. The main IP is 104.16.113.74, located in and belongs to CLOUDFLARENET, US. The main domain is www.mediafire.com. The Cisco Umbrella rank of the primary domain is 42789.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on September 18th 2023. Valid for: a year.
This is the only time www.mediafire.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 16 104.16.113.74 13335 (CLOUDFLAR...)
2 104.21.28.48 13335 (CLOUDFLAR...)
9 142.250.31.97 15169 (GOOGLE)
1 172.67.41.60 13335 (CLOUDFLAR...)
1 172.67.170.144 13335 (CLOUDFLAR...)
3 172.253.115.100 15169 (GOOGLE)
1 104.16.56.101 13335 (CLOUDFLAR...)
1 52.85.150.163 16509 (AMAZON-02)
2 104.19.214.37 13335 (CLOUDFLAR...)
2 216.239.36.178 15169 (GOOGLE)
1 157.240.244.35 32934 (FACEBOOK)
9 172.253.122.94 15169 (GOOGLE)
5 172.253.115.95 15169 (GOOGLE)
41 18.213.98.197 14618 (AMAZON-AES)
29 172.64.137.15 13335 (CLOUDFLAR...)
7 130.211.23.194 396982 (GOOGLE-CL...)
2 104.26.2.70 13335 (CLOUDFLAR...)
13 172.253.63.149 15169 (GOOGLE)
2 142.251.111.101 15169 (GOOGLE)
25 172.253.63.154 15169 (GOOGLE)
4 23.215.40.199 16625 (AKAMAI-AS)
2 157.240.244.1 32934 (FACEBOOK)
2 108.138.85.84 16509 (AMAZON-02)
1 54.83.134.184 14618 (AMAZON-AES)
2 5 3.93.99.238 14618 (AMAZON-AES)
6 172.253.122.105 15169 (GOOGLE)
2 172.67.75.241 13335 (CLOUDFLAR...)
1 74.119.119.129 19750 (AS-CRITEO)
3 147.28.129.37 54825 (PACKET)
5 26 51.222.39.187 16276 (OVH)
1 185.64.189.112 62713 (AS-PUBMATIC)
1 19 172.67.10.198 13335 (CLOUDFLAR...)
1 35.161.33.4 16509 (AMAZON-02)
1 185.106.140.18 7979 (SERVERS-COM)
1 54.87.125.83 14618 (AMAZON-AES)
1 23.227.151.194 55081 (24SHELLS)
7 212.36.83.246 15699 (AS_ADAM A...)
7 54.88.209.131 14618 (AMAZON-AES)
2 151.101.193.229 54113 (FASTLY)
1 104.22.53.86 13335 (CLOUDFLAR...)
1 34.102.146.192 396982 (GOOGLE-CL...)
2 74.119.119.131 19750 (AS-CRITEO)
1 99.84.222.71 16509 (AMAZON-02)
1 34.96.70.87 396982 (GOOGLE-CL...)
1 204.237.133.242 62713 (AS-PUBMATIC)
1 44.235.17.74 16509 (AMAZON-02)
3 162.19.138.120 16276 (OVH)
12 172.253.115.101 15169 (GOOGLE)
47 172.253.122.155 15169 (GOOGLE)
2 178.128.135.204 14061 (DIGITALOC...)
7 172.253.62.132 15169 (GOOGLE)
24 76 172.253.62.154 15169 (GOOGLE)
1 2 34.120.135.53 396982 (GOOGLE-CL...)
2 7 34.98.64.218 396982 (GOOGLE-CL...)
6 6 185.167.164.49 198622 (ADFORM)
2 4 67.220.228.201 16509 (AMAZON-02)
9 9 3.33.220.150 16509 (AMAZON-02)
43 172.253.115.149 15169 (GOOGLE)
26 142.251.16.132 15169 (GOOGLE)
5 7 104.18.36.155 13335 (CLOUDFLAR...)
16 19 68.67.179.164 29990 (ASN-APPNEX)
3 4 50.116.194.21 6336 (TURN-US-ASN)
8 8 205.180.85.204 25751 (VALUECLICK)
3 3 35.194.66.159 396982 (GOOGLE-CL...)
4 4 107.22.47.225 14618 (AMAZON-AES)
2 2 82.145.213.8 39832 (NO-OPERA)
1 2 23.197.41.36 16625 (AKAMAI-AS)
9 11 199.127.204.142 26120 (RHYTHMONE)
5 13 35.71.139.29 16509 (AMAZON-02)
1 1 23.45.180.209 ()
4 13.32.151.88 16509 (AMAZON-02)
1 34.196.127.236 14618 (AMAZON-AES)
1 2 52.54.71.185 14618 (AMAZON-AES)
1 1 185.98.54.153 39572 (ADVANCEDH...)
5 5 54.205.205.150 14618 (AMAZON-AES)
6 6 5.161.188.99 213230 (HETZNER-C...)
4 52.50.63.24 16509 (AMAZON-02)
6 8 3.225.218.10 14618 (AMAZON-AES)
3 3 37.157.2.229 198622 (ADFORM)
1 23.227.146.18 55081 (24SHELLS)
1 21 52.88.192.204 16509 (AMAZON-02)
3 212.36.83.245 15699 (AS_ADAM A...)
3 3 207.198.113.203 13768 (COGECO-PEER1)
3 5 34.111.113.62 396982 (GOOGLE-CL...)
9 11 35.211.178.172 15169 (GOOGLE)
2 2 74.121.140.211 30419 (MEDIAMATH...)
2 3 213.19.162.80 3356 (LEVEL3)
3 3 63.251.28.134 26558 (FREEWHEEL)
29 49 8.43.72.97 26667 (RUBICONPR...)
2 2 80.77.87.163 46636 (NATCOWEB)
2 4 23.105.12.171 30633 (LEASEWEB-...)
1 6 52.46.130.91 16509 (AMAZON-02)
9 10 104.36.113.110 62713 (AS-PUBMATIC)
1 1 198.148.27.131 19189 (PULSEPOINT)
3 10 104.36.113.107 62713 (AS-PUBMATIC)
1 162.19.138.116 16276 (OVH)
4 5 104.36.113.112 ()
2 13.107.42.14 8068 (MICROSOFT...)
2 3 34.202.221.201 14618 (AMAZON-AES)
2 2 52.5.229.57 14618 (AMAZON-AES)
2 2 23.83.76.89 395954 (LEASEWEB-...)
2 2 3.212.153.35 14618 (AMAZON-AES)
2 2 38.98.69.175 ()
2 2 199.38.167.131 54312 (ROCKETFUEL)
3 3 18.67.76.70 16509 (AMAZON-02)
3 3.226.187.105 14618 (AMAZON-AES)
2 3 72.251.238.254 32475 (SINGLEHOP...)
3 80.239.138.24 1299 (TWELVE99 ...)
5 5 70.42.32.255 13789 (INTERNAP-...)
4 4 185.184.8.90 204995 (RTB-HOUSE...)
2 7 23.83.76.73 395954 (LEASEWEB-...)
2 4 192.184.69.215 16509 (AMAZON-02)
1 2 192.0.77.40 2635 (AUTOMATTIC)
3 3 52.86.218.58 14618 (AMAZON-AES)
1 1 45.137.176.88 60350 (VP)
1 1 69.10.32.226 19318 (IS-AS-1)
1 1 54.88.4.137 14618 (AMAZON-AES)
2 2 96.46.186.57 7979 (SERVERS-COM)
2 2 192.132.33.69 18568 (BIDTELLECT)
2 3 35.244.154.8 15169 (GOOGLE)
3 3 184.84.195.97 16625 (AKAMAI-AS)
6 23.197.42.81 16625 (AKAMAI-AS)
1 1 52.85.151.39 16509 (AMAZON-02)
1 2 52.85.132.15 16509 (AMAZON-02)
2 2 54.165.74.222 14618 (AMAZON-AES)
1 80.239.138.59 ()
1 23.92.190.68 10913 (INTERNAP-BLK)
1 2 172.64.146.152 ()
2 169.197.150.8 ()
2 34.203.168.193 14618 (AMAZON-AES)
1 34.107.140.113 ()
1 70.42.32.191 ()
2 2 50.17.66.232 14618 (AMAZON-AES)
1 107.23.186.129 ()
1 44.214.40.113 ()
3 3 173.231.178.85 ()
1 34.96.105.8 396982 (GOOGLE-CL...)
1 96.46.186.182 ()
1 34.107.148.139 ()
10 8.28.7.83 ()
1 1 54.161.26.122 14618 (AMAZON-AES)
645 107
16    104.16.113.74 (None, )

ASN13335 (CLOUDFLARENET, US)
www.mediafire.com
static.mediafire.com
2    104.21.28.48 (None, )

ASN13335 (CLOUDFLARENET, US)
the.gatekeeperconsent.com
privacy.gatekeeperconsent.com
9    142.250.31.97 (Oxford, United States)

ASN15169 (GOOGLE, US)
PTR: bj-in-f97.1e100.net
www.googletagmanager.com
1    172.67.41.60 (United States)

ASN13335 (CLOUDFLARENET, US)
btloader.com
1    172.67.170.144 (United States)

ASN13335 (CLOUDFLARENET, US)
www.ezojs.com
3    172.253.115.100 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f100.1e100.net
translate.google.com
fundingchoicesmessages.google.com
1    104.16.56.101 (None, )

ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com
1    52.85.150.163 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-150-163.iad89.r.cloudfront.net
cdn.amplitude.com
2    104.19.214.37 (None, )

ASN13335 (CLOUDFLARENET, US)
cdn.otnolatrnup.com
otnolatrnup.com
2    216.239.36.178 (United States)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    157.240.244.35 (Apodaca, Mexico)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-mty2.facebook.com
www.facebook.com
9    172.253.122.94 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f94.1e100.net
www.gstatic.com
www.google.ca
fonts.gstatic.com
5    172.253.115.95 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f95.1e100.net
translate.googleapis.com
fonts.googleapis.com
41    18.213.98.197 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-213-98-197.compute-1.amazonaws.com
g.ezoic.net
29    172.64.137.15 (United States)

ASN13335 (CLOUDFLARENET, US)
go.ezodn.com
g.ezodn.com
bshr.ezodn.com
7    130.211.23.194 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 194.23.211.130.bc.googleusercontent.com
api.btloader.com
2    104.26.2.70 (None, )

ASN13335 (CLOUDFLARENET, US)
ad-delivery.net
13    172.253.63.149 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f149.1e100.net
ad.doubleclick.net
2    142.251.111.101 (United States)

ASN15169 (GOOGLE, US)
PTR: bk-in-f101.1e100.net
analytics.google.com
25    172.253.63.154 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f154.1e100.net
stats.g.doubleclick.net
securepubads.g.doubleclick.net
www.googletagservices.com
4    23.215.40.199 (McAllen, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-215-40-199.deploy.static.akamaitechnologies.com
ads.pubmatic.com
2    157.240.244.1 (Apodaca, Mexico)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-mty2.fbcdn.net
static.xx.fbcdn.net
2    108.138.85.84 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-85-84.iad12.r.cloudfront.net
tags.crwdcntrl.net
1    54.83.134.184 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-83-134-184.compute-1.amazonaws.com
ad.crwdcntrl.net
5    3.93.99.238 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-93-99-238.compute-1.amazonaws.com
bcp.crwdcntrl.net
id.crwdcntrl.net
sync.crwdcntrl.net
6    172.253.122.105 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f105.1e100.net
www.google.com
2    172.67.75.241 (United States)

ASN13335 (CLOUDFLARENET, US)
script.4dex.io
1    74.119.119.129 (United States)

ASN19750 (AS-CRITEO, US)
PTR: bidder.va1.vip.prod.criteo.com
bidder.criteo.com
3    147.28.129.37 (Ashburn, United States)

ASN54825 (PACKET, US)
prebid.a-mo.net
26    51.222.39.187 (Canada)

ASN16276 (OVH, FR)
PTR: ip187.ip-51-222-39.net
onetag-sys.com
1    185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
hbopenbid.pubmatic.com
19    172.67.10.198 (United States)

ASN13335 (CLOUDFLARENET, US)
prebid.smilewanted.com
csync.smilewanted.com
static.smilewanted.com
1    35.161.33.4 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-161-33-4.us-west-2.compute.amazonaws.com
hb-api.omnitagjs.com
1    185.106.140.18 (Netherlands)

ASN7979 (SERVERS-COM, US)
rtb.adxpremium.services
1    54.87.125.83 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-87-125-83.compute-1.amazonaws.com
hb.yellowblue.io
1    23.227.151.194 (Piscataway, United States)

ASN55081 (24SHELLS, US)
ghb.adtelligent.com
7    212.36.83.246 (Sant Vicenç dels Horts, Spain)

ASN15699 (AS_ADAM Adam Datacenter, ES)
PTR: lb2.vdmy.dtic.es
d.vidoomy.com
a.vidoomy.com
7    54.88.209.131 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-88-209-131.compute-1.amazonaws.com
ads.yieldmo.com
2    151.101.193.229 (United States)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
1    104.22.53.86 (None, )

ASN13335 (CLOUDFLARENET, US)
cdn.id5-sync.com
1    34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.146.102.34.bc.googleusercontent.com
oa.openxcdn.net
2    74.119.119.131 (United States)

ASN19750 (AS-CRITEO, US)
static.criteo.net
1    99.84.222.71 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-222-71.iad79.r.cloudfront.net
cdn.prod.uidapi.com
1    34.96.70.87 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 87.70.96.34.bc.googleusercontent.com
invstatic101.creativecdn.com
1    204.237.133.242 (United States)

ASN62713 (AS-PUBMATIC, US)
ut.pubmatic.com
1    44.235.17.74 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-235-17-74.us-west-2.compute.amazonaws.com
api.amplitude.com
3    162.19.138.120 (Frankfurt am Main, Germany)

ASN16276 (OVH, FR)
PTR: ns31533571.ip-162-19-138.eu
id5-sync.com
12    172.253.115.101 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f101.1e100.net
fundingchoicesmessages.google.com
47    172.253.122.155 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f155.1e100.net
pagead2.googlesyndication.com
2    178.128.135.204 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
rt.marphezis.com
7    172.253.62.132 (United States)

ASN15169 (GOOGLE, US)
PTR: bc-in-f132.1e100.net
c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
76    172.253.62.154 (United States)

ASN15169 (GOOGLE, US)
PTR: bc-in-f154.1e100.net
googleads.g.doubleclick.net
cm.g.doubleclick.net
2    34.120.135.53 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 53.135.120.34.bc.googleusercontent.com
oajs.openx.net
7    34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com
google-bidout-d.openx.net
eu-u.openx.net
us-u.openx.net
u.openx.net
6    185.167.164.49 (Denmark)

ASN198622 (ADFORM, DK)
c1.adform.net
4    67.220.228.201 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
aax-eu.amazon-adsystem.com
9    3.33.220.150 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com
match.adsrvr.org
43    172.253.115.149 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f149.1e100.net
s0.2mdn.net
26    142.251.16.132 (United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f132.1e100.net
tpc.googlesyndication.com
7    104.18.36.155 (None, )

ASN13335 (CLOUDFLARENET, US)
dsum-sec.casalemedia.com
ssum-sec.casalemedia.com
19    68.67.179.164 (North Bergen, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
ib.adnxs.com
secure.adnxs.com
4    50.116.194.21 (United States)

ASN6336 (TURN-US-ASN, US)
PTR: presentation-atl1.turn.com
ad.turn.com
r.turn.com
8    205.180.85.204 (United States)

ASN25751 (VALUECLICK, US)
PTR: iad06-nessy-float2.dotomi.com
dclk-match.dotomi.com
rubicon-match.dotomi.com
pubmatic-match.dotomi.com
3    35.194.66.159 (Washington, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 159.66.194.35.bc.googleusercontent.com
um.simpli.fi
4    107.22.47.225 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-107-22-47-225.compute-1.amazonaws.com
match.360yield.com
2    82.145.213.8 (Norway)

ASN39832 (NO-OPERA, NO)
PTR: n-sysadmin-jumpbox-03.feednews.opera.technology
t.adx.opera.com
2    23.197.41.36 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-197-41-36.deploy.static.akamaitechnologies.com
sync.teads.tv
11    199.127.204.142 (United States)

ASN26120 (RHYTHMONE, US)
sync.1rx.io
sync.targeting.unrulymedia.com
13    35.71.139.29 (United States)

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com
eb2.3lift.com
1    23.45.180.209 (None, )

ASN- ()
analytics.pangle-ads.com
4    13.32.151.88 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-151-88.iad66.r.cloudfront.net
bucket.cdnwebcloud.com
1    34.196.127.236 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-196-127-236.compute-1.amazonaws.com
partners.tremorhub.com
2    52.54.71.185 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-54-71-185.compute-1.amazonaws.com
rtb.adentifi.com
1    185.98.54.153 (Netherlands)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
s.uuidksinc.net
5    54.205.205.150 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-205-205-150.compute-1.amazonaws.com
sync.srv.stackadapt.com
6    5.161.188.99 (Ashburn, United States)

ASN213230 (HETZNER-CLOUD2-AS, DE)
PTR: static.99.188.161.5.clients.your-server.de
sync-dmp.mobtrakk.com
4    52.50.63.24 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-50-63-24.eu-west-1.compute.amazonaws.com
neural40.cdnwebcloud.com
8    3.225.218.10 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-218-10.compute-1.amazonaws.com
ups.analytics.yahoo.com
3    37.157.2.229 (Denmark)

ASN198622 (ADFORM, DK)
cm.adform.net
1    23.227.146.18 (Piscataway, United States)

ASN55081 (24SHELLS, US)
sync.adtelligent.com
21    52.88.192.204 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-88-192-204.us-west-2.compute.amazonaws.com
visitor.omnitagjs.com
visitor-us-west-2.omnitagjs.com
3    212.36.83.245 (Sant Vicenç dels Horts, Spain)

ASN15699 (AS_ADAM Adam Datacenter, ES)
PTR: lb1.vdmy.dtic.es
a-prebid.vidoomy.com
3    207.198.113.203 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)
pixel-sync.sitescout.com
5    34.111.113.62 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com
pixel.tapad.com
11    35.211.178.172 (North Charleston, United States)

ASN15169 (GOOGLE, US)
PTR: 172.178.211.35.bc.googleusercontent.com
x.bidswitch.net
2    74.121.140.211 (Reston, United States)

ASN30419 (MEDIAMATH-INC, US)
sync.mathtag.com
3    213.19.162.80 (United Kingdom)

ASN3356 (LEVEL3, US)
pixel-eu.rubiconproject.com
3    63.251.28.134 (Secaucus, United States)

ASN26558 (FREEWHEEL, US)
ads.stickyadstv.com
49    8.43.72.97 (United States)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
token.rubiconproject.com
2    80.77.87.163 (Clifton, United States)

ASN46636 (NATCOWEB, US)
cs.admanmedia.com
4    23.105.12.171 (Manassas, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
ssbsync-global.smartadserver.com
ssbsync.smartadserver.com
6    52.46.130.91 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
s.amazon-adsystem.com
10    104.36.113.110 (United States)

ASN62713 (AS-PUBMATIC, US)
image8.pubmatic.com
1    198.148.27.131 (New York, United States)

ASN19189 (PULSEPOINT, US)
bh.contextweb.com
10    104.36.113.107 (United States)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
1    162.19.138.116 (Frankfurt am Main, Germany)

ASN16276 (OVH, FR)
PTR: ns31533567.ip-162-19-138.eu
lb.eu-1-id5-sync.com
5    104.36.113.112 (None, )

ASN- ()
image6.pubmatic.com
2    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
3    34.202.221.201 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-202-221-201.compute-1.amazonaws.com
pr-bh.ybp.yahoo.com
2    52.5.229.57 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-5-229-57.compute-1.amazonaws.com
ads.creative-serving.com
2    23.83.76.89 (Los Angeles, United States)

ASN395954 (LEASEWEB-USA-LAX, US)
sync.smartadserver.com
2    3.212.153.35 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-212-153-35.compute-1.amazonaws.com
ice.360yield.com
2    38.98.69.175 (None, )

ASN- ()
aep.mxptint.net
2    199.38.167.131 (United States)

ASN54312 (ROCKETFUEL, US)
p.rfihub.com
3    18.67.76.70 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-67-76-70.iad89.r.cloudfront.net
s.ad.smaato.net
3    3.226.187.105 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-226-187-105.compute-1.amazonaws.com
match.sharethrough.com
3    72.251.238.254 (United States)

ASN32475 (SINGLEHOP-LLC, US)
ap.lijit.com
3    80.239.138.24 (Sweden)

ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE)
code.createjs.com
5    70.42.32.255 (United States)

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com
b1sync.zemanta.com
4    185.184.8.90 (Amsterdam, Netherlands)

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-90.rtbhouse.net
creativecdn.com
7    23.83.76.73 (Los Angeles, United States)

ASN395954 (LEASEWEB-USA-LAX, US)
rtb-csync.smartadserver.com
4    192.184.69.215 (United States)

ASN16509 (AMAZON-02, US)
cms.quantserve.com
2    192.0.77.40 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: assets.tumblr.com
www.tumblr.com
3    52.86.218.58 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-86-218-58.compute-1.amazonaws.com
match.prod.bidr.io
1    45.137.176.88 (France)

ASN60350 (VP, FR)
sync.adotmob.com
1    69.10.32.226 (Spring Lake, United States)

ASN19318 (IS-AS-1, US)
PTR: all.sitemanserver.com
inv-nets.admixer.net
1    54.88.4.137 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-88-4-137.compute-1.amazonaws.com
jadserve.postrelease.com
2    96.46.186.57 (United States)

ASN7979 (SERVERS-COM, US)
ads.betweendigital.com
2    192.132.33.69 (United States)

ASN18568 (BIDTELLECT, US)
PTR: NET-33-132-192.69.bidtellect.com
bttrack.com
3    35.244.154.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.154.244.35.bc.googleusercontent.com
id.rlcdn.com
3    184.84.195.97 (San Jose, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-84-195-97.deploy.static.akamaitechnologies.com
secure-assets.rubiconproject.com
6    23.197.42.81 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-197-42-81.deploy.static.akamaitechnologies.com
eus.rubiconproject.com
1    52.85.151.39 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-151-39.iad89.r.cloudfront.net
live.primis.tech
2    52.85.132.15 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-132-15.iad50.r.cloudfront.net
sync.intentiq.com
sync1.intentiq.com
2    54.165.74.222 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-165-74-222.compute-1.amazonaws.com
sync.ipredictive.com
1    80.239.138.59 (None, )

ASN- ()
hb.yahoo.net
1    23.92.190.68 (Houston, United States)

ASN10913 (INTERNAP-BLK, US)
ce.lijit.com
2    172.64.146.152 (None, )

ASN- ()
capi.connatix.com
2    169.197.150.8 (None, )

ASN- ()
match.deepintent.com
2    34.203.168.193 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-203-168-193.compute-1.amazonaws.com
cs.yellowblue.io
cs.minutemedia-prebid.com
1    34.107.140.113 (None, )

ASN- ()
s2s.t13.io
1    70.42.32.191 (None, )

ASN- ()
sync.outbrain.com
2    50.17.66.232 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-17-66-232.compute-1.amazonaws.com
i.liadm.com
1    107.23.186.129 (None, )

ASN- ()
i6.liadm.com
1    44.214.40.113 (None, )

ASN- ()
exchange.mediavine.com
3    173.231.178.85 (None, )

ASN- ()
cm.adgrx.com
1    34.96.105.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.105.96.34.bc.googleusercontent.com
tr.blismedia.com
1    96.46.186.182 (None, )

ASN- ()
sync.aniview.com
1    34.107.148.139 (None, )

ASN- ()
prebid-s2s.media.net
10    8.28.7.83 (None, )

ASN- ()
simage2.pubmatic.com
1    54.161.26.122 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-161-26-122.compute-1.amazonaws.com
pm.w55c.net
Apex Domain
Subdomains		 Transfer
108 doubleclick.net
ad.doubleclick.net — Cisco Umbrella Rank: 139
stats.g.doubleclick.net — Cisco Umbrella Rank: 75
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 196
googleads.g.doubleclick.net — Cisco Umbrella Rank: 33
cm.g.doubleclick.net — Cisco Umbrella Rank: 219
454 KB
80 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 102
c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
tpc.googlesyndication.com — Cisco Umbrella Rank: 148
508 KB
61 rubiconproject.com
pixel-eu.rubiconproject.com — Cisco Umbrella Rank: 2134
pixel.rubiconproject.com — Cisco Umbrella Rank: 339
secure-assets.rubiconproject.com — Cisco Umbrella Rank: 946
eus.rubiconproject.com — Cisco Umbrella Rank: 588
token.rubiconproject.com — Cisco Umbrella Rank: 461
87 KB
43 2mdn.net
s0.2mdn.net — Cisco Umbrella Rank: 300
5 MB
41 pubmatic.com
ads.pubmatic.com — Cisco Umbrella Rank: 544
hbopenbid.pubmatic.com — Cisco Umbrella Rank: 504
ut.pubmatic.com — Cisco Umbrella Rank: 7777
image8.pubmatic.com — Cisco Umbrella Rank: 661
image2.pubmatic.com — Cisco Umbrella Rank: 859
image6.pubmatic.com
simage2.pubmatic.com
image4.pubmatic.com Failed
213 KB
41 ezoic.net
g.ezoic.net — Cisco Umbrella Rank: 15372
26 KB
29 ezodn.com
go.ezodn.com — Cisco Umbrella Rank: 9368
g.ezodn.com — Cisco Umbrella Rank: 12135
bshr.ezodn.com — Cisco Umbrella Rank: 10745
327 KB
26 onetag-sys.com
onetag-sys.com — Cisco Umbrella Rank: 714
12 KB
23 google.com
translate.google.com — Cisco Umbrella Rank: 1298
analytics.google.com — Cisco Umbrella Rank: 152
fundingchoicesmessages.google.com — Cisco Umbrella Rank: 1404
www.google.com — Cisco Umbrella Rank: 2
103 KB
22 omnitagjs.com
hb-api.omnitagjs.com — Cisco Umbrella Rank: 3655
visitor.omnitagjs.com — Cisco Umbrella Rank: 656
visitor-us-west-2.omnitagjs.com — Cisco Umbrella Rank: 4953
10 KB
19 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 229
secure.adnxs.com — Cisco Umbrella Rank: 478
15 KB
19 smilewanted.com
prebid.smilewanted.com — Cisco Umbrella Rank: 5596
csync.smilewanted.com — Cisco Umbrella Rank: 2705
static.smilewanted.com — Cisco Umbrella Rank: 9095
19 KB
16 mediafire.com
www.mediafire.com — Cisco Umbrella Rank: 42789
static.mediafire.com — Cisco Umbrella Rank: 73082
169 KB
13 smartadserver.com
ssbsync-global.smartadserver.com — Cisco Umbrella Rank: 1332
sync.smartadserver.com — Cisco Umbrella Rank: 1285
ssbsync.smartadserver.com — Cisco Umbrella Rank: 742
rtb-csync.smartadserver.com — Cisco Umbrella Rank: 622
6 KB
13 3lift.com
tlx.3lift.com Failed
eb2.3lift.com — Cisco Umbrella Rank: 372
6 KB
11 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 336
5 KB
11 yahoo.com
ups.analytics.yahoo.com — Cisco Umbrella Rank: 307
pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 474
4 KB
10 amazon-adsystem.com
aax-eu.amazon-adsystem.com — Cisco Umbrella Rank: 807
s.amazon-adsystem.com — Cisco Umbrella Rank: 285
7 KB
10 vidoomy.com
d.vidoomy.com — Cisco Umbrella Rank: 10135
a-prebid.vidoomy.com — Cisco Umbrella Rank: 12418
a.vidoomy.com — Cisco Umbrella Rank: 2566
10 KB
9 adsrvr.org
match.adsrvr.org — Cisco Umbrella Rank: 331
4 KB
9 adform.net
c1.adform.net — Cisco Umbrella Rank: 560
cm.adform.net — Cisco Umbrella Rank: 1211
4 KB
9 openx.net
oajs.openx.net — Cisco Umbrella Rank: 1639
google-bidout-d.openx.net — Cisco Umbrella Rank: 1643
eu-u.openx.net — Cisco Umbrella Rank: 2473
us-u.openx.net — Cisco Umbrella Rank: 491
u.openx.net — Cisco Umbrella Rank: 672
2 KB
9 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 36
227 KB
8 cdnwebcloud.com
bucket.cdnwebcloud.com — Cisco Umbrella Rank: 25638
neural40.cdnwebcloud.com — Cisco Umbrella Rank: 40033
17 KB
8 dotomi.com
dclk-match.dotomi.com — Cisco Umbrella Rank: 2627
rubicon-match.dotomi.com — Cisco Umbrella Rank: 1918
pubmatic-match.dotomi.com
3 KB
8 crwdcntrl.net
tags.crwdcntrl.net — Cisco Umbrella Rank: 979
ad.crwdcntrl.net — Cisco Umbrella Rank: 7903
bcp.crwdcntrl.net — Cisco Umbrella Rank: 850
id.crwdcntrl.net — Cisco Umbrella Rank: 2417
sync.crwdcntrl.net — Cisco Umbrella Rank: 799
28 KB
8 btloader.com
btloader.com — Cisco Umbrella Rank: 931
api.btloader.com — Cisco Umbrella Rank: 1000
18 KB
7 casalemedia.com
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 578
ssum-sec.casalemedia.com — Cisco Umbrella Rank: 480
4 KB
7 yieldmo.com
ads.yieldmo.com — Cisco Umbrella Rank: 582
4 KB
7 gstatic.com
www.gstatic.com
fonts.gstatic.com
69 KB
6 mobtrakk.com
sync-dmp.mobtrakk.com — Cisco Umbrella Rank: 2647
2 KB
6 1rx.io
sync.1rx.io — Cisco Umbrella Rank: 546
4 KB
6 360yield.com
match.360yield.com — Cisco Umbrella Rank: 1765
ice.360yield.com — Cisco Umbrella Rank: 1817
2 KB
6 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 206
382 KB
5 zemanta.com
b1sync.zemanta.com — Cisco Umbrella Rank: 586
3 KB
5 tapad.com
pixel.tapad.com — Cisco Umbrella Rank: 465
1 KB
5 stackadapt.com
sync.srv.stackadapt.com — Cisco Umbrella Rank: 702
3 KB
5 unrulymedia.com
sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1258
3 KB
5 creativecdn.com
invstatic101.creativecdn.com — Cisco Umbrella Rank: 2133
creativecdn.com — Cisco Umbrella Rank: 564
3 KB
5 googleapis.com
translate.googleapis.com — Cisco Umbrella Rank: 947
fonts.googleapis.com — Cisco Umbrella Rank: 29
83 KB
4 quantserve.com
cms.quantserve.com — Cisco Umbrella Rank: 749
2 KB
4 lijit.com
ap.lijit.com — Cisco Umbrella Rank: 650
ce.lijit.com — Cisco Umbrella Rank: 835
2 KB
4 turn.com
ad.turn.com — Cisco Umbrella Rank: 773
r.turn.com — Cisco Umbrella Rank: 3570
2 KB
4 id5-sync.com
cdn.id5-sync.com — Cisco Umbrella Rank: 893
id5-sync.com — Cisco Umbrella Rank: 425
35 KB
3 adgrx.com
cm.adgrx.com
2 KB
3 liadm.com
i.liadm.com — Cisco Umbrella Rank: 517
i6.liadm.com
1 KB
3 rlcdn.com
id.rlcdn.com — Cisco Umbrella Rank: 711
761 B
3 bidr.io
match.prod.bidr.io — Cisco Umbrella Rank: 563
1 KB
3 createjs.com
code.createjs.com — Cisco Umbrella Rank: 1586
188 KB
3 sharethrough.com
match.sharethrough.com — Cisco Umbrella Rank: 495
838 B
3 smaato.net
s.ad.smaato.net — Cisco Umbrella Rank: 674
1 KB
3 stickyadstv.com
ads.stickyadstv.com — Cisco Umbrella Rank: 526
2 KB
3 sitescout.com
pixel-sync.sitescout.com — Cisco Umbrella Rank: 681
2 KB
3 simpli.fi
um.simpli.fi — Cisco Umbrella Rank: 780
2 KB
3 a-mo.net
prebid.a-mo.net — Cisco Umbrella Rank: 751
assets.a-mo.net Failed
1 KB
2 deepintent.com
match.deepintent.com
581 B
2 connatix.com
capi.connatix.com
539 B
2 ipredictive.com
sync.ipredictive.com — Cisco Umbrella Rank: 836
1 KB
2 intentiq.com
sync.intentiq.com — Cisco Umbrella Rank: 846
sync1.intentiq.com — Cisco Umbrella Rank: 2869
2 KB
2 bttrack.com
bttrack.com — Cisco Umbrella Rank: 815
695 B
2 betweendigital.com
ads.betweendigital.com — Cisco Umbrella Rank: 1601
2 KB
2 tumblr.com
www.tumblr.com — Cisco Umbrella Rank: 6412
370 B
2 rfihub.com
p.rfihub.com — Cisco Umbrella Rank: 825
2 KB
2 mxptint.net
aep.mxptint.net
pmp.mxptint.net Failed
1 KB
2 creative-serving.com
ads.creative-serving.com — Cisco Umbrella Rank: 4323
1 KB
2 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 327
987 B
2 admanmedia.com
cs.admanmedia.com — Cisco Umbrella Rank: 1022
1 KB
2 mathtag.com
sync.mathtag.com — Cisco Umbrella Rank: 1031
1 KB
2 adentifi.com
rtb.adentifi.com — Cisco Umbrella Rank: 1014
449 B
2 teads.tv
sync.teads.tv — Cisco Umbrella Rank: 1299
628 B
2 opera.com
t.adx.opera.com — Cisco Umbrella Rank: 1072
1 KB
2 criteo.net
static.criteo.net — Cisco Umbrella Rank: 631
44 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 313
2 KB
2 marphezis.com
rt.marphezis.com — Cisco Umbrella Rank: 9704 Failed
348 B
2 adtelligent.com
ghb.adtelligent.com — Cisco Umbrella Rank: 4825
sync.adtelligent.com — Cisco Umbrella Rank: 6860
2 KB
2 yellowblue.io
hb.yellowblue.io — Cisco Umbrella Rank: 2147
cs.yellowblue.io
758 B
2 4dex.io
script.4dex.io — Cisco Umbrella Rank: 1628
25 KB
2 fbcdn.net
static.xx.fbcdn.net — Cisco Umbrella Rank: 953
138 KB
2 google.ca
www.google.ca — Cisco Umbrella Rank: 9252
515 B
2 ad-delivery.net
ad-delivery.net — Cisco Umbrella Rank: 1018
1 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27
21 KB
2 otnolatrnup.com
cdn.otnolatrnup.com — Cisco Umbrella Rank: 74839
otnolatrnup.com — Cisco Umbrella Rank: 68659
57 KB
2 amplitude.com
cdn.amplitude.com — Cisco Umbrella Rank: 2546
api.amplitude.com — Cisco Umbrella Rank: 1839
22 KB
2 gatekeeperconsent.com
the.gatekeeperconsent.com — Cisco Umbrella Rank: 33272
privacy.gatekeeperconsent.com — Cisco Umbrella Rank: 40907
2 KB
1 w55c.net
pm.w55c.net — Cisco Umbrella Rank: 818
778 B
1 media.net
prebid-s2s.media.net
518 B
1 aniview.com
sync.aniview.com
251 B
1 blismedia.com
tr.blismedia.com — Cisco Umbrella Rank: 1618
173 B
1 mediavine.com
exchange.mediavine.com
186 B
1 minutemedia-prebid.com
cs.minutemedia-prebid.com — Cisco Umbrella Rank: 1777
326 B
1 outbrain.com
sync.outbrain.com
287 B
1 t13.io
s2s.t13.io
450 B
1 yahoo.net
hb.yahoo.net
646 B
1 primis.tech
live.primis.tech — Cisco Umbrella Rank: 1398
556 B
1 postrelease.com
jadserve.postrelease.com — Cisco Umbrella Rank: 936
598 B
1 admixer.net
inv-nets.admixer.net — Cisco Umbrella Rank: 2137
581 B
1 adotmob.com
sync.adotmob.com — Cisco Umbrella Rank: 1414
774 B
1 eu-1-id5-sync.com
lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 940
277 B
1 contextweb.com
bh.contextweb.com — Cisco Umbrella Rank: 501
869 B
1 uuidksinc.net
s.uuidksinc.net — Cisco Umbrella Rank: 9014
291 B
1 tremorhub.com
partners.tremorhub.com — Cisco Umbrella Rank: 1153
175 B
1 pangle-ads.com
analytics.pangle-ads.com
1 KB
1 uidapi.com
cdn.prod.uidapi.com — Cisco Umbrella Rank: 2789
3 KB
1 openxcdn.net
oa.openxcdn.net — Cisco Umbrella Rank: 1740
8 KB
1 adxpremium.services
rtb.adxpremium.services — Cisco Umbrella Rank: 9875
452 B
1 criteo.com
bidder.criteo.com — Cisco Umbrella Rank: 776
gum.criteo.com Failed
dis.criteo.com Failed
196 B
1 facebook.com
www.facebook.com — Cisco Umbrella Rank: 98
15 KB
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 864
7 KB
1 ezojs.com
www.ezojs.com — Cisco Umbrella Rank: 30115
42 KB
0 antigena.com Failed
us01.z.antigena.com Failed
0 gammaplatform.com Failed
cm-supply-web.gammaplatform.com Failed
0 mrtnsvr.com Failed
ad.mrtnsvr.com Failed
0 acuityplatform.com Failed
ums.acuityplatform.com Failed
0 tribalfusion.com Failed
a.tribalfusion.com Failed
0 aralego.com Failed
sync.aralego.com Failed
0 technoratimedia.com Failed
sync.technoratimedia.com Failed
0 kargo.com Failed
crb.kargo.com Failed
0 adition.com Failed
dsp.adfarm1.adition.com Failed
0 everesttech.net Failed
sync-tm.everesttech.net Failed
0 33across.com Failed
events-ssc.33across.com Failed
0 seedtag.com Failed
s.seedtag.com Failed
0 loopme.me Failed
csync.loopme.me Failed
0 spot.im Failed
api-2-0.spot.im Failed
0 chocolateplatform.com Failed
cs.chocolateplatform.com Failed
0 mdhv.io Failed
jelly.mdhv.io Failed
0 ad.gt Failed
id.hadron.ad.gt Failed
0 a-mx.com Failed
id.a-mx.com Failed
0 cpmstar.com Failed
server.cpmstar.com Failed
0 spotxchange.com Failed
sync.search.spotxchange.com Failed
0 inmobi.com Failed
mweb.ck.inmobi.com Failed
0 fksnk.com Failed
fksnk.com Failed
0 mediago.io Failed
trace.mediago.io Failed
645 132
Domain Requested by
69 cm.g.doubleclick.net 24 redirects google-bidout-d.openx.net
googleads.g.doubleclick.net
c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
www.mediafire.com
onetag-sys.com
eb2.3lift.com
visitor.omnitagjs.com
47 pagead2.googlesyndication.com www.mediafire.com
c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
tpc.googlesyndication.com
s0.2mdn.net
www.googletagservices.com
43 s0.2mdn.net www.mediafire.com
s0.2mdn.net
c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
41 g.ezoic.net www.ezojs.com
go.ezodn.com
37 pixel.rubiconproject.com 21 redirects onetag-sys.com
visitor.omnitagjs.com
26 tpc.googlesyndication.com www.mediafire.com
c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
tpc.googlesyndication.com
s0.2mdn.net
26 onetag-sys.com 5 redirects go.ezodn.com
onetag-sys.com
ads.yieldmo.com
visitor.omnitagjs.com
26 go.ezodn.com www.mediafire.com
go.ezodn.com
17 securepubads.g.doubleclick.net www.mediafire.com
securepubads.g.doubleclick.net
14 fundingchoicesmessages.google.com securepubads.g.doubleclick.net
www.mediafire.com
13 visitor.omnitagjs.com 1 redirects go.ezodn.com
visitor.omnitagjs.com
onetag-sys.com
ssbsync.smartadserver.com
13 eb2.3lift.com 5 redirects go.ezodn.com
eb2.3lift.com
www.mediafire.com
13 ad.doubleclick.net www.mediafire.com
12 token.rubiconproject.com 8 redirects eus.rubiconproject.com
visitor.omnitagjs.com
12 csync.smilewanted.com 1 redirects go.ezodn.com
csync.smilewanted.com
12 ib.adnxs.com 9 redirects googleads.g.doubleclick.net
eb2.3lift.com
visitor.omnitagjs.com
11 x.bidswitch.net 9 redirects www.mediafire.com
onetag-sys.com
10 simage2.pubmatic.com ads.pubmatic.com
www.mediafire.com
10 image2.pubmatic.com 3 redirects ads.pubmatic.com
www.mediafire.com
10 image8.pubmatic.com 9 redirects onetag-sys.com
10 static.mediafire.com www.mediafire.com
9 match.adsrvr.org 9 redirects
9 www.googletagmanager.com www.mediafire.com
www.googletagmanager.com
8 visitor-us-west-2.omnitagjs.com visitor.omnitagjs.com
8 ups.analytics.yahoo.com 6 redirects go.ezodn.com
onetag-sys.com
7 rtb-csync.smartadserver.com 2 redirects googleads.g.doubleclick.net
ssbsync.smartadserver.com
7 secure.adnxs.com 7 redirects
7 googleads.g.doubleclick.net pagead2.googlesyndication.com
c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
7 c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com securepubads.g.doubleclick.net
7 ads.yieldmo.com go.ezodn.com
ads.yieldmo.com
visitor.omnitagjs.com
7 api.btloader.com btloader.com
6 eus.rubiconproject.com visitor.omnitagjs.com
eus.rubiconproject.com
6 s.amazon-adsystem.com 1 redirects onetag-sys.com
visitor.omnitagjs.com
ads.pubmatic.com
6 sync-dmp.mobtrakk.com 6 redirects
6 sync.1rx.io 6 redirects
6 www.googletagservices.com c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
6 c1.adform.net 6 redirects
6 d.vidoomy.com go.ezodn.com
6 prebid.smilewanted.com go.ezodn.com
6 www.google.com www.mediafire.com
c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
6 www.mediafire.com 1 redirects www.mediafire.com
5 b1sync.zemanta.com 5 redirects
5 image6.pubmatic.com 4 redirects ads.pubmatic.com
5 pixel.tapad.com 3 redirects visitor.omnitagjs.com
www.mediafire.com
5 sync.srv.stackadapt.com 5 redirects
5 sync.targeting.unrulymedia.com 3 redirects www.mediafire.com
visitor.omnitagjs.com
5 dsum-sec.casalemedia.com 3 redirects googleads.g.doubleclick.net
4 cms.quantserve.com 2 redirects c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
4 creativecdn.com 4 redirects
4 neural40.cdnwebcloud.com c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
www.mediafire.com
4 bucket.cdnwebcloud.com s0.2mdn.net
bucket.cdnwebcloud.com
4 match.360yield.com 4 redirects
4 dclk-match.dotomi.com 4 redirects
4 us-u.openx.net 1 redirects google-bidout-d.openx.net
googleads.g.doubleclick.net
4 aax-eu.amazon-adsystem.com 2 redirects google-bidout-d.openx.net
visitor.omnitagjs.com
4 ads.pubmatic.com www.mediafire.com
go.ezodn.com
csync.smilewanted.com
4 fonts.gstatic.com www.mediafire.com
fonts.googleapis.com
3 cm.adgrx.com 3 redirects
3 secure-assets.rubiconproject.com 3 redirects
3 id.rlcdn.com 2 redirects visitor.omnitagjs.com
3 match.prod.bidr.io 3 redirects
3 code.createjs.com s0.2mdn.net
3 ap.lijit.com 2 redirects visitor.omnitagjs.com
3 match.sharethrough.com c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
ssbsync.smartadserver.com
visitor.omnitagjs.com
3 s.ad.smaato.net 3 redirects
3 pr-bh.ybp.yahoo.com 2 redirects www.mediafire.com
3 ads.stickyadstv.com 3 redirects
3 pixel-eu.rubiconproject.com 2 redirects onetag-sys.com
3 pixel-sync.sitescout.com 3 redirects
3 a-prebid.vidoomy.com www.mediafire.com
3 cm.adform.net 3 redirects
3 um.simpli.fi 3 redirects
3 ad.turn.com 3 redirects
3 id5-sync.com cdn.id5-sync.com
go.ezodn.com
3 prebid.a-mo.net go.ezodn.com
visitor.omnitagjs.com
3 bcp.crwdcntrl.net 1 redirects www.mediafire.com
tags.crwdcntrl.net
3 translate.googleapis.com
3 www.gstatic.com www.mediafire.com
www.gstatic.com
2 pubmatic-match.dotomi.com 2 redirects
2 rubicon-match.dotomi.com 2 redirects
2 i.liadm.com 2 redirects
2 match.deepintent.com visitor.omnitagjs.com
ads.pubmatic.com
2 capi.connatix.com 1 redirects visitor.omnitagjs.com
2 sync.ipredictive.com 2 redirects
2 bttrack.com 2 redirects
2 ads.betweendigital.com 2 redirects
2 www.tumblr.com 1 redirects www.mediafire.com
2 ssbsync.smartadserver.com 1 redirects visitor.omnitagjs.com
2 p.rfihub.com 2 redirects
2 aep.mxptint.net 2 redirects
2 ice.360yield.com 2 redirects
2 sync.smartadserver.com 2 redirects
2 ads.creative-serving.com 2 redirects
2 px.ads.linkedin.com eb2.3lift.com
visitor.omnitagjs.com
2 ssbsync-global.smartadserver.com 1 redirects onetag-sys.com
2 cs.admanmedia.com 2 redirects
2 sync.mathtag.com 2 redirects
2 rtb.adentifi.com 1 redirects c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
2 fonts.googleapis.com s0.2mdn.net
2 sync.teads.tv 1 redirects googleads.g.doubleclick.net
2 t.adx.opera.com 2 redirects
2 ssum-sec.casalemedia.com 2 redirects
2 oajs.openx.net 1 redirects www.mediafire.com
2 static.criteo.net securepubads.g.doubleclick.net
go.ezodn.com
2 cdn.jsdelivr.net securepubads.g.doubleclick.net
ads.pubmatic.com
2 rt.marphezis.com go.ezodn.com
2 script.4dex.io go.ezodn.com
script.4dex.io
2 bshr.ezodn.com go.ezodn.com
2 tags.crwdcntrl.net cdn.otnolatrnup.com
securepubads.g.doubleclick.net
2 static.xx.fbcdn.net www.facebook.com
2 www.google.ca www.mediafire.com
2 stats.g.doubleclick.net www.googletagmanager.com
www.google-analytics.com
2 analytics.google.com www.googletagmanager.com
2 ad-delivery.net www.mediafire.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
1 pm.w55c.net 1 redirects
1 prebid-s2s.media.net visitor.omnitagjs.com
1 sync.aniview.com visitor.omnitagjs.com
1 tr.blismedia.com visitor.omnitagjs.com
1 exchange.mediavine.com visitor.omnitagjs.com
1 i6.liadm.com visitor.omnitagjs.com
1 cs.minutemedia-prebid.com visitor.omnitagjs.com
1 sync.outbrain.com visitor.omnitagjs.com
1 s2s.t13.io visitor.omnitagjs.com
1 cs.yellowblue.io visitor.omnitagjs.com
1 ce.lijit.com visitor.omnitagjs.com
1 hb.yahoo.net visitor.omnitagjs.com
1 sync1.intentiq.com visitor.omnitagjs.com
1 sync.intentiq.com 1 redirects
1 live.primis.tech 1 redirects
1 jadserve.postrelease.com 1 redirects
1 inv-nets.admixer.net 1 redirects
1 sync.adotmob.com 1 redirects
1 u.openx.net 1 redirects
1 static.smilewanted.com csync.smilewanted.com
1 lb.eu-1-id5-sync.com go.ezodn.com
1 bh.contextweb.com 1 redirects
1 a.vidoomy.com www.mediafire.com
1 sync.crwdcntrl.net 1 redirects
1 sync.adtelligent.com go.ezodn.com
1 id.crwdcntrl.net go.ezodn.com
1 s.uuidksinc.net 1 redirects
1 partners.tremorhub.com googleads.g.doubleclick.net
1 analytics.pangle-ads.com 1 redirects
1 r.turn.com c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
1 eu-u.openx.net google-bidout-d.openx.net
1 google-bidout-d.openx.net oa.openxcdn.net
1 api.amplitude.com cdn.amplitude.com
1 ut.pubmatic.com ads.pubmatic.com
1 invstatic101.creativecdn.com securepubads.g.doubleclick.net
1 cdn.prod.uidapi.com securepubads.g.doubleclick.net
1 oa.openxcdn.net securepubads.g.doubleclick.net
1 cdn.id5-sync.com securepubads.g.doubleclick.net
1 ghb.adtelligent.com go.ezodn.com
1 hb.yellowblue.io go.ezodn.com
1 rtb.adxpremium.services go.ezodn.com
1 hb-api.omnitagjs.com go.ezodn.com
1 hbopenbid.pubmatic.com go.ezodn.com
1 bidder.criteo.com go.ezodn.com
1 ad.crwdcntrl.net cdn.otnolatrnup.com
1 g.ezodn.com www.mediafire.com
1 otnolatrnup.com cdn.otnolatrnup.com
1 www.facebook.com www.mediafire.com
1 cdn.otnolatrnup.com www.mediafire.com
1 cdn.amplitude.com www.mediafire.com
1 privacy.gatekeeperconsent.com the.gatekeeperconsent.com
1 static.cloudflareinsights.com www.mediafire.com
1 translate.google.com www.mediafire.com
1 www.ezojs.com www.mediafire.com
1 btloader.com www.mediafire.com
1 the.gatekeeperconsent.com www.mediafire.com
0 pmp.mxptint.net Failed www.mediafire.com
0 image4.pubmatic.com Failed www.mediafire.com
0 us01.z.antigena.com Failed www.mediafire.com
0 cm-supply-web.gammaplatform.com Failed ads.pubmatic.com
0 ad.mrtnsvr.com Failed ads.pubmatic.com
0 ums.acuityplatform.com Failed ads.pubmatic.com
0 a.tribalfusion.com Failed ads.pubmatic.com
0 sync.aralego.com Failed ads.pubmatic.com
0 sync.technoratimedia.com Failed ads.pubmatic.com
0 crb.kargo.com Failed visitor.omnitagjs.com
0 dsp.adfarm1.adition.com Failed visitor.omnitagjs.com
0 sync-tm.everesttech.net Failed visitor.omnitagjs.com
ads.pubmatic.com
0 events-ssc.33across.com Failed visitor.omnitagjs.com
0 s.seedtag.com Failed visitor.omnitagjs.com
0 csync.loopme.me Failed visitor.omnitagjs.com
0 api-2-0.spot.im Failed visitor.omnitagjs.com
0 cs.chocolateplatform.com Failed c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
0 jelly.mdhv.io Failed googleads.g.doubleclick.net
0 dis.criteo.com Failed eb2.3lift.com
visitor.omnitagjs.com
ads.pubmatic.com
0 assets.a-mo.net Failed prebid.a-mo.net
0 id.hadron.ad.gt Failed go.ezodn.com
0 id.a-mx.com Failed go.ezodn.com
0 gum.criteo.com Failed go.ezodn.com
0 server.cpmstar.com Failed www.mediafire.com
0 sync.search.spotxchange.com Failed googleads.g.doubleclick.net
0 mweb.ck.inmobi.com Failed c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
0 fksnk.com Failed c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
0 trace.mediago.io Failed c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
0 tlx.3lift.com Failed go.ezodn.com
645 200
Subject Issuer Validity Valid
*.mediafire.com
Sectigo RSA Organization Validation Secure Server CA		 2023-09-18 -
2024-08-28		 a year crt.sh
gatekeeperconsent.com
GTS CA 1P5		 2023-10-31 -
2024-01-29		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
btloader.com
GTS CA 1P5		 2023-10-19 -
2024-01-17		 3 months crt.sh
www.ezojs.com
GTS CA 1P5		 2023-11-08 -
2024-02-06		 3 months crt.sh
*.google.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-04-10 -
2024-04-09		 a year crt.sh
cdn.amplitude.com
Amazon RSA 2048 M01		 2023-01-12 -
2024-02-11		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2023-09-09 -
2023-12-08		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
ezoic.net
R3		 2023-11-16 -
2024-02-14		 3 months crt.sh
ezodn.com
E1		 2023-10-28 -
2024-01-26		 3 months crt.sh
api.btloader.com
GTS CA 1D4		 2023-10-10 -
2024-01-08		 3 months crt.sh
*.doubleclick.net
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
*.google.ca
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
*.pubmatic.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-11-26 -
2024-11-26		 a year crt.sh
*.crwdcntrl.net
Amazon RSA 2048 M01		 2023-10-08 -
2024-11-05		 a year crt.sh
www.google.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
script.4dex.io
Cloudflare Inc ECC CA-3		 2023-10-23 -
2024-10-22		 a year crt.sh
*.criteo.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-09-26 -
2023-12-23		 3 months crt.sh
*.a-mo.net
R3		 2023-11-07 -
2024-02-05		 3 months crt.sh
*.onetag-sys.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-12-28 -
2024-01-28		 a year crt.sh
*.omnitagjs.com
Amazon RSA 2048 M01		 2023-04-17 -
2024-05-16		 a year crt.sh
*.adxpremium.services
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-08-05		 a year crt.sh
*.yellowblue.io
Amazon ECDSA 256 M02		 2023-04-18 -
2024-05-16		 a year crt.sh
ghb.adtelligent.com
ZeroSSL ECC Domain Secure Site CA		 2023-11-28 -
2024-02-26		 3 months crt.sh
*.vidoomy.com
Sectigo RSA Domain Validation Secure Server CA		 2023-09-06 -
2024-10-06		 a year crt.sh
*.yieldmo.com
Amazon RSA 2048 M01		 2023-08-14 -
2024-09-12		 a year crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2023 Q3		 2023-09-27 -
2024-10-28		 a year crt.sh
oa.openxcdn.net
GTS CA 1D4		 2023-11-24 -
2024-02-22		 3 months crt.sh
*.criteo.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-10-09 -
2024-01-06		 3 months crt.sh
cdn.prod.uidapi.com
R3		 2023-11-02 -
2024-01-31		 3 months crt.sh
invstatic101.creativecdn.com
GTS CA 1D4		 2023-10-24 -
2024-01-22		 3 months crt.sh
*.amplitude.com
COMODO RSA Domain Validation Secure Server CA		 2023-01-23 -
2024-02-14		 a year crt.sh
*.id5-sync.com
R3		 2023-11-01 -
2024-01-30		 3 months crt.sh
*.marphezis.com
Sectigo RSA Domain Validation Secure Server CA		 2023-01-03 -
2024-01-03		 a year crt.sh
*.openx.net
RapidSSL TLS RSA CA G1		 2023-08-18 -
2024-08-18		 a year crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
*.cdnwebcloud.com
Amazon RSA 2048 M03		 2023-08-23 -
2024-09-21		 a year crt.sh
adentifi.com
Amazon RSA 2048 M01		 2023-07-06 -
2024-08-03		 a year crt.sh
ups.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2023-08-03 -
2024-01-24		 6 months crt.sh
*.3lift.com
Amazon RSA 2048 M02		 2023-04-13 -
2024-05-11		 a year crt.sh
sync.adtelligent.com
ZeroSSL ECC Domain Secure Site CA		 2023-11-20 -
2024-02-18		 3 months crt.sh
*.bidswitch.net
Sectigo RSA Domain Validation Secure Server CA		 2023-03-23 -
2024-03-23		 a year crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-03-05 -
2024-04-03		 a year crt.sh
*.smartadserver.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-01-21 -
2024-01-23		 a year crt.sh
*.eu-1-id5-sync.com
R3		 2023-11-01 -
2024-01-30		 3 months crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA		 2023-11-03 -
2024-05-03		 6 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2023-02-13 -
2024-03-15		 a year crt.sh
tls.adobe.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-02-08 -
2024-03-10		 a year crt.sh
quantserve.com
R3		 2023-10-28 -
2024-01-26		 3 months crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2023-05-06 -
2024-05-04		 a year crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2		 2022-11-30 -
2024-01-01		 a year crt.sh
tr.blismedia.com
GTS CA 1D4		 2023-10-04 -
2024-01-02		 3 months crt.sh
s.amazon-adsystem.com
Amazon RSA 2048 M01		 2023-03-03 -
2024-02-19		 a year crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2023-08-29 -
2024-02-21		 6 months crt.sh

This page contains 80 frames:

Primary Page: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Frame ID: E6D4E8C35377F308048843D38971E2B9
Requests: 215 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Frame ID: 8A7932C9B7D456C6F0DA8CF432B89830
Requests: 3 HTTP requests in this frame

Frame: https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Frame ID: 097DC27AEFE0F56E7C93CD34F240B401
Requests: 2 HTTP requests in this frame

Frame: data://truncated
Frame ID: C14AEC3FAE0000AF7C57D489A86DC924
Requests: 1 HTTP requests in this frame

Frame: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 01EFDA6F92A0469D5DE9EB8ED514F0FE
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231129/r20190131/zrt_lookup_fy2021.html
Frame ID: 0AEFCFC23DB1AD21BC5D12CE818D3930
Requests: 1 HTTP requests in this frame

Frame: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Frame ID: ECBE523F573936902CD0A48F531B44B5
Requests: 6 HTTP requests in this frame

Frame: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 3297ED643CEA88ACC33836A1853678F2
Requests: 18 HTTP requests in this frame

Frame: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: ED731E4518DA3AB8E2E6A7695612D7E7
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNPh9QIQ_uHy8QEY6LjqwgEwAQ&v=APEucNVqwyJjASPEB2E0fs8EvoZqEBFoskYkd1c4HB-IkGMXf4_fbyokCM_0jCU9ZJJLIAer5t3avKurTp-ArejTIwKQo98l5zp1neGp8Qz6Q9f1E6WYOxA
Frame ID: 5FB84129A455E6F5A6A6D7F7288533D0
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 718FE89ADD87E9968DF7DFC2BA76F82D
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDOyFUYqtv-lwEwAQ&v=APEucNXIyS3V-qqesEtrmBX_U1uZvmBVWcmevdjAst1jVAyXZ8Il4tZz774wluHpBV0AKw0EF6JmcRU87AsI6qTDJ9bSlFr0jt4RNb2GqGW-PuEnvD8F3-0
Frame ID: A9A75E1B8AB4A25AD7A194E4FF5EF376
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: E6F28105BAE33E1E6B1DB5F0230B8EBE
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: BED80BA621117D718150F30F295DF0A6
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 1F6B8BA07D5004D4F92734F7A29E580D
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
Frame ID: 80D2D82A79EC16BF409EF20D5B646B39
Requests: 12 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/16640302357973241815/index.html?ev=01_250
Frame ID: 886704129145B05A8C30B6A9BC919FAA
Requests: 13 HTTP requests in this frame

Frame: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: BD09AA6DCB3AA5083F926E92F9BF180C
Requests: 17 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNPh9QIQ_uHy8QEY6LjqwgEwAQ&v=APEucNXlvOpkQMTQN_o3VURS1QhMwfP1b_7GFwuDGB5oYupci1Yuf6YxAU6vmHpTv46WIazyrqjQLFcun7V5ieBkmjpbNJyj6b21B-LQrjxyoGS-zwh-xRA
Frame ID: 579F9DC2BA8B20EC08F569391358D56B
Requests: 4 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 6001E3F925F744E074D84BCCCEE39547
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 37B4CB57AEAA2E63E2BF92DD55AD66D2
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=8O1s7uYT4p&t=1&renderingType=2&ev=01_250
Frame ID: 4CFBBF7D1B615D16DF6E21D72D7F59D9
Requests: 12 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
Frame ID: 5605873B75BCDF47A82A097412567A8A
Requests: 1 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?cb=1701395917061
Frame ID: E91174493EF576557F66FB7D88E5FDBF
Requests: 15 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: 9C7E80801EF6180F56717ECD7EEC3B11
Requests: 11 HTTP requests in this frame

Frame: https://sync.adtelligent.com/csync?t=a&ep=743293&extuid=9135305356218733899&traffic_source=snippet&session=139C6587B24895D4&sp=678634&pb=493076&c=709112&a=743293&domain=https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Frame ID: CB045348B7FC1C1BA37C4807F7125665
Requests: 1 HTTP requests in this frame

Frame: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Frame ID: 0823594751F7AAF5C3E30EE3B116CE81
Requests: 21 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=162948
Frame ID: CA11CF4123AAC362BA4EBDCC1A38A45B
Requests: 19 HTTP requests in this frame

Frame: https://csync.smilewanted.com/
Frame ID: 819A3C7BB00EF38E26CEFE3F41F10EBD
Requests: 2 HTTP requests in this frame

Frame: https://prebid.a-mo.net/isyn?gdpr_consent=&gdpr=0&us_privacy=&gpp=&gpp_sid=
Frame ID: BA569C507F3057483CE3FC0893FF753D
Requests: 2 HTTP requests in this frame

Frame: https://ads.yieldmo.com/pbcas?us_privacy=&gdpr=0&gdpr_consent=&type=iframe
Frame ID: E954A875B9CDCA48838FC45DAF37490D
Requests: 6 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
Frame ID: B993E8AB623B0DBEE65F4B66A54D3FB6
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: 5005E4F2CC24DC28D3D5D4B6D42AF386
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smart/6271432635359966753
Frame ID: DE0C6C09E8370599C7F668408EDD3936
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/appnexus/8961910970674910848
Frame ID: A50E85406AF3B1B95BEA6C8394F0FA59
Requests: 1 HTTP requests in this frame

Frame: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 3611CB9C371A8AE4BA8CCE72D1B5114E
Requests: 14 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rubicon/LPLZ7BS5-D-FDIX?gdpr=0
Frame ID: 7E0539E893A98298AC480E44D5EAC027
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Frame ID: 7FA1C516DC3B439AE1C2DA9985E6DDED
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3AThCB-1gYz4LW-gEwAQ&v=APEucNU8b7PilS76NHiKr6tNhS9OigcP0Cm46YFtYszYVj5mDbOlhe9nyRYpkMDSyxdh7EXCpNXNoE-zX72Prff-0hxALFANq4RAZmhfxRFcSvnd9NQtlQw
Frame ID: F8749BDC398D044694CEDD5A401ADEA2
Requests: 4 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 93F00769D8AC237716725DAB9457037C
Requests: 9 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/improve/032b313a-9bd4-43d9-bcc5-c1d15ae21a9d&partner_id=1010
Frame ID: E681602A7E40FB18639EC70F5F859BB4
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 7447BCDABDECDE5E13427A2BF7A375B0
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/11674851576237916465/Ad9-160-600/Ad9-160-600.html?ev=01_250
Frame ID: 7F614834275602B56EAE527B9FDF9DA3
Requests: 4 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/openx/77209c27-0cd5-4694-9602-687603ff073e
Frame ID: 8A9342DFBF80FFDD0CE2FFE02EAE5B19
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sovrn/Hvu2ZLZHRMHRFVFyQd6nRYRY
Frame ID: CAAF6D98AAA4E9C622B4C46DC4399EB2
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/9135305356218733899
Frame ID: 9E31B09F203A27FC74ED9DE66176C5E7
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/outbrain/JthQNRlYKvyYtq8sninV?gdpr=0
Frame ID: BB5BBF84F56159FE34490D4988267F0C
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/YudBnxYzY05pE_p4oQJY7XUKcgMgXtb8ClAoiGkl-0U?pi=smilewanted&tc=1
Frame ID: 0DA908AD7D7842803CE914E35D6CD879
Requests: 1 HTTP requests in this frame

Frame: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 788CAD057B47D966386E508CC969F0FC
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3AThCB-1gYuYvW-gEwAQ&v=APEucNWfQIHlBQzSSsV5Pp4oxIYa89ewr-hOuf81tmxqBEIGTzLuXdubX4fQaliBIYbRl0P-IiGM7cc47t0woqQszXLLFTFiCT2hMXaS8Bs0sLnW2hve2kw
Frame ID: DF5ECD65110D6930F51E323F1B5E6077
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: EDA4D37F24B6465D77ACD1916E1E70A4
Requests: 9 HTTP requests in this frame

Frame: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 67084B459EDC979D3EB54652305D1832
Requests: 14 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: CC6C917E4BE6F617830783D717F13E71
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3AThCB-1gYh4bW-gEwAQ&v=APEucNWyZ9R-dLpzMwCdQDS8HsjGatwFXWSzs5H1Ig8TS4iIvzgpSELD6784hMnjzJLSqt3zkwVOvH5fjWD3E60jkQMLg6ZDus8OXxF4s8s7bYg7-hWV5yw
Frame ID: BCBA69AB02B73CC91A6844B5F3F3B5AD
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 97035260C083E29CFF4E53F5D8226FC9
Requests: 9 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/8610173591814663585/AD1-970-90/Ad1-970x90.html?ev=01_250
Frame ID: DDC751D22B538BD6A2481939CAA9FE2F
Requests: 4 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/12016345264017701978/Ad1-160-600/Ad1-160-600.html?ev=01_250
Frame ID: 6EFB6568DCB6B15CA7D0DA04EBDBF91A
Requests: 4 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 379EE4B97628D3F0504290883AB05E40
Requests: 3 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Frame ID: 7D95A20DFD5142B0708C50A47529C295
Requests: 15 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Frame ID: 65E528A544A573B0516A63F339AF78C6
Requests: 20 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Frame ID: 180E3D010893149E2152D2DE5AD0C141
Requests: 19 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Frame ID: 6CAC400CFA4366BD97CA549E39CC4FB0
Requests: 19 HTTP requests in this frame

Frame: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=
Frame ID: 83ACAF9891F660910C970CEDA864BFEB
Requests: 6 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=C120E36A-8AFF-4CA0-A41B-65783C2F6633&redir=true&gdpr=0&gdpr_consent=
Frame ID: A6BBB034E1C5B931632E1F63B5911870
Requests: 1 HTTP requests in this frame

Frame: https://sync.technoratimedia.com/services?uid=AADi8E7K0nwAABMXtn_NUw&srv=cs&pid=73&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpp%252Cpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2&gdpr=0
Frame ID: E790BFC46DA737DB7E893585EAAE88F9
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8961910970674910848&gdpr=0&gdpr_consent=
Frame ID: 10788B94A7F9D16B6FF16156BE5958CA
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=43ij_OYp8fb4K6Shs3m4_ON6pvX4KPT1timfRy2f
Frame ID: 3CA3BCCB4C3437EB3BC022A3020DE1EB
Requests: 1 HTTP requests in this frame

Frame: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Frame ID: 4D55B88FCFB296D87C32A2AB45439C16
Requests: 1 HTTP requests in this frame

Frame: https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=
Frame ID: 9043745E72D005FEA547AFBBB415B66E
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:ukFBPzdY1R8SNN5&gdpr=0&gdpr_consent=
Frame ID: 4722B22694376E714C40B06AB0989BAB
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=2b7a36e8-8fed-11ee-8e97-8536f0308748
Frame ID: 3BF93D59BE25DDD1B45B97EB2FC18E59
Requests: 1 HTTP requests in this frame

Frame: https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Frame ID: E8D8A50EEA0CB99B0A9525B63802345B
Requests: 1 HTTP requests in this frame

Frame: https://sync.aralego.com/bsw_sync?ucf_nid=par-E2B44D84BBBDED8A0B297323E4B4A68&dsp_id=445&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=a4aa8fa7-9617-489f-a8fd-b4612be68449&gdpr=0&gdpr_consent=&gdpr_pd=&usprivacy=
Frame ID: CF8C26B1BD0A6403F60114F65B73C6A9
Requests: 1 HTTP requests in this frame

Frame: https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Frame ID: CAB9690BF8E26FD5726CB80FF0EBB5A7
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969188722382023932
Frame ID: 80E6EC64F6894F56C3DDF0C4CEE682D7
Requests: 1 HTTP requests in this frame

Frame: https://ums.acuityplatform.com/tum?umid=6
Frame ID: 6EE52A4926F9BE59AB07FE4DAB917713
Requests: 1 HTTP requests in this frame

Frame: https://ad.mrtnsvr.com/sync/pubmatic?gdpr=0&gdpr_consent=
Frame ID: BE040D5AECA44DDAFDEBB3372E7838C9
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:JthQNRlYKvyYtq8sninV&gdpr=0&gdpr_consent=&gdpr=0
Frame ID: 2B8BD2AE2EE7C6A9542D9DCC53A3EF38
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU8cd00b679a4d4a4fb282885d711e45a0
Frame ID: 737561D6F719B63F5B92E13356F33F28
Requests: 1 HTTP requests in this frame

Frame: https://cm-supply-web.gammaplatform.com/adx/usersyncsupply?pid=7&t=pixel
Frame ID: ABE04D9A06A5A56D56901B7ED295B1EC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

NSwish texture pack

Detected technologies

Overall confidence: 100%
Detected patterns
  • cdn\.amplitude\.com
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net
Overall confidence: 100%
Detected patterns
  • adnxs\.com/[^"]*(?:prebid|/pb\.js)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

645
Requests

69 %
HTTPS

0 %
IPv6

132
Domains

200
Subdomains

107
IPs

13
Countries

8624 kB
Transfer

16597 kB
Size

203
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 25
  • https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Request Chain 76
  • https://bcp.crwdcntrl.net/map/c=3722/tp=ADSP/tpid=445a8d8318c64ece961e210e05fb7c6d HTTP 302
  • https://bcp.crwdcntrl.net/map/ct=y/c=3722/tp=ADSP/tpid=445a8d8318c64ece961e210e05fb7c6d
Request Chain 158
  • https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&rid=esp HTTP 302
  • https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&rid=esp&cc=1
Request Chain 163
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=9135305356218733899
Request Chain 164
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=fa457a28-e898-4449-9a1d-2b11dd13a271&id=8abc22cc-201a-c3f0-1079-2d0d157064ac HTTP 302
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=fa457a28-e898-4449-9a1d-2b11dd13a271&id=8abc22cc-201a-c3f0-1079-2d0d157064ac&dcc=t
Request Chain 165
  • https://match.adsrvr.org/track/cmf/openx?oxid=d26a5eb1-3cb0-780a-d077-af9a7d43af4c&gdpr=0 HTTP 302
  • https://match.adsrvr.org/track/cmb/openx?oxid=d26a5eb1-3cb0-780a-d077-af9a7d43af4c&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=a0469c36-bc77-430e-9825-0adde7e331a8&ttd_puid=d26a5eb1-3cb0-780a-d077-af9a7d43af4c&gdpr=0&gdpr_consent=
Request Chain 167
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEIIEKE338b57ZZKQrrCAHg&google_cver=1
Request Chain 203
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELgZvJsorFd6YdJ1iSGxhJU&google_cver=1&gdpr=0 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELgZvJsorFd6YdJ1iSGxhJU&google_cver=1&gdpr=0&C=1
Request Chain 204
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZWk90SxXbfbp5HVe8b1dCQAA HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELgZvJsorFd6YdJ1iSGxhJU&google_cver=1
Request Chain 205
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEKbEuknRkzhrlbcieVTYr2A&google_cver=1 HTTP 307
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEKbEuknRkzhrlbcieVTYr2A%26google_cver%3D1
Request Chain 206
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ1NDA2MTk2MDYzNDY2MjE5Mw%3D%3D
Request Chain 207
  • https://ad.turn.com/r/cs?pid=3&google_gid=CAESEN0XNgHb6FDviVy8iDNzhy8&google_cver=1&google_push=AXcoOmTW60zPO44b7YwU7rBLRJI4qfMLBJBilcWBNpdnstrt02C8LDqjxgYAy4fDqVwbUjmSiWTW3eAPLwM1xDjGNUbEOZRaiCp3mw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjQwMTc5NDcwNjA5OTMzNjUwOA==&gdpr=&gdpr_consent= HTTP 302
  • https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEHISU_SLJw8l1gbFSwwu76Y&google_cver=1
Request Chain 208
  • https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESELNLE7WN44TmChYE7iBN7iI&google_cver=1&google_push=AXcoOmTWyFUSfXIowfub44hhkWIPyRQM6dT2KQw5Uyd2C6aioqy1e7BM-qfJcYKTiq2LT6Dv_BC_N-gaaLAn15ZGb2XPbeibWvmqtQ HTTP 302
  • https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=2b8ef9b6e44114f&is_secure=true&networkId=14000&version=1&google_gid=CAESELNLE7WN44TmChYE7iBN7iI&google_cver=1&google_push=AXcoOmTWyFUSfXIowfub44hhkWIPyRQM6dT2KQw5Uyd2C6aioqy1e7BM-qfJcYKTiq2LT6Dv_BC_N-gaaLAn15ZGb2XPbeibWvmqtQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGJjvFXuBz8ANLVV8XAAAAAAA&expiration=1701482321&google_cver=1&is_secure=true&google_gid=CAESELNLE7WN44TmChYE7iBN7iI&google_push=AXcoOmTWyFUSfXIowfub44hhkWIPyRQM6dT2KQw5Uyd2C6aioqy1e7BM-qfJcYKTiq2LT6Dv_BC_N-gaaLAn15ZGb2XPbeibWvmqtQ
Request Chain 209
  • https://um.simpli.fi/gp_match?google_gid=CAESEPc_UujaFUrOx-o5siWztpY&google_cver=1&google_push=AXcoOmR72zYBcucDOtUZo0yc55FG0SVJvf2ht9AY3_46EqqGXpaSSuwgmt5VJpp7eiN-omqiOSM9B7F1Gw7qStTNGlIfrBrHKqL_ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=172B0C337EA24A8F83EA8C8A4B595618&google_push=AXcoOmR72zYBcucDOtUZo0yc55FG0SVJvf2ht9AY3_46EqqGXpaSSuwgmt5VJpp7eiN-omqiOSM9B7F1Gw7qStTNGlIfrBrHKqL_
Request Chain 210
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGCJR7fSqfUfinpCWebouuM&google_cver=1&google_push=AXcoOmQr5oWVHzAZ8UeOENK35l_WFWFaYfCM_2mjjCbA17iFcrxfOWIvCBoFsVLri8IvPZXxYY_ulnRHTQTUQzrzCjQnIb1GKbvTtQ HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEGCJR7fSqfUfinpCWebouuM&google_push=AXcoOmQr5oWVHzAZ8UeOENK35l_WFWFaYfCM_2mjjCbA17iFcrxfOWIvCBoFsVLri8IvPZXxYY_ulnRHTQTUQzrzCjQnIb1GKbvTtQ&s=184023&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGCJR7fSqfUfinpCWebouuM&google_hm=ZWk90VgNqmwBwKie5PdSRAAADlAAAAAB&google_nid=index&google_push=AXcoOmQr5oWVHzAZ8UeOENK35l_WFWFaYfCM_2mjjCbA17iFcrxfOWIvCBoFsVLri8IvPZXxYY_ulnRHTQTUQzrzCjQnIb1GKbvTtQ
Request Chain 211
  • https://match.360yield.com/match/ebda?google_gid=CAESEPRvZkXZWLFTly1Tg31NL30&google_cver=1&google_push=AXcoOmRj0g6ZptEhDtC9i9C446Sm9hmToxM3QoJi-W1Q_aW1S0c05suMQWyKyn8zOFqDuBcFnTmNbNRNgLpJQBN12LZY2RTsN_cgTg HTTP 302
  • https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEPRvZkXZWLFTly1Tg31NL30&google_cver=1&google_push=AXcoOmRj0g6ZptEhDtC9i9C446Sm9hmToxM3QoJi-W1Q_aW1S0c05suMQWyKyn8zOFqDuBcFnTmNbNRNgLpJQBN12LZY2RTsN_cgTg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=7xT3NXJYS2igUsQIGeD5Bw&google_push=AXcoOmRj0g6ZptEhDtC9i9C446Sm9hmToxM3QoJi-W1Q_aW1S0c05suMQWyKyn8zOFqDuBcFnTmNbNRNgLpJQBN12LZY2RTsN_cgTg
Request Chain 212
  • https://t.adx.opera.com/pub/sync?pubid=pub6871767557696&google_push=AXcoOmS4b5XTDAkLaZAOwOMJcEIF-WNRmxlnhGWiRpmdma-OlCSkncKwTPeJeWASnM9EjkGf1JOXo__fsHQ7wTS5DRBBpH9NFKTBGqM&google_gid=CAESEHwCtajIXEjJl7gPKMqE3VM&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEHwCtajIXEjJl7gPKMqE3VM&google_hm=T1BVOGNkMDBiNjc5YTRkNGE0ZmIyODI4ODVkNzExZTQ1YTA&google_nid=opera_norway_as&google_push=AXcoOmS4b5XTDAkLaZAOwOMJcEIF-WNRmxlnhGWiRpmdma-OlCSkncKwTPeJeWASnM9EjkGf1JOXo__fsHQ7wTS5DRBBpH9NFKTBGqM
Request Chain 216
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEwKCkY-Q4T--Y1Sz57w4UA&google_cver=1&gdpr=0
Request Chain 217
  • https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=0&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZmUwNThkN2ItZjVjNy0yNmFlLWM1OTctZjUyM2I3YTE2MTJj
Request Chain 218
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://sync.teads.tv/um?eid=3&uid=CAESEPupZ_clYrjsMYAfGJjvnj4&google_cver=1&gdpr=0
Request Chain 219
  • https://sync.teads.tv/um?eid=3&uid=&gdpr=0&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YTJmZmExMWUtYmE3ZS00NTNmLTgyYTItNjUwNWQxYzhmMTkw
Request Chain 224
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEPC8IH5i7vdThFqmkZjdL-c&google_cver=1&google_push=AXcoOmRdLfAyTVhB_ZsJCvEft2JpY4sSMmsVTbXG1e7MO-p4Evobne-n3vx7K5kgRJP0cNxWl8a2yp0yHOzKud7JloG54DHJu5k HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTEzNTMwNTM1NjIxODczMzg5OQ&google_push=AXcoOmRdLfAyTVhB_ZsJCvEft2JpY4sSMmsVTbXG1e7MO-p4Evobne-n3vx7K5kgRJP0cNxWl8a2yp0yHOzKud7JloG54DHJu5k
Request Chain 225
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEM0syb-5HEt-KaRo4abBlIc&google_cver=1&google_push=AXcoOmSNN-z0NW6ftPz5eH-IOY-YBbaYpJfa9KEdZFqCZr6jtS_u0bucUSRD91wkWut_pyJaARgmwcWvoZES58dpW2pfSCevup4 HTTP 302
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=AXcoOmSNN-z0NW6ftPz5eH-IOY-YBbaYpJfa9KEdZFqCZr6jtS_u0bucUSRD91wkWut_pyJaARgmwcWvoZES58dpW2pfSCevup4&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&cb=1701395921582 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-358895dc-82d6-4392-9b03-d569568dac10-005?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAXcoOmSNN-z0NW6ftPz5eH-IOY-YBbaYpJfa9KEdZFqCZr6jtS_u0bucUSRD91wkWut_pyJaARgmwcWvoZES58dpW2pfSCevup4%26google_hm%3DBTWIldyC1kOSmwPVaVaNrBA HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmSNN-z0NW6ftPz5eH-IOY-YBbaYpJfa9KEdZFqCZr6jtS_u0bucUSRD91wkWut_pyJaARgmwcWvoZES58dpW2pfSCevup4&google_hm=BTWIldyC1kOSmwPVaVaNrBA
Request Chain 226
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEPnSyueLLZdDWQoaCzqzPnQ&google_cver=1&google_push=AXcoOmTDt08O2zyX8UBCh7L4tuGPm-tofnovTQig8fbBoYmQaWsst3oRjKpnWbjqLwlYpWEFhtF8zmAC7UDC7F0YsqroWct1JR8 HTTP 302
  • https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=0&gdpr_consent=&us_privacy=&sync=1&google_push=AXcoOmTDt08O2zyX8UBCh7L4tuGPm-tofnovTQig8fbBoYmQaWsst3oRjKpnWbjqLwlYpWEFhtF8zmAC7UDC7F0YsqroWct1JR8&google_gid=CAESEPnSyueLLZdDWQoaCzqzPnQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDAzMzUzOTcxMTU1NTc4NjA4NDI4NQ%3D%3D&google_push=AXcoOmTDt08O2zyX8UBCh7L4tuGPm-tofnovTQig8fbBoYmQaWsst3oRjKpnWbjqLwlYpWEFhtF8zmAC7UDC7F0YsqroWct1JR8
Request Chain 227
  • https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEHC8HWDCWcayD3VrUi1W7dc&google_cver=1&google_push=AXcoOmTX25AlOghqGWwUgnlvz0eOn5ZiEuKwnk8a4JlacdiEY1m1MaD-F69od8gQmiug8DLpkrewKNWxZRKo4Jjv_bPKQF1OeCXD HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dxandr_eb%26google_hm%3D%24%7BBASE64_UID_ENC%7D%26google_gid%3DCAESEHC8HWDCWcayD3VrUi1W7dc%26google_cver%3D1%26google_push%3DAXcoOmTX25AlOghqGWwUgnlvz0eOn5ZiEuKwnk8a4JlacdiEY1m1MaD-F69od8gQmiug8DLpkrewKNWxZRKo4Jjv_bPKQF1OeCXD HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=ODk2MTkxMDk3MDY3NDkxMDg0OA%3D%3D&google_gid=CAESEHC8HWDCWcayD3VrUi1W7dc&google_cver=1&google_push=AXcoOmTX25AlOghqGWwUgnlvz0eOn5ZiEuKwnk8a4JlacdiEY1m1MaD-F69od8gQmiug8DLpkrewKNWxZRKo4Jjv_bPKQF1OeCXD
Request Chain 228
  • https://analytics.pangle-ads.com/api/ad/union/gg_cookie_matching?google_gid=CAESEHXEdb-DMb_buHC-lgiVCMQ&google_cver=1&google_push=AXcoOmRC_NgynfCmOy_sgH01gD1pXzNF_kOZJkgXMXErWwVzIpG2mZhUigsozKlFCSabvrlNeU4nWndokAwteY_IBK2aKzC_InYR HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmRC_NgynfCmOy_sgH01gD1pXzNF_kOZJkgXMXErWwVzIpG2mZhUigsozKlFCSabvrlNeU4nWndokAwteY_IBK2aKzC_InYR
Request Chain 258
  • https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://partners.tremorhub.com/sync?UIGL=CAESELFKsejX6-h0T00tlEERUU4&google_cver=1&gdpr=0
Request Chain 259
  • https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&uid=CAESEJN68q_Bm143upm1uztSI0k&google_cver=1
Request Chain 272
  • https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESELT3iw-GH3Mlw4R88PLsGRM&google_cver=1&google_push=AXcoOmTnhVLEpdL3S3Ba-SVV6xCgIV4HONVaVYBILGlGovX8bPUEvsmVHhurBKRp8FDLCoJQFmQNKyuBbP52NMa-XCtRsD0seg4 HTTP 302
  • https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=65cd523349ed1230&is_secure=true&networkId=14000&version=1&google_gid=CAESELT3iw-GH3Mlw4R88PLsGRM&google_cver=1&google_push=AXcoOmTnhVLEpdL3S3Ba-SVV6xCgIV4HONVaVYBILGlGovX8bPUEvsmVHhurBKRp8FDLCoJQFmQNKyuBbP52NMa-XCtRsD0seg4 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAHHduNO7ivsQMzOZJhAAAAAAA&expiration=1701482321&google_cver=1&is_secure=true&google_gid=CAESELT3iw-GH3Mlw4R88PLsGRM&google_push=AXcoOmTnhVLEpdL3S3Ba-SVV6xCgIV4HONVaVYBILGlGovX8bPUEvsmVHhurBKRp8FDLCoJQFmQNKyuBbP52NMa-XCtRsD0seg4
Request Chain 274
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEC0MqaNJWOFQe9MUzdQtH8A&google_cver=1&google_push=AXcoOmQTgIi2sD_DCOdYOSTNbXFi8AOslmIcXdMEC4OjrnUe3_Jzkms219QkxPdTDfL0iVA0P2zWOk4USeCX-Oo2YvJFJPTovcM HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEC0MqaNJWOFQe9MUzdQtH8A&google_cver=1&google_push=AXcoOmQTgIi2sD_DCOdYOSTNbXFi8AOslmIcXdMEC4OjrnUe3_Jzkms219QkxPdTDfL0iVA0P2zWOk4USeCX-Oo2YvJFJPTovcM HTTP 302
  • https://server.cpmstar.com/usersync.aspx?bsw_custom_parameter=a4aa8fa7-9617-489f-a8fd-b4612be68449&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%26ssp%3Dgoogle%26user_id%3D%24UID
Request Chain 275
  • https://s.uuidksinc.net/match/47/?remote_uid=CAESEK596AFpYLNqQN2M0TAlIKc&c_param1=AXcoOmSXnyvwRWucvDa2qsQN-GlCY-QeaofCyC51YKKBH4HGweqJBjzwwjhaZYGjVxSQ9ow-JqH1NlOMpwrHUOQsReBBM6m7s_Vr&gdpr=%%GDPR%%&addtl_consent=%%ADDTL_CONSENT%%&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmSXnyvwRWucvDa2qsQN-GlCY-QeaofCyC51YKKBH4HGweqJBjzwwjhaZYGjVxSQ9ow-JqH1NlOMpwrHUOQsReBBM6m7s_Vr
Request Chain 276
  • https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESENIYEwgeHHWG-aMYTsCt0B4&google_cver=1&google_push=AXcoOmQlm91gEvJpUcNsqEanJ3RNExK9jxdYV7Ql2hlL8KFMH3-IymAePMyIDLn4XjG0dwXQJrTGQzUUOhMsnL1LtqYjGBPZd-zw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=GnXLSWpRUlpUMgCssutHlbnVUKQ&google_push=AXcoOmQlm91gEvJpUcNsqEanJ3RNExK9jxdYV7Ql2hlL8KFMH3-IymAePMyIDLn4XjG0dwXQJrTGQzUUOhMsnL1LtqYjGBPZd-zw
Request Chain 277
  • https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEOpiMJLJp_KuF6gU5UVeqEM&google_cver=1&google_push=AXcoOmSKp5nlvDALTz7gZDHIcKTrs8gQp-5UZgmTaWONzhtzCbbr_Gtr01KopQnN-GEQH37ZocQ3A0dqBrg57cUQCKt18Yt3j2yf HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSKp5nlvDALTz7gZDHIcKTrs8gQp-5UZgmTaWONzhtzCbbr_Gtr01KopQnN-GEQH37ZocQ3A0dqBrg57cUQCKt18Yt3j2yf
Request Chain 278
  • https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESECoXUKp0P-orFYDQk_lnj8M&google_cver=1&google_push=AXcoOmRIerYAFXINskYJFMU_i6UBFePQHiJ6-n9TUoFTHsq2gfD1VF8KPWwe8swr7ifxKIPOU0TAtSXTZH7xewFpD-D8-3IAYey5Iw HTTP 302
  • https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESECoXUKp0P-orFYDQk_lnj8M&google_cver=1&google_push=AXcoOmRIerYAFXINskYJFMU_i6UBFePQHiJ6-n9TUoFTHsq2gfD1VF8KPWwe8swr7ifxKIPOU0TAtSXTZH7xewFpD-D8-3IAYey5Iw&chk=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=MWIxNzhjNWMxYjY1ODJiMw&google_push=AXcoOmRIerYAFXINskYJFMU_i6UBFePQHiJ6-n9TUoFTHsq2gfD1VF8KPWwe8swr7ifxKIPOU0TAtSXTZH7xewFpD-D8-3IAYey5Iw
Request Chain 318
  • https://eb2.3lift.com/sync HTTP 302
  • https://eb2.3lift.com/sync?&ld=1
Request Chain 319
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D743293%26extuid%3D%24UID%26traffic_source%3Dsnippet%26session%3D139C6587B24895D4%26sp%3D678634%26pb%3D493076%26c%3D709112%26a%3D743293%26domain%3Dhttps%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile HTTP 303
  • https://sync.adtelligent.com/csync?t=a&ep=743293&extuid=9135305356218733899&traffic_source=snippet&session=139C6587B24895D4&sp=678634&pb=493076&c=709112&a=743293&domain=https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Request Chain 325
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fa-prebid.vidoomy.com%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID HTTP 302
  • https://a-prebid.vidoomy.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=8961910970674910848
Request Chain 326
  • https://ups.analytics.yahoo.com/ups/58531/occ?gdpr=0&gdpr_consent= HTTP 302
  • https://ups.analytics.yahoo.com/ups/58531/occ?gdpr=0&gdpr_consent=&verify=true HTTP 302
  • https://a-prebid.vidoomy.com/setuid?bidder=verizonmedia&uid=y-xv9cScBE2uEqP4mZbM8DQ8.FiwBsqMDOo3P8nz8-~A&gdpr=0
Request Chain 327
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fa-prebid.vidoomy.com%2Fsetuid%3Fbidder%3Dadf%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID HTTP 303
  • https://a-prebid.vidoomy.com/setuid?bidder=adf&gdpr=0&gdpr_consent=&uid=9135305356218733899
Request Chain 328
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=120&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fa.vidoomy.com%2Fapi%2Frtbserver%2Fcookie%3Fi%3DCEN%26uid%3D%7BuserId%7D HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=120&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fa.vidoomy.com%2Fapi%2Frtbserver%2Fcookie%3Fi%3DCEN%26uid%3D%7BuserId%7D HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3D736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553%26partner_url%3Dhttps%253A%252F%252Fa.vidoomy.com%252Fapi%252Frtbserver%252Fcookie%253Fi%253DCEN%2526uid%253D736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553&partner_url=https%3A%2F%2Fa.vidoomy.com%2Fapi%2Frtbserver%2Fcookie%3Fi%3DCEN%26uid%3D736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553&partner_url=https%3A%2F%2Fa.vidoomy.com%2Fapi%2Frtbserver%2Fcookie%3Fi%3DCEN%26uid%3D736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553 HTTP 302
  • https://a.vidoomy.com/api/rtbserver/cookie?i=CEN&uid=736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553
Request Chain 334
  • https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D1%26gdpr_consent%3D HTTP 302
  • https://onetag-sys.com/match/?int_id=1&uid=9ff86569-3dd5-4800-a1c7-b1d0a032f114&gdpr=1&gdpr_consent=
Request Chain 336
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D1%26gdpr_consent%3D%26uid%3D$UID HTTP 302
  • https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=8961910970674910848
Request Chain 337
  • https://ads.stickyadstv.com/user-matching?id=3679&gdpr=1&gdpr_consent= HTTP 302
  • https://onetag-sys.com/match/?int_id=3&uid=19e74a65c36c6d13014e8a2869ef343&gdpr_consent=&gdpr=1
Request Chain 339
  • https://cs.admanmedia.com/73c1e1bfc3bde354d60b80e601ae3914.gif?puid=[UID]&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D164%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%5BUID%5D&gdpr=1&gdpr_consent=&ccpa=&coppa= HTTP 302
  • https://onetag-sys.com/match/?int_id=164&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5850f379-36d6-4b94-9eaf-286cf9fb0f17
Request Chain 340
  • https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABjCMZfJNv_UiAPAKbInHrmsMEknyn63trSw
Request Chain 342
  • https://onetag-sys.com/match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=5L_ScCmIe04VLRjc2VnEry0yNqNSktKNq21C2Hw8kMI
Request Chain 344
  • https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm HTTP 302
  • https://onetag-sys.com/match/?int_id=106&google_gid=CAESECGu7pF2HhMHxAjTB__6CXA&google_cver=1
Request Chain 346
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent= HTTP 302
  • https://onetag-sys.com/match/?int_id=29&uid=a0469c36-bc77-430e-9825-0adde7e331a8&gdpr=0&gdpr_consent=
Request Chain 348
  • https://bh.contextweb.com/bh/rtset?pid=561118&ev=1&rurl=https%3a%2f%2fads.yieldmo.com/v000/sync?userid=%%VGUID%%&pn_id=pp&gdpr=0&gdpr_consent=&gpp=&gpp_sid=&us_privacy= HTTP 302
  • https://ads.yieldmo.com/v000/sync?userid=oR97ZMVTiSrh&ev=1&pn_id=pp&gpp_sid=&gpp=&us_privacy=&pid=561118&gdpr_consent=&gdpr=0
Request Chain 349
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=yieldmo&ttd_tpi=1&ttd_puid=3zE7aqqnn7qUr6HrdVjl HTTP 302
  • https://ads.yieldmo.com/v000/sync?tdid=a0469c36-bc77-430e-9825-0adde7e331a8
Request Chain 350
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.yieldmo.com%252Fsync%253Fpn_id%253Dpub%2526id%253D%2523PMUID%2526gdpr%253DPM_GDPR%2526gdpr_consent%253DPM_CONSENT HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.yieldmo.com%252Fsync%253Fpn_id%253Dpub%2526id%253D%2523PMUID%2526gdpr%253DPM_GDPR%2526gdpr_consent%253DPM_CONSENT&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NTk1OTFCM0YtMzQzOC00QUIyLTg2QzUtMkQ2MTRFNTcwNjIw&gdpr=-1&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} HTTP 302
  • https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=476A89A3-0BB0-450F-AC03-2F959BAA28BD
Request Chain 351
  • https://cm.g.doubleclick.net/pixel?google_nid=yieldmo_dbm&google_cm&pn_id=c HTTP 302
  • https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEASEEgvHwSkIqDJWnvimmD4&google_cver=1
Request Chain 352
  • https://ib.adnxs.com/getuid?https://ads.yieldmo.com/v000/sync?userid=$UID&pn_id=an HTTP 302
  • https://ads.yieldmo.com/v000/sync?userid=8961910970674910848&pn_id=an
Request Chain 356
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=3658&xuid=a0469c36-bc77-430e-9825-0adde7e331a8&dongle=0cfd&gdpr=0&gdpr_consent=
Request Chain 357
  • https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDAzMzUzOTcxMTU1NTc4NjA4NDI4NQ%3D%3D HTTP 302
  • https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Request Chain 358
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEO25avhk7A3ETOq3Ssp8KD0&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 359
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDAzMzUzOTcxMTU1NTc4NjA4NDI4NQ%3D%3D
Request Chain 361
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/4033539711555786084285?gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-fWrWTLFE2oSf5brlw_9UGncr88I1LLJ7XdF0vSzhfA--~A&dongle=0883
Request Chain 362
  • https://x.bidswitch.net/sync?ssp=triplelift&user_id=4033539711555786084285&gdpr=0&gdpr_consent=${GDPR_CONSENT} HTTP 302
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=a4aa8fa7-9617-489f-a8fd-b4612be68449&gdpr=0&gdpr_consent= HTTP 302
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=a4aa8fa7-9617-489f-a8fd-b4612be68449&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=7bf77b4b-d840-4833-9c17-8c93328d985b&ssp=triplelift&expires=30&user_group=5&bsw_param=a4aa8fa7-9617-489f-a8fd-b4612be68449 HTTP 302
  • https://eb2.3lift.com/xuid?mid=2409&xuid=a4aa8fa7-9617-489f-a8fd-b4612be68449&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 364
  • https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=0%26gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=3335&xuid=8961910970674910848&dongle=4d58&gdpr=0&gdpr_consent=
Request Chain 375
  • https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid] HTTP 302
  • https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid]&cklb=1 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smart/6271432635359966753
Request Chain 377
  • https://secure.adnxs.com/getuid?https://csync.smilewanted.com/set_partner_userid_get/appnexus/$UID HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/appnexus/8961910970674910848
Request Chain 383
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-smilewanted&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rubicon/LPLZ7BS5-D-FDIX?gdpr=0
Request Chain 399
  • https://ice.360yield.com/server_match?r=https://csync.smilewanted.com/set_partner_userid_get/improve/{PUB_USER_ID}&partner_id=1010 HTTP 302
  • https://ice.360yield.com/ul_cb/server_match?r=https://csync.smilewanted.com/set_partner_userid_get/improve/%7BPUB_USER_ID%7D&partner_id=1010 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/improve/032b313a-9bd4-43d9-bcc5-c1d15ae21a9d&partner_id=1010
Request Chain 401
  • https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&gdpr=0&redir=true HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS16ejFsNnRCRTJ1RlROalYyTDlyWnMxYXNVZURoSEdpOH5B&gdpr=0
Request Chain 402
  • https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEFdef8FhrmoQJ8DdXumOBp0&google_cver=1&gdpr=0 HTTP 302
  • https://1f2e7.v.fwmrm.net/ad/u?_dv=2&dsp_user_mapping=true&127719=19e74a65c36c6d13014e8a2869ef343&rdU=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D1169%26userId%3d%23%7buser.id%7d%26gdpr%3d0%26gdpr_consent%3d&159=CAESEFdef8FhrmoQJ8DdXumOBp0&gdpr=0 HTTP 302
  • https://ads.stickyadstv.com/user-registering?dataProviderId=1169&userId=umo1a91_7309131076569196210&gdpr=0&gdpr_consent= HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/stickyads/19e74a65c36c6d13014e8a2869ef343?gdpr=0&gdpr_consent= HTTP 302
  • https://ads.stickyadstv.com/user-registering?dataProviderId=199&userId=y-vNmC.6hE2oPtOk768c6C9fHHUvO.6FFhvH_nRcIW~A HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=stickyads&ttd_tpi=1 HTTP 302
  • https://ads.stickyadstv.com/user-registering?dataProviderId=208&userId=a0469c36-bc77-430e-9825-0adde7e331a8&gdpr=0&gdpr_consent= HTTP 302
  • https://match.prod.bidr.io/cookie-sync/stv?gdpr=0&gdpr_consent= HTTP 303
  • https://match.prod.bidr.io/cookie-sync/stv?gdpr=0&gdpr_consent=&_bee_ppp=1 HTTP 303
  • https://ads.stickyadstv.com/user-registering?userId=AAB0vk7K0nwAABPqtqAq9A&dataProviderId=817&gdpr=0 HTTP 302
  • https://pm.w55c.net/ping_match.gif?st=FREEWHEEL&rurl=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D593&userId=_wfivefivec_&gdpr=0 HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&st=FREEWHEEL&rurl=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D593&userId=_wfivefivec_&gdpr=0 HTTP 302
  • https://ads.stickyadstv.com/user-registering?dataProviderId=593&userId=ukFBPzdY1R8SNN5&gdpr=0 HTTP 302
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D209%26userId%3D$UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0 HTTP 302
  • https://ads.stickyadstv.com/user-registering?dataProviderId=209&userId=8961910970674910848&gdpr=0&gdpr_consent=&gdpr=0 HTTP 302
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=stickyadstv&append=1&cb=4624239&redirect=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D690%26userId%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://ads.stickyadstv.com/user-registering?dataProviderId=690&userId=bf3b4c55-e598-442d-83b3-e58668bc1d22 HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=103&gdpr=0&gdpr_consent= HTTP 302
  • https://ads.stickyadstv.com/user-registering?dataProviderId=721&userId=736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553&gdpr=0&gdpr_consent= HTTP 302
  • https://jelly.mdhv.io/v4/pixie?gdpr=0&gdpr_consent=
Request Chain 403
  • https://ads.stickyadstv.com/user-matching?id=11 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=MTllNzRhNjVjMzZjNmQxMzAxNGU4YTI4NjllZjM0Mw==&gdpr=0&gdpr_consent=
Request Chain 405
  • https://aep.mxptint.net/sn.ashx?google_gid=CAESENQB-rpzQBFSNvIns5aXglU&google_cver=1&google_push=AXcoOmRpkqT6aX94zDC_707sw_bjgzE-org_5aKqQNn-jiMWtQJ7_K3xqXNrVy06dJiRnO5XIYy5aYuEElHnuCG3y8SvPgXKjw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmRpkqT6aX94zDC_707sw_bjgzE-org_5aKqQNn-jiMWtQJ7_K3xqXNrVy06dJiRnO5XIYy5aYuEElHnuCG3y8SvPgXKjw&google_hm=UjMzNjQ1XzEwQ0ZDQUZEQl9BRUExOEJGMw%3D%3D
Request Chain 406
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEOpAtE_gQ1Sx0ogcj7FSe9s&google_cver=1&google_push=AXcoOmTpCNen9vzoa9lnBqW8MLxLV0bz0CL3rWbGWbuAxoOWpfq5f-iWgURPUm52mMEvBE89Ql3NWSapbqYZCGDKH53BnkwqtfSV HTTP 302
  • https://p.rfihub.com/cm?in=1&pub=20513&ssp=google&gdpr=&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=969188722382023932&expires=30&ssp=google HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmQVK6gkRaNEYIFI-iQHYnTQXfz9Ih8crhrQ1-Ax_b3V67_83whxhX9uHrQ7BA6TGdqNWLmsy0bB_oqKhH6PGuj2IPbSLA0ovw&google_hm=pKqPp5YXSJ-o_bRhK-aESQ==
Request Chain 407
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEIG2LyTobK3Pz4uREu0ePDk&google_cver=1&google_push=AXcoOmQgfRoDX6ntM-yTy8Fgd7MCYFaoBQUNvy2QxWUC5ySZXc2RD-MEVFGD-Vd671d-h86fn7hXYv8tZVu4XDt9A4wVpTzpcmsF HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=xTFJbLbs37tyhbKsPP9VC2cm&source_user_id=7a252ca9f1&gdpr=0&gdpr_consent=
Request Chain 409
  • https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEF-DsbDz9VWB6RVYWA5uxIs&google_cver=1&google_push=AXcoOmTQDMHbUVuQB0x6a0aGBYOFNxKyRxrvEOo3si28IHEE5czlWmgCvmJHDGffD62mCBp16jr38cJQPr7zwNK7TDBfITiiiZPu HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AXcoOmTQDMHbUVuQB0x6a0aGBYOFNxKyRxrvEOo3si28IHEE5czlWmgCvmJHDGffD62mCBp16jr38cJQPr7zwNK7TDBfITiiiZPu&google_hm=Njc0NjQ0NTgzOTIyNTA3NTI4Mw%3D%3D
Request Chain 410
  • https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEC2LbqsZqbI6R1ZYep-EbaE&google_cver=1&google_push=AXcoOmTGn0Zm_YFGu3go5ywjIfEM_nGQE0o4HF7i5-laNwPbO6YSTyCY3q3NlmDha0q5gK0ZRZrkipOEOUoZfoR0XbD-K5gST5ngWw HTTP 302
  • https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEC2LbqsZqbI6R1ZYep-EbaE&google_cver=1&google_push=AXcoOmTGn0Zm_YFGu3go5ywjIfEM_nGQE0o4HF7i5-laNwPbO6YSTyCY3q3NlmDha0q5gK0ZRZrkipOEOUoZfoR0XbD-K5gST5ngWw&chk=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=M2JjMmI1NGU5NmE4NDJmNg&google_push=AXcoOmTGn0Zm_YFGu3go5ywjIfEM_nGQE0o4HF7i5-laNwPbO6YSTyCY3q3NlmDha0q5gK0ZRZrkipOEOUoZfoR0XbD-K5gST5ngWw
Request Chain 416
  • https://u.openx.net/w/1.0/cm?id=158474f5-20ec-4fcc-8ba8-4c101c556b25&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fopenx%2F HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/openx/77209c27-0cd5-4694-9602-687603ff073e
Request Chain 417
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID HTTP 307
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID&sovrn_retry=true HTTP 307
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/Hvu2ZLZHRMHRFVFyQd6nRYRY
Request Chain 421
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/9135305356218733899
Request Chain 423
  • https://b1sync.zemanta.com/usersync/smilewanted?gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Foutbrain%2F__ZUID__ HTTP 302
  • https://b1sync.zemanta.com/usersync/smilewanted?cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Foutbrain%2F__ZUID__&gdpr=0&gdpr_consent=&s=2&us_privacy= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/outbrain/JthQNRlYKvyYtq8sninV?gdpr=0
Request Chain 425
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://creativecdn.com/cm-notify?pi=smilewanted&tc=1 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/YudBnxYzY05pE_p4oQJY7XUKcgMgXtb8ClAoiGkl-0U?pi=smilewanted&tc=1
Request Chain 456
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEI_NGlBdGpCGad5YGvcZ0xg&gdpr=0&google_cver=1
Request Chain 457
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=GOOGLE_HOSTED_PI&gdpr=0&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_hm%3DSMART_USER_ID_B64 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_hm=NjI3MTQzMjYzNTM1OTk2Njc1Mw==&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEI_NGlBdGpCGad5YGvcZ0xg&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 460
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEOpAtE_gQ1Sx0ogcj7FSe9s&google_cver=1&google_push=AXcoOmQVK6gkRaNEYIFI-iQHYnTQXfz9Ih8crhrQ1-Ax_b3V67_83whxhX9uHrQ7BA6TGdqNWLmsy0bB_oqKhH6PGuj2IPbSLA0ovw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmQVK6gkRaNEYIFI-iQHYnTQXfz9Ih8crhrQ1-Ax_b3V67_83whxhX9uHrQ7BA6TGdqNWLmsy0bB_oqKhH6PGuj2IPbSLA0ovw&google_hm=pKqPp5YXSJ-o_bRhK-aESQ==
Request Chain 461
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEHkJcSLI1jppfBa56T6qw3E&google_cver=1&google_push=AXcoOmTgYye1auY30lOewFrPZGgSxqDlqYppQBdmdBNbd1rujaMZx8-uP8GncqtGnBZQtgPcyRaFn5Qcvav0KwdrSGzxw26uh3rubQ HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEHkJcSLI1jppfBa56T6qw3E&google_cver=1&google_push=AXcoOmTgYye1auY30lOewFrPZGgSxqDlqYppQBdmdBNbd1rujaMZx8-uP8GncqtGnBZQtgPcyRaFn5Qcvav0KwdrSGzxw26uh3rubQ&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=wSDjaor_TKCkG2V4PC9mMw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmTgYye1auY30lOewFrPZGgSxqDlqYppQBdmdBNbd1rujaMZx8-uP8GncqtGnBZQtgPcyRaFn5Qcvav0KwdrSGzxw26uh3rubQ
Request Chain 462
  • https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESELeO2L60owA_PBOUHfLY3Ug&google_cver=1&google_push=AXcoOmRGrKJDJuz3m5SJ6SGWdbSMNOe6p_tMJjoCq0Ovg63OIHoMMVOY6RhuswMxnTmFzKewe-RP2aj1TsMZg36UvarTKuCHOF_Ikg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=GnXLSWpRUlpUMgCssutHlbnVUKQ&google_push=AXcoOmRGrKJDJuz3m5SJ6SGWdbSMNOe6p_tMJjoCq0Ovg63OIHoMMVOY6RhuswMxnTmFzKewe-RP2aj1TsMZg36UvarTKuCHOF_Ikg
Request Chain 463
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEIG2LyTobK3Pz4uREu0ePDk&google_cver=1&google_push=AXcoOmQ4FAJQ0SNxOB71jHdMbVvcgDzKYn_bay7Y2OhDs8JbZiJjHyGRVGwhx0mv3YKgqmRA7NWATo-rjrX6mp5kIBJ5lO7L4e2zPA HTTP 302
  • https://www.tumblr.com/ads-user-sync?partner=smaato&uid=9658eab955&gdpr=0&gdpr_consent= HTTP 303
  • https://www.tumblr.com/privacy/consent/begin?redirect=https%3A%2F%2Fwww.tumblr.com%2Fads-user-sync%3Fpartner%3Dsmaato%26uid%3D9658eab955%26gdpr%3D0%26gdpr_consent%3D&v=2
Request Chain 464
  • https://match.360yield.com/match/ebda?google_gid=CAESEF-u4EHfj8Kht2Skq9pbQss&google_cver=1&google_push=AXcoOmQXqRTCCGYc12A8LEwkO-sMKkKroe1Na8b5uhBcMAilYQXH1JD1IA4CqE2CgCKnc4SFRKeywDkBbgsPVcMabsdV8XNm7UCaLA HTTP 302
  • https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEF-u4EHfj8Kht2Skq9pbQss&google_cver=1&google_push=AXcoOmQXqRTCCGYc12A8LEwkO-sMKkKroe1Na8b5uhBcMAilYQXH1JD1IA4CqE2CgCKnc4SFRKeywDkBbgsPVcMabsdV8XNm7UCaLA HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=7xT3NXJYS2igUsQIGeD5Bw&google_push=AXcoOmQXqRTCCGYc12A8LEwkO-sMKkKroe1Na8b5uhBcMAilYQXH1JD1IA4CqE2CgCKnc4SFRKeywDkBbgsPVcMabsdV8XNm7UCaLA
Request Chain 489
  • https://aep.mxptint.net/sn.ashx?google_gid=CAESENQB-rpzQBFSNvIns5aXglU&google_cver=1&google_push=AXcoOmSZXDpqKPUYS_xt9KZf-mM0Ug8BrGhpJ6EfQiw5MER4msuk9Z1FkfCgMKrq9KMTUx0bepBFkVexAP50YwVlk61BaO14n8k HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmSZXDpqKPUYS_xt9KZf-mM0Ug8BrGhpJ6EfQiw5MER4msuk9Z1FkfCgMKrq9KMTUx0bepBFkVexAP50YwVlk61BaO14n8k&google_hm=UjMzNjQ1XzEwQ0ZDQUZEQl9BRUExOEVGOQ%3D%3D
Request Chain 490
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEHkJcSLI1jppfBa56T6qw3E&google_cver=1&google_push=AXcoOmTAHct2wsKOb2l6OeYU-aQJwKrQaN8mVJHKU-5PFQ4_4aNym7e6hC5fGGpGMGgV1QvHKSsiy-f7mUy19x3Es1Rh5BdghcM HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEHkJcSLI1jppfBa56T6qw3E&google_cver=1&google_push=AXcoOmTAHct2wsKOb2l6OeYU-aQJwKrQaN8mVJHKU-5PFQ4_4aNym7e6hC5fGGpGMGgV1QvHKSsiy-f7mUy19x3Es1Rh5BdghcM&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=wSDjaor_TKCkG2V4PC9mMw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmTAHct2wsKOb2l6OeYU-aQJwKrQaN8mVJHKU-5PFQ4_4aNym7e6hC5fGGpGMGgV1QvHKSsiy-f7mUy19x3Es1Rh5BdghcM
Request Chain 491
  • https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESELeO2L60owA_PBOUHfLY3Ug&google_cver=1&google_push=AXcoOmSoOpmXXRcOp_MC2ZzqvFWxLjeV6V4YK55quXzTD5uy6rd_Lq8BN_G7awXGeTZ4lq_0Ludyz9aBKHIqRNKTVKHSVgwipmE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=GnXLSWpRUlpUMgCssutHlbnVUKQ&google_push=AXcoOmSoOpmXXRcOp_MC2ZzqvFWxLjeV6V4YK55quXzTD5uy6rd_Lq8BN_G7awXGeTZ4lq_0Ludyz9aBKHIqRNKTVKHSVgwipmE
Request Chain 492
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEIG2LyTobK3Pz4uREu0ePDk&google_cver=1&google_push=AXcoOmS1QGbHJrga_duUX5vQVgQeki10XLQumRlkOSGI518Mk2gNcCJ0H_Z37SWPGa_sp8q86p2pbdiAu8xfSknv3u6Fa3uT4A HTTP 302
  • https://sync.1rx.io/usersync/smaato/b7f6348625?gdpr=0&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-358895dc-82d6-4392-9b03-d569568dac10-005
Request Chain 493
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEM0syb-5HEt-KaRo4abBlIc&google_cver=1&google_push=AXcoOmRrnGuitrhSqNNq2jvG04x_NUetmmoaqqZiUjYNqXhglIKKloEAIcGCURIeZUfp2dB0BUSVrk0zWnbsEt11bppu3X5h3w HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-358895dc-82d6-4392-9b03-d569568dac10-005?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAXcoOmRrnGuitrhSqNNq2jvG04x_NUetmmoaqqZiUjYNqXhglIKKloEAIcGCURIeZUfp2dB0BUSVrk0zWnbsEt11bppu3X5h3w%26google_hm%3DBTWIldyC1kOSmwPVaVaNrBA HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmRrnGuitrhSqNNq2jvG04x_NUetmmoaqqZiUjYNqXhglIKKloEAIcGCURIeZUfp2dB0BUSVrk0zWnbsEt11bppu3X5h3w&google_hm=BTWIldyC1kOSmwPVaVaNrBA
Request Chain 494
  • https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEC2LbqsZqbI6R1ZYep-EbaE&google_cver=1&google_push=AXcoOmR8azaYCbRZSPOEBd3yDCd9P0AjAQJDchN4hdNV-WRZu1KpmtsGHbiKq-9uyObz8gXcF72wfew5bD0A1iIEsaLXyO8rHRFd HTTP 302
  • https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEC2LbqsZqbI6R1ZYep-EbaE&google_cver=1&google_push=AXcoOmR8azaYCbRZSPOEBd3yDCd9P0AjAQJDchN4hdNV-WRZu1KpmtsGHbiKq-9uyObz8gXcF72wfew5bD0A1iIEsaLXyO8rHRFd&chk=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=NjA5YTRjOWU3NzkzZTM0Yw&google_push=AXcoOmR8azaYCbRZSPOEBd3yDCd9P0AjAQJDchN4hdNV-WRZu1KpmtsGHbiKq-9uyObz8gXcF72wfew5bD0A1iIEsaLXyO8rHRFd
Request Chain 513
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DXandr%2B%25E2%2580%2593%2BInvest%2BDSP%2B-%2BBanner%26ttl%3D720%26uid%3D75d56568a11564bfb79a01d2fa9fdb29%26visitor%3D%24UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP+-+Banner&ttl=720&uid=75d56568a11564bfb79a01d2fa9fdb29&visitor=8961910970674910848&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
Request Chain 514
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DXandr%2B%25E2%2580%2593%2BInvest%2BDSP%26ttl%3D720%26uid%3D48d5713d5c563cba2049f505b2d944b6%26visitor%3D%24UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP&ttl=720&uid=48d5713d5c563cba2049f505b2d944b6&visitor=8961910970674910848&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
Request Chain 515
  • https://x.bidswitch.net/sync?ssp=adyoulike&gdpr=0&gdpr_consent= HTTP 302
  • https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=adyoulike HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=70&user_id=9135305356218733899&ssp=adyoulike HTTP 302
  • https://visitor.omnitagjs.com/visitor/sync?uid=2a62ca3297af454b8f19eb7922ed945f&visitor=a4aa8fa7-9617-489f-a8fd-b4612be68449&name=BIDSWITCH&gdpr=&gdpr_consent=
Request Chain 517
  • https://creativecdn.com/cm-notify?pi=adyoulike&gdpr=0&gdpr_consent= HTTP 302
  • https://creativecdn.com/cm-notify?pi=adyoulike&gdpr=0&gdpr_consent=&tc=1 HTTP 302
  • https://visitor.omnitagjs.com/visitor/sync?uid=094e13e3a08b6f25e4d4f7b1fba0b26b&visitor=nJhNX3BFCNmexFG-v6tMoBwZNIldP_0c5HeQ1KUCu0k&name=RTB_HOUSE&pi=adyoulike&gdpr=0&gdpr_consent=&tc=1
Request Chain 518
  • https://csync.smilewanted.com/getuid?source=openrtb&zoneCode=openrtb_adyoulike&redirect=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DSMILE_WANTED%26ttl%3D720%26uid%3De77031af9e62c4ae76bee5b9517c4ef4%26visitor%3D%24UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=SMILE_WANTED&ttl=720&uid=e77031af9e62c4ae76bee5b9517c4ef4&visitor=7b224b57df1db1f14d334ad9f861d9cf&gdpr=0&gdpr_consent=
Request Chain 519
  • https://match.prod.bidr.io/cookie-sync/aul HTTP 303
  • https://match.prod.bidr.io/cookie-sync/aul?_bee_ppp=1 HTTP 303
  • https://visitor.omnitagjs.com/visitor/sync?uid=25295ec01618ddaad37302ab4dd9c8ac&visitor=AADi8E7K0nwAABMXtn_NUw&name=BEESWAX
Request Chain 520
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=k2j3gqp&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://visitor.omnitagjs.com/visitor/sync?uid=8122fdac60517b1efe1389612f3dfb34&visitor=a0469c36-bc77-430e-9825-0adde7e331a8&name=THE_TRADE_DESK
Request Chain 521
  • https://b1sync.zemanta.com/usersync/adyoulike/?cb=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_NATIVE_1_2%26ttl%3D720%26uid%3Df2d9136cf53dede7f83ba16171a37fdd%26visitor%3D__ZUID__%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ZEMANTA_NATIVE_1_2&ttl=720&uid=f2d9136cf53dede7f83ba16171a37fdd&visitor=JthQNRlYKvyYtq8sninV&gdpr=0&gdpr_consent=&gdpr=0
Request Chain 522
  • https://image8.pubmatic.com/AdServer/ImgSync?p=159706&pu=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visitor%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=159706&pu=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visitor%3D%23PMUID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=N0ZDQkJCRTgtRjE0Qi00QUVFLUE1OEItQzk1RTEyMzgyM0VF&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} HTTP 302
  • https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=476A89A3-0BB0-450F-AC03-2F959BAA28BD
Request Chain 523
  • https://b1sync.zemanta.com/usersync/adyoulike/?cb=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_BANNER%26ttl%3D720%26uid%3Dbdef6bd95b7450b4e62a32db8c7d8c9d%26visitor%3D__ZUID__%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ZEMANTA_BANNER&ttl=720&uid=bdef6bd95b7450b4e62a32db8c7d8c9d&visitor=JthQNRlYKvyYtq8sninV&gdpr=0&gdpr_consent=&gdpr=0
Request Chain 525
  • https://sync.adotmob.com/cookie/adyoulike?r=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DADOTMOB%26ttl%3D720%26uid%3Db989ee06df7dfc250798f7f0dfc4ddee%26visitor%3D%7Bamob_user_id%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ADOTMOB&ttl=720&uid=b989ee06df7dfc250798f7f0dfc4ddee&visitor=09dd220400f7d56bef5cd80c&gdpr=0&gdpr_consent=&gdpr=0&gdprConsent=
Request Chain 526
  • https://sync.srv.stackadapt.com/sync?nid=33&gdpr=0&gdpr_consent= HTTP 302
  • https://visitor.omnitagjs.com/visitor/sync?uid=74a1ec3b61e72925193cfceeea1b0608&visitor=0-1a75cb49-6a51-525a-5432-00acb2eb4795$ip$185.213.80.164&name=STACKADAPT&gdpr=0&gdpr_consent=
Request Chain 528
  • https://inv-nets.admixer.net/adxcm.aspx?ssp=5E789729-1E92-41CA-8B4F-987C6EDAE9FE&rurl=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DADMIXER%26ttl%3D720%26uid%3D0f4b0fcde45fe67019618f4c5f35f52e%26visitor%3D%24%24visitor_cookie%24%24%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ADMIXER&ttl=720&uid=0f4b0fcde45fe67019618f4c5f35f52e&visitor=1774b204c12b4887abdf5e36871b12e5&gdpr=0&gdpr_consent=
Request Chain 529
  • https://jadserve.postrelease.com/suid/101967?ntv_r=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DNATIVO%26ttl%3D720%26uid%3D0544850a0778385701c6899403bef718%26visitor%3DNTV_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=NATIVO&ttl=720&uid=0544850a0778385701c6899403bef718&visitor=f616cb2e-ea3f-4a4d-b38a-d37bfae9b5cc&gdpr=0&gdpr_consent=
Request Chain 530
  • https://ads.betweendigital.com/match?bidder_id=44774&callback_url=%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fuid%3Dbf39a6af2a15b80f82f7ff725f351919%26visitor%3D%24%7BUSER_ID%7D%26name%3DBETWEENX%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_CONSENT%7D&gdpr=0&consent= HTTP 302
  • https://ads.betweendigital.com/match?bidder_id=44774&callback_url=%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fuid%3Dbf39a6af2a15b80f82f7ff725f351919%26visitor%3D%24%7BUSER_ID%7D%26name%3DBETWEENX%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_CONSENT%7D&gdpr=0&consent=&crf=1&rts=-6076311382343178456 HTTP 302
  • https://visitor.omnitagjs.com/visitor/sync?uid=bf39a6af2a15b80f82f7ff725f351919&visitor=a2fd180f-1eab-534f-b26c-6b6bd70556be&name=BETWEENX&gdpr=0&gdpr_consent=
Request Chain 531
  • https://bttrack.com/pixel/cookiesync?source=6b2595d5-cf4e-4298-a4ac-bcc34433eaad&secure=1&gdpr=0&gdpr_consent= HTTP 302
  • https://visitor.omnitagjs.com/visitor/sync?uid=6ca9493fd95af83951a8d0b213a77e8d&visitor=4116a309-2928-4d65-b56c-2c6a48e8a2a7&name=BIDTELLECT&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}
Request Chain 532
  • https://id.rlcdn.com/711333.gif?&gdpr=0&gdpr_consent= HTTP 307
  • https://id.rlcdn.com/1000.gif?memo=CKW1KxoNCNX7pKsGEgUI6AcQAEIASgA
Request Chain 534
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent= HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Request Chain 535
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent= HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Request Chain 536
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent= HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Request Chain 539
  • https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABjCMZiZM2_SNeZN2Jr1ZggM8IUFJwTLQK1Q
Request Chain 540
  • https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://onetag-sys.com/match/?int_id=1&uid=ad486569-3dd5-4800-ba9a-c274bf6c91fb&gdpr=0&gdpr_consent=
Request Chain 541
  • https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=0&gdpr_consent= HTTP 302
  • https://onetag-sys.com/match/?int_id=2&uid=LPLZ7BT1-K-6QY9&gdpr=0
Request Chain 542
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D0%26gdpr_consent%3D%26uid%3D$UID HTTP 302
  • https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=8961910970674910848
Request Chain 543
  • https://ads.stickyadstv.com/user-matching?id=3679&gdpr=0&gdpr_consent= HTTP 302
  • https://onetag-sys.com/match/?int_id=3&uid=19e74a65c36c6d13014e8a2869ef343&gdpr_consent=&gdpr=0
Request Chain 544
  • https://cs.admanmedia.com/73c1e1bfc3bde354d60b80e601ae3914.gif?puid=[UID]&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D164%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%26uid%3D%5BUID%5D&gdpr=0&gdpr_consent=&ccpa=&coppa= HTTP 302
  • https://onetag-sys.com/match/?int_id=164&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5e3b3c30-3b2a-4b86-b01b-9dc4120b1f41
Request Chain 545
  • https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid] HTTP 302
  • https://onetag-sys.com/match/?int_id=107&uid=6746445839225075283
Request Chain 546
  • https://onetag-sys.com/match/?int_id=113&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=LHP9BTcFATj7SsusPnWgknafkm9l-neXw34ShLXSWRg
Request Chain 547
  • https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D%23PMUID HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D%23PMUID&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NDc2QTg5QTMtMEJCMC00NTBGLUFDMDMtMkY5NTlCQUEyOEJE&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY} HTTP 302
  • https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=476A89A3-0BB0-450F-AC03-2F959BAA28BD
Request Chain 548
  • https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm HTTP 302
  • https://onetag-sys.com/match/?int_id=106&google_gid=CAESECGu7pF2HhMHxAjTB__6CXA&google_cver=1
Request Chain 549
  • https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=0&gdpr_consent= HTTP 302
  • https://onetag-sys.com/match/?int_id=92&uid=y-xv9cScBE2uEqP4mZbM8DQ8.FiwBsqMDOo3P8nz8-~A
Request Chain 550
  • https://x.bidswitch.net/sync?ssp=onetag&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=onetag&bsw_param=a4aa8fa7-9617-489f-a8fd-b4612be68449&google_hm=YTRhYThmYTctOTYxNy00ODlmLWE4ZmQtYjQ2MTJiZTY4NDQ5 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESENzNhJKZxC_kW9jQ1k8JCp0&google_cver=1&ssp=onetag&bsw_param=a4aa8fa7-9617-489f-a8fd-b4612be68449 HTTP 302
  • https://onetag-sys.com/match/?int_id=30&uid=a4aa8fa7-9617-489f-a8fd-b4612be68449&gdpr=&gdpr_consent=&us_privacy=
Request Chain 553
  • https://secure.adnxs.com/getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partneruserid%3D$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=8961910970674910848&gdpr=0&gdpr_consent=
Request Chain 554
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DSMART_USER_ID&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=6746445839225075283&gdpr=0&gdpr_consent=
Request Chain 555
  • https://visitor.omnitagjs.com/visitor/bsync?uid=627080440e659fbe0f85333c665ae1de&name=SMARTADSERVER&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D117%26partneruserid%3DPARTNER_USER_ID%26gdpr%3DGDPR%26gdpr_consent%3DGDPR_CONSENT&gdpr=0&gdpr_consent= HTTP 307
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=62ae6d0f7138766890cdfecf38ceff8f&gdpr=0&gdpr_consent=0
Request Chain 556
  • https://cms.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=LkOVBSsSxw81EJJYfkKOBS5BkAw1E8IMexJyU98A
Request Chain 567
  • https://pixel-eu.rubiconproject.com/exchange/sync.php?p=adyoulike&gdpr=0&gdpr_consent=&gdpr=0&us_privacy=1---&khaos=LPLZ7BT1-K-6QY9 HTTP 302
  • https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LPLZ7BT1-K-6QY9&name=RUBICON&gdpr=0&us_privacy=1---
Request Chain 568
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&gdpr=0&us_privacy=1--- HTTP 302
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=kcZydKTuRlKWztfIFMjiAQ&rk=usync-other&gdpr=0 HTTP 302
  • https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=kcZydKTuRlKWztfIFMjiAQ&gdpr=0
Request Chain 569
  • https://token.rubiconproject.com/token?pid=36584&gdpr=0&us_privacy=1--- HTTP 302
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Request Chain 570
  • https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&gdpr=0&us_privacy=1--- HTTP 302
  • https://s.amazon-adsystem.com/ecm3?id=LPLZ7BT1-K-6QY9&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1---
Request Chain 571
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0&us_privacy=1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=a0469c36-bc77-430e-9825-0adde7e331a8&gdpr=0&gdpr_consent=&expires=30
Request Chain 572
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr=0&us_privacy=1--- HTTP 302
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=qlXVDL0GTHm4wPYJ1Li8Zg&rk=usync-na&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=qlXVDL0GTHm4wPYJ1Li8Zg&gdpr=0
Request Chain 573
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&gdpr=0&us_privacy=1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEGbEL0JXCMAzjP1mQ9hmVtA&google_cver=1
Request Chain 574
  • https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr=0&us_privacy=1--- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YmEwZjQyODg0OTVlOTRmMmIwMzc3YzkyOGIyMDQwNzNiMTdiMzJjMQ&gdpr=0&us_privacy=1---
Request Chain 575
  • https://token.rubiconproject.com/token?pid=25470&gdpr=0&us_privacy=1--- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TFBMWjdCVDEtSy02UVk5&gdpr=0&us_privacy=1--- HTTP 302
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&gdpr=0&google_gid=CAESENH3npdsUJSdslP1pQnH6Zs&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBMWjdCVDEtSy02UVk5&google_push=&gdpr=0
Request Chain 576
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&gdpr=0&us_privacy=1--- HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/I6nyO-4KxCWEfeDPvzIwWQ?csrc=&gdpr=0&us_privacy=1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-QJ2VS_lE2oIwrTZua5d920hqzGcTVsJXdumV6A--~A
Request Chain 577
  • https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&gdpr=0&us_privacy=1--- HTTP 303
  • https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AADi8E7K0nwAABMXtn_NUw&expires=30&gdpr=0
Request Chain 578
  • https://pixel.rubiconproject.com/exchange/sync.php?p=primis&gdpr=0&us_privacy=1--- HTTP 302
  • https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1--- HTTP 301
  • https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LPLZ7BT1-K-6QY9 HTTP 302
  • https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LPLZ7BT1-K-6QY9&ckls=true&ci=cCawVhmeDc&nc=false&trid=941298698
Request Chain 579
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&gdpr=0&us_privacy=1--- HTTP 302
  • https://prebid.a-mo.net/setuid/magnite?uid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Request Chain 580
  • https://token.rubiconproject.com/token?pid=37556&a=1&gdpr=0&us_privacy=1--- HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Request Chain 581
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&gdpr=0&us_privacy=1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=bf3b4c55-e598-442d-83b3-e58668bc1d22&expires=30&gdpr=0&us_privacy=1---
Request Chain 582
  • https://token.rubiconproject.com/token?pid=26594&gdpr=0&us_privacy=1--- HTTP 302
  • https://ups.analytics.yahoo.com/ups/58160/sync?_origin=1&uid=LPLZ7BT1-K-6QY9&redir=true&gdpr=0&us_privacy=1--- HTTP 302
  • https://ups.analytics.yahoo.com/ups/58824/sync?_origin=0&dpid=58160&ovsid=LPLZ7BT1-K-6QY9&gdpr=0&redir=true&us_privacy=1--- HTTP 302
  • https://hb.yahoo.net/cksync?cs=63&axid_e=eS16ejFsNnRCRTJ1RlROalYyTDlyWnMxYXNVZURoSEdpOH5B&gdpr=0&ovsid=LPLZ7BT1-K-6QY9&dpid=58160&us_privacy=1---
Request Chain 583
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn&gdpr=0&us_privacy=1--- HTTP 302
  • https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Request Chain 584
  • https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn&gdpr=0&us_privacy=1--- HTTP 302
  • https://ce.lijit.com/merge?pid=80&3pid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Request Chain 585
  • https://pixel.rubiconproject.com/exchange/sync.php?p=19564&gdpr=0&us_privacy=1--- HTTP 302
  • https://capi.connatix.com/us/pixel?puid=LPLZ7BT1-K-6QY9&pId=11&gdpr=&gdpr_consent=&us_privacy=&gdpr=0&us_privacy=1--- HTTP 302
  • https://capi.connatix.com/us/pixel?puid=LPLZ7BT1-K-6QY9&pId=11&gdpr=&gdpr_consent=&us_privacy=&gdpr=0&us_privacy=1---&final=true
Request Chain 586
  • https://pixel.rubiconproject.com/exchange/sync.php?p=18694&gdpr=0&us_privacy=1--- HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Request Chain 587
  • https://c1.adform.net/serving/cookie/match?party=1164&gdpr=0&us_privacy=1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=14240&nid=2676&put=9135305356218733899
Request Chain 589
  • https://pixel.rubiconproject.com/exchange/sync.php?p=seedtag&gdpr=0&us_privacy=1--- HTTP 302
  • https://s.seedtag.com/cs/cookiesync/Rubicon?channeluid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Request Chain 590
  • https://bttrack.com/pixel/cookiesync?source=c91bfcce-bb43-46f7-b14e-567c0a4332b3&gdpr=0&us_privacy=1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=71772&nid=3664&put=4116a309-2928-4d65-b56c-2c6a48e8a2a7
Request Chain 591
  • https://sync.srv.stackadapt.com/sync?nid=14&gdpr=0&us_privacy=1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=731524&nid=3858&put=GnXLSWpRUlpUMgCssutHlbnVUKQ
Request Chain 592
  • https://secure.adnxs.com/getuidnb?https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4894%26nid%3D1986%26put%3D$UID%26expires%3D30&gdpr=0&us_privacy=1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=4894&nid=1986&put=8961910970674910848&expires=30&gdpr=0&us_privacy=1---
Request Chain 593
  • https://ad.turn.com/r/cs?pid=6&gdpr=0&us_privacy=1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=4212&nid=1185&put=2401794706099336508&expires=60&gdpr=0&gdpr_consent=
Request Chain 594
  • https://sync.1rx.io/usersync2/rubicon?gdpr=0&us_privacy=1--- HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-358895dc-82d6-4392-9b03-d569568dac10-005?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D186028%26nid%3D4112%26put%3DRX-358895dc-82d6-4392-9b03-d569568dac10-005%26expires%3D30%26us_privacy%3D1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=186028&nid=4112&put=RX-358895dc-82d6-4392-9b03-d569568dac10-005&expires=30&us_privacy=1---
Request Chain 595
  • https://id.rlcdn.com/709414.gif?gdpr=0&us_privacy=1--- HTTP 307
  • https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e
Request Chain 597
  • https://pixel.rubiconproject.com/exchange/sync.php?p=33across&gdpr=0&us_privacy=1--- HTTP 302
  • https://ssc-cms.33across.com/ps/?xi=1&xu=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1--- HTTP 302
  • https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LPLZ7BT1-K-6QY9&ts=1701395930&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1---
Request Chain 598
  • https://pixel.rubiconproject.com/exchange/sync.php?p=rise_engage&gdpr=0&us_privacy=1--- HTTP 302
  • https://cs.yellowblue.io/cs?aid=11590&id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Request Chain 599
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-triple13&gdpr=0&us_privacy=1--- HTTP 302
  • https://s2s.t13.io/setuid?bidder=rubicon&uid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Request Chain 600
  • https://pixel.rubiconproject.com/exchange/sync.php?p=outbrain&gdpr=0&us_privacy=1--- HTTP 302
  • https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LPLZ7BT1-K-6QY9&obUid=&initiator=&gdpr=0&us_privacy=1---
Request Chain 601
  • https://pixel.rubiconproject.com/exchange/sync.php?p=adyoulike&gdpr=0&us_privacy=1--- HTTP 302
  • https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LPLZ7BT1-K-6QY9&name=RUBICON&gdpr=0&us_privacy=1---
Request Chain 602
  • https://pixel.rubiconproject.com/exchange/sync.php?p=minute_media&gdpr=0&us_privacy=1--- HTTP 302
  • https://cs.minutemedia-prebid.com/cs?aid=21479&id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Request Chain 603
  • https://token.rubiconproject.com/token?pid=49096&gdpr=0&us_privacy=1--- HTTP 302
  • https://i.liadm.com/s/60909?bidder_id=227664&bidder_uuid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1--- HTTP 303
  • https://i.liadm.com/s/60909?gdpr=0&bidder_id=227664&bidder_uuid=LPLZ7BT1-K-6QY9&_li_chk=true&us_privacy=1---&previous_uuid=1a39f2bf14f74a96a87f091187cddd6a HTTP 303
  • https://i6.liadm.com/s/60909?gdpr=0&bidder_id=227664&bidder_uuid=LPLZ7BT1-K-6QY9&us_privacy=1---&us_privacy=1---
Request Chain 604
  • https://pixel.rubiconproject.com/exchange/sync.php?p=unruly&gdpr=0&us_privacy=1--- HTTP 302
  • https://sync.1rx.io/usersync/rubicon/LPLZ7BT1-K-6QY9?gdpr=0&us_privacy=1--- HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-358895dc-82d6-4392-9b03-d569568dac10-005
Request Chain 605
  • https://pixel.rubiconproject.com/exchange/sync.php?p=17404&gdpr=0&us_privacy=1--- HTTP 302
  • https://exchange.mediavine.com/usersync/redirect?partner=rubicon&partnerId=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Request Chain 607
  • https://um.simpli.fi/rb_match?gdpr=0&us_privacy=1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=172B0C337EA24A8F83EA8C8A4B595618&expires=365
Request Chain 608
  • https://cm.adgrx.com/bridge?AG_SETCOOKIE&AG_PID=rubicon&gdpr=0&us_privacy=1--- HTTP 302
  • https://cm.adgrx.com/bridge.gif?AG_PID=rubicon&gdpr=0&us_privacy=1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=144054&nid=4032&put=2b7a36e8-8fed-11ee-8e97-8536f0308748&expires=60
Request Chain 609
  • https://token.rubiconproject.com/token?pid=2046&pt=n&a=1&gdpr=0&us_privacy=1--- HTTP 302
  • https://rubicon-match.dotomi.com/match/bounce/current?networkId=12783&version=1&nuid=8PvYAksz_7pYkW-n9zOznQ&gdpr=0&us_privacy=1--- HTTP 302
  • https://rubicon-match.dotomi.com/match/bounce/current?DotomiTest=68180ae3495d14be&is_secure=true&networkId=12783&version=1&nuid=8PvYAksz_7pYkW-n9zOznQ&gdpr=0&us_privacy=1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=5364|1|90&nid=2046&put=AAAGditm25Iy9wMXWiNQAAAAAAA&expiration=1701482328&nuid=8PvYAksz_7pYkW-n9zOznQ&is_secure=true&us_privacy=1---&gdpr=0
Request Chain 612
  • https://pixel.rubiconproject.com/exchange/sync.php?p=yieldmo&gdpr=0&us_privacy=1--- HTTP 302
  • https://ads.yieldmo.com/sync?pn_id=rc&id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Request Chain 613
  • https://pixel.rubiconproject.com/exchange/sync.php?p=11864&gdpr=0&us_privacy=1--- HTTP 302
  • https://crb.kargo.com/api/v1/dsync/Rubicon?exid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Request Chain 614
  • https://pixel.rubiconproject.com/exchange/sync.php?p=17184&gdpr=0&us_privacy=1--- HTTP 302
  • https://sync.aniview.com/cookiesyncendpoint?biddername=5&auid=&key=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Request Chain 615
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-medianet&gdpr=0&us_privacy=1--- HTTP 302
  • https://prebid-s2s.media.net/setuid?bidder=rubicon&uid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Request Chain 618
  • https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent= HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFEaThFN0swbndBQUJNWHRuX05Vdw&gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 303
  • https://sync.technoratimedia.com/services?uid=AADi8E7K0nwAABMXtn_NUw&srv=cs&pid=73&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpp%252Cpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2&gdpr=0
Request Chain 619
  • https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8961910970674910848&gdpr=0&gdpr_consent=
Request Chain 620
  • https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=43ij_OYp8fb4K6Shs3m4_ON6pvX4KPT1timfRy2f
Request Chain 623
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:ukFBPzdY1R8SNN5&gdpr=0&gdpr_consent=
Request Chain 624
  • https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=2b7a36e8-8fed-11ee-8e97-8536f0308748
Request Chain 626
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://sync.aralego.com/bsw_sync?ucf_nid=par-E2B44D84BBBDED8A0B297323E4B4A68&dsp_id=445&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=a4aa8fa7-9617-489f-a8fd-b4612be68449&gdpr=0&gdpr_consent=&gdpr_pd=&usprivacy=
Request Chain 628
  • https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969188722382023932
Request Chain 631
  • https://b1sync.zemanta.com/usersync/pubmatic/?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:JthQNRlYKvyYtq8sninV&gdpr=0&gdpr_consent=&gdpr=0
Request Chain 632
  • https://t.adx.opera.com/pub/sync?pubid=pub8730968190912 HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU8cd00b679a4d4a4fb282885d711e45a0
Request Chain 634
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=wSDjaor_TKCkG2V4PC9mMw%3D%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Request Chain 635
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=C120E36A-8AFF-4CA0-A41B-65783C2F6633 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=785428a7-1311-49b6-8148-11f15b1f4e66%252C%252C&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=a0469c36-bc77-430e-9825-0adde7e331a8&ttd_puid=785428a7-1311-49b6-8148-11f15b1f4e66%2C%2C
Request Chain 638
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QzEyMEUzNkEtOEFGRi00Q0EwLUE0MUItNjU3ODNDMkY2NjMz&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Request Chain 639
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEIJWLQbIDq1CaCPrnV5WzHg&google_cver=1
Request Chain 640
  • https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:172B0C337EA24A8F83EA8C8A4B595618
Request Chain 641
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=a0469c36-bc77-430e-9825-0adde7e331a8&gdpr=0&gdpr_consent=
Request Chain 642
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=C120E36A-8AFF-4CA0-A41B-65783C2F6633&redir=true&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-Mo47knJE2uWnuwfndhFQ2mNqVoGxaos-~A&gdpr=0
Request Chain 644
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=bf3b4c55-e598-442d-83b3-e58668bc1d22&gdpr=0&gdpr_consent=
Request Chain 645
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2401794706099336508&gdpr=0&gdpr_consent=&us_privacy=1---
Request Chain 646
  • https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=C120E36A-8AFF-4CA0-A41B-65783C2F6633&gdpr=0&gdpr_consent= HTTP 302
  • https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=50289e14251a110b&is_secure=true&networkId=17100&version=1&nuid=C120E36A-8AFF-4CA0-A41B-65783C2F6633&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAHJxg86EGjDQMeQ1JHAAAAAAA&expiration=1701482330&nuid=C120E36A-8AFF-4CA0-A41B-65783C2F6633&is_secure=true&gdpr_consent=&gdpr=0
Request Chain 647
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553&gdpr=0&gdpr_consent=
Request Chain 648
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=9135305356218733899
Request Chain 650
  • https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMTUmdGw9MTI5NjAw&piggybackCookie=cuid_2709aa30-8fed-11ee-bb78-125335d52042&gdpr=0

645 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request file
www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/ 		309 KB
82 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.16.113.74 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0ae875f5cc7243e4c142dc754a0cd30f482aaace7507790a4cdc434a96c89175
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
cf-cache-status
DYNAMIC
cf-ray
82e7b9d999d3a1e1-YYZ
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 01 Dec 2023 01:58:35 GMT
expires
0
pragma
no-cache
server
cloudflare
strict-transport-security
max-age=0
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
x-robots-tag
noindex, nofollow
cmp.min.js
the.gatekeeperconsent.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://the.gatekeeperconsent.com/cmp.min.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.28.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
66f8ecd359ccf9d79ae9c4ad10312de1a65db446344b2667e54d604f25d3165b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 01 Dec 2023 01:54:02 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
274
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FSx2HHTSx0ypL%2FFv%2BvmvQxYnZTBPF7uOXvXkCouVk13P9wUlyhSemEiK7ehYDPCutIU1yfy3CUUoKsOlAeuxv8h1w7Nv1i%2FPFPSo6J7Qd2gkeF3bnjmn4L0%2B4Sa%2BgQMDp93ZJ7%2FkU93aihfb"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=14400
x-robots-tag
noindex
cf-ray
82e7b9dbbd72a21c-YYZ
alt-svc
h3=":443"; ma=86400
js
www.googletagmanager.com/gtag/ 		174 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-829541-1
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.31.97 Oxford, United States, ASN15169 (GOOGLE, US),
Reverse DNS
bj-in-f97.1e100.net
Software
Google Tag Manager /
Resource Hash
ead8e45499426a960090b63835ac9a2544a43497b16d4390606caeb885600004
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
64876
x-xss-protection
0
last-modified
Fri, 01 Dec 2023 01:02:50 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 01 Dec 2023 01:58:36 GMT
tag
btloader.com/ 		52 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://btloader.com/tag?o=5678961798414336&upapi=true
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.41.60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab0755e32905c4c823f523f750f0360e004ee6d13419a81a3f15caaf3212b43e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
via
1.1 google
cf-cache-status
HIT
last-modified
Fri, 01 Dec 2023 01:42:55 GMT
server
cloudflare
age
746
etag
"0adcba94e59749defefb0e2c87894dbb"
vary
Origin, Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
accept-ranges
bytes
cf-ray
82e7b9dcf8b3a1fc-YYZ
content-length
17941
sa.min.js
www.ezojs.com/ezoic/ 		121 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.ezojs.com/ezoic/sa.min.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.170.144 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5887ea0717fc39d653a3453200bea15c7aa04dc6d97ef19905f3dac89f7262ea

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 30 Nov 2023 22:14:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
13426
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UfIvkmK0j%2FuqzyeNFKocBEi7DHTFEER1q5WlrNz%2B%2FoRRMvgJEa236sF4bAD65baheOBvI7diOD0K4j8y13Zreu5woRNfJgq73LPc%2BJyMb%2FhT%2B%2BVaJSepCdYp4U%2Fkil8g"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=86400
x-robots-tag
noindex
cf-ray
82e7b9dcc9365491-YYZ
alt-svc
h3=":443"; ma=86400
element.js
translate.google.com/translate_a/ 		88 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://translate.google.com/translate_a/element.js?cb=googFooterTranslate
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f100.1e100.net
Software
ESF /
Resource Hash
ed8ab2f9385a7f58d695bf0aecf88a5851b20ab17f7fd501e4a488383908e7e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
expires
Mon, 01 Jan 1990 00:00:00 GMT
v84a3a4012de94ce1a686ba8c167c359c1696973893317
static.cloudflareinsights.com/beacon.min.js/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.56.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

Request headers

Referer
https://www.mediafire.com/
Origin
https://www.mediafire.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
last-modified
Tue, 10 Oct 2023 21:38:13 GMT
server
cloudflare
etag
W/"2023.10.0"
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
82e7b9dcaabc398a-YYZ
consent_modules.json
privacy.gatekeeperconsent.com/ 		34 B
502 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://privacy.gatekeeperconsent.com/consent_modules.json
Requested by
Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/cmp.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.28.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
24434236112e2c40b190268b75b5a499d50fa6a4cd93664b9ec82f7852865ebf

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jz0Gs0mCgODvRMGiqtpbTJJfAl2axU7xw2jdvJInIp7hyegDPGiDUYEC%2B%2F6uvlesS%2FFb7OagxaicQmVqBUoNqvavo0h%2F5DnVyfBptpuYQI1ae7EhmX6c3KcR0jLM%2BjkjFTodDYN8lYLj12WT9TwqWg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json;charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=15780000, public
cf-ray
82e7b9dc7cb036fe-YYZ
alt-svc
h3=":443"; ma=86400
content-length
34
amplitude-8.5.0-min.gz.js
cdn.amplitude.com/libs/ 		68 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.150.163 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-150-163.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4

Request headers

Referer
https://www.mediafire.com/
Origin
https://www.mediafire.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 15:37:09 GMT
content-encoding
gzip
via
1.1 de2ed3c94563fee614f35f9bc3f52d1c.cloudfront.net (CloudFront)
x-amz-version-id
NY8_7uBz3xoXYJBVsMSBAGHOz8ixMBS3
x-amz-cf-pop
IAD89-C3
age
2715689
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
22154
last-modified
Fri, 13 Aug 2021 22:37:42 GMT
server
AmazonS3
etag
"660c3b546f2a131de50b69b91f26c636"
access-control-max-age
3000
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges
bytes
x-amz-cf-id
Qkt4zWo3xsNpWTg6KxK2u4KqJ4q_337jDhL402FKjB5ibvOmf-hzDA==
gtm.js
www.googletagmanager.com/ 		260 KB
82 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.31.97 Oxford, United States, ASN15169 (GOOGLE, US),
Reverse DNS
bj-in-f97.1e100.net
Software
Google Tag Manager /
Resource Hash
d81afbabdbd5a49876a5de55e9f667f261a18548ccfb3d4a1ae1a4dc9f4f9664
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
83469
x-xss-protection
0
last-modified
Fri, 01 Dec 2023 01:02:50 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 01 Dec 2023 01:58:36 GMT
mf_logo_full_color.svg
static.mediafire.com/images/backgrounds/header/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/backgrounds/header/mf_logo_full_color.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.16.113.74 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 28 Oct 2016 22:22:42 GMT
server
cloudflare
age
7675
etag
W/"5813cfb2-d1d"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cf-ray
82e7b9dc2d53a1e1-YYZ
file-zip-v3.png
static.mediafire.com/images/filetype/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/filetype/file-zip-v3.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.16.113.74 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
cf-cache-status
HIT
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
server
cloudflare
age
7429
etag
"62deda56-750"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
82e7b9dc2d50a1e1-YYZ
content-length
1872
expires
Sat, 30 Dec 2023 23:32:22 GMT
icons_sprite.svg
www.mediafire.com/images/icons/svg_light/ 		36 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mediafire.com/images/icons/svg_light/icons_sprite.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.16.113.74 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
server
cloudflare
age
4580
etag
W/"62deda56-90ab"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cf-ray
82e7b9dc2d4fa1e1-YYZ
apps_list_sprite-v6.png
static.mediafire.com/images/backgrounds/download/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/backgrounds/download/apps_list_sprite-v6.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.16.113.74 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc54b817820f14ce6395ba2a037f37d4bb0af75d5b017336140793fbe2f7f738

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
cf-cache-status
HIT
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
server
cloudflare
age
8223
etag
"62deda56-1fd1"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
82e7b9dc4da2a1e1-YYZ
content-length
8145
expires
Sat, 30 Dec 2023 23:33:17 GMT
arrow_dropdown.svg
www.mediafire.com/images/icons/svg_dark/ 		315 B
333 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mediafire.com/images/icons/svg_dark/arrow_dropdown.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.16.113.74 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
server
cloudflare
age
1219
etag
W/"62deda56-13b"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cf-ray
82e7b9dc4da3a1e1-YYZ
check_circle_green.svg
static.mediafire.com/images/icons/svg_dark/ 		444 B
374 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/icons/svg_dark/check_circle_green.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.16.113.74 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
server
cloudflare
age
2452
etag
W/"62deda56-1bc"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cf-ray
82e7b9dc4da4a1e1-YYZ
fb_16x16.png
static.mediafire.com/images/backgrounds/download/social/ 		181 B
282 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/backgrounds/download/social/fb_16x16.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.16.113.74 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
cf-cache-status
HIT
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
server
cloudflare
age
1990
etag
"62deda56-b5"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
82e7b9dc4da5a1e1-YYZ
content-length
181
expires
Sat, 30 Dec 2023 23:54:16 GMT
infinity.js.aspx
cdn.otnolatrnup.com/Scripts/ 		177 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.otnolatrnup.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.214.37 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
35b7b500dca7f0e16292ca2253d16e372786ac3030c1b18288ba3d71823a1363

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 01 Dec 2023 01:56:21 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
server
cloudflare
age
25
vary
Accept-Encoding
p3p
CP="CAO PSA OUR IND"
access-control-allow-origin
*
content-type
application/x-javascript; charset=utf-8
cache-control
public, no-transform, max-age=900
cf-ray
82e7b9dcaa0c36c9-YYZ
alt-svc
h3=":443"; ma=86400
footerIcons.png
static.mediafire.com/images/backgrounds/footer/social/ 		583 B
681 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/backgrounds/footer/social/footerIcons.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.16.113.74 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
cf-cache-status
HIT
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
server
cloudflare
age
7675
etag
"62deda56-247"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
82e7b9dc4da6a1e1-YYZ
content-length
583
expires
Sat, 30 Dec 2023 23:32:27 GMT
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-829541-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.239.36.178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 01 Dec 2023 00:38:05 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
4831
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Fri, 01 Dec 2023 02:38:05 GMT
like.php
www.facebook.com/plugins/ Frame 8A79 		43 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.240.244.35 Apodaca, Mexico, ASN32934 (FACEBOOK, US),
Reverse DNS
edge-star-mini-shv-01-mty2.facebook.com
Software
/
Resource Hash
fb07d2959ec9548dfe750dfdea160a300ece939c9e018faba07c8a71dfe887f2
Security Headers
Name Value
Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, no-cache, no-store, must-revalidate
content-encoding
br
content-security-policy
default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type
text/html; charset="utf-8"
cross-origin-opener-policy
unsafe-none
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 01:58:36 GMT
document-policy
force-load-at-top
expires
Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster
?0
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), gamepad=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), payment=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=()
permissions-policy-report-only
autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
pragma
no-cache
report-to
{"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
reporting-endpoints
default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"
strict-transport-security
max-age=15552000; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-fb-debug
zHesqLFl8O/N3+bN6ynirAmykRxKytIkPMjDUvbZo8Visg0Ix3YEseL39gFrBMUrzhiG7o3B97pJ/dQmPInltA==
x-xss-protection
0
world.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 		143 KB
52 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/backgrounds/download/additional_content/world.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.16.113.74 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
server
cloudflare
age
7664
etag
W/"62deda56-23ce2"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cf-ray
82e7b9dc9e15a1e1-YYZ
continent-eu.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 		23 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/backgrounds/download/additional_content/continent-eu.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.16.113.74 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cbb99c4149249b280f1d3d924d9bdd29a4a14cba1e71775fb3bdbdf13ebd5a48

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
server
cloudflare
age
4131
etag
W/"62deda56-5ca3"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cf-ray
82e7b9dc9e16a1e1-YYZ
nor.svg
static.mediafire.com/images/flags_svg/ 		517 B
342 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/flags_svg/nor.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.16.113.74 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
86edd1bd7bd5f3251da12cd3c5b391deb666745d36daf364bfaf0a5aa5d59bc5

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
server
cloudflare
age
8521
etag
W/"62deda56-205"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cf-ray
82e7b9dcae22a1e1-YYZ
flag.svg
static.mediafire.com/images/backgrounds/download/additional_content/ 		234 B
277 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.mediafire.com/images/backgrounds/download/additional_content/flag.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.16.113.74 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f52a0c7d9fa7ae8e45916c491ae7193f9a1e289f128f05264122c53d8da970db

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 25 Jul 2022 18:00:54 GMT
server
cloudflare
age
7046
etag
W/"62deda56-ea"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cf-ray
82e7b9dcfe97a1e1-YYZ
js
www.googletagmanager.com/gtag/ 		234 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-53LP4T
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.31.97 Oxford, United States, ASN15169 (GOOGLE, US),
Reverse DNS
bj-in-f97.1e100.net
Software
Google Tag Manager /
Resource Hash
a017ff6b8ae193889bf7cc3fd35ed7b22ddf106b22ec1ec9b3c581e97dfac943
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
82962
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 01 Dec 2023 01:58:36 GMT
main.js
www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/ Frame 097D
Redirect Chain
  • https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
7 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Server
104.16.113.74 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d51d6b611f47875116c593b131e1310e5ec32c822b63e4e94a73dec8370519ad
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cloudflare
vary
accept-encoding
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
82e7b9de184aa1e1-YYZ

Redirect headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
server
cloudflare
vary
accept-encoding
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
access-control-allow-origin
*
cache-control
max-age=300, public
cf-ray
82e7b9dd3ef4a1e1-YYZ
m=el_main_css
www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.qhDXWpKopYk.L.W.O/am=CAM/d=0/rs=AN8SPfqeKn8wA30q4viup18yaci8udUjKQ/ 		22 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.qhDXWpKopYk.L.W.O/am=CAM/d=0/rs=AN8SPfqeKn8wA30q4viup18yaci8udUjKQ/m=el_main_css
Requested by
Host:
URL: /_/translate_http/_/js/k=translate_http.tr.en_US.NCDVv9o_B5A.O/am=CAM/d=1/rs=AN8SPfpp3nu6l97CsQCuUSY9TVoCT_-UAQ/m=el_conf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f94.1e100.net
Software
sffe /
Resource Hash
71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Tue, 28 Nov 2023 01:19:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
261536
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4144
x-xss-protection
0
last-modified
Sat, 15 Jul 2023 01:09:03 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="rosetta"
vary
Accept-Encoding
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type
text/css; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 27 Nov 2024 01:19:40 GMT
m=el_main
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.NCDVv9o_B5A.O/d=1/exm=el_conf/ed=1/rs=AN8SPfp-aCrxd0pMNJ2j_7sr2ckH2kDAHw/ 		230 KB
82 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.NCDVv9o_B5A.O/d=1/exm=el_conf/ed=1/rs=AN8SPfp-aCrxd0pMNJ2j_7sr2ckH2kDAHw/m=el_main
Requested by
Host:
URL: /_/translate_http/_/js/k=translate_http.tr.en_US.NCDVv9o_B5A.O/am=CAM/d=1/rs=AN8SPfpp3nu6l97CsQCuUSY9TVoCT_-UAQ/m=el_conf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f95.1e100.net
Software
sffe /
Resource Hash
98f6e8c47cc9172e4c8c74ec2a4b4a8df8988dd3b77803cd88bc435c42db2936
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 17:04:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
32036
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
83047
x-xss-protection
0
last-modified
Tue, 28 Nov 2023 22:11:38 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="rosetta"
vary
Accept-Encoding
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 29 Nov 2024 17:04:40 GMT
saa.go
g.ezoic.net/ 		13 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/saa.go
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
Apache/2.4.39 (Ubuntu) /
Resource Hash
966f3ac430cb4b37e8df3ecb24ba675d4a307f902fa767cd5102b0b46fc1d24a

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
server
Apache/2.4.39 (Ubuntu)
access-control-max-age
1728000
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
text/javascript
access-control-allow-origin
https://www.mediafire.com
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials
true
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-robots-tag
noindex
access-control-allow-headers
Content-Type
expires
Thu, 30 Nov 2023 01:58:36 GMT
boise.js
go.ezodn.com/detroitchicago/ 		926 B
791 B 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/boise.js?gcb=195-3&cb=2
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b0dc9f241ec7f0549db655a6d4aaa8c5540e5c82a1c908b8b83750e6853cd2cf

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 28 Nov 2023 07:56:44 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
229618
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CZ%2FotE8TGx6hmbxeS8sPihuq4xS0hiec4EeZBGMzOaXmD0jmxQyua9ZU0iZesyv%2BpK8gJFOoYiatm1wxJoQ7CTjkfBrZKWA7R6jwVcwbiJVlBIzcZTzF%2B6%2F4EKTglm0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9de9977430e-EWR
alt-svc
h3=":443"; ma=86400
abilene.js
go.ezodn.com/parsonsmaize/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b01d53596221a10ad89cd142297dd43310bbe0531fe4694fd590fdbeebf5a18d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 11 Nov 2023 03:46:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1534457
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kJND9BRz%2B7t1KqmUsklVWcSb56xbICYJ465K45rox9G1Z7RUmRnQsVWAJWwWaSG34%2FWP8eH3es4ZQAgS4W4LOLp1w2Z07MjYW3Nt5KWKIT%2B4PB%2BiLANPqAw1jSMOyJI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9de9976430e-EWR
alt-svc
h3=":443"; ma=86400
et.js
go.ezodn.com/porpoiseant/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/porpoiseant/et.js?gcb=195-3&cb=2
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2c34f09169d2a10e8f5863960e81575ab70f88b52f4bd3386ce5e41e73a94487

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 08 Nov 2023 12:37:09 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1705764
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oxmv9bHLbaj5SyTWZi6yIQv%2Fg6F7O0%2FI1kr%2FTWOdOwK0B0Tk%2BYShfyE9yUnkcswd%2FqiFSsENWR9FAn7XdwWQ8wL0M5JG%2F7mznA1hhRmLGlhaEKv2WYdIzObl3JP04Ac%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9de9974430e-EWR
alt-svc
h3=":443"; ma=86400
sa.go
g.ezoic.net/ 		85 KB
19 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/sa.go
Requested by
Host: www.ezojs.com
URL: https://www.ezojs.com/ezoic/sa.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
Apache/2.4.39 (Ubuntu) /
Resource Hash
bb98377ce3cea0d9070bca9d68aa2125f8933bb1699127d59da3ae6079aab819

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
server
Apache/2.4.39 (Ubuntu)
access-control-max-age
1728000
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
text/javascript
access-control-allow-origin
https://www.mediafire.com
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials
true
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-robots-tag
noindex
access-control-allow-headers
Content-Type
expires
Thu, 30 Nov 2023 01:58:36 GMT
Tag.engine
otnolatrnup.com/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://otnolatrnup.com/Tag.engine?time=480&id=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0&rand=49004&ver=async&referrerUrl=&fingerPrint=123&abr=false&stdTime=-480&fpe=1&bw=1600&bh=1200&res=1600x1200&curl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&kw=online%20storage%2Cfree%20storage%2Ccloud%20storage%2Ccollaboration%2Cbackup%20file%20sharing%2Cshare%20files%2Cphoto%20backup%2Cphoto%20sharing%2Cftp%20replacement%2Ccross%20platform%2Cremote%20access%2Cmobile%20access%2Csend%20large%20files%2Crecover%20files%2Cfile%20versioning%2Cundelete%2Cwindows%2Cpc%2Cmac%2Cos%20x%2Clinux%2Ciphone
Requested by
Host: cdn.otnolatrnup.com
URL: https://cdn.otnolatrnup.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.214.37 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b5d1ad93140fad26133258f38d9c8a0aaf8a2a41ea5697a3e36349f712c79d18

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
server
cloudflare
vary
Accept-Encoding
p3p
CP="CAO PSA OUR IND"
access-control-allow-origin
*
content-type
application/json; charset=utf-8
cache-control
private, no-transform
cf-ray
82e7b9de4d0736c9-YYZ
alt-svc
h3=":443"; ma=86400
state
api.btloader.com/mw/ 		0
101 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.btloader.com/mw/state?bt_env=prod
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 01 Dec 2023 01:58:36 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary
Origin
log
api.btloader.com/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.btloader.com/log?tid=eDSbOXyZ&cv=2.1.24-1-g0c437e2&sid=O3Yfbk4uHE&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Fri, 01 Dec 2023 01:58:36 GMT
cache-control
no-cache, no-store, must-revalidate
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary
Origin
log
api.btloader.com/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.btloader.com/log?tid=eDSbOXyZ&cv=2.1.24-1-g0c437e2&sid=O3Yfbk4uHE&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Fri, 01 Dec 2023 01:58:36 GMT
cache-control
no-cache, no-store, must-revalidate
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary
Origin
px.gif
ad-delivery.net/ 		43 B
910 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad-delivery.net/px.gif?ch=2
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.2.70 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
147121
x-guploader-uploadid
ABPtcPqR2mxsF_UCBjT1c9bzHiHNNZ5teJ453RBTM1B8uk7_b7NKVHexcSTepnQ9w6ikMK1tpwvsxakLKQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
5
x-goog-stored-content-encoding
identity
content-length
43
last-modified
Wed, 05 May 2021 19:25:32 GMT
server
cloudflare
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
vary
Accept-Encoding
x-goog-generation
1620242732037093
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=86400
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EQhnueQgV0zAsZG%2BHTnXUzlBP76PMC3%2BU4GBkqiYsCWB2otdVIIUREiH%2FKQ4Mu93Y7b5UrBHIkVEGIM7XL6PjtBfCgjJbRxQ7FUq0BEl%2FAluDiMCbomyzkYUoHb%2F%2B2tcsw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length
43
accept-ranges
bytes
cf-ray
82e7b9ded99b39f4-YYZ
expires
Wed, 29 Nov 2023 09:40:42 GMT
favicon.ico
ad.doubleclick.net/ 		1 KB
571 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.63.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f149.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 10:29:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
55755
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
104
x-xss-protection
0
last-modified
Tue, 08 May 2012 13:08:06 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/x-icon
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 01 Dec 2023 10:29:21 GMT
px.gif
ad-delivery.net/ 		43 B
330 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.9911766049611448
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.2.70 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
147121
x-guploader-uploadid
ABPtcPqR2mxsF_UCBjT1c9bzHiHNNZ5teJ453RBTM1B8uk7_b7NKVHexcSTepnQ9w6ikMK1tpwvsxakLKQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
5
x-goog-stored-content-encoding
identity
content-length
43
last-modified
Wed, 05 May 2021 19:25:32 GMT
server
cloudflare
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
vary
Accept-Encoding
x-goog-generation
1620242732037093
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=86400
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K9RE8AaI8VftOIbXQSGQdSRSv%2B4cy%2FREbi9BIq%2BikufSnBs5RU66QwKBU5VpYXYuazG2Yc527tU%2Be447%2BHSDOfvrpzjoGKUuSIUTbPuyi1cFhjyEY1KonhuEZ%2B7swrwv4g%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length
43
accept-ranges
bytes
cf-ray
82e7b9ded99c39f4-YYZ
expires
Wed, 29 Nov 2023 09:40:42 GMT
collect
analytics.google.com/g/ 		0
246 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-K68XP6D85D&gtm=45je3bt0v887485693z86304663&_p=1701395916156&_gaz=1&gcd=11l1l1l1l1&dma=0&cid=1675868932.1701395917&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1701395916&sct=1&seg=0&dl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&dt=NSwish%20texture%20pack&en=page_view&_fv=1&_nsi=1&_ss=1&up.page_url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&tfd=849
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.111.101 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bk-in-f101.1e100.net
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:36 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/ 		0
255 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-K68XP6D85D&cid=1675868932.1701395917&gtm=45je3bt0v887485693z86304663&aip=1&dma=0&gcd=11l1l1l1l1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:36 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
a
www.googletagmanager.com/ 		0
11 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.googletagmanager.com/a?id=G-K68XP6D85D&v=3&t=t&pid=1216235338&cv=1&rv=3bt0&tc=13&es=1&e=gtm.init_consent&eid=-1&h=Ag&dl=www.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&tdp=G-K68XP6D85D;87485693;1;6;0&z=0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.31.97 Oxford, United States, ASN15169 (GOOGLE, US),
Reverse DNS
bj-in-f97.1e100.net
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
td
www.googletagmanager.com/ 		0
15 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.googletagmanager.com/td?id=G-K68XP6D85D&v=3&t=t&pid=1216235338&cv=1&rv=3bt0&tc=13&es=1&e=gtm.init_consent&eid=-1&h=Ag&dl=www.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&tdp=G-K68XP6D85D;87485693;1;6;0&z=0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.31.97 Oxford, United States, ASN15169 (GOOGLE, US),
Reverse DNS
bj-in-f97.1e100.net
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:36 GMT
server
Golfe2
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
a
www.googletagmanager.com/ 		0
11 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.googletagmanager.com/a?id=G-K68XP6D85D&v=3&t=t&pid=1216235338&cv=1&rv=3bt0&tc=13&es=1&e=gtm.init&eid=0&h=Ag&tr=1ogt1pdatav2.1ccdgafirst.1setproductsettings.1ogtgagamlink.1ogtgooglesignals.1ccdgaregscope.1ccdconversionmarking.1ogteventcreate.1ogteventcreate.1ogteventcreate.1ccdautoredact.1ccdgalast&ti=2ogt1pdatav2.2ccdgafirst.2setproductsettings.2ogtgagamlink.2ogtgooglesignals.2ccdgaregscope.2ccdconversionmarking.2ogteventcreate.2ogteventcreate.2ogteventcreate.2ccdautoredact.2ccdgalast&z=0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.31.97 Oxford, United States, ASN15169 (GOOGLE, US),
Reverse DNS
bj-in-f97.1e100.net
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
ga-audiences
www.google.ca/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-K68XP6D85D&cid=1675868932.1701395917&gtm=45je3bt0v887485693z86304663&aip=1&dma=0&gcd=11l1l1l1l1&z=2087738221
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f94.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:36 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
a
www.googletagmanager.com/ 		0
11 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.googletagmanager.com/a?id=G-K68XP6D85D&v=3&t=t&pid=1216235338&cv=1&rv=3bt0&tc=13&es=1&e=gtag.config&eid=1&u=AAAAAAAAAAAAACA&h=Ag&epr=1G.2G&tr=1gct&ti=1gct&z=0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.31.97 Oxford, United States, ASN15169 (GOOGLE, US),
Reverse DNS
bj-in-f97.1e100.net
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
a
www.googletagmanager.com/ 		0
11 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.googletagmanager.com/a?id=G-K68XP6D85D&v=3&t=t&pid=1216235338&cv=1&rv=3bt0&tc=13&es=1&e=gtag.config&eid=2&u=AAAAAAAAAAAAACA&h=Ag&z=0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.31.97 Oxford, United States, ASN15169 (GOOGLE, US),
Reverse DNS
bj-in-f97.1e100.net
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
a
www.googletagmanager.com/ 		0
11 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.googletagmanager.com/a?id=G-K68XP6D85D&v=3&t=t&pid=1216235338&cv=1&rv=3bt0&tc=13&es=1&e=*&eid=4&u=AAAAAAAAAAAAACA&h=Ag&z=0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.31.97 Oxford, United States, ASN15169 (GOOGLE, US),
Reverse DNS
bj-in-f97.1e100.net
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
truncated
/ Frame C14A 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
31f4e4abd5d8e145d6bd5505ae3ee469f66e6aba53fcc6cf04741d0a802ebc3d

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Content-Type
text/html;charset=UTF-8
24px.svg
fonts.gstatic.com/s/i/productlogos/translate/v14/ 		6 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f94.1e100.net
Software
sffe /
Resource Hash
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 14:59:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
39569
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3340
x-xss-protection
0
last-modified
Wed, 20 Apr 2022 14:24:23 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
vary
Accept-Encoding
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 29 Nov 2024 14:59:07 GMT
googlelogo_color_42x16dp.png
www.gstatic.com/images/branding/googlelogo/1x/ 		910 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_42x16dp.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f94.1e100.net
Software
sffe /
Resource Hash
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 12:29:53 GMT
x-content-type-options
nosniff
age
307723
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
910
x-xss-protection
0
last-modified
Thu, 02 Nov 2023 22:48:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Tue, 26 Nov 2024 12:29:53 GMT
v.js
g.ezodn.com/cmp/v2/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://g.ezodn.com/cmp/v2/v.js?v=4
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b104db680a9d1df48409a24d2f18c31e2867e67e921c44b00c72b22d9762bb8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 22 Feb 2023 19:45:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1368481
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gs1nak%2FMWteJxF7IEhGqFs4IZ7wlTg92FrVPdKg16UeuP30X952XXyGGxR8R%2B7IR%2FM9YLKkK3UnQ4mS9cOnsApMBaGBFkPxLgMvAk0bZcmb5lhQvJL2WZY6U3xz2Cw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
cache-control
public, max-age=15780000
cf-ray
82e7b9dee9b8430e-EWR
alt-svc
h3=":443"; ma=86400
video-inserter.js
go.ezodn.com/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/video-inserter.js?gcb=3&cb=1
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b2c75da950a2de4abb65dc7cbbf775d56d969b4f46a558d47f21cef8015be7b6

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 01 Dec 2023 01:10:18 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1250
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DUsjRhxv2uI8kMU%2FPCFJ4dAUSj3X3hbLElFAYjVnO1XzjtekdFyzwWnLsANlzpZwbTzcbE27KL7MF0xSiDjM1MgmryjptQJ7L5%2FSsGvxS%2B0QQrCG4F4aMdJttV4rBW8%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=14400
x-robots-tag
noindex
cf-ray
82e7b9df19e2430e-EWR
alt-svc
h3=":443"; ma=86400
sidebarwall.js
go.ezodn.com/detroitchicago/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/sidebarwall.js?gcb=3&cb=20
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c27c396b7f4c1ff33d934d2c66f082c7f81193203971648a114f862c9143c234

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 01 Nov 2023 17:53:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2534623
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sYZatFWB9AkVa0CJFl0IP7v7tk8kvTgPwXIxQrXmuSw7IiDvymf8PyjcH7y7O1SWvm3tZ3ZoicU8R98uC3fB8jOukgEWh2%2FW%2BImad1o3uC8JQ9966CCMCBFvReEfz10%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=14400
x-robots-tag
noindex
cf-ray
82e7b9df19e4430e-EWR
alt-svc
h3=":443"; ma=86400
translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/branding/product/2x/translate_24dp.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.qhDXWpKopYk.L.W.O/am=CAM/d=0/rs=AN8SPfqeKn8wA30q4viup18yaci8udUjKQ/m=el_main_css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f94.1e100.net
Software
sffe /
Resource Hash
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.qhDXWpKopYk.L.W.O/am=CAM/d=0/rs=AN8SPfqeKn8wA30q4viup18yaci8udUjKQ/m=el_main_css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 12:29:16 GMT
x-content-type-options
nosniff
age
307760
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1842
x-xss-protection
0
last-modified
Thu, 14 Oct 2021 09:08:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Tue, 26 Nov 2024 12:29:16 GMT
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		92 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
823ca0c131fa4cab24e6f5a49a7db2c0b21a66d9ec77f4faa17dbe55cbc971af
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30170
x-xss-protection
0
server
cafe
etag
771 / 19692 / 31079808 / config-hash: 11152387477177976423
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Fri, 01 Dec 2023 01:58:36 GMT
tuscon.js
go.ezodn.com/detroitchicago/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/tuscon.js?gcb=3&cb=13
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
50fbbe164918e6fb86e26b49d99c193d1c36ec6bbf9a51b9967ca74f2282ccde

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 28 Nov 2023 07:07:51 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
138887
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E894kXaX0ikL4n%2B1WjOoNIk%2F5w6tJsKNckcJehpa50zrbXiwUPkU6KO%2F2B3J%2B%2BK3gQOrB5oC7PEEkP8WNT6o7RDmt32PUW%2B3epY22t2WybwlAAVZVmf3dH84bQghQAE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9df19e5430e-EWR
alt-svc
h3=":443"; ma=86400
kenai.js
go.ezodn.com/detroitchicago/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/kenai.js?gcb=3&cb=8
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6c144d4227c26d96577d0683d8ae46e5dfe9c15c5c9979aa9bce3de4f8b1b039

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 15 Nov 2023 23:36:59 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1304468
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u3C9MPIGmTXlxEJivd7TUY%2Bs36jysAPelHhr2ANa6a3PFkyxXi%2FgMHwJbRevzpuD7MukxbMcH6JmYbxpAedpU9m1mGl05QlTTPOrmRKeTw2kdGSn34%2FPD9l%2FURNfYzY%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9df19e8430e-EWR
alt-svc
h3=":443"; ma=86400
portland.js
go.ezodn.com/detroitchicago/ 		35 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/portland.js?gcb=3&cb=76
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bfad213dc2566a8f25d84d36ce9c8f5f695547d5274192c0bf6ec68de6932bd0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 20 Nov 2023 21:41:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
879413
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WUnhs9VzAY2YIdVAy%2BO9Acx3QjBTJ7B6sI4KTl1d%2BjYtUT3OJuiseS5qgKULNGaBgfLjdtYz2BpmglgV1RVDlVlHyMeEMWnJJn6FozXHlpIehrkNglO8FLPVOR8gNqY%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9df19ea430e-EWR
alt-svc
h3=":443"; ma=86400
dall.js
go.ezodn.com/hb/ 		774 KB
228 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/hb/dall.js?cb=195-3-71
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
084d109cd724591b96f08d010168646de2d2e910fbdf47a7c23e5d86ef438add

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 16 Nov 2023 23:55:07 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
56066
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=npyZ8%2BEsfb62aYQ%2Fgg8zz0oMMIFv%2BNZ8NXHd2zv5CcXQbih38Y6szLeenH8IUvNF0zk%2FmVQfkRKGculPflP04IGqRm9k6La1yfF5XI0GwLkh2mG4NXUXPA9jtcSxem8%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
cf-ray
82e7b9df19ed430e-EWR
alt-svc
h3=":443"; ma=86400
pwt.js
ads.pubmatic.com/AdServer/js/pwt/162833/9311/ 		523 KB
170 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.215.40.199 McAllen, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-215-40-199.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
777e7af804814e50ee22a4a349b603a523f5555b666a5e42d98b862520cc2b83

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
last-modified
Wed, 29 Nov 2023 18:14:45 GMT
server
Apache
vary
Accept-Encoding
content-type
application/javascript
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
max-age=58504
accept-ranges
bytes
content-length
173405
expires
Fri, 01 Dec 2023 18:13:40 GMT
banger.js
go.ezodn.com/porpoiseant/ 		55 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/porpoiseant/banger.js?cb=195-3&bv=280&PageSpeed=off
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4daf293be350b22d032f276ada21dc44225dcbf92e09f067d45dded786e44b0f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 17 Nov 2023 01:39:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
230633
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NbhdrRaUvFF2H439Snyis7J8tI%2FRVnqLvj8ofl7aXm7OkcZ53a7tCln9Vpkp1ZSOhHI9dkInJ2jN4Ws9wBa2hAFfG8exhsz05Cz28JXqQzILD4hqU6GIUQHLU9KgoyQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9df19ee430e-EWR
alt-svc
h3=":443"; ma=86400
FEppCFCt76d.png
static.xx.fbcdn.net/rsrc.php/v3/yD/r/ Frame 8A79 		299 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yD/r/FEppCFCt76d.png
Requested by
Host: www.facebook.com
URL: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.240.244.1 Apodaca, Mexico, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-01-mty2.fbcdn.net
Software
/
Resource Hash
d65f4b2e8eee94ddc7f762d098de19558d879a3b597c8913b4d075532e3ed4b4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.facebook.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

permissions-policy-report-only
autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
date
Fri, 01 Dec 2023 01:58:36 GMT
x-content-type-options
nosniff
content-md5
OIlAxCmR79nrM/Ez4ygGlg==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
299
reporting-endpoints
x-fb-debug
83sDsNMMlx3LtFZIyJxnB1mhjPwU+9imbEw/Lfp6tbqcWW/HqPX1qJZQKY/TcyPgfBebKIKCHPrgqY0IXr2NBg==
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-type
image/png
access-control-allow-origin
*
origin-agent-cluster
?0
cache-control
public,max-age=31536000,immutable
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin
*
expires
Fri, 29 Nov 2024 08:10:43 GMT
82e7b9d999d3a1e1
www.mediafire.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 097D 		0
251 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.mediafire.com/cdn-cgi/challenge-platform/h/g/jsd/r/82e7b9d999d3a1e1
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.16.113.74 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
gzip
server
cloudflare
cf-ray
82e7b9dfaa6da1e1-YYZ
content-type
text/plain; charset=UTF-8
FVd9kkeG8pX.js
static.xx.fbcdn.net/rsrc.php/v3iEpO4/yE/l/en_US/ Frame 8A79 		527 KB
137 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/yE/l/en_US/FVd9kkeG8pX.js?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: www.facebook.com
URL: https://www.facebook.com/plugins/like.php?href=http://www.facebook.com/MediaFire&width=193&layout=button_count&action=like&show_faces=false&share=true&height=30&appId=124578887583575
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.240.244.1 Apodaca, Mexico, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-01-mty2.fbcdn.net
Software
/
Resource Hash
aed2504f1be6c286ea63059738a63c91ace7762624ccf5e750d452dd754eb52c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.facebook.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
pPMe+TozOlQ38nJmx9+Eug==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
139166
reporting-endpoints
x-fb-debug
r5FM5l7ETp5SfZuh7KLBlTsh3Usw92KAuqXxYrMHzEFc0OTk7RTO/hUGax+QB/8Ztej2Gs4zak9Csfc5pdRPww==
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Origin
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://www.facebook.com
origin-agent-cluster
?0
cache-control
public,max-age=31536000,immutable
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin
*
expires
Thu, 28 Nov 2024 22:15:44 GMT
log
api.btloader.com/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.btloader.com/log?tid=eDSbOXyZ&cv=2.1.24-1-g0c437e2&sid=O3Yfbk4uHE&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Fri, 01 Dec 2023 01:58:36 GMT
cache-control
no-cache, no-store, must-revalidate
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary
Origin
country
api.btloader.com/ 		16 B
141 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.btloader.com/country
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash
8bd69d0dddab8bc553263c254faad469c2a3e08bfb0b737e763f7feabe571225

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
via
1.1 google
vary
Origin
content-type
application/json
access-control-allow-origin
*
cache-control
private, max-age=300, stale-while-revalidate=600, stale-if-error=600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
16
mulvane.js
go.ezodn.com/parsonsmaize/ 		1002 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/parsonsmaize/mulvane.js?gcb=195-3&cb=5
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f2e858e11bbfe82d0150dd8fc768dfdb4577415c0ee84435e0d6c51a50e6cb64

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 27 Nov 2023 00:04:19 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
245825
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HhIVXyieRh%2FU%2BnA5WOVE2cPSBgYjDpgdsQ%2FWITRAPK%2BnJ9uxNUL5HCeDvz2jhJXvjsBt7L%2Fejp%2BlEYozr8LExRf9AfXDhWyAcIfSqroP3jPyr%2BhYvgcB6vBCcwcOCNM%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9dfdd736a52-EWR
alt-svc
h3=":443"; ma=86400
raleigh.js
go.ezodn.com/detroitchicago/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/raleigh.js?gcb=195-3&cb=6
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
10c5779cae461daba4b2f636f90df6cbf420e8c3dbe5a326bd937e7392c2b8df

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 14 Oct 2023 14:26:04 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1609565
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vtjUZH0eLJSlnR8eRil5NBUtCphCQzhFnU5AhVwmYK5VGZmkAIK3SGUw4cq%2BbxNNrdmV%2FXVcOuZTPuleMS09iFwF5sC3g7KRxmaKD0gyOtX6VFUIUQgq%2B7%2Bt5LPmX7A%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9e05e176a52-EWR
alt-svc
h3=":443"; ma=86400
vista.js
go.ezodn.com/detroitchicago/ 		1 KB
966 B 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/vista.js?gcb=195-3&cb=5
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
079f59405da9aed3725440b658577d5b8f974dc7cc3a87f9cbe0dc82d235c13d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 28 Nov 2023 06:14:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
50789
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=opqMg8Gf1P%2FmqxJqnET4GX9p0UOITimcyLYvinqqqa6rJF9Bt0K9FwZMwMP1VXxx8WUxA4XrlH80WykOR7N4LqU0jmyV8CHS7KwLa4ZikzD7tp9rFCnsp1ZGTTV2%2FC4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9dfed756a52-EWR
alt-svc
h3=":443"; ma=86400
tampa.js
go.ezodn.com/detroitchicago/ 		976 B
990 B 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/detroitchicago/tampa.js?gcb=195-3&cb=5
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7af805fc2bda263e9826c3433adb07b0e8881afecb62d611961d767d68c3ac05

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 13 Oct 2023 20:50:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2543900
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GMLt78K3GsEJSCvhX5xkE9EE4IelTlCZnO26FCNWR9vFCmL3A57VPLLBp%2Fo8K22h66eMUZYJXiEPoKkQTXc9hEZpOo8w1QGs5586faOGSBzavlJ0RUOh1hPoINvvM6E%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9dfed766a52-EWR
alt-svc
h3=":443"; ma=86400
collect
www.google-analytics.com/j/ 		2 B
208 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=846692808&t=pageview&_s=1&dl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&ul=en-us&de=UTF-8&dt=NSwish%20texture%20pack&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1231217857&gjid=1094986356&cid=1675868932.1701395917&tid=UA-829541-1&_gid=458481660.1701395917&_r=1&gtm=457e3bt0&gcd=11l1l1l1l1&dma=0&cd1=unregistered&cd7=legacy&cd3=archive&cd4=51&cd5=rar&cd8=%2F100%2F&jsscut=1&z=131268095
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.239.36.178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:36 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
pv
api.btloader.com/ 		0
40 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.btloader.com/pv?tid=eDSbOXyZ&w=5115845767331840&o=5678961798414336&cv=2.1.24-1-g0c437e2&widget=false&r=false&vr=1600x1200&pageURL=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&sid=O3Yfbk4uHE&pm=true&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 01 Dec 2023 01:58:36 GMT
cache-control
no-cache, no-store, must-revalidate
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary
Origin
cc_af.js
tags.crwdcntrl.net/c/4545/ 		55 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.crwdcntrl.net/c/4545/cc_af.js
Requested by
Host: cdn.otnolatrnup.com
URL: https://cdn.otnolatrnup.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.85.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-85-84.iad12.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
8a1ca667f8be1d9635b262dc3b15aeecc9d61e0fc2457a1f95ccf6d0bc25a37a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:15:48 GMT
content-encoding
gzip
via
1.1 70b043d52df382dd62760368de89949e.cloudfront.net (CloudFront)
last-modified
Mon, 03 Oct 2022 20:56:51 GMT
server
AmazonS3
x-amz-cf-pop
IAD12-P2
age
2624
x-amz-server-side-encryption
AES256
etag
W/"a4ff03e3d8274ebe2833a0a33a541e12"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/json
cache-control
public, max-age=86400
x-amz-cf-id
0fBEoc5f2M18FQmAD7fIkRTOJ6sgdthgAcKDxg9MWANqLhCh_aw3aA==
callback=g367CB268B1094004A3689751E7AC568F.Lotame.CallExtractionAPICallback
ad.crwdcntrl.net/5/c=3722/pe=y/ 		131 B
368 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.crwdcntrl.net/5/c=3722/pe=y/callback=g367CB268B1094004A3689751E7AC568F.Lotame.CallExtractionAPICallback?79962822
Requested by
Host: cdn.otnolatrnup.com
URL: https://cdn.otnolatrnup.com/Scripts/infinity.js.aspx?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.83.134.184 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-83-134-184.compute-1.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
3d41b5eccb6d46de2253c6c225a6aef2009f266fc4180385b9d1ad17c19e7329

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:37 GMT
server
Jetty(9.4.38.v20210224)
content-type
application/javascript;charset=utf-8
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
*
cache-control
no-cache
x-server
10.40.14.138
content-length
131
expires
0
tpid=445a8d8318c64ece961e210e05fb7c6d
bcp.crwdcntrl.net/map/ct=y/c=3722/tp=ADSP/
Redirect Chain
  • https://bcp.crwdcntrl.net/map/c=3722/tp=ADSP/tpid=445a8d8318c64ece961e210e05fb7c6d
  • https://bcp.crwdcntrl.net/map/ct=y/c=3722/tp=ADSP/tpid=445a8d8318c64ece961e210e05fb7c6d
49 B
265 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bcp.crwdcntrl.net/map/ct=y/c=3722/tp=ADSP/tpid=445a8d8318c64ece961e210e05fb7c6d
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Server
3.93.99.238 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-93-99-238.compute-1.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:37 GMT
server
Jetty(9.4.38.v20210224)
content-type
image/gif
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
*
cache-control
no-cache
x-server
10.40.55.229
content-length
49
expires
0

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:37 GMT
server
Jetty(9.4.38.v20210224)
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location
https://bcp.crwdcntrl.net/map/ct=y/c=3722/tp=ADSP/tpid=445a8d8318c64ece961e210e05fb7c6d
cache-control
no-cache
x-server
10.40.52.21
content-length
0
expires
0
/
bshr.ezodn.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://bshr.ezodn.com/?did=484470&bf=30000&dc=21732118914%7C1254144
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-pingback
Access-Control-Request-Method
GET
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type,x-pingback
access-control-allow-methods
GET, POST, PUT, OPTIONS
access-control-allow-origin
https://www.mediafire.com
access-control-max-age
1728000
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
82e7b9e0be4e43ad-EWR
content-length
0
content-type
text/plain; charset=utf-8
date
Fri, 01 Dec 2023 01:58:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sTNBqQEZHOMj%2FCNb8QnaA3Uk0yTogEJDZ3a2Xh3VVq1ij7PdNJFsfk%2BebN%2Fg1i4W9IOgOXwCTLRGVYp41pHRI16ueXDkEzaBjNn7vbOyQjtetqEbWPHaAlO5hBaU0KwAAg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
nmash.js
go.ezodn.com/porpoiseant/ 		66 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/porpoiseant/nmash.js?bv=280
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-3&bv=280&PageSpeed=off
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
88a06e3771c8b67e7728885dbb75764937a70bae70c754904f991fe2d0de789d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 16 Nov 2023 23:24:12 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1218864
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rs1Nenr8sZyfvq0wwowXLYjiAnviI8PdJifbWb7ecfFTVBIXA2yHaB2qZoUXOVzB%2BI4E%2Fca0pgkBeVyGpeIgEXyzRwIDZCQy%2FESjL6chHL2SuB80ofzooIyMwg5fJck%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9e00d9d6a52-EWR
alt-svc
h3=":443"; ma=86400
/
bshr.ezodn.com/ 		9 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://bshr.ezodn.com/?did=484470&bf=30000&dc=21732118914%7C1254144
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-3&bv=280&PageSpeed=off
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0887e40d9c66ba2d2fd9769ab474ff53090a126f9ddb1dce0042f77d2cbfc955

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
X-PINGBACK
pingpong
Content-Type
application/json

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
68704
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 31 Oct 2023 10:54:48 GMT
server
cloudflare
access-control-max-age
1728000
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
application/json; charset=utf8
access-control-allow-origin
https://www.mediafire.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mW%2B6sl7yVdrPDNLP%2FFxBMZxA%2FV7xs5jcYY1ldNyTM%2BEllA9vyfilhINV1kG%2FdAW5U3cYQwxrZzFDMRiGW3mHnzZNygooAN0hGq6ZI%2FzRnPruTFl%2F6tXFkc8wTRmtVQuFYA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
private, max-age=1209600
access-control-allow-credentials
true
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
cf-ray
82e7b9e11edb43ad-EWR
access-control-allow-headers
Content-Type
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/ 		432 KB
135 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
7e071e5b39d13cef80f7a46d854de133fd73c15d1351ebcf7e1f1b48821e7aeb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 16:26:51 GMT
content-encoding
br
x-content-type-options
nosniff
age
34305
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
138259
x-xss-protection
0
server
cafe
etag
16445146976575771301
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
expires
Fri, 29 Nov 2024 16:26:51 GMT
olathe.js
go.ezodn.com/parsonsmaize/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/parsonsmaize/olathe.js?gcb=195-3&cb=23
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cebc0ded9f2ef3dd4e3c6d6010538dee890c24a070d6ba991e0c93e451d96ccd

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 28 Nov 2023 06:45:02 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
155549
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JlhcTSaJOMgEa0zXyma3quny6HNe8Oi7IjKbk27jPA1ipu%2Fk%2F1wPP%2FIfpIq1dP5zcXcoTq9tc2%2FJ5s8Xc8mcas56ZQoXRrsY0Y%2BdDP7C6AoUuR3lrU084CQjHPEZviw%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9e03dc06a52-EWR
alt-svc
h3=":443"; ma=86400
chanute.js
go.ezodn.com/parsonsmaize/ 		21 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/parsonsmaize/chanute.js?a=a&cb=7&dcb=195-3&shcb=34
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2cb36489072c0eb085096a47bfcced826b7a973e5f294d5a2b54bf16df3449d9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 02 Nov 2023 07:48:52 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1778893
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MrcMhMJFgFr3HhMaTKomhBH3pnQPt3NIagTMicN3uFQjtuVkK5MYH9Y6bujpL%2BcWmi6hJWE0FTDzeqMtIQCLyEld6hU855ungHi7D9Gy8%2FvMRvHUAP%2FYb7vikBFAiBE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9e06e236a52-EWR
alt-svc
h3=":443"; ma=86400
vitals.js
go.ezodn.com/tardisrocinante/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/tardisrocinante/vitals.js?gcb=195-3&cb=3
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
549bd3e9e2cfe91e355ba68c1fe15c0af27e0391123630b9ccfbbbd559cdba47

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 28 Nov 2023 07:56:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
155240
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ADIyGxSRsgr8juT%2BpIkSHHy49VjzK4%2BUxsJQmx8gcSSaHpvUCPRBJpQk5xzwC63D1xXqsl8LHzLmYMW2%2Fq%2FP6wY1DsrKIAeYH0uzw9WeWruY8QZYqsQbSD9SWXp33MA%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9e03dc46a52-EWR
alt-svc
h3=":443"; ma=86400
log
api.btloader.com/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.btloader.com/log?tid=eDSbOXyZ&cv=2.1.24-1-g0c437e2&sid=O3Yfbk4uHE&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=5678961798414336&upapi=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Fri, 01 Dec 2023 01:58:36 GMT
cache-control
no-cache, no-store, must-revalidate
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary
Origin
collect
stats.g.doubleclick.net/j/ 		4 B
151 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-829541-1&cid=1675868932.1701395917&jid=1231217857&gjid=1094986356&_gid=458481660.1701395917&_u=YADAAUAAAAAAACAAI~&z=1425845177
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
Golfe2 /
Resource Hash
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Fri, 01 Dec 2023 01:58:36 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ezadloadhb.js
go.ezodn.com/porpoiseant/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/porpoiseant/ezadloadhb.js?gcb=195-3&cb=141
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f1ed1a4cb16ea8035d7947f8d83cf8da5073cbaf1a7f39502e787c3346fe5a8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 29 Nov 2023 20:08:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
107407
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ahqHm1psncq1%2BDKGytwpzhzSB2x9zUopPRFG6rXR72zwS7UJLK8Kiyb4lgamgVC87m3uB6D77fAaL5tL95dTndew25%2FxbUwMhp0%2FNdGZG4jprbhGF8m3mbuYQtsfQXk%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9e08e416a52-EWR
alt-svc
h3=":443"; ma=86400
imp.gif
g.ezoic.net/detroitchicago/ 		43 B
196 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/imp.gif
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:40 GMT
content-encoding
br
access-control-max-age
1728000
access-control-allow-methods
HEAD, PUT, POST, GET, OPTIONS
content-type
image/gif
access-control-allow-origin
https://www.mediafire.com
x-middleton-display
imp_sol
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
access-control-allow-headers
Content-Type
content-length
47
expires
Thu, 30 Nov 2023 01:58:40 GMT
183096492
fundingchoicesmessages.google.com/i/ 		176 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/i/183096492?ers=3
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f100.1e100.net
Software
ESF /
Resource Hash
5e8240895c0b0bcbde2c9a2fe1fa1278624007f99fe00cce07d21ab47d1f9255
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-01GUiFLpyd_s4Rv4C99fUA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:36 GMT
content-security-policy
script-src 'report-sample' 'nonce-01GUiFLpyd_s4Rv4C99fUA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin
*
expires
Mon, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-829541-1&cid=1675868932.1701395917&jid=1231217857&_u=YADAAUAAAAAAACAAI~&z=1426009218
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f105.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:37 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.ca/ads/ 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-829541-1&cid=1675868932.1701395917&jid=1231217857&_u=YADAAUAAAAAAACAAI~&z=1426009218
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f94.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:36 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
localstore.js
script.4dex.io/ 		483 B
1010 B 		Script
General
Check archive.org
Download Go to
Full URL
https://script.4dex.io/localstore.js
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
172.67.75.241 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date
Fri, 01 Dec 2023 01:58:37 GMT
Content-Encoding
br
CF-Cache-Status
HIT
Last-Modified
Mon, 27 Nov 2023 07:14:08 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Age
236617
ETag
W/"922cffdd75f7192f75231d92684885aa"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CbNfAxUBKSA4iK0L7%2FrpdKWKa37iql%2F55vpLWHUxjjhc64%2BVA9EdIRfhsfjv13tEVMNVLgEl%2F4v%2B8WS%2FwrBCUKdmGDMy01jnkKegHi68id%2BtPWS5ENz4C30h9WXZ0vdi"}],"group":"cf-nel","max_age":604800}
Cache-Control
public, max-age=1800
Connection
keep-alive
CF-RAY
82e7b9e14ee33a0b-YYZ
cdb
bidder.criteo.com/ 		0
196 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.16.0&cb=85783787206&lsavail=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.119.129 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
bidder.va1.vip.prod.criteo.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
https://www.mediafire.com
date
Fri, 01 Dec 2023 01:58:36 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
c
prebid.a-mo.net/a/ 		0
171 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prebid.a-mo.net/a/c
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

x-nbr
8
date
Fri, 01 Dec 2023 01:58:36 GMT
server
envoy
vary
origin, Accept-Encoding
access-control-allow-origin
https://www.mediafire.com
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
x-envoy-upstream-service-time
2
prebid-request
onetag-sys.com/ 		15 B
414 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/prebid-request
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

strict-transport-security
max-age=15552000
content-encoding
gzip
content-type
application/json
access-control-allow-origin
https://www.mediafire.com
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control
no-transform, no-cache
access-control-allow-credentials
true
access-control-allow-headers
content-type, origin, referer, user-agent
content-length
41
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
translator
hbopenbid.pubmatic.com/ 		0
114 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
https://www.mediafire.com
date
Fri, 01 Dec 2023 01:58:36 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
/
prebid.smilewanted.com/ 		0
310 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:37 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
82e7b9e17f6736b7-YYZ
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
/
prebid.smilewanted.com/ 		0
35 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:37 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
82e7b9e17f6336b7-YYZ
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
/
prebid.smilewanted.com/ 		0
36 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:37 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
82e7b9e17f6936b7-YYZ
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
/
prebid.smilewanted.com/ 		0
36 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:37 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
82e7b9e17f6b36b7-YYZ
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
/
prebid.smilewanted.com/ 		0
36 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:37 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
82e7b9e17f6c36b7-YYZ
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
/
prebid.smilewanted.com/ 		0
36 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:37 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
82e7b9e17f6e36b7-YYZ
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
v1
hb-api.omnitagjs.com/hb-api/prebid/ 		1 KB
830 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&PageUrl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&PageReferrer=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.161.33.4 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-161-33-4.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
fe4333a37764543c3a81178aeea86317eab5d7e47cf9deec31e97c6ca477a0ec
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:37 GMT
via
kong/2.8.3
x-content-type-options
nosniff
content-encoding
gzip
x-kong-proxy-latency
0
p3p
CP="CAO PSA OUR"
x-kong-upstream-latency
55
pragma
no-cache
access-control-max-age
3600
vary
Accept-Encoding, Accept-Encoding
access-control-allow-methods
OPTIONS, POST
access-control-allow-origin
https://www.mediafire.com
content-type
application/json; charset=utf-8
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Accept-Encoding, Content-Type
expires
0
auction
rtb.adxpremium.services/openrtb2/ 		69 B
452 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://rtb.adxpremium.services/openrtb2/auction
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.106.140.18 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software
nginx /
Resource Hash
96e593fff7a5fda6f458924a800242ec31fd51f682b20c7dac093fafaa885823

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:37 GMT
Server
nginx
X-Prebid
pbs-go/unknown
Vary
Origin
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://www.mediafire.com
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
69
Expires
0
hb-multi
hb.yellowblue.io/ 		84 B
432 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://hb.yellowblue.io/hb-multi
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
54.87.125.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-125-83.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
fcdf52e788354566e130d669c261443a03d3738fc83b908c727e7be6e6f9950d

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:37 GMT
server
istio-envoy
x-reason
maxmind hosting provider
access-control-allow-methods
GET, OPTIONS
access-control-allow-origin
https://www.mediafire.com
content-type
application/json
access-control-allow-credentials
true
x-envoy-upstream-service-time
35
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length
84
/
ghb.adtelligent.com/v2/auction/ 		21 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ghb.adtelligent.com/v2/auction/
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
23.227.151.194 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software
Adtelligent /
Resource Hash
4f1c44da767ba20c7bf97816c0c57781f859f80a038dd2aeddfac69c2930394f

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

Date
Fri, 01 Dec 2023 01:58:37 GMT
Content-Encoding
gzip
Server
Adtelligent
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
https://www.mediafire.com
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
X-Robots-Tag
noindex
Content-Length
1708
hb
rt.marphezis.com/ 		0
0
auction
tlx.3lift.com/header/ 		0
0
/
d.vidoomy.com/api/rtbserver/prebid/ 		0
367 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-mediafire_com-box-2-0&w=728&h=90&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.199%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=77f2889d1802f93&schain=1.0%2C1!ezoic.co.uk%2C8907ccb0baf12fbaae7b225e96c9e525%2C1%2C%2C%2Cwww.mediafire.com&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22402b364a-8993-4464-a3d9-61f38d2a050b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0.04&d=mediafire.com&sp=https%253A%252F%252Fwww.mediafire.com%252Ffile%252F4jpxw5szul7blh2%252FNSwish_texture_pack.rar%252Ffile&usp=&coppa=false&videoContext=&bcat=&badv=&bapp=&btype=&battr=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.36.83.246 Sant Vicenç dels Horts, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS
lb2.vdmy.dtic.es
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

Date
Fri, 01 Dec 2023 01:58:38 GMT
Server
nginx
Access-Control-Allow-Methods
HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.mediafire.com
Access-Control-Expose-Headers
X-VD-C
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
/
d.vidoomy.com/api/rtbserver/prebid/ 		0
367 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-mediafire_com-box-4-0&w=728&h=90&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.199%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=78204f11324e79a&schain=1.0%2C1!ezoic.co.uk%2C8907ccb0baf12fbaae7b225e96c9e525%2C1%2C%2C%2Cwww.mediafire.com&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22402b364a-8993-4464-a3d9-61f38d2a050b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0.05&d=mediafire.com&sp=https%253A%252F%252Fwww.mediafire.com%252Ffile%252F4jpxw5szul7blh2%252FNSwish_texture_pack.rar%252Ffile&usp=&coppa=false&videoContext=&bcat=&badv=&bapp=&btype=&battr=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.36.83.246 Sant Vicenç dels Horts, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS
lb2.vdmy.dtic.es
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

Date
Fri, 01 Dec 2023 01:58:38 GMT
Server
nginx
Access-Control-Allow-Methods
HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.mediafire.com
Access-Control-Expose-Headers
X-VD-C
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
/
d.vidoomy.com/api/rtbserver/prebid/ 		6 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-mediafire_com-medrectangle-3-0&w=300&h=250&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.199%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=797397d742a064&schain=1.0%2C1!ezoic.co.uk%2C8907ccb0baf12fbaae7b225e96c9e525%2C1%2C%2C%2Cwww.mediafire.com&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22402b364a-8993-4464-a3d9-61f38d2a050b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0.02&d=mediafire.com&sp=https%253A%252F%252Fwww.mediafire.com%252Ffile%252F4jpxw5szul7blh2%252FNSwish_texture_pack.rar%252Ffile&usp=&coppa=false&videoContext=&bcat=&badv=&bapp=&btype=&battr=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.36.83.246 Sant Vicenç dels Horts, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS
lb2.vdmy.dtic.es
Software
nginx /
Resource Hash
7e6c76bdc96abb91eed5f6a493da23b69aa461a78711d9112561e82bb08703a6

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

Date
Fri, 01 Dec 2023 01:58:38 GMT
Content-Encoding
br
Server
nginx
Access-Control-Allow-Methods
HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type
application/json
Access-Control-Allow-Origin
https://www.mediafire.com
Access-Control-Expose-Headers
X-VD-C
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
2727
/
d.vidoomy.com/api/rtbserver/prebid/ 		6 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-mediafire_com-medrectangle-4-0&w=300&h=250&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.199%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=8081f0bba450a84&schain=1.0%2C1!ezoic.co.uk%2C8907ccb0baf12fbaae7b225e96c9e525%2C1%2C%2C%2Cwww.mediafire.com&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22402b364a-8993-4464-a3d9-61f38d2a050b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0.02&d=mediafire.com&sp=https%253A%252F%252Fwww.mediafire.com%252Ffile%252F4jpxw5szul7blh2%252FNSwish_texture_pack.rar%252Ffile&usp=&coppa=false&videoContext=&bcat=&badv=&bapp=&btype=&battr=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.36.83.246 Sant Vicenç dels Horts, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS
lb2.vdmy.dtic.es
Software
nginx /
Resource Hash
87fd9927f7d9a0b0f9073d53fa43c07b867798afbf8b8dd029cbd8899d5f79b7

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

Date
Fri, 01 Dec 2023 01:58:38 GMT
Content-Encoding
br
Server
nginx
Access-Control-Allow-Methods
HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type
application/json
Access-Control-Allow-Origin
https://www.mediafire.com
Access-Control-Expose-Headers
X-VD-C
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
2730
/
d.vidoomy.com/api/rtbserver/prebid/ 		0
367 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-mediafire_com-edge-2-0&w=160&h=600&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.199%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=8101f299e72b182&schain=1.0%2C1!ezoic.co.uk%2C8907ccb0baf12fbaae7b225e96c9e525%2C1%2C%2C%2Cwww.mediafire.com&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22402b364a-8993-4464-a3d9-61f38d2a050b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0.05&d=mediafire.com&sp=https%253A%252F%252Fwww.mediafire.com%252Ffile%252F4jpxw5szul7blh2%252FNSwish_texture_pack.rar%252Ffile&usp=&coppa=false&videoContext=&bcat=&badv=&bapp=&btype=&battr=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.36.83.246 Sant Vicenç dels Horts, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS
lb2.vdmy.dtic.es
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

Date
Fri, 01 Dec 2023 01:58:38 GMT
Server
nginx
Access-Control-Allow-Methods
HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.mediafire.com
Access-Control-Expose-Headers
X-VD-C
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
/
d.vidoomy.com/api/rtbserver/prebid/ 		0
367 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-mediafire_com-edge-1-0&w=160&h=600&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.199%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=8262adf9c55f37&schain=1.0%2C1!ezoic.co.uk%2C8907ccb0baf12fbaae7b225e96c9e525%2C1%2C%2C%2Cwww.mediafire.com&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22402b364a-8993-4464-a3d9-61f38d2a050b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0.03&d=mediafire.com&sp=https%253A%252F%252Fwww.mediafire.com%252Ffile%252F4jpxw5szul7blh2%252FNSwish_texture_pack.rar%252Ffile&usp=&coppa=false&videoContext=&bcat=&badv=&bapp=&btype=&battr=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.36.83.246 Sant Vicenç dels Horts, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS
lb2.vdmy.dtic.es
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

Date
Fri, 01 Dec 2023 01:58:38 GMT
Server
nginx
Access-Control-Allow-Methods
HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.mediafire.com
Access-Control-Expose-Headers
X-VD-C
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
prebid
ads.yieldmo.com/exchange/ 		0
226 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ads.yieldmo.com/exchange/prebid?pbav=8.16.0&p=%5B%7B%22placement_id%22%3A%22div-gpt-ad-mediafire_com-box-2-0%22%2C%22callback_id%22%3A%2284930dad4080a2a%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%5D%2C%22ym_placement_id%22%3A%223226420080287883314%22%2C%22bidFloor%22%3A0.04%2C%22gpid%22%3A%22div-gpt-ad-mediafire_com-box-2-0%22%7D%2C%7B%22placement_id%22%3A%22div-gpt-ad-mediafire_com-box-4-0%22%2C%22callback_id%22%3A%228586b56488b169f%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B970%2C90%5D%5D%2C%22ym_placement_id%22%3A%223226420080287883314%22%2C%22bidFloor%22%3A0.05%2C%22gpid%22%3A%22div-gpt-ad-mediafire_com-box-4-0%22%7D%2C%7B%22placement_id%22%3A%22div-gpt-ad-mediafire_com-medrectangle-3-0%22%2C%22callback_id%22%3A%2286aecdc776ea088%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%5D%2C%22ym_placement_id%22%3A%223226420080287883314%22%2C%22bidFloor%22%3A0.02%2C%22gpid%22%3A%22div-gpt-ad-mediafire_com-medrectangle-3-0%22%7D%2C%7B%22placement_id%22%3A%22div-gpt-ad-mediafire_com-medrectangle-4-0%22%2C%22callback_id%22%3A%2287c38ac5d7e4e47%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B336%2C280%5D%5D%2C%22ym_placement_id%22%3A%223226420080287883314%22%2C%22bidFloor%22%3A0.02%2C%22gpid%22%3A%22div-gpt-ad-mediafire_com-medrectangle-4-0%22%7D%2C%7B%22placement_id%22%3A%22div-gpt-ad-mediafire_com-edge-2-0%22%2C%22callback_id%22%3A%2288596ad6685bc4b%22%2C%22sizes%22%3A%5B%5B160%2C600%5D%5D%2C%22ym_placement_id%22%3A%223226420080287883314%22%2C%22bidFloor%22%3A0.05%2C%22gpid%22%3A%22div-gpt-ad-mediafire_com-edge-2-0%22%7D%2C%7B%22placement_id%22%3A%22div-gpt-ad-mediafire_com-edge-1-0%22%2C%22callback_id%22%3A%22899be2e2020579b%22%2C%22sizes%22%3A%5B%5B160%2C600%5D%5D%2C%22ym_placement_id%22%3A%223226420080287883314%22%2C%22bidFloor%22%3A0.03%2C%22gpid%22%3A%22div-gpt-ad-mediafire_com-edge-1-0%22%7D%5D&page_url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&bust=1701395916975&dnt=false&description=MediaFire%20is%20a%20simple%20to%20use%20free%20service%20that%20lets%20you%20put%20all%20your%20photos%2C%20documents%2C%20music%2C%20and%20video%20in%20a%20single%20place%20so%20you%20can%20access%20them%20anywhere%20and%20share%20them%20everywhere.&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%5B%5D%7D&us_privacy=&pr=&scrd=1&title=NSwish%20texture%20pack&w=1600&h=1200&pubcid=402b364a-8993-4464-a3d9-61f38d2a050b&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22ezoic.co.uk%22%2C%22sid%22%3A%228907ccb0baf12fbaae7b225e96c9e525%22%2C%22domain%22%3A%22www.mediafire.com%22%2C%22hp%22%3A1%7D%5D%7D&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22402b364a-8993-4464-a3d9-61f38d2a050b%22%2C%22atype%22%3A1%7D%5D%7D%5D
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.88.209.131 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-88-209-131.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
https://www.mediafire.com
pragma
no-cache
date
Fri, 01 Dec 2023 01:58:38 GMT
access-control-allow-credentials
true
x-robots-tag
none,NOINDEX,NOFOLLOW
access-control-allow-methods
POST, GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma
AGSKWxXGR9BN4novmRFFrPifBSJxI2jvhNDE8V8-QBTO81acCtMq5AzH4sO02hfrXCk0lbpt0_te25mMgOfJkKRV2FmE9_xegqDI9mBNBbg2Fn3pEIrE1Jt6JUvpn7aaePYRN1FFpwu7xQ==
fundingchoicesmessages.google.com/f/ 		13 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxXGR9BN4novmRFFrPifBSJxI2jvhNDE8V8-QBTO81acCtMq5AzH4sO02hfrXCk0lbpt0_te25mMgOfJkKRV2FmE9_xegqDI9mBNBbg2Fn3pEIrE1Jt6JUvpn7aaePYRN1FFpwu7xQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzAxMzk1OTE3LDQyMDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbN11dLCJodHRwczovL3d3dy5tZWRpYWZpcmUuY29tL2ZpbGUvNGpweHc1c3p1bDdibGgyL05Td2lzaF90ZXh0dXJlX3BhY2sucmFyL2ZpbGUiLG51bGwsW1s4LCJGYVlQdVJ3ZXFJSSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdXV0
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.FaYPuRweqII.es5.O/am=CAM/d=1/rs=AJlcJMwtXJqxLeKc2R0IUIFp1d5liGKRSg/m=kernel_loader,loader_js_executable
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f100.1e100.net
Software
ESF /
Resource Hash
ce80d85b86dd086d02878eb4bfe069dae65844b65dbd364c8a1b9a69db2f4cf0
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-UdWrt6Du6K-vNGndcLoItA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:37 GMT
content-security-policy
script-src 'report-sample' 'nonce-UdWrt6Du6K-vNGndcLoItA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin
*
expires
Mon, 01 Jan 1990 00:00:00 GMT
pubcid.min.js
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 		732 B
897 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.229 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 01 Dec 2023 01:58:40 GMT
x-content-type-options
nosniff
content-encoding
br
age
19906
x-jsd-version
master
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
439
x-served-by
cache-fra-eddf8230042-FRA, cache-yul12827-YUL
x-jsd-version-type
branch
etag
W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
esp.js
cdn.id5-sync.com/api/1.0/ 		152 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.id5-sync.com/api/1.0/esp.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.53.86 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d050c56b76cb2dae10e3eadd8e8f5e83594db0916d25946bec2f662f69dd776d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:37 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 28 Nov 2023 11:19:25 GMT
server
cloudflare
x-amz-request-id
Z3CQKCMQ8TFESDQE
age
2125
etag
W/"d12fc51ceb66081fc72dabad6e4e0ded"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
cache-control
public, max-age=3600
cf-ray
82e7b9e548c736c3-YYZ
x-amz-id-2
5y8EqxJiQodf/8fjS646ynPU6tzcDG8KKCwfxSXFcUCzQELRXaiRkqudfK/DwKgW2rNgF5BtRJEf9s5HtwLHug==
esp.js
oa.openxcdn.net/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://oa.openxcdn.net/esp.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
192.146.102.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 20:26:38 GMT
content-encoding
gzip
age
1143122
x-guploader-uploadid
ABPtcPpk6oDx036tAyFrM6ODF6Dc7iDzxD5hnGhczM6YT3qls-8dFKPmCVbIOdtNGD5WNWEF4bzJSgzKAWV_jGhyW52PFQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7927
last-modified
Thu, 27 May 2021 18:30:51 GMT
server
UploadServer
etag
"df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation
1622140251693895
x-goog-hash
crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type
application/javascript
cache-control
no-transform
x-goog-stored-content-length
7927
accept-ranges
bytes
expires
Sat, 16 Nov 2024 20:26:38 GMT
publishertag.ids.js
static.criteo.net/js/ld/ 		42 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.ids.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
a1a256244f073b9ed474c52d16f8b7d0ed5d92ca4129042d6ee150817671bcd9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:39 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Fri, 27 Oct 2023 06:43:26 GMT
server
nginx
etag
W/"653b5c0e-a9a7"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Sat, 02 Dec 2023 01:58:39 GMT
uid2SecureSignal.js
cdn.prod.uidapi.com/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
99.84.222.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-222-71.iad79.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id
KP_OVZMS6roEW_XJdOd.KnSEmM8GWiP3
Date
Thu, 30 Nov 2023 12:11:10 GMT
Via
1.1 e811c1e9e6ed756b98bfcf15c74f6bea.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
IAD79-C1
Age
49651
x-amz-server-side-encryption
AES256
X-Cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
Connection
keep-alive
Content-Length
2776
Last-Modified
Thu, 19 Oct 2023 06:40:11 GMT
Server
AmazonS3
ETag
"a3a9a9ee8e72db69d54e805f0586c651"
Content-Type
text/javascript
Accept-Ranges
bytes
X-Amz-Cf-Id
8Cdsx5kSpm0hYd1pupWS2xz66CsaPpRMe3nqU-OPiBoSpyQbwNqcgQ==
sync.min.js
tags.crwdcntrl.net/lt/c/16589/ 		39 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.85.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-85-84.iad12.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 12:34:28 GMT
content-encoding
gzip
via
1.1 70b043d52df382dd62760368de89949e.cloudfront.net (CloudFront)
last-modified
Wed, 06 Sep 2023 15:56:57 GMT
server
AmazonS3
x-amz-cf-pop
IAD12-P2
age
48250
etag
W/"e073e71ed7a44e6f9cdd72904fda5940"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
public, max-age=86400
x-amz-cf-id
U1ZMVxLLQue_I3JvUmIEfPyVg-tReKKlNTRDFXuIVnCg88XEbLmkvQ==
encrypted-tag-g.js
invstatic101.creativecdn.com/encrypted-signals/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
87.70.96.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:38 GMT
via
1.1 google, 1.1 google
last-modified
Thu, 03 Aug 2023 03:28:51 GMT
server
Google Frontend
etag
fc4e6bfe266081c4873c6f08c8298e5c
content-type
text/javascript; charset=utf-8
x-cloud-trace-context
8ea607825419339c35a38237d243a2d0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1207
adagio.js
script.4dex.io/ 		75 KB
24 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://script.4dex.io/adagio.js
Requested by
Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
172.67.75.241 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
26305a08644b4f51b55812cf0ecf879c22da303a365b3d2769baa1b54c028c4d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date
Fri, 01 Dec 2023 01:58:38 GMT
Content-Encoding
br
CF-Cache-Status
HIT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age
232349
Transfer-Encoding
chunked
Connection
keep-alive
Last-Modified
Mon, 27 Nov 2023 07:14:07 GMT
Server
cloudflare
ETag
W/"6faf3acfde3bb82adada71be4fc1deb0"
Vary
Origin, Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NiYV9FSMrSPitoFKNh4ZVdCWiX%2BwNq5BTHo7t7Gc9ZX%2FdHYwPeRI8Tqoda7TX5EgFSJw8f9jX6bFFMZevUB7XDhiv8lWHS15NPtiMS1CKc2G0EUTDwrzl1l2iCWNby%2BM"}],"group":"cf-nel","max_age":604800}
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Cache-Control
public, max-age=1800
CF-RAY
82e7b9ea2cf03700-YYZ
map
bcp.crwdcntrl.net/6/ 		156 B
614 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bcp.crwdcntrl.net/6/map
Requested by
Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.93.99.238 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-93-99-238.compute-1.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
61799b7d2a46cf04fc19dc02d3b99a560da6c2e06fce8feae39848086c3f30da

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:37 GMT
server
Jetty(9.4.38.v20210224)
content-type
application/json;charset=utf-8
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache
x-server
10.40.52.92
access-control-allow-credentials
true
content-length
156
expires
0
latest.json
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20231130
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.229 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
dfc128586fee9486ced3ab7fd7011f0620be545c6a4d55f48f8268917213c943
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 01 Dec 2023 01:58:37 GMT
x-content-type-options
nosniff
content-encoding
br
age
35868
x-jsd-version
1.0.1890
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
838
x-served-by
cache-fra-eddf8230103-FRA, cache-yul12834-YUL
x-jsd-version-type
version
etag
W/"63f-TNgfTrEmgU0kvSD/fpfRT6TRJJo"
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
geo
ut.pubmatic.com/ 		12 B
93 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ut.pubmatic.com/geo?pubid=162833
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
204.237.133.242 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
1f0eb9334bd3f2bafab2dcb4753d04b50c3ef2cbbf505ef3c3af63fddee7f056

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
date
Fri, 01 Dec 2023 01:58:37 GMT
cache-control
max-age=172800
content-length
12
content-type
application/json
/
api.amplitude.com/ 		7 B
228 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.amplitude.com/
Requested by
Host: cdn.amplitude.com
URL: https://cdn.amplitude.com/libs/amplitude-8.5.0-min.gz.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.235.17.74 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-44-235-17-74.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Fri, 01 Dec 2023 01:58:37 GMT
strict-transport-security
max-age=15768000
access-control-max-age
86400
access-control-allow-methods
GET, POST
content-type
text/html;charset=utf-8
access-control-allow-origin
*
trace-id
Root=1-65693dcd-1e8bb837453b064958d08703
content-length
7
increment
id5-sync.com/api/esp/ 		0
233 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/api/esp/increment?counter=no-config
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.120 Frankfurt am Main, Germany, ASN16276 (OVH, FR),
Reverse DNS
ns31533571.ip-162-19-138.eu
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mediafire.com
date
Fri, 01 Dec 2023 01:58:37 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-credentials
true
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
px.gif
fundingchoicesmessages.google.com/img/ 		43 B
68 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fundingchoicesmessages.google.com/img/px.gif?ch=1&rn=3.4748308659957434
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.101 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f101.1e100.net
Software
ESF /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-KbfZalk_rKkYRvhzXDeIJw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:38 GMT
content-security-policy
script-src 'report-sample' 'nonce-KbfZalk_rKkYRvhzXDeIJw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options
SAMEORIGIN
content-type
image/gif
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires
Mon, 01 Jan 1990 00:00:00 GMT
px.gif
fundingchoicesmessages.google.com/img/ 		43 B
68 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fundingchoicesmessages.google.com/img/px.gif?ch=2&rn=6.137562326087277
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.101 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f101.1e100.net
Software
ESF /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-1fdE1lqepO1VO--jQFFxXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:38 GMT
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-1fdE1lqepO1VO--jQFFxXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options
SAMEORIGIN
content-type
image/gif
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxWkpF0drgDCGa-TZO4__aegrIw3Q7k8WWAMWkPIrY8XCwB7pEvd6jJJud5DNRq3jZwFDKcUsOZs1LojrpqW23GIsDVXjCoYgOBndnK5Y7Rhb2lbtdsMVVX6Nsn9_i0MIM_bDsp3qA==
fundingchoicesmessages.google.com/el/ 		0
28 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxWkpF0drgDCGa-TZO4__aegrIw3Q7k8WWAMWkPIrY8XCwB7pEvd6jJJud5DNRq3jZwFDKcUsOZs1LojrpqW23GIsDVXjCoYgOBndnK5Y7Rhb2lbtdsMVVX6Nsn9_i0MIM_bDsp3qA==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.FaYPuRweqII.es5.O/am=CAM/d=1/rs=AJlcJMwtXJqxLeKc2R0IUIFp1d5liGKRSg/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.101 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f101.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-ZQl9kBWJIZDuHtlZxLjKxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:38 GMT
content-security-policy
script-src 'report-sample' 'nonce-ZQl9kBWJIZDuHtlZxLjKxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-origin
https://www.mediafire.com
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options
SAMEORIGIN
expires
Mon, 01 Jan 1990 00:00:00 GMT
ad_box
fundingchoicesmessages.google.com/f/AGSKWxXpJ8xLlBJ-zME15yKJFrMS-Clpen8CinnNDiYPGtIiZOPNfgwib8l-HqoolGjsMCzRvmsB-LLWMriuYBxSncssVP0pttxf_FmGDX7ZCMJBTbKYwUPffXSdFJg6pukchZcPToXCc_uGidAln5UiXrWk1FB6C... 		54 B
109 B 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxXpJ8xLlBJ-zME15yKJFrMS-Clpen8CinnNDiYPGtIiZOPNfgwib8l-HqoolGjsMCzRvmsB-LLWMriuYBxSncssVP0pttxf_FmGDX7ZCMJBTbKYwUPffXSdFJg6pukchZcPToXCc_uGidAln5UiXrWk1FB6CI5YxXfQdiz6pqW131uz9CrUMkCx_K1e/_/ad_box?/ad/play1./boxad_-120x400./proxyadcall?
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.FaYPuRweqII.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMzufRugCfZ2QricSdnhl71g5NspTQ/m=ad_blocking_detection_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.101 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f101.1e100.net
Software
ESF /
Resource Hash
b407f3b563fcd301acdef748df9d5f3f908e0d166fc764b3855899c1f3482863
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-w9-7RLJY2F6MTCnWupC85w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:38 GMT
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-w9-7RLJY2F6MTCnWupC85w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires
Mon, 01 Jan 1990 00:00:00 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		150 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?fcd=true
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.FaYPuRweqII.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMzufRugCfZ2QricSdnhl71g5NspTQ/m=ad_blocking_detection_executable
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
92ae764151ea5966b63780dc3ab63859adee978abb6c3494e99cbc99688706cd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:39 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
52624
x-xss-protection
0
server
cafe
etag
17054004967122314145
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 01 Dec 2023 01:58:39 GMT
AGSKWxWkpF0drgDCGa-TZO4__aegrIw3Q7k8WWAMWkPIrY8XCwB7pEvd6jJJud5DNRq3jZwFDKcUsOZs1LojrpqW23GIsDVXjCoYgOBndnK5Y7Rhb2lbtdsMVVX6Nsn9_i0MIM_bDsp3qA==
fundingchoicesmessages.google.com/el/ 		0
28 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxWkpF0drgDCGa-TZO4__aegrIw3Q7k8WWAMWkPIrY8XCwB7pEvd6jJJud5DNRq3jZwFDKcUsOZs1LojrpqW23GIsDVXjCoYgOBndnK5Y7Rhb2lbtdsMVVX6Nsn9_i0MIM_bDsp3qA==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.FaYPuRweqII.es5.O/am=CAM/d=1/rs=AJlcJMwtXJqxLeKc2R0IUIFp1d5liGKRSg/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.101 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f101.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-lAq4vwo8uGosi4ZmLr9NvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:38 GMT
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-lAq4vwo8uGosi4ZmLr9NvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-origin
https://www.mediafire.com
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options
SAMEORIGIN
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxWkpF0drgDCGa-TZO4__aegrIw3Q7k8WWAMWkPIrY8XCwB7pEvd6jJJud5DNRq3jZwFDKcUsOZs1LojrpqW23GIsDVXjCoYgOBndnK5Y7Rhb2lbtdsMVVX6Nsn9_i0MIM_bDsp3qA==
fundingchoicesmessages.google.com/el/ 		0
28 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxWkpF0drgDCGa-TZO4__aegrIw3Q7k8WWAMWkPIrY8XCwB7pEvd6jJJud5DNRq3jZwFDKcUsOZs1LojrpqW23GIsDVXjCoYgOBndnK5Y7Rhb2lbtdsMVVX6Nsn9_i0MIM_bDsp3qA==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.FaYPuRweqII.es5.O/am=CAM/d=1/rs=AJlcJMwtXJqxLeKc2R0IUIFp1d5liGKRSg/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.101 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f101.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-OsDndWRT3JxIxN7vmkaqfQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:38 GMT
content-security-policy
script-src 'report-sample' 'nonce-OsDndWRT3JxIxN7vmkaqfQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-origin
https://www.mediafire.com
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options
SAMEORIGIN
expires
Mon, 01 Jan 1990 00:00:00 GMT
bluemonkey.gif
g.ezoic.net/detroitchicago/ 		43 B
82 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/bluemonkey.gif?e=eyJhZHZlcnRpc2VyX2RvbWFpbnMiOiJsZW9uLmNhc2lubyIsImZyb21fY2FjaGUiOjAsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiYXVjdGlvbl9pZCI6IjE3ZWY5ZDM4LWVlMzMtNDY1Ny1iODg2LTIyZTAxMzhkZTkzZSIsImFkX3VuaXRfY29kZSI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwiYWRhcHRlcl9jb2RlIjoidmlkb29teSIsIm9yaWdpbmFsX2NwbSI6MC4wNzQ1NTAwNTE1MTA4NzY1NywiY3BtIjowLjA3NDU1MDA1MTUxMDg3NjU3LCJhZGp1c3RtZW50IjoxLCJtZWRpYV90eXBlIjoiZGlzcGxheSIsInRpbWVfdG9fcmVzcG9uZCI6MTYxNywicmVzcG9uc2Vfc2l6ZSI6IjMwMHgyNTAiLCJkb21haW5faWQiOjQ4NDQ3MCwiZm9ybV9mYWN0b3JfaWQiOjEsInN0YXRfc291cmNlX2lkIjoxMTMzMSwic291cmNlIjoiY2xpZW50IiwiYWJfdGVzdF9pZCI6Im1vZDEiLCJwb3NpdGlvbl90eXBlIjoyMSwicmVmcmVzaF9jb3VudCI6MH0=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/kenai.js?gcb=3&cb=8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
Apache/2.4.39 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:39 GMT
content-encoding
br
server
Apache/2.4.39 (Ubuntu)
access-control-max-age
1728000
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
image/gif
access-control-allow-origin
https://www.mediafire.com
x-middleton-display
imp_sol
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials
true
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type
content-length
49
expires
Thu, 30 Nov 2023 01:58:39 GMT
bluemonkey.gif
g.ezoic.net/detroitchicago/ 		43 B
82 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/bluemonkey.gif?e=eyJhZHZlcnRpc2VyX2RvbWFpbnMiOiJjb3N0YXIuY29tIiwiZnJvbV9jYWNoZSI6MCwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJhdWN0aW9uX2lkIjoiMTdlZjlkMzgtZWUzMy00NjU3LWI4ODYtMjJlMDEzOGRlOTNlIiwiYWRfdW5pdF9jb2RlIjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLWVkZ2UtMS0wIiwiYWRhcHRlcl9jb2RlIjoiYWR0ZWxsaWdlbnQiLCJvcmlnaW5hbF9jcG0iOjAuMTEsImNwbSI6MC4xMSwiYWRqdXN0bWVudCI6MSwibWVkaWFfdHlwZSI6ImRpc3BsYXkiLCJ0aW1lX3RvX3Jlc3BvbmQiOjE3MjUsInJlc3BvbnNlX3NpemUiOiIxNjB4NjAwIiwiZG9tYWluX2lkIjo0ODQ0NzAsImZvcm1fZmFjdG9yX2lkIjoxLCJzdGF0X3NvdXJjZV9pZCI6MTEzMTYsInNvdXJjZSI6ImNsaWVudCIsImFiX3Rlc3RfaWQiOiJtb2QxIiwicG9zaXRpb25fdHlwZSI6MzgsInJlZnJlc2hfY291bnQiOjB9
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/kenai.js?gcb=3&cb=8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
Apache/2.4.39 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:39 GMT
content-encoding
br
server
Apache/2.4.39 (Ubuntu)
access-control-max-age
1728000
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
image/gif
access-control-allow-origin
https://www.mediafire.com
x-middleton-display
imp_sol
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials
true
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type
content-length
49
expires
Thu, 30 Nov 2023 01:58:39 GMT
bluemonkey.gif
g.ezoic.net/detroitchicago/ 		43 B
429 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/bluemonkey.gif?e=eyJhZHZlcnRpc2VyX2RvbWFpbnMiOiJjb3N0YXIuY29tIiwiZnJvbV9jYWNoZSI6MCwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJhdWN0aW9uX2lkIjoiMTdlZjlkMzgtZWUzMy00NjU3LWI4ODYtMjJlMDEzOGRlOTNlIiwiYWRfdW5pdF9jb2RlIjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLWVkZ2UtMi0wIiwiYWRhcHRlcl9jb2RlIjoiYWR0ZWxsaWdlbnQiLCJvcmlnaW5hbF9jcG0iOjAuMTEsImNwbSI6MC4xMSwiYWRqdXN0bWVudCI6MSwibWVkaWFfdHlwZSI6ImRpc3BsYXkiLCJ0aW1lX3RvX3Jlc3BvbmQiOjE3MjUsInJlc3BvbnNlX3NpemUiOiIxNjB4NjAwIiwiZG9tYWluX2lkIjo0ODQ0NzAsImZvcm1fZmFjdG9yX2lkIjoxLCJzdGF0X3NvdXJjZV9pZCI6MTEzMTYsInNvdXJjZSI6ImNsaWVudCIsImFiX3Rlc3RfaWQiOiJtb2QxIiwicG9zaXRpb25fdHlwZSI6MzksInJlZnJlc2hfY291bnQiOjB9
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/kenai.js?gcb=3&cb=8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
Apache/2.4.39 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:39 GMT
content-encoding
br
server
Apache/2.4.39 (Ubuntu)
access-control-max-age
1728000
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
image/gif
access-control-allow-origin
https://www.mediafire.com
x-middleton-display
imp_sol
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials
true
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type
content-length
49
expires
Thu, 30 Nov 2023 01:58:39 GMT
bluemonkey.gif
g.ezoic.net/detroitchicago/ 		43 B
82 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/bluemonkey.gif?e=eyJhZHZlcnRpc2VyX2RvbWFpbnMiOiJsZW9uLmNhc2lubyIsImZyb21fY2FjaGUiOjAsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiYXVjdGlvbl9pZCI6IjE3ZWY5ZDM4LWVlMzMtNDY1Ny1iODg2LTIyZTAxMzhkZTkzZSIsImFkX3VuaXRfY29kZSI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtNC0wIiwiYWRhcHRlcl9jb2RlIjoidmlkb29teSIsIm9yaWdpbmFsX2NwbSI6MC4wNzQ1NTAwNTE1MTA4NzY1NywiY3BtIjowLjA3NDU1MDA1MTUxMDg3NjU3LCJhZGp1c3RtZW50IjoxLCJtZWRpYV90eXBlIjoiZGlzcGxheSIsInRpbWVfdG9fcmVzcG9uZCI6MTczMSwicmVzcG9uc2Vfc2l6ZSI6IjMwMHgyNTAiLCJkb21haW5faWQiOjQ4NDQ3MCwiZm9ybV9mYWN0b3JfaWQiOjEsInN0YXRfc291cmNlX2lkIjoxMTMzMSwic291cmNlIjoiY2xpZW50IiwiYWJfdGVzdF9pZCI6Im1vZDEiLCJwb3NpdGlvbl90eXBlIjoyMiwicmVmcmVzaF9jb3VudCI6MH0=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/detroitchicago/kenai.js?gcb=3&cb=8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
Apache/2.4.39 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:39 GMT
content-encoding
br
server
Apache/2.4.39 (Ubuntu)
access-control-max-age
1728000
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
image/gif
access-control-allow-origin
https://www.mediafire.com
x-middleton-display
imp_sol
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials
true
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers
Content-Type
content-length
49
expires
Thu, 30 Nov 2023 01:58:39 GMT
timeout
rt.marphezis.com/prebid/ 		0
174 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://rt.marphezis.com/prebid/timeout
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
178.128.135.204 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
https://www.mediafire.com
date
Fri, 01 Dec 2023 01:58:39 GMT
access-control-allow-credentials
true
vary
Origin
publishertag.prebid.js
static.criteo.net/js/ld/ 		96 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.js
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:39 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Fri, 27 Oct 2023 06:43:26 GMT
server
nginx
etag
W/"653b5c0e-1811e"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Sat, 02 Dec 2023 01:58:39 GMT
error
rt.marphezis.com/prebid/ 		0
174 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://rt.marphezis.com/prebid/error
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
178.128.135.204 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
https://www.mediafire.com
date
Fri, 01 Dec 2023 01:58:38 GMT
access-control-allow-credentials
true
vary
Origin
ads
securepubads.g.doubleclick.net/gampad/ 		785 B
446 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3378551494251738&correlator=4242679180449186&eid=31079808%2C44807689%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=21732118914%3A183096492%2Cmediafire_com-medrectangle-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&ifi=1&didk=46192883&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701395918995&lmt=1701395918&adxs=320&adys=420&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&vis=1&aee=1&psz=336x-1&msz=336x-1&fws=512&ohw=0&ga_vid=1675868932.1701395917&ga_sid=1701395919&ga_hid=846692808&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABj50uWYwjFIABIZCgpwdWJjaWQub3JnGPvR5ZjCMUgAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRj80eWYwjFIAFICCGQSFwoIcnRiaG91c2UY9tzlmMIxSABSAghqEhkKCnVpZGFwaS5jb20Y_NHlmMIxSABSAghkEhQKBW9wZW54GPzR5ZjCMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Y19nlmMIxSABSAghq&cbidsp=CrQDCAESFAoGY3JpdGVvEHQgAlIGY3JpdGVvEg4KA2FteBBxIAJSA2FteBIUCgZvbmV0YWcQbiACUgZvbmV0YWcSGQoIcHVibWF0aWMQtwIgAlIIcHVibWF0aWMSHwoLc21pbGV3YW50ZWQQhgIgAlILc21pbGV3YW50ZWQSGwoJYWR5b3VsaWtlEMUCIAJSCWFkeW91bGlrZRIdCgpsdXBvbm1lZGlhELECIAJSCmx1cG9ubWVkaWESEQoEcmlzZRC7AyACUgRyaXNlEh8KC2FkdGVsbGlnZW50EL0NIAJSC2FkdGVsbGlnZW50EhUKBmJjbXNzcBDQDyADUgZiY21zc3ASHQoKdHJpcGxlbGlmdBDQDyADUgp0cmlwbGVsaWZ0Ej0KB3ZpZG9vbXkQww0aJAoPOTRhN2VjZjNmYzBjZjBiELbGBBoDVVNEKAE6BgisAhD6ASABUgd2aWRvb215EhcKB3lpZWxkbW8QvQwgAlIHeWllbGRtbxgCIiQ0NTdiZDYyMS0wNzA2LTQwNDQtOGMyMS1hZjFlMWUxODhkMTQqBAgDIAAyB3Y4LjE2LjBA0A9KAA..&dlt=1701395915992&idt=906&prev_scp=a%3D%257C0%257C%26iid1%3D1469122495588782%26eid%3D1469122495588782%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1105%26sap%3D1105%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D5302779%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D0%26tap%3Dmediafire_com-medrectangle-4-1469122495588782%26eb_br%3Dc6ffcfdd3dd19ac09fbf0cb03baa3e4b%26eba%3D1%26ebss%3D10061%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D36%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D36%26br2%3D18%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26icsticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C899%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C4276%2C5747%2C6293%2C6294%2C6295%2C5136%2C774%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C835%26hb_bidder%3Dvidoomy%26hb_adid%3D94a7ecf3fc0cf0b%26hb_format%3Dbanner%26hb_ssid%3D11331%26hb_opt%3D0.07%26hb_rt%3Dclient&adks=2694534479&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
a7ca18584d5b719a63b6250da424c7111365a767bb5ee7e941d28f4633e54085
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:39 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
415
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 01EF 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.62.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f132.1e100.net
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 01:58:39 GMT
expires
Sat, 30 Nov 2024 01:58:39 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		627 B
297 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3378551494251738&correlator=4242679180449186&eid=31079808%2C44807689%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=21732118914%3A183096492%2Cmediafire_com-box-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C728x90&ifi=2&didk=1698006286&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701395919010&lmt=1701395919&adxs=430&adys=1095&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&vis=1&aee=1&psz=970x90&msz=970x90&fws=512&ohw=0&ga_vid=1675868932.1701395917&ga_sid=1701395919&ga_hid=846692808&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABj50uWYwjFIABIZCgpwdWJjaWQub3JnGPvR5ZjCMUgAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRj80eWYwjFIAFICCGQSFwoIcnRiaG91c2UY9tzlmMIxSABSAghqEhkKCnVpZGFwaS5jb20Y_NHlmMIxSABSAghkEhQKBW9wZW54GPzR5ZjCMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Y19nlmMIxSABSAghq&cbidsp=Co4DCAESFAoGY3JpdGVvEHQgAlIGY3JpdGVvEg4KA2FteBBxIAJSA2FteBIUCgZvbmV0YWcQbiACUgZvbmV0YWcSGQoIcHVibWF0aWMQtwIgAlIIcHVibWF0aWMSHwoLc21pbGV3YW50ZWQQhgIgAlILc21pbGV3YW50ZWQSGwoJYWR5b3VsaWtlEMUCIAJSCWFkeW91bGlrZRIdCgpsdXBvbm1lZGlhELECIAJSCmx1cG9ubWVkaWESEQoEcmlzZRC7AyACUgRyaXNlEh8KC2FkdGVsbGlnZW50EL0NIAJSC2FkdGVsbGlnZW50EhUKBmJjbXNzcBDQDyADUgZiY21zc3ASHQoKdHJpcGxlbGlmdBDQDyADUgp0cmlwbGVsaWZ0EhcKB3ZpZG9vbXkQmw8gAlIHdmlkb29teRIXCgd5aWVsZG1vEL0MIAJSB3lpZWxkbW8YAiIkYzNkMjEzYzEtMThjYi00NDVlLTk4OTYtMDgzNTU3MTI0ZWJmKgQIAyAAMgd2OC4xNi4wQNAPSgA.&dlt=1701395915992&idt=906&prev_scp=a%3D%257C0%257C%26iid1%3D6238432755633144%26eid%3D6238432755633144%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1106%26sap%3D1106%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D5302779%26rid%3D99998%26pt%3D3%26al%3D1003%26compid%3D0%26tap%3Dmediafire_com-box-4-6238432755633144%26eb_br%3D1ea83551a903e458c56ec08ec0ffaa93%26eba%3D1%26ebss%3D10061%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D73%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D90%26br2%3D46%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26icsticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C760%2C815%2C817%2C899%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3933%2C4184%2C4185%2C4186%2C4604%2C4605%2C5747%2C6293%2C6294%2C6295%2C5136%2C774%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C835&adks=342075838&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
d68373f27557bdc1c9772cc016d385b78c2e078666267d17826c02d216c15465
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
266
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		637 B
319 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3378551494251738&correlator=4242679180449186&eid=31079808%2C44807689%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=21732118914%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=3&didk=46179496&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701395919016&lmt=1701395919&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&vis=1&aee=1&psz=300x-1&msz=300x-1&fws=512&ohw=0&ga_vid=1675868932.1701395917&ga_sid=1701395919&ga_hid=846692808&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABj50uWYwjFIABIZCgpwdWJjaWQub3JnGPvR5ZjCMUgAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRj80eWYwjFIAFICCGQSFwoIcnRiaG91c2UY9tzlmMIxSABSAghqEhkKCnVpZGFwaS5jb20Y_NHlmMIxSABSAghkEhQKBW9wZW54GPzR5ZjCMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Y19nlmMIxSABSAghq&cbidsp=CrQDCAESFAoGY3JpdGVvEHQgAlIGY3JpdGVvEg4KA2FteBBxIAJSA2FteBIUCgZvbmV0YWcQbiACUgZvbmV0YWcSGQoIcHVibWF0aWMQtwIgAlIIcHVibWF0aWMSHwoLc21pbGV3YW50ZWQQhgIgAlILc21pbGV3YW50ZWQSGwoJYWR5b3VsaWtlEMUCIAJSCWFkeW91bGlrZRIdCgpsdXBvbm1lZGlhELECIAJSCmx1cG9ubWVkaWESEQoEcmlzZRC7AyACUgRyaXNlEh8KC2FkdGVsbGlnZW50EL0NIAJSC2FkdGVsbGlnZW50EhUKBmJjbXNzcBDQDyADUgZiY21zc3ASHQoKdHJpcGxlbGlmdBDQDyADUgp0cmlwbGVsaWZ0Ej0KB3ZpZG9vbXkQ0QwaJAoPOTE1Y2M1YzA5NTZhZjlmELbGBBoDVVNEKAE6BgisAhD6ASABUgd2aWRvb215EhcKB3lpZWxkbW8QvQwgAlIHeWllbGRtbxgCIiQ0NTgyMTljYS0yNDdjLTQyYjktYjlkNS1hYTQ3MDRhZDE1ODYqBAgDIAAyB3Y4LjE2LjBA0A9KAA..&dlt=1701395915992&idt=906&prev_scp=a%3D%257C0%257C%26iid1%3D1891485707631873%26eid%3D1891485707631873%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D5302779%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dmediafire_com-medrectangle-3-1891485707631873%26eb_br%3D2987c3db2c41b735b4d6867239315fb0%26eba%3D1%26ebss%3D10061%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D39%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D38%26br2%3D20%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26icsticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C4276%2C5747%2C6293%2C6294%2C6295%2C5136%2C774%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C835%26hb_bidder%3Dvidoomy%26hb_adid%3D915cc5c0956af9f%26hb_format%3Dbanner%26hb_ssid%3D11331%26hb_opt%3D0.07%26hb_rt%3Dclient&adks=2693153471&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
45d8ab66850adf85d81feb47d7909f5e63eb86cbe3e5feb8404bd6afd79bb8b8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:40 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
288
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		629 B
304 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3378551494251738&correlator=4242679180449186&eid=31079808%2C44807689%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=21732118914%3A183096492%2Cmediafire_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=4&didk=2994273263&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701395919020&lmt=1701395919&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&vis=1&aee=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&ga_vid=1675868932.1701395917&ga_sid=1701395919&ga_hid=846692808&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABj50uWYwjFIABIZCgpwdWJjaWQub3JnGPvR5ZjCMUgAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRj80eWYwjFIAFICCGQSFwoIcnRiaG91c2UY9tzlmMIxSABSAghqEhkKCnVpZGFwaS5jb20Y_NHlmMIxSABSAghkEhQKBW9wZW54GPzR5ZjCMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Y19nlmMIxSABSAghq&cbidsp=CpkDCAESFAoGY3JpdGVvEHQgAlIGY3JpdGVvEg4KA2FteBBxIAJSA2FteBIUCgZvbmV0YWcQbiACUgZvbmV0YWcSHwoLc21pbGV3YW50ZWQQhgIgAlILc21pbGV3YW50ZWQSGwoJYWR5b3VsaWtlEMUCIAJSCWFkeW91bGlrZRIdCgpsdXBvbm1lZGlhELECIAJSCmx1cG9ubWVkaWESEQoEcmlzZRC7AyACUgRyaXNlEkUKC2FkdGVsbGlnZW50EL0NGiQKDzkyYzRiZmZmN2U1YjIyNhCw2wYaA1VTRCgBOgYIoAEQ2AQgAVILYWR0ZWxsaWdlbnQSFQoGYmNtc3NwENAPIANSBmJjbXNzcBIdCgp0cmlwbGVsaWZ0ENAPIANSCnRyaXBsZWxpZnQSFwoHdmlkb29teRCbDyACUgd2aWRvb215EhcKB3lpZWxkbW8QvQwgAlIHeWllbGRtbxgCIiRhYmI2MjI0Mi0zZTE0LTQ0YjgtOWJmMy05ZDEzYTFjMDZkMzYqBAgDIAAyB3Y4LjE2LjBA0A9KAA..&dlt=1701395915992&idt=906&prev_scp=a%3D%257C0%257C%26iid1%3D5203464651626414%26eid%3D5203464651626414%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D5302779%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dmediafire_com-edge-1-5203464651626414%26eb_br%3D5dfc84b2afe9d09bb5135bfcbbc5970f%26eba%3D1%26ebss%3D10061%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D34%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D60%26br2%3D30%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C4276%2C5747%2C6293%2C6294%2C6295%2C5136%2C774%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C835%26hb_bidder%3Dadtelligent%26hb_adid%3D939d55580a5e57d%26hb_format%3Dbanner%26hb_ssid%3D11316%26hb_opt%3D0.11%26hb_rt%3Dclient&adks=3297035300&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
de73d0db16257218a30cb9f69aa6964fc3b770ec05ab5d276fe79dc72e2797ae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:40 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
273
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		627 B
301 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3378551494251738&correlator=4242679180449186&eid=31079808%2C44807689%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=21732118914%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=5&didk=1697938527&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701395919024&lmt=1701395919&adxs=702&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&vis=1&aee=1&psz=728x-1&msz=728x-1&fws=512&ohw=0&ga_vid=1675868932.1701395917&ga_sid=1701395919&ga_hid=846692808&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABj50uWYwjFIABIZCgpwdWJjaWQub3JnGPvR5ZjCMUgAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRj80eWYwjFIAFICCGQSFwoIcnRiaG91c2UY9tzlmMIxSABSAghqEhkKCnVpZGFwaS5jb20Y_NHlmMIxSABSAghkEhQKBW9wZW54GPzR5ZjCMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Y19nlmMIxSABSAghq&cbidsp=Co4DCAESFAoGY3JpdGVvEHQgAlIGY3JpdGVvEg4KA2FteBBxIAJSA2FteBIUCgZvbmV0YWcQbiACUgZvbmV0YWcSGQoIcHVibWF0aWMQtwIgAlIIcHVibWF0aWMSHwoLc21pbGV3YW50ZWQQhgIgAlILc21pbGV3YW50ZWQSGwoJYWR5b3VsaWtlEMUCIAJSCWFkeW91bGlrZRIdCgpsdXBvbm1lZGlhELECIAJSCmx1cG9ubWVkaWESEQoEcmlzZRC7AyACUgRyaXNlEh8KC2FkdGVsbGlnZW50EL0NIAJSC2FkdGVsbGlnZW50EhUKBmJjbXNzcBDQDyADUgZiY21zc3ASHQoKdHJpcGxlbGlmdBDQDyADUgp0cmlwbGVsaWZ0EhcKB3ZpZG9vbXkQmw8gAlIHdmlkb29teRIXCgd5aWVsZG1vEL0MIAJSB3lpZWxkbW8YAiIkZDEzOTA4YWQtNTIxZC00NmNiLWI2YTgtYjQ4MTZiYjM0ZDNlKgQIAyAAMgd2OC4xNi4wQNAPSgA.&dlt=1701395915992&idt=906&prev_scp=a%3D%257C0%257C%26iid1%3D7698006623587942%26eid%3D7698006623587942%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dmediafire_com-box-2-7698006623587942%26eb_br%3D931e89386514f6e0ab7df9718ec5a124%26eba%3D1%26ebss%3D10061%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D84%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D80%26br2%3D40%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26icsticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3933%2C4184%2C4185%2C4186%2C4605%2C5747%2C6293%2C6294%2C6295%2C5136%2C774%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C835&adks=3863269515&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
7f569bb6b66b59ce3243c4dc7bce8075f400de17232b3eab9fa89c67703b8a9a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:40 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
270
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		636 B
313 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3378551494251738&correlator=4242679180449186&eid=31079808%2C44807689%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=21732118914%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=6&didk=2994425013&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701395919027&lmt=1701395919&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&vis=1&aee=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&ga_vid=1675868932.1701395917&ga_sid=1701395919&ga_hid=846692808&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABj50uWYwjFIABIZCgpwdWJjaWQub3JnGPvR5ZjCMUgAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRj80eWYwjFIAFICCGQSFwoIcnRiaG91c2UY9tzlmMIxSABSAghqEhkKCnVpZGFwaS5jb20Y_NHlmMIxSABSAghkEhQKBW9wZW54GPzR5ZjCMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Y19nlmMIxSABSAghq&cbidsp=CpkDCAESFAoGY3JpdGVvEHQgAlIGY3JpdGVvEg4KA2FteBBxIAJSA2FteBIUCgZvbmV0YWcQbiACUgZvbmV0YWcSHwoLc21pbGV3YW50ZWQQhgIgAlILc21pbGV3YW50ZWQSGwoJYWR5b3VsaWtlEMUCIAJSCWFkeW91bGlrZRIdCgpsdXBvbm1lZGlhELECIAJSCmx1cG9ubWVkaWESEQoEcmlzZRC7AyACUgRyaXNlEkUKC2FkdGVsbGlnZW50EL0NGiQKDzkzOWQ1NTU4MGE1ZTU3ZBCw2wYaA1VTRCgBOgYIoAEQ2AQgAVILYWR0ZWxsaWdlbnQSFQoGYmNtc3NwENAPIANSBmJjbXNzcBIdCgp0cmlwbGVsaWZ0ENAPIANSCnRyaXBsZWxpZnQSFwoHdmlkb29teRCbDyACUgd2aWRvb215EhcKB3lpZWxkbW8QvQwgAlIHeWllbGRtbxgCIiQ4NWU1MWJjMC0xMDViLTQ3YjMtYTI0MC04NjZiOGE3M2EzY2IqBAgDIAAyB3Y4LjE2LjBA0A9KAA..&dlt=1701395915992&idt=906&prev_scp=a%3D%257C0%257C%26iid1%3D3084741803591765%26eid%3D3084741803591765%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D5302779%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Dmediafire_com-edge-2-3084741803591765%26eb_br%3D1ea83551a903e458c56ec08ec0ffaa93%26eba%3D1%26ebss%3D10061%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D38%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D90%26br2%3D44%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C6293%2C6294%2C6295%2C5136%2C774%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C835%26hb_bidder%3Dadtelligent%26hb_adid%3D92c4bfff7e5b226%26hb_format%3Dbanner%26hb_ssid%3D11316%26hb_opt%3D0.11%26hb_rt%3Dclient&adks=1509549554&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
81e788698a5fcd072967d0756cd2533ce5f93416731845be47eae0dbc1b4aada
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
282
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
zrt_lookup_fy2021.html
googleads.g.doubleclick.net/pagead/html/r20231129/r20190131/ Frame 0AEF 		9 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20231129/r20190131/zrt_lookup_fy2021.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?fcd=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
cafe /
Resource Hash
9f6e245ec73203f99ecb888db309a2bdaf91f8696c1cebaa94e477a953fab30a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
58270
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=1209600
content-encoding
br
content-length
4121
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 30 Nov 2023 09:47:29 GMT
etag
12051592065903069241
expires
Thu, 14 Dec 2023 09:47:29 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
AGSKWxWkpF0drgDCGa-TZO4__aegrIw3Q7k8WWAMWkPIrY8XCwB7pEvd6jJJud5DNRq3jZwFDKcUsOZs1LojrpqW23GIsDVXjCoYgOBndnK5Y7Rhb2lbtdsMVVX6Nsn9_i0MIM_bDsp3qA==
fundingchoicesmessages.google.com/el/ 		0
28 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxWkpF0drgDCGa-TZO4__aegrIw3Q7k8WWAMWkPIrY8XCwB7pEvd6jJJud5DNRq3jZwFDKcUsOZs1LojrpqW23GIsDVXjCoYgOBndnK5Y7Rhb2lbtdsMVVX6Nsn9_i0MIM_bDsp3qA==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.FaYPuRweqII.es5.O/am=CAM/d=1/rs=AJlcJMwtXJqxLeKc2R0IUIFp1d5liGKRSg/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.101 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f101.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-15z15UzJSB9jPwNynCNwyA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:39 GMT
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-15z15UzJSB9jPwNynCNwyA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
access-control-max-age
86400
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type
text/html; charset=utf-8
access-control-allow-origin
https://www.mediafire.com
access-control-allow-methods
POST, GET, OPTIONS
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options
SAMEORIGIN
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxWkpF0drgDCGa-TZO4__aegrIw3Q7k8WWAMWkPIrY8XCwB7pEvd6jJJud5DNRq3jZwFDKcUsOZs1LojrpqW23GIsDVXjCoYgOBndnK5Y7Rhb2lbtdsMVVX6Nsn9_i0MIM_bDsp3qA==
fundingchoicesmessages.google.com/el/ 		0
28 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxWkpF0drgDCGa-TZO4__aegrIw3Q7k8WWAMWkPIrY8XCwB7pEvd6jJJud5DNRq3jZwFDKcUsOZs1LojrpqW23GIsDVXjCoYgOBndnK5Y7Rhb2lbtdsMVVX6Nsn9_i0MIM_bDsp3qA==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.FaYPuRweqII.es5.O/am=CAM/d=1/rs=AJlcJMwtXJqxLeKc2R0IUIFp1d5liGKRSg/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.101 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f101.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-uUZB0kKbLb_4NATPZ0SiaQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:39 GMT
content-security-policy
script-src 'report-sample' 'nonce-uUZB0kKbLb_4NATPZ0SiaQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
access-control-max-age
86400
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type
text/html; charset=utf-8
access-control-allow-origin
https://www.mediafire.com
access-control-allow-methods
POST, GET, OPTIONS
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options
SAMEORIGIN
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxXmAGcPBKj_H1ZYy5jsXYMthTheZvDblncxxnCh_zISBN-s9LMLm2Zxs5rr9D2bJAWHxRabplJ7e0DzoIIDa0onZbTZhBAOOcrFlxtEPO1jA9JwSQuzlBYgGI5qHM7zSrtAiTy22w==
fundingchoicesmessages.google.com/f/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxXmAGcPBKj_H1ZYy5jsXYMthTheZvDblncxxnCh_zISBN-s9LMLm2Zxs5rr9D2bJAWHxRabplJ7e0DzoIIDa0onZbTZhBAOOcrFlxtEPO1jA9JwSQuzlBYgGI5qHM7zSrtAiTy22w==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzAxMzk1OTE5LDI0MDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vd3d3Lm1lZGlhZmlyZS5jb20vZmlsZS80anB4dzVzenVsN2JsaDIvTlN3aXNoX3RleHR1cmVfcGFjay5yYXIvZmlsZSIsbnVsbCxbWzgsIkZhWVB1UndlcUlJIl0sWzksImVuLVVTIl0sWzE5LCIyIl1dXQ
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.FaYPuRweqII.es5.O/am=CAM/d=1/rs=AJlcJMwtXJqxLeKc2R0IUIFp1d5liGKRSg/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.101 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f101.1e100.net
Software
ESF /
Resource Hash
67659f4ba232982072a6adad0db2297cda97402e9f3a95da3e63ec34c0566f93
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-Z2oHqpouuS8sNGrulR2cfA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:39 GMT
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-Z2oHqpouuS8sNGrulR2cfA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin
*
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxXnFgWpBH_ZZ2SrK2zpQVnC_7cF6UXthWmLGHsmodx2C6vwYEa0gIepjt_h3iLFwNGuJPnIpwUMfrd_2YANs4Td1_RhqElI_Wt6wY3mZDpOYj2PoptjJc6ZGAv01TUx87ev27V33A==
fundingchoicesmessages.google.com/f/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxXnFgWpBH_ZZ2SrK2zpQVnC_7cF6UXthWmLGHsmodx2C6vwYEa0gIepjt_h3iLFwNGuJPnIpwUMfrd_2YANs4Td1_RhqElI_Wt6wY3mZDpOYj2PoptjJc6ZGAv01TUx87ev27V33A==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzAxMzk1OTE5LDMwODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vd3d3Lm1lZGlhZmlyZS5jb20vZmlsZS80anB4dzVzenVsN2JsaDIvTlN3aXNoX3RleHR1cmVfcGFjay5yYXIvZmlsZSIsbnVsbCxbWzgsIkZhWVB1UndlcUlJIl0sWzksImVuLVVTIl0sWzE5LCIyIl1dXQ
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.FaYPuRweqII.es5.O/am=CAM/d=1/rs=AJlcJMwtXJqxLeKc2R0IUIFp1d5liGKRSg/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.101 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f101.1e100.net
Software
ESF /
Resource Hash
287ac8c1d32b483d2754bf885e8248c50db2472780b9b0c459554438fabef745
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-f4OiCTvNGbGEa9p8X60feg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:39 GMT
content-security-policy
script-src 'report-sample' 'nonce-f4OiCTvNGbGEa9p8X60feg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin
*
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxXLN2sEzjGps6XuiD0BXPTVUgmMH4rrOAH9jyLkCI9bKUbVgRCthiihA-79fl8qMEAqwTiHAryDOrVREavHB8fXNnXtWcVvoKJVP-0Ei4v34E0pY_IoUNlX2GKT51eO98y7IhNKxg==
fundingchoicesmessages.google.com/f/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxXLN2sEzjGps6XuiD0BXPTVUgmMH4rrOAH9jyLkCI9bKUbVgRCthiihA-79fl8qMEAqwTiHAryDOrVREavHB8fXNnXtWcVvoKJVP-0Ei4v34E0pY_IoUNlX2GKT51eO98y7IhNKxg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzAxMzk1OTE5LDM5MTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly93d3cubWVkaWFmaXJlLmNvbS9maWxlLzRqcHh3NXN6dWw3YmxoMi9OU3dpc2hfdGV4dHVyZV9wYWNrLnJhci9maWxlIixudWxsLFtbOCwiRmFZUHVSd2VxSUkiXSxbOSwiZW4tVVMiXSxbMTksIjIiXV1d
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.FaYPuRweqII.es5.O/am=CAM/d=1/rs=AJlcJMwtXJqxLeKc2R0IUIFp1d5liGKRSg/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.101 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f101.1e100.net
Software
ESF /
Resource Hash
853aa761562ba4ba9a2686df56d9c15dfd9213cf5dc95e3a6836569d3da1ecac
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-7UvmTya_T0JXv1L6Dl9YVg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:39 GMT
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-7UvmTya_T0JXv1L6Dl9YVg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin
*
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxWMzylm5TTUAtZs9KgM9e4bOAHUu_VmKo7Pf9JQ8zGNrvFyyC5TQoM9C2_OfjYjytW1ztp0FILdToVOP7Y-UL0fOZFzeeQRGzG7o6aLN3v95zN047FRqTd1DzJmho1PcZuWSx4iwQ==
fundingchoicesmessages.google.com/el/ 		0
28 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxWMzylm5TTUAtZs9KgM9e4bOAHUu_VmKo7Pf9JQ8zGNrvFyyC5TQoM9C2_OfjYjytW1ztp0FILdToVOP7Y-UL0fOZFzeeQRGzG7o6aLN3v95zN047FRqTd1DzJmho1PcZuWSx4iwQ==
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.FaYPuRweqII.es5.O/am=CAM/d=1/rs=AJlcJMwtXJqxLeKc2R0IUIFp1d5liGKRSg/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.101 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f101.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-7rsfFp9koPtO6eJuCelrmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:39 GMT
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-7rsfFp9koPtO6eJuCelrmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy
same-origin
server
ESF
access-control-max-age
86400
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type
text/html; charset=utf-8
access-control-allow-origin
https://www.mediafire.com
access-control-allow-methods
POST, GET, OPTIONS
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options
SAMEORIGIN
expires
Mon, 01 Jan 1990 00:00:00 GMT
greenoaks.gif
g.ezoic.net/detroitchicago/ 		0
70 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjMtMTEtMzAifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxNyJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI0In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6IjQ4MCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInRfZXBvY2giOjE3MDEzOTU5MTYsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV90YWciLCJ2YWwiOiJlbi1VUyJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInRfZXBvY2giOjE3MDEzOTU5MTYsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV9wcmltYXJ5X3N1YnRhZyIsInZhbCI6ImVuIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwiZGF0YSI6W3sibmFtZSI6InRpbWVyX2ZpcnN0X2FkX3JlcXVlc3QiLCJ2YWwiOiIzMTU0In1dfV0=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:39 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:39 GMT
esp
oajs.openx.net/
Redirect Chain
  • https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&rid=esp
  • https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&rid=esp&cc=1
85 B
194 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&rid=esp&cc=1
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Server
34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
53.135.120.34.bc.googleusercontent.com
Software
/ Express
Resource Hash
2a0f8c3fd005ec5df2e677c030eae66ce97a2bb198934560885798d7fe42a7ee

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:40 GMT
via
1.1 google
x-powered-by
Express
etag
W/"55-Wl6a5DyiVE+W1a+5rSi162wyRCM"
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mediafire.com
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
85

Redirect headers

date
Fri, 01 Dec 2023 01:58:40 GMT
via
1.1 google
x-powered-by
Express
vary
Origin
access-control-allow-origin
https://www.mediafire.com
location
/esp?url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&rid=esp&cc=1
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
pd
google-bidout-d.openx.net/w/1.0/ Frame ECBE 		572 B
789 B 		Document
General
Check archive.org
Download Go to
Full URL
https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by
Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
ee644d330c66fd73672ac55d7f2dc8a80e124fe598e3babb36a1f7571ac536b6

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
373
content-type
text/html
date
Fri, 01 Dec 2023 01:58:40 GMT
p3p
CP="CUR ADM OUR NOR STA NID"
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
via
1.1 google
ads
securepubads.g.doubleclick.net/gampad/ 		112 KB
46 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3378551494251738&correlator=663343333544041&eid=31079808%2C44807689%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=21732118914%3A183096492%2Cmediafire_com-medrectangle-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280%7C300x250&ifi=7&didk=46192883&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3D2a1d6dca0f8a021d%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_Malc8ZWfrvDthYxd9Ug6WWaQwArrA&gpic=UID%3D00000da4ec3f8978%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_MYJuQJ7h8IYdqvRWbNzt6iQAisLcA&abxe=1&dt=1701395920401&lmt=1701395920&adxs=320&adys=420&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&vis=1&aee=1&psz=336x-1&msz=336x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1675868932.1701395917&ga_sid=1701395919&ga_hid=846692808&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABj50uWYwjFIABIZCgpwdWJjaWQub3JnGLXq5ZjCMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj80eWYwjFIAFICCGQSFwoIcnRiaG91c2UY9tzlmMIxSABSAghqEhkKCnVpZGFwaS5jb20Y_NHlmMIxSABSAghkEj4KBW9wZW54EixleUpwSWpvaVFXTmFhRFpLVlROU0x6SkxiMWRrZVVkWFUyTnpVVDA5SW4wPRji6-WYwjFIABIbCgxpZDUtc3luYy5jb20Y19nlmMIxSABSAghq&dlt=1701395915992&idt=906&prev_scp=a%3D%257C0%257C%26iid1%3D1469122495588782%26eid%3D1469122495588782%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1105%26sap%3D1105%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D5302779%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D0%26tap%3Dmediafire_com-medrectangle-4-1469122495588782%26eb_br%3D190bf94969f2d51c1f9954199aa5f4f8%2C8de355ef1cf56b7da61277050d9957b1%26eba%3D1%26ebss%3D10061%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D36%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D18%26br2%3D18%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26icsticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C899%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C4276%2C5747%2C6293%2C6294%2C6295%2C5136%2C774%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C835%2C18%2C1428%2C3052%26hb_bidder%3Dvidoomy%26hb_adid%3D94a7ecf3fc0cf0b%26hb_format%3Dbanner%26hb_ssid%3D11331%26hb_opt%3D0.07%26hb_rt%3Dclient%26lb%3D36%26reqt%3D1701395920390&adks=2694534479&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
d1eeab0a5d6afce29d878f65b23d8353d4275b45b21ba69b06bf13c8de1ffa4c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:40 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
46942
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		110 KB
45 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3378551494251738&correlator=3827985082434230&eid=31079808%2C44807689%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=21732118914%3A183096492%2Cmediafire_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=8&didk=1697938527&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3D2a1d6dca0f8a021d%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_Malc8ZWfrvDthYxd9Ug6WWaQwArrA&gpic=UID%3D00000da4ec3f8978%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_MYJuQJ7h8IYdqvRWbNzt6iQAisLcA&abxe=1&dt=1701395920409&lmt=1701395920&adxs=702&adys=10&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&vis=1&aee=1&psz=728x-1&msz=728x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1675868932.1701395917&ga_sid=1701395919&ga_hid=846692808&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABj50uWYwjFIABIZCgpwdWJjaWQub3JnGLXq5ZjCMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj80eWYwjFIAFICCGQSFwoIcnRiaG91c2UY9tzlmMIxSABSAghqEhkKCnVpZGFwaS5jb20Y_NHlmMIxSABSAghkEj4KBW9wZW54EixleUpwSWpvaVFXTmFhRFpLVlROU0x6SkxiMWRrZVVkWFUyTnpVVDA5SW4wPRji6-WYwjFIABIbCgxpZDUtc3luYy5jb20Y19nlmMIxSABSAghq&dlt=1701395915992&idt=906&prev_scp=a%3D%257C0%257C%26iid1%3D7698006623587942%26eid%3D7698006623587942%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dmediafire_com-box-2-7698006623587942%26eb_br%3D6f1c86ebad23a9c4f3d9e02ac8a8dbbf%2Cee685f77592ce296910ee91457d66ba3%26eba%3D1%26ebss%3D10061%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D84%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D40%26br2%3D40%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26icsticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3933%2C4184%2C4185%2C4186%2C4605%2C5747%2C6293%2C6294%2C6295%2C5136%2C774%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C835%2C2693%2C3045%2C4276%26lb%3D80%26reqt%3D1701395920385&adks=3863269515&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
8866fbe187560750670602bf4de0584c42839c187723d78a2f6617c3d7e04cba
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:40 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
46199
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		389 B
169 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3378551494251738&correlator=2021913458905637&eid=31079808%2C44807689%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=21732118914%3A183096492%2Cmediafire_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=9&didk=2994273263&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3D2a1d6dca0f8a021d%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_Malc8ZWfrvDthYxd9Ug6WWaQwArrA&gpic=UID%3D00000da4ec3f8978%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_MYJuQJ7h8IYdqvRWbNzt6iQAisLcA&abxe=1&dt=1701395920414&lmt=1701395920&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&vis=1&aee=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1675868932.1701395917&ga_sid=1701395919&ga_hid=846692808&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABj50uWYwjFIABIZCgpwdWJjaWQub3JnGLXq5ZjCMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj80eWYwjFIAFICCGQSFwoIcnRiaG91c2UY9tzlmMIxSABSAghqEhkKCnVpZGFwaS5jb20Y_NHlmMIxSABSAghkEj4KBW9wZW54EixleUpwSWpvaVFXTmFhRFpLVlROU0x6SkxiMWRrZVVkWFUyTnpVVDA5SW4wPRji6-WYwjFIABIbCgxpZDUtc3luYy5jb20Y19nlmMIxSABSAghq&dlt=1701395915992&idt=906&prev_scp=a%3D%257C0%257C%26iid1%3D5203464651626414%26eid%3D5203464651626414%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D5302779%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dmediafire_com-edge-1-5203464651626414%26eb_br%3Dd753ba285129d8fd7ef33dec95bcaa7e%2C54d0fa6d5f6aabe7623cb24faa42a441%26eba%3D1%26ebss%3D10061%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D34%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D30%26br2%3D30%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C4276%2C5747%2C6293%2C6294%2C6295%2C5136%2C774%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C835%2C2693%2C3053%26hb_bidder%3Dadtelligent%26hb_adid%3D939d55580a5e57d%26hb_format%3Dbanner%26hb_ssid%3D11316%26hb_opt%3D0.11%26hb_rt%3Dclient%26lb%3D60%26reqt%3D1701395920395&adks=3297035300&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
a76af442cfc0fba4c4ddfc213c7ba282359ad64fc4abdb293e20a7e31f3310ca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:40 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
137
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame ECBE
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=9135305356218733899
43 B
97 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=9135305356218733899
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://google-bidout-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:40 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
GET
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=9135305356218733899
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
dcm
aax-eu.amazon-adsystem.com/s/ Frame ECBE
Redirect Chain
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=fa457a28-e898-4449-9a1d-2b11dd13a271&id=8abc22cc-201a-c3f0-1079-2d0d157064ac
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=fa457a28-e898-4449-9a1d-2b11dd13a271&id=8abc22cc-201a-c3f0-1079-2d0d157064ac&dcc=t
43 B
855 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aax-eu.amazon-adsystem.com/s/dcm?pid=fa457a28-e898-4449-9a1d-2b11dd13a271&id=8abc22cc-201a-c3f0-1079-2d0d157064ac&dcc=t
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
HTTP/1.1
Server
67.220.228.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://google-bidout-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:41 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
FQAHJFF4NADMKBXAS7TZ
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:40 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
R7C8R574G2YR3ETMFMNH
Vary
Content-Type,Accept-Encoding,User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://aax-eu.amazon-adsystem.com/s/dcm?pid=fa457a28-e898-4449-9a1d-2b11dd13a271&id=8abc22cc-201a-c3f0-1079-2d0d157064ac&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame ECBE
Redirect Chain
  • https://match.adsrvr.org/track/cmf/openx?oxid=d26a5eb1-3cb0-780a-d077-af9a7d43af4c&gdpr=0
  • https://match.adsrvr.org/track/cmb/openx?oxid=d26a5eb1-3cb0-780a-d077-af9a7d43af4c&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=a0469c36-bc77-430e-9825-0adde7e331a8&ttd_puid=d26a5eb1-3cb0-780a-d077-af9a7d43af4c&gdpr=0&gdpr_consent=
43 B
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072971&val=a0469c36-bc77-430e-9825-0adde7e331a8&ttd_puid=d26a5eb1-3cb0-780a-d077-af9a7d43af4c&gdpr=0&gdpr_consent=
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://google-bidout-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:40 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537072971&val=a0469c36-bc77-430e-9825-0adde7e331a8&ttd_puid=d26a5eb1-3cb0-780a-d077-af9a7d43af4c&gdpr=0&gdpr_consent=
date
Fri, 01 Dec 2023 01:58:40 GMT
server
Kestrel
content-length
335
pixel
cm.g.doubleclick.net/ Frame ECBE 		170 B
243 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZmUwNThkN2ItZjVjNy0yNmFlLWM1OTctZjUyM2I3YTE2MTJj
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://google-bidout-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:40 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame ECBE
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEIIEKE338b57ZZKQrrCAHg&google_cver=1
43 B
180 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEIIEKE338b57ZZKQrrCAHg&google_cver=1
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://google-bidout-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:40 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:40 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEIIEKE338b57ZZKQrrCAHg&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		112 KB
46 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3378551494251738&correlator=3832971418399219&eid=31079808%2C44807689%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=21732118914%3A183096492%2Cmediafire_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=10&didk=46179496&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3D8f092541ad7e4743%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_MZ5GjNwaVk1qq9XkEEuIDT3YLF6Yw&gpic=UID%3D00000da4eb5f7aba%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_MYwsDEGbuYm9yj6rFLDBymXRxa0qg&abxe=1&dt=1701395920839&lmt=1701395920&adxs=320&adys=120&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&vis=1&aee=1&psz=300x-1&msz=300x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1675868932.1701395917&ga_sid=1701395919&ga_hid=846692808&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABj50uWYwjFIABIZCgpwdWJjaWQub3JnGLXq5ZjCMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj80eWYwjFIAFICCGQSFwoIcnRiaG91c2UY9tzlmMIxSABSAghqEhkKCnVpZGFwaS5jb20Y_NHlmMIxSABSAghkEj4KBW9wZW54EixleUpwSWpvaVFXTmFhRFpLVlROU0x6SkxiMWRrZVVkWFUyTnpVVDA5SW4wPRji6-WYwjFIABIbCgxpZDUtc3luYy5jb20Y19nlmMIxSABSAghq&dlt=1701395915992&idt=906&prev_scp=a%3D%257C0%257C%26iid1%3D1891485707631873%26eid%3D1891485707631873%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D5302779%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dmediafire_com-medrectangle-3-1891485707631873%26eb_br%3D45449ee2d6533045f60351c94107ba8e%2C7432360301409ae695ba255f16fbcf06%26eba%3D1%26ebss%3D10061%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D39%26shp%3D3%26ftsn%3D12%26ftsng%3D12%26br1%3D20%26br2%3D20%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26icsticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C4276%2C5747%2C6293%2C6294%2C6295%2C5136%2C774%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C835%2C18%2C1428%2C3052%2C3053%26hb_bidder%3Dvidoomy%26hb_adid%3D915cc5c0956af9f%26hb_format%3Dbanner%26hb_ssid%3D11331%26hb_opt%3D0.07%26hb_rt%3Dclient%26lb%3D38%26reqt%3D1701395920834&adks=2693153471&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
654229c7db9f22ea2aa458bd0c5b7d07c77170d1e78b1cdd24d7bff6347079ed
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
46804
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 3297 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.62.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f132.1e100.net
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 01:58:41 GMT
expires
Sat, 30 Nov 2024 01:58:41 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
greenoaks.gif
g.ezoic.net/detroitchicago/ 		0
62 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjQ1MzYifV19XQ==
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:41 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:41 GMT
ezadfilled.js
go.ezodn.com/porpoiseant/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/porpoiseant/ezadfilled.js?gcb=195-3&cb=141
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
adbd4855a8c8b406e9f528883f91e4cad19d3051400f5bdba7dadf446a8d6815

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 30 Nov 2023 07:21:08 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
56065
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rRIuzMDco9tBzmfO5eHRW1PDAYQZz1RkiNHK0EkgMDwucCklqbnXw97jilwFVKV6ZpaCsnUdA5M9iiAlcYTikg9iwODYOe%2BWlH2rZ1VEkVkMhFZV5SuTkKh23IWW5Z4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-middleton-display
sol-js
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
82e7b9fa6bc96a52-EWR
alt-svc
h3=":443"; ma=86400
army.gif
g.ezoic.net/porpoiseant/ 		0
62 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQ2OTEyMjQ5NTU4ODc4MiIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTQtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0ODg5ODg4LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjIifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE0NjkxMjI0OTU1ODg3ODIiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS00LTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDg4OTg4OCwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjE5MGJmOTQ5NjlmMmQ1MWMxZjk5NTQxOTlhYTVmNGY4LDhkZTM1NWVmMWNmNTZiN2RhNjEyNzcwNTBkOTk1N2IxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxNDY5MTIyNDk1NTg4NzgyIiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtNC0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicmV2ZW51ZSI6MC4wMDAxOCwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDAxOCwic3RhdF9zb3VyY2VfaWQiOjM1LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDg4OTg4OCwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE0NjkxMjI0OTU1ODg3ODIiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS00LTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDg4OTg4OCwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MjQxMTIzNTE3In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxNDY5MTIyNDk1NTg4NzgyIiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtNC0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ4ODk4ODgsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjQ5NzQ4ODk4ODgifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:42 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:42 GMT
4974889888
go.ezodn.com/dac/ 		0
602 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/dac/4974889888
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-3&bv=280&PageSpeed=off
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2820
alt-svc
h3=":443"; ma=86400
content-length
0
last-modified
Fri, 01 Dec 2023 00:45:17 GMT
server
cloudflare
access-control-max-age
1728000
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.mediafire.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vcHxyLW3LpS4yhKVAKydn4ODHb5GbVzYOk2qbjhaz09M%2FL1S3QqDX2345MbqQqaB1GV646uQ9jWkYhsp7e%2B3d86cOVG9%2B2suKrGDpq4fbPka6o4pTfSOliVNb1WyZis%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=14400
access-control-allow-credentials
true
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges
bytes
cf-ray
82e7b9fa6e134379-EWR
access-control-allow-headers
Content-Type
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQ2OTEyMjQ5NTU4ODc4MiIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTQtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0ODg5ODg4LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMy0xMS0zMCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjE3In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjQifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiNDgwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:40 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:40 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTQ2OTEyMjQ5NTU4ODc4MiIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTQtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsImF1Y3Rpb25fZXBvY2giOjE3MDEzOTU5MjEsImFkX3Bvc2l0aW9uIjoxMTA1LCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiYmlkX2Zsb29yX2luaXRpYWwiOjM2LCJiaWRfZmxvb3JfcHJldiI6MzYsImJpZF9mbG9vcl9maWxsZWQiOjE4LCJhdWN0aW9uX2NvdW50IjoyLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo2MDQsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjIxNzMyMTE4OTE0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjQ5NzQ4ODk4ODh9XQ==
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:40 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:40 GMT
container.html
c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame ED73 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.62.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f132.1e100.net
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 01:58:41 GMT
expires
Sat, 30 Nov 2024 01:58:41 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzY5ODAwNjYyMzU4Nzk0MiIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tYm94LTItMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc1NDAyMzE5LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjIifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijc2OTgwMDY2MjM1ODc5NDIiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NTQwMjMxOSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjZmMWM4NmViYWQyM2E5YzRmM2Q5ZTAyYWM4YThkYmJmLGVlNjg1Zjc3NTkyY2UyOTY5MTBlZTkxNDU3ZDY2YmEzIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3Njk4MDA2NjIzNTg3OTQyIiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicmV2ZW51ZSI6MC4wMDA0LCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDQsInN0YXRfc291cmNlX2lkIjozNSwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzU0MDIzMTksImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3Njk4MDA2NjIzNTg3OTQyIiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzU0MDIzMTksImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODI0MTEyMzUxNyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzY5ODAwNjYyMzU4Nzk0MiIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tYm94LTItMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc1NDAyMzE5LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiI0OTc1NDAyMzE5In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:41 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:41 GMT
4975402319
go.ezodn.com/dac/ 		0
571 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/dac/4975402319
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-3&bv=280&PageSpeed=off
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
170
alt-svc
h3=":443"; ma=86400
content-length
0
last-modified
Fri, 01 Dec 2023 00:45:10 GMT
server
cloudflare
access-control-max-age
1728000
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.mediafire.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t%2BkI9kfbxRPfBpko6OuUrh%2F4CgkKOwFkT4YymSTDc8%2FFnYMB0Mculj%2FSHd%2FFWuFLrH83gqEuEMMUzFp78Tsu5Z2sgtoCgPHOj%2Bis4NrkM%2Fke60jofk520W1s7hmSBzU%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=14400
access-control-allow-credentials
true
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges
bytes
cf-ray
82e7b9faae614379-EWR
access-control-allow-headers
Content-Type
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzY5ODAwNjYyMzU4Nzk0MiIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tYm94LTItMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc1NDAyMzE5LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMy0xMS0zMCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjE3In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjQifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiNDgwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:40 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:40 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNzY5ODAwNjYyMzU4Nzk0MiIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tYm94LTItMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsImF1Y3Rpb25fZXBvY2giOjE3MDEzOTU5MjEsImFkX3Bvc2l0aW9uIjoxMTAzLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiYmlkX2Zsb29yX2luaXRpYWwiOjgwLCJiaWRfZmxvb3JfcHJldiI6ODAsImJpZF9mbG9vcl9maWxsZWQiOjQwLCJhdWN0aW9uX2NvdW50IjoyLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo2MzYsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjIxNzMyMTE4OTE0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjQ5NzU0MDIzMTl9XQ==
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:40 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:40 GMT
pixel
googleads.g.doubleclick.net/xbbe/ Frame 5FB8 		645 B
301 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CNPh9QIQ_uHy8QEY6LjqwgEwAQ&v=APEucNVqwyJjASPEB2E0fs8EvoZqEBFoskYkd1c4HB-IkGMXf4_fbyokCM_0jCU9ZJJLIAer5t3avKurTp-ArejTIwKQo98l5zp1neGp8Qz6Q9f1E6WYOxA
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
cafe /
Resource Hash
a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
br
content-length
234
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 01:58:41 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
html_inpage_rendering_lib_200_278.js
s0.2mdn.net/879366/ Frame 3297 		172 KB
61 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Origin
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 20:53:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
18298
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
61485
x-xss-protection
0
last-modified
Tue, 14 Mar 2023 18:43:57 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 01 Dec 2023 20:53:43 GMT
omrhp_fy2021.js
pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/elements/html/ Frame 3297 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/elements/html/omrhp_fy2021.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 22:35:25 GMT
content-encoding
br
x-content-type-options
nosniff
age
12196
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3071
x-xss-protection
0
server
cafe
etag
10674441169935035545
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 22:35:25 GMT
abg_lite_fy2021.js
pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/ Frame 3297 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/abg_lite_fy2021.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
b67ad968ba3668562f331df45b73501e17c7c166bcf7e5443c33633cbc9d5783
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 18:42:45 GMT
content-encoding
br
x-content-type-options
nosniff
age
26156
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9305
x-xss-protection
0
server
cafe
etag
13635642240219548939
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 18:42:45 GMT
Q12zgMmT.js
tpc.googlesyndication.com/sodar/ Frame 3297 		41 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Q12zgMmT.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
sffe /
Resource Hash
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 09:08:53 GMT
content-encoding
br
x-content-type-options
nosniff
age
146988
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13937
x-xss-protection
0
last-modified
Fri, 25 Aug 2023 23:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2024 09:08:53 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 3297 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/window_focus_fy2021.js
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 19:53:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
21895
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 19:53:46 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 718F 		1 KB
759 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
76983
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=86400
content-encoding
br
content-length
618
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 30 Nov 2023 04:35:38 GMT
etag
48472445140208031
expires
Fri, 01 Dec 2023 04:35:38 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 3297 		20 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
cafe /
Resource Hash
09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 19:53:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
21895
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8544
x-xss-protection
0
server
cafe
etag
17124069415086231762
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 19:53:46 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 3297 		42 B
173 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CxmjOp0C80NCxbRTE-y0arTToDfzfENCev9TPaSYGjG9BwvRskdxamDyCg1bN3SB6unEyxITdZQQ5W3mtWCpx9t439dSmA39DoI62htq45TwEdnNE
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
l
www.google.com/ads/measurement/ Frame 3297 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTx_Kyr4jMs0XzQYoTdUEarcbfYL6-qGud6l6fcziFhcWSzaSlIFG3Kt3m8718mbxPnhEZGWybAuZaB7y-_Yrdp0Or3YA
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f105.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers
ufs_web_display.js
www.googletagservices.com/activeview/js/current/ Frame 3297 		202 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
sffe /
Resource Hash
1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
65067
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1701261208926228"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 01 Dec 2023 01:58:41 GMT
pixel
googleads.g.doubleclick.net/xbbe/ Frame A9A7 		668 B
313 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDOyFUYqtv-lwEwAQ&v=APEucNXIyS3V-qqesEtrmBX_U1uZvmBVWcmevdjAst1jVAyXZ8Il4tZz774wluHpBV0AKw0EF6JmcRU87AsI6qTDJ9bSlFr0jt4RNb2GqGW-PuEnvD8F3-0
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
cafe /
Resource Hash
8015a89c7e50b71a6597cfc7bc2be462212ae1f57c37e40878a79e7550768ccd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
br
content-length
246
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 01:58:41 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
express_html_inpage_rendering_lib_200_278.js
s0.2mdn.net/879366/ Frame ED73 		111 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Origin
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 06:39:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
69529
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39806
x-xss-protection
0
last-modified
Tue, 14 Mar 2023 18:44:05 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 01 Dec 2023 06:39:52 GMT
omrhp_fy2021.js
pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/elements/html/ Frame ED73 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/elements/html/omrhp_fy2021.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 22:35:25 GMT
content-encoding
br
x-content-type-options
nosniff
age
12196
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3071
x-xss-protection
0
server
cafe
etag
10674441169935035545
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 22:35:25 GMT
abg_lite_fy2021.js
pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/ Frame ED73 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/abg_lite_fy2021.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
b67ad968ba3668562f331df45b73501e17c7c166bcf7e5443c33633cbc9d5783
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 18:42:45 GMT
content-encoding
br
x-content-type-options
nosniff
age
26156
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9305
x-xss-protection
0
server
cafe
etag
13635642240219548939
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 18:42:45 GMT
Q12zgMmT.js
tpc.googlesyndication.com/sodar/ Frame ED73 		41 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Q12zgMmT.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
sffe /
Resource Hash
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 09:08:53 GMT
content-encoding
br
x-content-type-options
nosniff
age
146988
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13937
x-xss-protection
0
last-modified
Fri, 25 Aug 2023 23:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2024 09:08:53 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame ED73 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/window_focus_fy2021.js
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 19:53:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
21895
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 19:53:46 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame E6F2 		1 KB
678 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
76983
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=86400
content-encoding
br
content-length
618
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 30 Nov 2023 04:35:38 GMT
etag
48472445140208031
expires
Fri, 01 Dec 2023 04:35:38 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame ED73 		20 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
cafe /
Resource Hash
09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 19:53:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
21895
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8544
x-xss-protection
0
server
cafe
etag
17124069415086231762
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 19:53:46 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame ED73 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DmC7LHd6poeeO1cJfbjWbydkBToxpG5dyD5uwrHQVxhLpsadyJkLdULB2y8yad9KaMXrMDWejSnRWdLAO_vnsuGolmarOORMilHWv0VyDc0-rdxVM
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
l
www.google.com/ads/measurement/ Frame ED73 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRkG0u5onlH9cYvl8GsLkDXuROGQdmy7Qt6J1CLyIY1MFQPE13GXrqzTaHCeqPl8zT0_h7uRf3IVz5LdR6lOm9_z2Ap7g
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.122.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f105.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers
ufs_web_display.js
www.googletagservices.com/activeview/js/current/ Frame ED73 		202 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
sffe /
Resource Hash
1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
65067
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1701261208926228"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 01 Dec 2023 01:58:41 GMT
rum
dsum-sec.casalemedia.com/ Frame 5FB8
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELgZvJsorFd6YdJ1iSGxhJU&google_cver=1&gdpr=0
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELgZvJsorFd6YdJ1iSGxhJU&google_cver=1&gdpr=0&C=1
43 B
335 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELgZvJsorFd6YdJ1iSGxhJU&google_cver=1&gdpr=0&C=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNPh9QIQ_uHy8QEY6LjqwgEwAQ&v=APEucNVqwyJjASPEB2E0fs8EvoZqEBFoskYkd1c4HB-IkGMXf4_fbyokCM_0jCU9ZJJLIAer5t3avKurTp-ArejTIwKQo98l5zp1neGp8Qz6Q9f1E6WYOxA
Protocol
H2
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h0IJ5sYEa4yh9jWJrkLYRfhozxiKugC5f%2FStTjC65qlkmqVlGB8rZoYTSJTJ2f0eEv9jZbLzNXfkXye6FQGzfmsMdapQdUt13TXubcm2sj4OxkvCs0xQblXII9LYzplAI0O8ItlNy%2B2zvA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82e7b9fc19037133-YUL
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KjD2fjruygqpN50QLn7jrlbNEH4T4k556ViwCNUT%2FLKPlM1KiETF0ZqjpSqloAN5Li%2FWcw6%2B%2BbYW%2Bol26Msj0%2FzZB08y2rh9YIQXwUBVJ6ve4rghL%2BYiGWzPTSpPrS2LZYz1fJ1yUMHdfw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location
/rum?cm_dsp_id=45&external_user_id=CAESELgZvJsorFd6YdJ1iSGxhJU&google_cver=1&gdpr=0&C=1
cache-control
no-cache
cf-ray
82e7b9fb7ff67133-YUL
alt-svc
h3=":443"; ma=86400
content-length
0
expires
0
rum
dsum-sec.casalemedia.com/ Frame 5FB8
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZWk90SxXbfbp5HVe8b1dCQAA
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELgZvJsorFd6YdJ1iSGxhJU&google_cver=1
43 B
773 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELgZvJsorFd6YdJ1iSGxhJU&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNPh9QIQ_uHy8QEY6LjqwgEwAQ&v=APEucNVqwyJjASPEB2E0fs8EvoZqEBFoskYkd1c4HB-IkGMXf4_fbyokCM_0jCU9ZJJLIAer5t3avKurTp-ArejTIwKQo98l5zp1neGp8Qz6Q9f1E6WYOxA
Protocol
H3
Server
104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9kcZh2%2FMU%2FNUei4VmZuLg9Mg%2BlcIeIf4QJa5TztIcsh7fMeuYcWoTbd7z%2B8WrS2%2BCRmKLFv9duVB2X6W5J4JWZEj3j%2FXWGAYmi0kNfLPSDt2j05PsDWFQY%2B7k2ndK8f6OFsIvZD25kQoag%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
image/gif
cache-control
no-cache
cf-ray
82e7b9fcbc09398d-YYZ
alt-svc
h3=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELgZvJsorFd6YdJ1iSGxhJU&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
bounce
ib.adnxs.com/ Frame 5FB8
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
  • https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEKbEuknRkzhrlbcieVTYr2A&google_cver=1
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEKbEuknRkzhrlbcieVTYr2A%26google_cver%3D1
43 B
892 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEKbEuknRkzhrlbcieVTYr2A%26google_cver%3D1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNPh9QIQ_uHy8QEY6LjqwgEwAQ&v=APEucNVqwyJjASPEB2E0fs8EvoZqEBFoskYkd1c4HB-IkGMXf4_fbyokCM_0jCU9ZJJLIAer5t3avKurTp-ArejTIwKQo98l5zp1neGp8Qz6Q9f1E6WYOxA
Protocol
H2
Server
68.67.179.164 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
an-x-request-uuid
564f531d-c6bd-42b4-a770-739a9500a7a7
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
image/gif
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length
43
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
an-x-request-uuid
fd2386ad-74db-4e8b-b004-82219850b33c
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
location
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEKbEuknRkzhrlbcieVTYr2A%26google_cver%3D1
cache-control
no-store, no-cache, private
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 5FB8
Redirect Chain
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ1NDA2MTk2MDYzNDY2MjE5Mw%3D%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ1NDA2MTk2MDYzNDY2MjE5Mw%3D%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNPh9QIQ_uHy8QEY6LjqwgEwAQ&v=APEucNVqwyJjASPEB2E0fs8EvoZqEBFoskYkd1c4HB-IkGMXf4_fbyokCM_0jCU9ZJJLIAer5t3avKurTp-ArejTIwKQo98l5zp1neGp8Qz6Q9f1E6WYOxA
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
an-x-request-uuid
8b1d38d9-b675-4534-bb25-32649776a805
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODQ1NDA2MTk2MDYzNDY2MjE5Mw%3D%3D
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 718F
Redirect Chain
  • https://ad.turn.com/r/cs?pid=3&google_gid=CAESEN0XNgHb6FDviVy8iDNzhy8&google_cver=1&google_push=AXcoOmTW60zPO44b7YwU7rBLRJI4qfMLBJBilcWBNpdnstrt02C8LDqjxgYAy4fDqVwbUjmSiWTW3eAPLwM1xDjGNUbEOZRaiCp3mw
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjQwMTc5NDcwNjA5OTMzNjUwOA==&gdpr=&gdpr_consent=
  • https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEHISU_SLJw8l1gbFSwwu76Y&google_cver=1
43 B
398 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEHISU_SLJw8l1gbFSwwu76Y&google_cver=1
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Server
50.116.194.21 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
presentation-atl1.turn.com
Software
/
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEHISU_SLJw8l1gbFSwwu76Y&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
329
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 718F
Redirect Chain
  • https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESELNLE7WN44TmChYE7iBN7iI&google_cver=1&google_push=AXcoOmTWyFUSfXIowfub44hhkWIPyRQM6dT2KQw5Uyd2C6aioqy1e7B...
  • https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=2b8ef9b6e44114f&is_secure=true&networkId=14000&version=1&google_gid=CAESELNLE7WN44TmChYE7iBN7iI&google_cver=1&google_push=AXcoOmTWyFUSf...
  • https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGJjvFXuBz8ANLVV8XAAAAAAA&expiration=1701482321&google_cver=1&is_secure=true&google_gid=CAESELNLE7WN44TmChYE7iBN7...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGJjvFXuBz8ANLVV8XAAAAAAA&expiration=1701482321&google_cver=1&is_secure=true&google_gid=CAESELNLE7WN44TmChYE7iBN7iI&google_push=AXcoOmTWyFUSfXIowfub44hhkWIPyRQM6dT2KQw5Uyd2C6aioqy1e7BM-qfJcYKTiq2LT6Dv_BC_N-gaaLAn15ZGb2XPbeibWvmqtQ
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAGJjvFXuBz8ANLVV8XAAAAAAA&expiration=1701482321&google_cver=1&is_secure=true&google_gid=CAESELNLE7WN44TmChYE7iBN7iI&google_push=AXcoOmTWyFUSfXIowfub44hhkWIPyRQM6dT2KQw5Uyd2C6aioqy1e7BM-qfJcYKTiq2LT6Dv_BC_N-gaaLAn15ZGb2XPbeibWvmqtQ
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
pixel
cm.g.doubleclick.net/ Frame 718F
Redirect Chain
  • https://um.simpli.fi/gp_match?google_gid=CAESEPc_UujaFUrOx-o5siWztpY&google_cver=1&google_push=AXcoOmR72zYBcucDOtUZo0yc55FG0SVJvf2ht9AY3_46EqqGXpaSSuwgmt5VJpp7eiN-omqiOSM9B7F1Gw7qStTNGlIfrBrHKqL_
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=172B0C337EA24A8F83EA8C8A4B595618&google_push=AXcoOmR72zYBcucDOtUZo0yc55FG0SVJvf2ht9AY3_46EqqGXpaSSuwgmt5VJpp7eiN-omqiOSM9B7F1Gw7qStT...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=172B0C337EA24A8F83EA8C8A4B595618&google_push=AXcoOmR72zYBcucDOtUZo0yc55FG0SVJvf2ht9AY3_46EqqGXpaSSuwgmt5VJpp7eiN-omqiOSM9B7F1Gw7qStTNGlIfrBrHKqL_
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Fri, 01 Dec 2023 01:58:41 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=172B0C337EA24A8F83EA8C8A4B595618&google_push=AXcoOmR72zYBcucDOtUZo0yc55FG0SVJvf2ht9AY3_46EqqGXpaSSuwgmt5VJpp7eiN-omqiOSM9B7F1Gw7qStTNGlIfrBrHKqL_
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Thu, 30 Nov 2023 01:58:41 GMT
pixel
cm.g.doubleclick.net/ Frame 718F
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGCJR7fSqfUfinpCWebouuM&google_cver=1&googl...
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEGCJR7fSqfUfinpCWebouuM&google_push=AX...
  • https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGCJR7fSqfUfinpCWebouuM&google_hm=ZWk90VgNqmwBwKie5PdSRAAADlAAAAAB&google_nid=index&google_push=AXcoOmQr5oWVHzAZ8UeOENK35l_WFWFaYfCM_...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGCJR7fSqfUfinpCWebouuM&google_hm=ZWk90VgNqmwBwKie5PdSRAAADlAAAAAB&google_nid=index&google_push=AXcoOmQr5oWVHzAZ8UeOENK35l_WFWFaYfCM_2mjjCbA17iFcrxfOWIvCBoFsVLri8IvPZXxYY_ulnRHTQTUQzrzCjQnIb1GKbvTtQ
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k8WdM%2BfNcRnPcNw7lgZ5oon58JcH8aQbZRoLiraAnXsIPrG6HbGafhFN5TLJSsWf24%2Fg%2B8stXpij5jyBem3WBpiqtQuq9kFtkX1g8bZKDqWeiAbNzL96A%2FzlxIbdbweL42PE9WG4GOtCJw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGCJR7fSqfUfinpCWebouuM&google_hm=ZWk90VgNqmwBwKie5PdSRAAADlAAAAAB&google_nid=index&google_push=AXcoOmQr5oWVHzAZ8UeOENK35l_WFWFaYfCM_2mjjCbA17iFcrxfOWIvCBoFsVLri8IvPZXxYY_ulnRHTQTUQzrzCjQnIb1GKbvTtQ
cache-control
no-cache
cf-ray
82e7b9fd3cce398d-YYZ
alt-svc
h3=":443"; ma=86400
content-length
0
expires
0
pixel
cm.g.doubleclick.net/ Frame 718F
Redirect Chain
  • https://match.360yield.com/match/ebda?google_gid=CAESEPRvZkXZWLFTly1Tg31NL30&google_cver=1&google_push=AXcoOmRj0g6ZptEhDtC9i9C446Sm9hmToxM3QoJi-W1Q_aW1S0c05suMQWyKyn8zOFqDuBcFnTmNbNRNgLpJQBN12LZY2R...
  • https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEPRvZkXZWLFTly1Tg31NL30&google_cver=1&google_push=AXcoOmRj0g6ZptEhDtC9i9C446Sm9hmToxM3QoJi-W1Q_aW1S0c05suMQWyKyn8zOFqDuBcFnTmNbNRNgLpJQBN1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=7xT3NXJYS2igUsQIGeD5Bw&google_push=AXcoOmRj0g6ZptEhDtC9i9C446Sm9hmToxM3QoJi-W1Q_aW1S0c05suMQWyKyn8zOFqDuBcFnTmNbNRNgLpJQBN...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=7xT3NXJYS2igUsQIGeD5Bw&google_push=AXcoOmRj0g6ZptEhDtC9i9C446Sm9hmToxM3QoJi-W1Q_aW1S0c05suMQWyKyn8zOFqDuBcFnTmNbNRNgLpJQBN12LZY2RTsN_cgTg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:48 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=7xT3NXJYS2igUsQIGeD5Bw&google_push=AXcoOmRj0g6ZptEhDtC9i9C446Sm9hmToxM3QoJi-W1Q_aW1S0c05suMQWyKyn8zOFqDuBcFnTmNbNRNgLpJQBN12LZY2RTsN_cgTg
access-control-allow-origin
*
date
Fri, 01 Dec 2023 01:58:48 GMT
content-type
text/plain
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
pixel
cm.g.doubleclick.net/ Frame 718F
Redirect Chain
  • https://t.adx.opera.com/pub/sync?pubid=pub6871767557696&google_push=AXcoOmS4b5XTDAkLaZAOwOMJcEIF-WNRmxlnhGWiRpmdma-OlCSkncKwTPeJeWASnM9EjkGf1JOXo__fsHQ7wTS5DRBBpH9NFKTBGqM&google_gid=CAESEHwCtajIXE...
  • https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEHwCtajIXEjJl7gPKMqE3VM&google_hm=T1BVOGNkMDBiNjc5YTRkNGE0ZmIyODI4ODVkNzExZTQ1YTA&google_nid=opera_norway_as&google_push=AXcoOmS4b5XT...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEHwCtajIXEjJl7gPKMqE3VM&google_hm=T1BVOGNkMDBiNjc5YTRkNGE0ZmIyODI4ODVkNzExZTQ1YTA&google_nid=opera_norway_as&google_push=AXcoOmS4b5XTDAkLaZAOwOMJcEIF-WNRmxlnhGWiRpmdma-OlCSkncKwTPeJeWASnM9EjkGf1JOXo__fsHQ7wTS5DRBBpH9NFKTBGqM
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:44 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:44 GMT
server
nginx
access-control-allow-methods
POST, GET
content-type
text/html; charset=utf-8
access-control-allow-origin
*
location
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEHwCtajIXEjJl7gPKMqE3VM&google_hm=T1BVOGNkMDBiNjc5YTRkNGE0ZmIyODI4ODVkNzExZTQ1YTA&google_nid=opera_norway_as&google_push=AXcoOmS4b5XTDAkLaZAOwOMJcEIF-WNRmxlnhGWiRpmdma-OlCSkncKwTPeJeWASnM9EjkGf1JOXo__fsHQ7wTS5DRBBpH9NFKTBGqM
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
content-length
327
expires
Mon, 01 Jan 1990 00:00:00 GMT
google
trace.mediago.io/cs/ Frame 718F 		0
0
attr
cm.g.doubleclick.net/pixel/ Frame 718F 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J5Iblc252ZrHrxPQClcPXkwb9P-OfftOr4fIaW0qj5EiNYt8wfmGfCYrY5rbLDTQCMGB9HLXk
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
ads
securepubads.g.doubleclick.net/gampad/ 		387 B
163 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3378551494251738&correlator=2352245664481249&eid=31079808%2C44807689%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=21732118914%3A183096492%2Cmediafire_com-box-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C728x90&ifi=11&didk=1698006286&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3D04f7d9f43eb6df75%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_MYEm7OslMPa5eNuyPuqaTyOzRHs8w&gpic=UID%3D00000da4eb675805%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_MYt4x5fwQFWz5R6mUcP1JPCYopVaQ&abxe=1&dt=1701395921150&lmt=1701395921&adxs=430&adys=1095&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&vis=1&aee=1&psz=970x90&msz=970x90&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1675868932.1701395917&ga_sid=1701395919&ga_hid=846692808&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABj50uWYwjFIABIZCgpwdWJjaWQub3JnGLXq5ZjCMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj80eWYwjFIAFICCGQSFwoIcnRiaG91c2UY9tzlmMIxSABSAghqEhkKCnVpZGFwaS5jb20Y_NHlmMIxSABSAghkEj4KBW9wZW54EixleUpwSWpvaVFXTmFhRFpLVlROU0x6SkxiMWRrZVVkWFUyTnpVVDA5SW4wPRji6-WYwjFIABIbCgxpZDUtc3luYy5jb20Y19nlmMIxSABSAghq&dlt=1701395915992&idt=906&prev_scp=a%3D%257C0%257C%26iid1%3D6238432755633144%26eid%3D6238432755633144%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1106%26sap%3D1106%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D5302779%26rid%3D99998%26pt%3D3%26al%3D1003%26compid%3D0%26tap%3Dmediafire_com-box-4-6238432755633144%26eb_br%3Dfc44e27e7de5f52a5f3c42d1877542d7%2Cfe5b0c99ab7ba15f050582be1301303f%26eba%3D1%26ebss%3D10061%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D73%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D46%26br2%3D46%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26icsticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C760%2C815%2C817%2C899%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3933%2C4184%2C4185%2C4186%2C4604%2C4605%2C5747%2C6293%2C6294%2C6295%2C5136%2C774%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C835%2C2693%2C3045%2C4276%26lb%3D90%26reqt%3D1701395921142&adks=342075838&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
574e1db830eca18f0ea1dff860d8d6708d9e0e4fadfc2ca28e13644f3526acc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
133
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame A9A7
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEwKCkY-Q4T--Y1Sz57w4UA&google_cver=1&gdpr=0
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEwKCkY-Q4T--Y1Sz57w4UA&google_cver=1&gdpr=0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDOyFUYqtv-lwEwAQ&v=APEucNXIyS3V-qqesEtrmBX_U1uZvmBVWcmevdjAst1jVAyXZ8Il4tZz774wluHpBV0AKw0EF6JmcRU87AsI6qTDJ9bSlFr0jt4RNb2GqGW-PuEnvD8F3-0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEwKCkY-Q4T--Y1Sz57w4UA&google_cver=1&gdpr=0
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
306
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame A9A7
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=0&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZmUwNThkN2ItZjVjNy0yNmFlLWM1OTctZjUyM2I3YTE2MTJj
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZmUwNThkN2ItZjVjNy0yNmFlLWM1OTctZjUyM2I3YTE2MTJj
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDOyFUYqtv-lwEwAQ&v=APEucNXIyS3V-qqesEtrmBX_U1uZvmBVWcmevdjAst1jVAyXZ8Il4tZz774wluHpBV0AKw0EF6JmcRU87AsI6qTDJ9bSlFr0jt4RNb2GqGW-PuEnvD8F3-0
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Fri, 01 Dec 2023 01:58:41 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZmUwNThkN2ItZjVjNy0yNmFlLWM1OTctZjUyM2I3YTE2MTJj
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
um
sync.teads.tv/ Frame A9A7
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm&gdpr=0
  • https://sync.teads.tv/um?eid=3&uid=CAESEPupZ_clYrjsMYAfGJjvnj4&google_cver=1&gdpr=0
23 B
277 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.teads.tv/um?eid=3&uid=CAESEPupZ_clYrjsMYAfGJjvnj4&google_cver=1&gdpr=0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDOyFUYqtv-lwEwAQ&v=APEucNXIyS3V-qqesEtrmBX_U1uZvmBVWcmevdjAst1jVAyXZ8Il4tZz774wluHpBV0AKw0EF6JmcRU87AsI6qTDJ9bSlFr0jt4RNb2GqGW-PuEnvD8F3-0
Protocol
H2
Server
23.197.41.36 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-41-36.deploy.static.akamaitechnologies.com
Software
pekko-http/1.0.0 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

expires
Fri, 01 Dec 2023 01:58:44 GMT
pragma
no-cache
date
Fri, 01 Dec 2023 01:58:44 GMT
cache-control
max-age=0, no-cache, no-store
server
pekko-http/1.0.0
content-length
23
content-type
image/gif

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://sync.teads.tv/um?eid=3&uid=CAESEPupZ_clYrjsMYAfGJjvnj4&google_cver=1&gdpr=0
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
292
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame A9A7
Redirect Chain
  • https://sync.teads.tv/um?eid=3&uid=&gdpr=0&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YTJmZmExMWUtYmE3ZS00NTNmLTgyYTItNjUwNWQxYzhmMTkw
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YTJmZmExMWUtYmE3ZS00NTNmLTgyYTItNjUwNWQxYzhmMTkw
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDOyFUYqtv-lwEwAQ&v=APEucNXIyS3V-qqesEtrmBX_U1uZvmBVWcmevdjAst1jVAyXZ8Il4tZz774wluHpBV0AKw0EF6JmcRU87AsI6qTDJ9bSlFr0jt4RNb2GqGW-PuEnvD8F3-0
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:44 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:44 GMT
server
pekko-http/1.0.0
content-type
text/html; charset=UTF-8
location
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YTJmZmExMWUtYmE3ZS00NTNmLTgyYTItNjUwNWQxYzhmMTkw
cache-control
max-age=0, no-cache, no-store
content-length
189
expires
Fri, 01 Dec 2023 01:58:44 GMT
truncated
/ Frame 3297 		216 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6e276fa730247ab06d00f83c944608d9ec16d9f81d3c8ec88d0ea431a768ac44

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame ED73 		216 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6bc3c2d3634a070f17cafad43c9287130fe07c8ce95ff5aac28fbf50685aa4e0

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/png
google
fksnk.com/cs/ Frame E6F2 		0
0
3
mweb.ck.inmobi.com/sync/ Frame E6F2 		0
0
pixel
cm.g.doubleclick.net/ Frame E6F2
Redirect Chain
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEPC8IH5i7vdThFqmkZjdL-c&google_cver=1&google_push=AXcoOmRdLfAyTVhB_ZsJCvEft2JpY4sSMmsVTbXG1e7MO-p4Evobne-n3vx7K5kgRJP0cNxWl8a2yp0y...
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTEzNTMwNTM1NjIxODczMzg5OQ&google_push=AXcoOmRdLfAyTVhB_ZsJCvEft2JpY4sSMmsVTbXG1e7MO-p4Evobne-n3vx7K5kgRJP0cNxWl8a2yp...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTEzNTMwNTM1NjIxODczMzg5OQ&google_push=AXcoOmRdLfAyTVhB_ZsJCvEft2JpY4sSMmsVTbXG1e7MO-p4Evobne-n3vx7K5kgRJP0cNxWl8a2yp0yHOzKud7JloG54DHJu5k
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
GET
location
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTEzNTMwNTM1NjIxODczMzg5OQ&google_push=AXcoOmRdLfAyTVhB_ZsJCvEft2JpY4sSMmsVTbXG1e7MO-p4Evobne-n3vx7K5kgRJP0cNxWl8a2yp0yHOzKud7JloG54DHJu5k
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
pixel
cm.g.doubleclick.net/ Frame E6F2
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEM...
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=AXcoOmSNN-z0NW6ftPz5eH-IOY-YBbaYpJfa9KEdZFqCZr6jtS_u0bucUSRD91wkWut_pyJaARgmwcWvoZES58dpW2pfSCevup4&redir=https%3A%2F%2Fcm.g.double...
  • https://sync.targeting.unrulymedia.com/csync/RX-358895dc-82d6-4392-9b03-d569568dac10-005?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAXcoOmSNN-z0NW6ftPz5eH-IO...
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmSNN-z0NW6ftPz5eH-IOY-YBbaYpJfa9KEdZFqCZr6jtS_u0bucUSRD91wkWut_pyJaARgmwcWvoZES58dpW2pfSCevup4&google_hm=BTWIldyC1kOSmwPVaVaNrBA
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmSNN-z0NW6ftPz5eH-IOY-YBbaYpJfa9KEdZFqCZr6jtS_u0bucUSRD91wkWut_pyJaARgmwcWvoZES58dpW2pfSCevup4&google_hm=BTWIldyC1kOSmwPVaVaNrBA
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmSNN-z0NW6ftPz5eH-IOY-YBbaYpJfa9KEdZFqCZr6jtS_u0bucUSRD91wkWut_pyJaARgmwcWvoZES58dpW2pfSCevup4&google_hm=BTWIldyC1kOSmwPVaVaNrBA
Date
Fri, 01 Dec 2023 01:58:41 GMT
Content-Type
text/html
Connection
keep-alive
ETag
RX358895dc82d643929b03d569568dac10005
Transfer-Encoding
chunked
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
pixel
cm.g.doubleclick.net/ Frame E6F2
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEPnSyueLLZdDWQoaCzqzPnQ&google_cver=1&google_push=AXcoOmTDt08O2zyX8UBCh7L4tuGPm-tofnovTQig8fbBoYmQaWsst3oRjKpnWbjqLwlYpWEFhtF8zmAC7UDC7F0YsqroWct1JR8
  • https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=0&gdpr_consent=&us_privacy=&sync=1&google_push=AXcoOmTDt08O2zyX8UBCh7L4tuGPm-tofnovTQig8fbBoYmQaWsst3oRjKpnWbjqLwlYpWEFhtF8zmAC7UDC7F0YsqroWct1JR8...
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDAzMzUzOTcxMTU1NTc4NjA4NDI4NQ%3D%3D&google_push=AXcoOmTDt08O2zyX8UBCh7L4tuGPm-tofnovTQig8fbBoYmQaWsst3oR...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDAzMzUzOTcxMTU1NTc4NjA4NDI4NQ%3D%3D&google_push=AXcoOmTDt08O2zyX8UBCh7L4tuGPm-tofnovTQig8fbBoYmQaWsst3oRjKpnWbjqLwlYpWEFhtF8zmAC7UDC7F0YsqroWct1JR8
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDAzMzUzOTcxMTU1NTc4NjA4NDI4NQ%3D%3D&google_push=AXcoOmTDt08O2zyX8UBCh7L4tuGPm-tofnovTQig8fbBoYmQaWsst3oRjKpnWbjqLwlYpWEFhtF8zmAC7UDC7F0YsqroWct1JR8
date
Fri, 01 Dec 2023 01:58:42 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
pixel
cm.g.doubleclick.net/ Frame E6F2
Redirect Chain
  • https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEHC8HWDCWcayD3VrUi1W7dc&google_cver=1&google_push=AXcoOmTX25AlOghqG...
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dxandr_eb%26google_hm%3D%24%7BBASE64_UID_ENC%7D%26google_gid%3DCAESEHC8HWDCWcayD3VrUi1W7dc%26goo...
  • https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=ODk2MTkxMDk3MDY3NDkxMDg0OA%3D%3D&google_gid=CAESEHC8HWDCWcayD3VrUi1W7dc&google_cver=1&google_push=AXcoOmTX25AlOghqGWwUgnlvz0eOn5ZiEu...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=ODk2MTkxMDk3MDY3NDkxMDg0OA%3D%3D&google_gid=CAESEHC8HWDCWcayD3VrUi1W7dc&google_cver=1&google_push=AXcoOmTX25AlOghqGWwUgnlvz0eOn5ZiEuKwnk8a4JlacdiEY1m1MaD-F69od8gQmiug8DLpkrewKNWxZRKo4Jjv_bPKQF1OeCXD
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
an-x-request-uuid
2ff697c3-64e4-4132-8522-3d6f6710f043
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=ODk2MTkxMDk3MDY3NDkxMDg0OA%3D%3D&google_gid=CAESEHC8HWDCWcayD3VrUi1W7dc&google_cver=1&google_push=AXcoOmTX25AlOghqGWwUgnlvz0eOn5ZiEuKwnk8a4JlacdiEY1m1MaD-F69od8gQmiug8DLpkrewKNWxZRKo4Jjv_bPKQF1OeCXD
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame E6F2
Redirect Chain
  • https://analytics.pangle-ads.com/api/ad/union/gg_cookie_matching?google_gid=CAESEHXEdb-DMb_buHC-lgiVCMQ&google_cver=1&google_push=AXcoOmRC_NgynfCmOy_sgH01gD1pXzNF_kOZJkgXMXErWwVzIpG2mZhUigsozKlFCSa...
  • https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmRC_NgynfCmOy_sgH01gD1pXzNF_kOZJkgXMXErWwVzIpG2mZhUigsozKlFCSabvrlNeU4nWndokAwteY_IBK2aKzC_InYR
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmRC_NgynfCmOy_sgH01gD1pXzNF_kOZJkgXMXErWwVzIpG2mZhUigsozKlFCSabvrlNeU4nWndokAwteY_IBK2aKzC_InYR
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:48 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-akamai-request-id
511eab96.2faa942e
date
Fri, 01 Dec 2023 01:58:48 GMT
x-bytefaas-request-id
2023120101584822722DA5179B1EFB6E0A
x-tt-trace-tag
id=16;cdn-cache=miss;type=dyn
x-cache
TCP_MISS from a23-45-180-205.deploy.akamaitechnologies.com (AkamaiGHost/11.3.2-52183077) (-)
x-parent-response-time
13,23.45.180.205
server-timing
cdn-cache; desc=MISS, edge; dur=3, origin; dur=12, inner; dur=9
content-length
0
pragma
no-cache
server
nginx
x-tt-logid
2023120101584822722DA5179B1EFB6E0A
x-cache-remote
TCP_MISS from a23-58-124-21.deploy.akamaitechnologies.com (AkamaiGHost/11.3.2-52183077) (-)
access-control-max-age
86400
access-control-allow-methods
*
location
https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmRC_NgynfCmOy_sgH01gD1pXzNF_kOZJkgXMXErWwVzIpG2mZhUigsozKlFCSabvrlNeU4nWndokAwteY_IBK2aKzC_InYR
x-bytefaas-execution-duration
5.66
access-control-allow-origin
*
access-control-allow-credentials
true
x-gw-dst-psm
ad.union.pangle_web_traffic
x-tt-trace-host
01dab6e432c2d67003bdcd1749fd4f9e9b0e1c02741e5436dd5bac70993908f900706e4676c87ed6610ecaece975bbb694b76dc4f88450a01a694445568e062bb4ebd981a203426ff56d4088cc2bee751aceb2b17eff3707d0f40ecd3339f1dc6d5d5953b4546917f32c086fd5819bce8a
x-origin-response-time
12,23.58.124.21
cache-control
max-age=0, no-cache, no-store
access-control-allow-headers
*
expires
Fri, 01 Dec 2023 01:58:48 GMT
attr
cm.g.doubleclick.net/pixel/ Frame E6F2 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13INwzaScxi-uw_CCtiLatsBX8mY1rpejCUwxub9c_2oAjKdXjnnFU84LahAgNAM-hS6pMuBnVE
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
62bHydCX.html
tpc.googlesyndication.com/sodar/ Frame BED8 		38 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/62bHydCX.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
sffe /
Resource Hash
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
152037
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
br
content-length
13045
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 29 Nov 2023 07:44:44 GMT
expires
Thu, 28 Nov 2024 07:44:44 GMT
last-modified
Fri, 25 Aug 2023 23:48:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
62bHydCX.html
tpc.googlesyndication.com/sodar/ Frame 1F6B 		38 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/62bHydCX.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
sffe /
Resource Hash
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
152037
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
br
content-length
13045
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 29 Nov 2023 07:44:44 GMT
expires
Thu, 28 Nov 2024 07:44:44 GMT
last-modified
Fri, 25 Aug 2023 23:48:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
n_one_vway_bahia-principe-es_np.js
bucket.cdnwebcloud.com/ Frame 3297 		1 KB
976 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bucket.cdnwebcloud.com/n_one_vway_bahia-principe-es_np.js?n_o_nu=not&n_o_aut_tc=329167526&ord=3121343279
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.151.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-151-88.iad66.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
74130e91791cf3496d353724953e6466d3240ea308838a482dff16cd6c119aa0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 13:10:03 GMT
content-encoding
gzip
via
1.1 316ff1e97338bc9bbb335af58b00d0aa.cloudfront.net (CloudFront)
last-modified
Fri, 20 Dec 2019 13:03:10 GMT
server
AmazonS3
x-amz-cf-pop
IAD66-C2
age
46119
etag
W/"9748fb959a7ee41d8aebb52473ace3d2"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
l5dQaeMpU6f2vNV-YYRSqgwzqaBvUIRrneuhyq7P1jRVRB_MriUCrw==
index.html
s0.2mdn.net/sadbundle/16527439329884676748/ Frame 80D2 		212 KB
32 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
c65bb06b181f59165b6d9906e6dcd6ffc956d43cb39d7fdebb3b4005820abe2b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 01:58:41 GMT
expires
Sat, 30 Nov 2024 01:58:41 GMT
last-modified
Thu, 25 Nov 2021 15:48:57 GMT
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-xss-protection
0
view
ad.doubleclick.net/pcs/ Frame 3297 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/pcs/view?xai=AKAOjsuEjYn8AzuFggnha06KnwHmk_jqAu62u89b8AmN-cyZ7frgVWdGC4FbjcvNAUWBwdc8VlrBx78Ios3hLTey5c8NbYZxe4zodJ6JlB7fSfZfM5M50fOWK4CoKXMANS_VhLF9IFRcIJFroxwoTqRUK0zBifPOIV8ccm6aPpzi4idMTRjFvFVujjw7eASLQyAns95PsaPXtV85x-cWEjvoC-M2gQBySk3k87HgR97n7_L7tQezx1UI0OyycksZngJyFvXG6Jm494YiuRqxueTiUjpImvUc1h9sTSq-_wmSPaapVoXn4WvTfpP1IPR-TdU3uWSFV1jku6Nj-0DcN8dEnAVmx6SW9QbqXveBRidxbTKioeIyQzE541xGfhsOckqFUrcKdN6sW4rF9c5Gta0U_cv_o0HjR_whmHxXq8946kNKFgRbwT7M27_B3foBwTDFnSBM_MYL8npaOIz3u3VDBCjlHMod_dK2d-Q8-UG6advjCr09WNqhqQBK3Ih7OAyAIqbW4bG2q0g8CXH7d2cU-eWNbDAQutvidgBlG76GX-h2y4q3Q6EFH-We6hJeSJiyx2A6skaPsQHX8CnpHgt4TkgiBX0eecOvkjskGIc4xPEza-qZiUrgPgBWDDiSyolsO9dloiHV_Ki0obuELPoV5PfkAcAZljgenbULEIwtvPrhgEMXQi6bRghGfQOiP_Jo36XI985_0IT4vQi1b474AUgtyF6cccPMQSLdCNFAic7hTF-DX2l3tXZvT3fGoJZM4NXGag7DvUcWqeTfwqszR_1e_KohdDWEOEOkHpCp8S_h-qye43OP_uXUsopzzomu1tf9sCWwA746aLajpeCjv49hc0-L1Dy5Dx9D2TLFrSj1S_XK-5Jbh_sLaUuKmm5JTx4_oNnazF_PAswUrKbW4PnlVLA7UrJjP-pWgUocyNQa5PFH3VmCYJG3qbj4lL9u5jdM4A-dkWPkRtMRVeQZHCHndWqhoXCIebpqxKQBr0WD0sjUrz2tAa_FXv3C9cSRKrYO2QH0Tz_l8H5SfcKayStmmS74Txo2lfXobNtqDHWWIldkj7OBpO5ZsMDwjX_Eh4FGLwU1jb6A-Tj_F45_5CXRJzQh4ucpLv0pyhLn8R7fx0uvXb6o0JXgQN7SYQJqTiYlVRpm17eZnrwMQTCvE7IIz-_rnfgYRMHeZjVUga32iJmrNCOHrWhslP0NhGsjS9yZZDcOsKHXpbJUvtRK4nOXjTeCORccmcz_KtIJS-bnm5BonksJBmtpW9KPxBLABIVfRwqHcZDGGzNLfwDc4EEapdEmt1N9XSda5albm9t7MhZQe20uJfSOcz6e1S9CzGo02nRxr8c7Oc5545GzN54rW-fwWVn9NAwnm85rDKNT8Z2wHuDxzmPkLcDfCfzkF21JZ4TE0BjhIKKcBUHpIBhrbKCXuYaUVDI_5JR-9hG3jVb6uVWt_qa2r2dqvdkN5SHs6A40ABpwtBMXBLYHn9rlUymlrnTf&sai=AMfl-YQboJlWjKkevojvqCuZi5L8aVjbzeMTxW-iaWxvRHXyXlHjDtUeEUV6G4fJ8KT5q7O-mBWf_jClWlDLTfx57hrTRe3VrhirY6pZeqYMDzeWllfmdGcCEs_odOCVhHZArRHXYiko9t9tWiRD9cY6yHIAWeIYKblQkv-ak5vQqURPwvAyeP9qgY55ZRz1ltZG33ypEj5JtVSxA1Bo8BiJv07WHqZzmgpXrrbzRv-u9ZMXEImEv-9U9BqbSIuovmfbyV5VhJ3QKezdR9v1tPgpGG_N3s5U5ckstyGTvVEi5Gtw1AQ5YYZ9VXeOkPspzMaCJgqIZxjYwC15OMBiqxSy0YbdxBwS5wDAmkyeBeFXYRRaIAlL0mcV8-SUbwdeqBAnH4lF6bHPVW8bUWfE_G0j3hdPESoHOIl4JHUS8hTDXoCew_WY4LE&sig=Cg0ArKJSzMo9b3nO6QBCEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iYWhpYS1wcmluY2lwZS5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=219&cbvp=1&cstd=210&cisv=r20231129.83636&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.63.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f149.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy
script-src 'none'; object-src 'none'
date
Fri, 01 Dec 2023 01:58:41 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
content-type
image/gif
cache-control
private
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
index.html
s0.2mdn.net/sadbundle/16640302357973241815/ Frame 8867 		28 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/16640302357973241815/index.html?ev=01_250
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
2ef1cb1bb38376f511d26358f2fa6077b097d2af2596c6a294bc6748deca0c39
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
96960
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5232
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy
cross-origin
date
Wed, 29 Nov 2023 23:02:41 GMT
expires
Thu, 28 Nov 2024 23:02:41 GMT
last-modified
Mon, 13 Nov 2023 15:05:38 GMT
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-xss-protection
0
view
ad.doubleclick.net/pcs/ Frame ED73 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/pcs/view?xai=AKAOjssJLDwCkJfwLiGr2YI2hEkogjew6SiujIO81A72vvNoxQy8x3yf6ckXcrbCi_o6pBbMSsER3RcypiV7AVx_GBCj-KzuHq3p7ahw2jabE8bHX_lap3GaLeKrstxhgeTZt8PAEpn1AW_kRBm9fMHhP4ghARdtZ_NqnkiVP9AWM3Xxa6ghtt3bmB6vd018KU3AdigORWX80vI9sZzbFGj5oL4-b5-OZfVthbgjMPFWsC2DVGpygiifZ1OI0TXPy4zG9WEbCu6LvLooZy8M3EUkQXskUDkKQtccELP_y3zm6lDa0XE_MXFRBTOW857nN_IglPk1SnqhqQ0V-Qu3LYFjPbRqpKcALMwwd_KMe7g6f4ZxVKpMt49WpHXE3uURmjXEaqhIeFJxBFlQ1JkMty2mcgftXFGlDuWOj59B8-nbdU0xvRd98cN5S8as4mPzL_LQM8AIsi08vbmUeNwK8qOL7vy-20a0-MX48ArhCgb3xDwsQYMPsLE9M6LPCspxVT8dHyg7a77umj8PwkPyQamW6hZtGooJlRfeJ09g2xrPrnfXwA2kGRLql1B1sewBWPH-_aCsgrh9sa6vQ3dXMfeg48lRNwsprksmnICh0seqdwVlqYf75P25x320eVcCJ6J_jn5NA4BCaF4aYwkTWPldJZf00RzH6yoh0kmYReSDqK3DlgDAhsW4qbIeg4FiJgH-nu1m_pm_cyZQyb_YmRjNEaTkmIUE8qEuxdQZPVl9HMo7_Ex8pY7S8waZYC8nBvYcCB4C4fw1nbU7N1IhGXVzowfjEkHURx_M_TH0D-ZjaXPctCsR96d4crmBQ2O5uFSwXeo111x8A5e9y-I6VRl_HKbIH0BZfXOYWe6s5LKmBJ0lDWN0i3tAStKcNip2MqI3f3y7O4j8WDVyUL0XHx7bntr4N7nzewjrWdb1x4utWfQ4IhO7Lf7vyDhDEEnbLmjL43uBh8B9t3Lr2uRCtwus6C6J7g-C_zZSzGgnaUBOJZU8vFD7yIsIvawCHDbGh_RkHAmF-5gHcPYQtGAOwq6GM8H025ytOsWuwTUyOCbwyrI1-iTmMdIAT0dTGdTIWE4RqZNwRoY_RgxvyXJiI-bOQYyyLA2LkiJvUCzwYy3fjUv1TBVItpmQZHhKrq7FD0BZw0WcROve27maez80bPfroZtwGXayoQgqQUSN2GrKJnswOwo1cZnUW4ZLbumMs5APFCUxPMwL51Fkvk4LFfgc2enz8qXVT4LM_WmXb7DajB94tDIhwITbeSBSvvh8wYeMRtceWpm-bNycS_w1zYRjeG0HcXzFa2KPTB_aC6pKbYRD7utJOU7Sk-4r-cx9Yl-bYkswZ09aKuDtsH6eE4zCUqfzIurGHGLfjLmBv9EEodVojw7URfqhUiILqy30BjN_asMLP4Fx62QvfVIgDtINNns&sai=AMfl-YQC4WzK5VpCHckhI8h_k9ugmSaMnrxyVWAvcOK8k93X6s6PRa6N3EazJi1RO1_Cl4TOhIjYRb21xc41hk7VXXzAwAqdaBb-zcxB7qATgmBYb7nX5shMohmUmIpPS-ul93jdW-2dNNFqqWIl5cHoHJ2wPRpstE34154GhWnWDkGgQVvrYcmHbYbkwNzP5SSIZsh9LUwHDkx2cdcbHjp7_UZgbRG34QuwqBiSfUT9kpzbws08LJmlqyY5oSkm5onY2-I06rEHVFG0Ui3Ooo4HVlS-Ya7dj432iXN5vgwB8NdqOZTcc5EukxW4fRCoJ_1louZYbSFiZyduqmD5M4lr3FL8EzpBf2SpIdu2UrO57c37BmVWqjVf7rlBc8BkzJjACAvXGmWOoGkWaYnqxzKWi6_5sKU2nj441FlmmO-EpveboGM&sig=Cg0ArKJSzBGgojPHkcvgEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iaXRkZWZlbmRlci5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=239&cbvp=1&cstd=236&cisv=r20231129.63422&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.63.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f149.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy
script-src 'none'; object-src 'none'
date
Fri, 01 Dec 2023 01:58:41 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
content-type
image/gif
cache-control
private
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
pagead2.googlesyndication.com/bg/ Frame BED8 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
sffe /
Resource Hash
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 00:33:55 GMT
content-encoding
br
x-content-type-options
nosniff
age
5086
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15165
x-xss-protection
0
last-modified
Tue, 28 Nov 2023 18:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 30 Nov 2024 00:33:55 GMT
container.html
c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame BD09 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.62.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f132.1e100.net
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 01:58:41 GMT
expires
Sat, 30 Nov 2024 01:58:41 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
army.gif
g.ezoic.net/porpoiseant/ 		0
63 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTg5MTQ4NTcwNzYzMTg3MyIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc1NDAyMzE5LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjIifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE4OTE0ODU3MDc2MzE4NzMiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NTQwMjMxOSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjQ1NDQ5ZWUyZDY1MzMwNDVmNjAzNTFjOTQxMDdiYThlLDc0MzIzNjAzMDE0MDlhZTY5NWJhMjU1ZjE2ZmJjZjA2In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxODkxNDg1NzA3NjMxODczIiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicmV2ZW51ZSI6MC4wMDAyLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDIsInN0YXRfc291cmNlX2lkIjozNSwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzU0MDIzMTksImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxODkxNDg1NzA3NjMxODczIiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzU0MDIzMTksImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODI0MTEyMzUxNyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTg5MTQ4NTcwNzYzMTg3MyIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc1NDAyMzE5LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiI0OTc1NDAyMzE5In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:43 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:43 GMT
4975402319
go.ezodn.com/dac/ 		0
562 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/dac/4975402319
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-3&bv=280&PageSpeed=off
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
170
alt-svc
h3=":443"; ma=86400
content-length
0
last-modified
Fri, 01 Dec 2023 00:45:10 GMT
server
cloudflare
access-control-max-age
1728000
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.mediafire.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AsM4SzcumXCphEWcsJbxVPr7rcLvKGiYXqfxZX0%2FSVwkCflSsAFuzOJQ1EWDa1jvU734atCsqd12v1hSBDotjn6TxiN51XCzulJhj2ecDpg4bQX%2B4wh1Vm0E30Slsew%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=14400
access-control-allow-credentials
true
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges
bytes
cf-ray
82e7b9fcea0b4379-EWR
access-control-allow-headers
Content-Type
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTg5MTQ4NTcwNzYzMTg3MyIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc1NDAyMzE5LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMy0xMS0zMCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjE3In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjQifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiNDgwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:41 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:41 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTg5MTQ4NTcwNzYzMTg3MyIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsImF1Y3Rpb25fZXBvY2giOjE3MDEzOTU5MjEsImFkX3Bvc2l0aW9uIjoxMTA0LCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiYmlkX2Zsb29yX2luaXRpYWwiOjM4LCJiaWRfZmxvb3JfcHJldiI6MzgsImJpZF9mbG9vcl9maWxsZWQiOjIwLCJhdWN0aW9uX2NvdW50IjoyLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo1NzIsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjIxNzMyMTE4OTE0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjQ5NzU0MDIzMTl9XQ==
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:41 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:41 GMT
a60923bbda08a39de3899dc6e900156f.js
s0.2mdn.net/sadbundle/16640302357973241815/ Frame 8867 		130 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/16640302357973241815/a60923bbda08a39de3899dc6e900156f.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16640302357973241815/index.html?ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
95b6520c97d4d4becbd22b3debb53342de4dc99284af87a03bd1d54dc9bf5e62
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16640302357973241815/index.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Tue, 28 Nov 2023 08:56:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
234126
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
38349
x-xss-protection
0
last-modified
Mon, 13 Nov 2023 15:05:38 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Wed, 27 Nov 2024 08:56:35 GMT
Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
pagead2.googlesyndication.com/bg/ Frame 1F6B 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
sffe /
Resource Hash
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 00:33:55 GMT
content-encoding
br
x-content-type-options
nosniff
age
5086
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15165
x-xss-protection
0
last-modified
Tue, 28 Nov 2023 18:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 30 Nov 2024 00:33:55 GMT
Enabler_01_247.js
s0.2mdn.net/879366/ Frame 80D2 		118 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/Enabler_01_247.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 02:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
83037
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
41099
x-xss-protection
0
last-modified
Mon, 27 Sep 2021 18:45:07 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 01 Dec 2023 02:54:44 GMT
noah.min.js
bucket.cdnwebcloud.com/ Frame 3297 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bucket.cdnwebcloud.com/noah.min.js?1701395921472
Requested by
Host: bucket.cdnwebcloud.com
URL: https://bucket.cdnwebcloud.com/n_one_vway_bahia-principe-es_np.js?n_o_nu=not&n_o_aut_tc=329167526&ord=3121343279
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.151.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-151-88.iad66.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3949bc357609db6e9bc5796a30a25a1865ba837e2cada69a1832b03e0814a51d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 14:51:51 GMT
content-encoding
gzip
via
1.1 316ff1e97338bc9bbb335af58b00d0aa.cloudfront.net (CloudFront)
last-modified
Mon, 04 Sep 2023 14:02:49 GMT
server
AmazonS3
x-amz-cf-pop
IAD66-C2
age
40011
x-amz-server-side-encryption
AES256
etag
W/"3c5a63b88b693279fc4d9dcff91d29c1"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
u13NW2UQXeTn9d5kssL7W-nQiw6aa2tIrDra9ZBqCKjb6r-j_NveLw==
pixel
googleads.g.doubleclick.net/xbbe/ Frame 579F 		503 B
221 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CNPh9QIQ_uHy8QEY6LjqwgEwAQ&v=APEucNXlvOpkQMTQN_o3VURS1QhMwfP1b_7GFwuDGB5oYupci1Yuf6YxAU6vmHpTv46WIazyrqjQLFcun7V5ieBkmjpbNJyj6b21B-LQrjxyoGS-zwh-xRA
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
cafe /
Resource Hash
58644b7dfa826a3291e2e5d6c2974b47906616e1aa03a2f757fdd1bde7796621
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-encoding
br
content-length
198
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 01:58:41 GMT
expires
Fri, 01 Dec 2023 01:58:41 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
html_inpage_rendering_lib_200_278.js
s0.2mdn.net/879366/ Frame BD09 		172 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Origin
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 20:53:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
18298
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
61485
x-xss-protection
0
last-modified
Tue, 14 Mar 2023 18:43:57 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 01 Dec 2023 20:53:43 GMT
omrhp_fy2021.js
pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/elements/html/ Frame BD09 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/elements/html/omrhp_fy2021.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 22:35:25 GMT
content-encoding
br
x-content-type-options
nosniff
age
12196
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3071
x-xss-protection
0
server
cafe
etag
10674441169935035545
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 22:35:25 GMT
abg_lite_fy2021.js
pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/ Frame BD09 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/abg_lite_fy2021.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
b67ad968ba3668562f331df45b73501e17c7c166bcf7e5443c33633cbc9d5783
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 18:42:45 GMT
content-encoding
br
x-content-type-options
nosniff
age
26156
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9305
x-xss-protection
0
server
cafe
etag
13635642240219548939
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 18:42:45 GMT
Q12zgMmT.js
tpc.googlesyndication.com/sodar/ Frame BD09 		41 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Q12zgMmT.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
sffe /
Resource Hash
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 09:08:53 GMT
content-encoding
br
x-content-type-options
nosniff
age
146988
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13937
x-xss-protection
0
last-modified
Fri, 25 Aug 2023 23:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2024 09:08:53 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame BD09 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/window_focus_fy2021.js
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 19:53:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
21895
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 19:53:46 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 6001 		1 KB
643 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
76983
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=86400
content-encoding
br
content-length
618
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 30 Nov 2023 04:35:38 GMT
etag
48472445140208031
expires
Fri, 01 Dec 2023 04:35:38 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame BD09 		20 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
cafe /
Resource Hash
09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 19:53:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
21895
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8544
x-xss-protection
0
server
cafe
etag
17124069415086231762
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 19:53:46 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame BD09 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cni_IlS3XgE-ZDHPEvaLXnexyIwQXILYdlFCcxIXIRFFaAfSWuT0TAbb2x3Q4CLDSP3ODY9OqsO59yhp29NUvrUAAXvesVeAo1RqK6B5B3LL4MWu0
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ufs_web_display.js
www.googletagservices.com/activeview/js/current/ Frame BD09 		202 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
sffe /
Resource Hash
1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
65067
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1701261208926228"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 01 Dec 2023 01:58:41 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		389 B
167 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3378551494251738&correlator=881016588021370&eid=31079808%2C44807689%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=21732118914%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=12&didk=2994425013&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3D8ed23798d17fef2e%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_MYa84XzsqA-d-Y6sn06Y8FEKt-Mkw&gpic=UID%3D00000da4eba87dbb%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_MYNqbDdY9cfK7DMkmU6DodsZiNUzA&abxe=1&dt=1701395921531&lmt=1701395921&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&vis=1&aee=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1675868932.1701395917&ga_sid=1701395919&ga_hid=846692808&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABj50uWYwjFIABIZCgpwdWJjaWQub3JnGLXq5ZjCMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj80eWYwjFIAFICCGQSFwoIcnRiaG91c2UY9tzlmMIxSABSAghqEhkKCnVpZGFwaS5jb20Y_NHlmMIxSABSAghkEj4KBW9wZW54EixleUpwSWpvaVFXTmFhRFpLVlROU0x6SkxiMWRrZVVkWFUyTnpVVDA5SW4wPRji6-WYwjFIABIbCgxpZDUtc3luYy5jb20Y19nlmMIxSABSAghq&dlt=1701395915992&idt=906&prev_scp=a%3D%257C0%257C%26iid1%3D3084741803591765%26eid%3D3084741803591765%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D5302779%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Dmediafire_com-edge-2-3084741803591765%26eb_br%3Dfc44e27e7de5f52a5f3c42d1877542d7%2Cfe5b0c99ab7ba15f050582be1301303f%26eba%3D1%26ebss%3D10061%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D38%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D46%26br2%3D44%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C6293%2C6294%2C6295%2C5136%2C774%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C835%2C2693%2C3045%2C4276%26hb_bidder%3Dadtelligent%26hb_adid%3D92c4bfff7e5b226%26hb_format%3Dbanner%26hb_ssid%3D11316%26hb_opt%3D0.11%26hb_rt%3Dclient%26lb%3D90%26reqt%3D1701395921515&adks=1509549554&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
52ba10a405c7340216d2843e2ea9a5641748ac3dca01c50b4188c3496d68c0f5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
137
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
sync
partners.tremorhub.com/ Frame 579F
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm&gdpr=0
  • https://partners.tremorhub.com/sync?UIGL=CAESELFKsejX6-h0T00tlEERUU4&google_cver=1&gdpr=0
43 B
175 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://partners.tremorhub.com/sync?UIGL=CAESELFKsejX6-h0T00tlEERUU4&google_cver=1&gdpr=0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNPh9QIQ_uHy8QEY6LjqwgEwAQ&v=APEucNXlvOpkQMTQN_o3VURS1QhMwfP1b_7GFwuDGB5oYupci1Yuf6YxAU6vmHpTv46WIazyrqjQLFcun7V5ieBkmjpbNJyj6b21B-LQrjxyoGS-zwh-xRA
Protocol
H2
Server
34.196.127.236 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-127-236.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date
Fri, 01 Dec 2023 01:58:41 GMT
server
nginx
content-type
image/gif

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://partners.tremorhub.com/sync?UIGL=CAESELFKsejX6-h0T00tlEERUU4&google_cver=1&gdpr=0
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
294
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
partner
sync.search.spotxchange.com/ Frame 579F
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm&gdpr=0
  • https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&uid=CAESEJN68q_Bm143upm1uztSI0k&google_cver=1
0
0
partner
sync.search.spotxchange.com/ Frame 579F 		0
0
css
fonts.googleapis.com/ Frame 8867 		4 KB
902 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=IBM+Plex+Sans:600|IBM+Plex+Sans:700
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16640302357973241815/a60923bbda08a39de3899dc6e900156f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f95.1e100.net
Software
ESF /
Resource Hash
892e60dbfc3ed039098df6041eae6e7ecc9401632e6692e709067f9dd8a8b7fa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 01 Dec 2023 01:58:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 01 Dec 2023 01:30:14 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 01 Dec 2023 01:58:41 GMT
732e6b6c27a20285e7b8e3ff8714511a.png
s0.2mdn.net/sadbundle/16640302357973241815/media/ Frame 8867 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/16640302357973241815/media/732e6b6c27a20285e7b8e3ff8714511a.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16640302357973241815/index.html?ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
0aa1be81fda06de2efd9639b18bd2580f814320b13ccbef13a8d1c30f5ee3d4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16640302357973241815/index.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 09:35:18 GMT
x-content-type-options
nosniff
age
59003
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4840
x-xss-protection
0
last-modified
Mon, 13 Nov 2023 15:05:38 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 09:35:18 GMT
14a5357efe026c52e8c22f698ff46157.png
s0.2mdn.net/sadbundle/16640302357973241815/media/ Frame 8867 		794 B
821 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/16640302357973241815/media/14a5357efe026c52e8c22f698ff46157.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16640302357973241815/index.html?ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
5bce27ce4b302cea70cf511c73d44c7dd0e38aa5b4744101662253be55946b31
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16640302357973241815/index.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 18:46:48 GMT
x-content-type-options
nosniff
age
25913
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
794
x-xss-protection
0
last-modified
Mon, 13 Nov 2023 15:05:38 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 18:46:48 GMT
c16184f967ef0aa68e4960402d920774.png
s0.2mdn.net/sadbundle/16640302357973241815/media/ Frame 8867 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/16640302357973241815/media/c16184f967ef0aa68e4960402d920774.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16640302357973241815/index.html?ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
98fd2b5a818cc924222ce20be58a36e91f730654b487c484f3c524894411e4a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16640302357973241815/index.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 23:02:42 GMT
x-content-type-options
nosniff
age
96959
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9705
x-xss-protection
0
last-modified
Mon, 13 Nov 2023 15:05:38 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 28 Nov 2024 23:02:42 GMT
Gotham-Bold.otf
s0.2mdn.net/sadbundle/16527439329884676748/ Frame 80D2 		154 KB
69 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/16527439329884676748/Gotham-Bold.otf
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
183be4309aa229c11d790bb79b82a6a181a3f76cd009635a145a9d65c9c80766
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
Origin
https://s0.2mdn.net
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 11:16:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
52946
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
70565
x-xss-protection
0
last-modified
Thu, 25 Nov 2021 15:48:57 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
font/otf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 11:16:15 GMT
Gotham-Medium.otf
s0.2mdn.net/sadbundle/16527439329884676748/ Frame 80D2 		126 KB
59 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/16527439329884676748/Gotham-Medium.otf
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
e8183507b37f3df80ea253b144745ed58784f5b4465b5216fbf9e314df592d06
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
Origin
https://s0.2mdn.net
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 11:16:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
52946
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
60432
x-xss-protection
0
last-modified
Thu, 25 Nov 2021 15:48:57 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
font/otf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 11:16:15 GMT
62bHydCX.html
tpc.googlesyndication.com/sodar/ Frame 37B4 		38 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/62bHydCX.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
sffe /
Resource Hash
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
152037
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
br
content-length
13045
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 29 Nov 2023 07:44:44 GMT
expires
Thu, 28 Nov 2024 07:44:44 GMT
last-modified
Fri, 25 Aug 2023 23:48:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
n_one_vway_bahia-principe-es_np.js
bucket.cdnwebcloud.com/ Frame BD09 		1 KB
976 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bucket.cdnwebcloud.com/n_one_vway_bahia-principe-es_np.js?n_o_nu=not&n_o_aut_tc=329167526&ord=333506464
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.151.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-151-88.iad66.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
74130e91791cf3496d353724953e6466d3240ea308838a482dff16cd6c119aa0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 13:10:03 GMT
content-encoding
gzip
via
1.1 316ff1e97338bc9bbb335af58b00d0aa.cloudfront.net (CloudFront)
last-modified
Fri, 20 Dec 2019 13:03:10 GMT
server
AmazonS3
x-amz-cf-pop
IAD66-C2
age
46119
etag
W/"9748fb959a7ee41d8aebb52473ace3d2"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
f3N5WJ3M_t7-dQwJMB2JdXEPMvwln1N2DOhOUQZwVhLNvVugBSUo2Q==
index.html
s0.2mdn.net/sadbundle/16527439329884676748/ Frame 4CFB 		212 KB
32 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=8O1s7uYT4p&t=1&renderingType=2&ev=01_250
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
c65bb06b181f59165b6d9906e6dcd6ffc956d43cb39d7fdebb3b4005820abe2b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 01:58:41 GMT
expires
Sat, 30 Nov 2024 01:58:41 GMT
last-modified
Thu, 25 Nov 2021 15:48:57 GMT
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-xss-protection
0
view
ad.doubleclick.net/pcs/ Frame BD09 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/pcs/view?xai=AKAOjstzPKe6jQ80v3D38zoyividFjXz4EF0DYXWdgHSIqcvt9lcFX7Fy0d_8p6F4i7K6LjbRkmCmHouHLozzTcUkjHdDALUyQVTPFH0hf7GfwsA-ddEwjDoY0hgMr1A65H-gK-evc4LabpJrRa1iLzOkwWkqEy2kgW0mM3Nr-L5hf0QsnE7s1sarnoJRc3JSauDrW1KoQUWD-uIts4gM43wqbnPELXnojmmQGyVxhOfsDnjyzubPx7jNC0W2SQfqtPgbokWU2BZ7cZeGjpVn-R5DbhcyejsAKu5B-PQIp0Llx77gD4xy_e--NXLvJXvluhJEQs03DowBd2mVXYzg7g0N_gTaAPogBi-B1dmxPvX7bViGvHQwzJ8juH3tBzW_bX7uMqKTA9xgEtz3uZg4Lk48LBC5l4eDWkf80eYjjePFt7ll965nAnATBSr8q3AWZEzCB1nRis-vRn1ZdEz7YYqhPohoCE4ES7OfaCrvfBah4KwRloHWYTNk1HAweqM1BLBiqlUDspBAam7UP9z6oDVRgq9Hw-f4yBEIKsOfhx-YOUjuhB5Uk8GrNnbjcmyXuJXwBe95S9KjxdxTIE__DnCTrmRlrNkD1AjfOZxwLC8VsvK8JW742-0JoMWIzsNXBZUl0vLh-sfhkUFjzAwLy4yeH9N16DudmIGO-wcIZgQRT6heRJYFADwckYiqpvROAKVwXL3ElhTGthcLtEKnscTJ0CbTseitx6pe0sPyoxdRL66ZwKwcvm9BjV0BmfsutTbDVMSvcNJ5e_BeCLaedl6LKVP_YDrD3jb0lcuQtzhXnqoCYXJ9htAJv_GkuRxwhtjp-5pCAZ4_qYxhJkCEFKp1MFLuwRZM-SOurFfT4tHYZ48X8plJt4yAgzXvmLN9F9Eq3pXBxSZhQM34whMap7hRwNoN_aDkiWGELR_DntrpAnQanKHq8bff7QbInNsi2HxW869yoE_SsR6jWznk5oQupSHz2yB03lOp7RschpRk_s7cz1ncF1aZDM41gpdcfUY4OWYZQcgX0P5_-m-Pa3jcsvCBARdPYC93wHo8mP8o9hwMXtoErVKOZ7Z3dP2sK0ZajuaanIpRMoPapP9BmY4QVgSCmN0ph2uwrqxWu5J_P2HMwNi0WyAT89gZKPeGnXIigwO89lD0WbRnYkkousLiQ4TbtcIr7BEx2SHfl7wNk2iqxru4mj4w67OLNH_YVm3DJM-FEo_yNiIh7hLB3Maw6_YpDDfgTR9XGs7W5AH_T0W7GXLKglheaGyYJtw3ZT2XRf_nfxsu5A4ywF6tQWP7eS1XVa1YcwfpsSuYteqdSt7PMxEFCWbwuUgpEK5LxFFTwpefXIO6vrT2-q3z0GTjyBAJBzMDH7a5NBvGfDhI7D0H3R2FipVtDNputOHQK_p5Ri5exFxQqM4BXpBM_Ekfqh8vIFpl-xaZn1zASHjfMSFHmzlpK6fQoV4lYDYSIkj7xArOciYcP1UodI&sai=AMfl-YSsb81Z_tsbW84tcstDL7QbCo9zDQ3IT3OevgcFCF_5iMjGVzV2GXODDOKRMYgt0RO9PNQBA3v1Wq-CxlPOrVQTCGrKNtM8ASV7y4xq7UyMmJMsHl-VKTPIR2oxitfN-yDWTncAaPhV0N9Yee0qNughMkBbIP5Ufi2B04FkPa69lQeCyxALxcWTLfNmdida-8jFyGirNXmLhc-IMwdxdt1JFjzo6MzxqWwTsyd0s4JDhIu1aUx834jphtxagIUM398bNZMwis7y305rhMEK_cGJ_xaQLEbpVjGoUj3i6IVqqY4_2s62Nm9vU9LgMc_duIZ6epDBDN59WyZ1psbIg8XC7e-OZr0U8-oKHtsfd9Bhpq93lRWCq8Yga1CCiYi6Z7dbnZ4ZDMitVPorKTn1ke1O9T5B0MgQHwKhNs6tvk3g7-HBwaAOKww&sig=Cg0ArKJSzBBLHtSv1SjKEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iYWhpYS1wcmluY2lwZS5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=138&cbvp=1&cstd=131&cisv=r20231129.17723&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f149.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy
script-src 'none'; object-src 'none'
date
Fri, 01 Dec 2023 01:58:41 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
content-type
image/gif
cache-control
private
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
truncated
/ Frame BD09 		213 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e80f1f484b9bcfc06df1b6b984b0f3304338338d5c8bc8f85807c682660e9605

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/png
pixel
cm.g.doubleclick.net/ Frame 6001
Redirect Chain
  • https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESELT3iw-GH3Mlw4R88PLsGRM&google_cver=1&google_push=AXcoOmTnhVLEpdL3S3Ba-SVV6xCgIV4HONVaVYBILGlGovX8bPUEvsm...
  • https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=65cd523349ed1230&is_secure=true&networkId=14000&version=1&google_gid=CAESELT3iw-GH3Mlw4R88PLsGRM&google_cver=1&google_push=AXcoOmTnhVLE...
  • https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAHHduNO7ivsQMzOZJhAAAAAAA&expiration=1701482321&google_cver=1&is_secure=true&google_gid=CAESELT3iw-GH3Mlw4R88PLsG...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAHHduNO7ivsQMzOZJhAAAAAAA&expiration=1701482321&google_cver=1&is_secure=true&google_gid=CAESELT3iw-GH3Mlw4R88PLsGRM&google_push=AXcoOmTnhVLEpdL3S3Ba-SVV6xCgIV4HONVaVYBILGlGovX8bPUEvsmVHhurBKRp8FDLCoJQFmQNKyuBbP52NMa-XCtRsD0seg4
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAHHduNO7ivsQMzOZJhAAAAAAA&expiration=1701482321&google_cver=1&is_secure=true&google_gid=CAESELT3iw-GH3Mlw4R88PLsGRM&google_push=AXcoOmTnhVLEpdL3S3Ba-SVV6xCgIV4HONVaVYBILGlGovX8bPUEvsmVHhurBKRp8FDLCoJQFmQNKyuBbP52NMa-XCtRsD0seg4
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
CookieSyncAdX
rtb.adentifi.com/ Frame 6001 		0
285 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESEKntkhkm4jhUfAtGYm45C0o&google_cver=1&google_push=AXcoOmQsZzEjCslJc5yD4N3SMGUqcxuPRPzNrijFWk1KsLsFWFOWIHrOGtASLgWGEOsfax1-c7rHQ2kMc42O4ZUYTeNCu4aPFes7
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.54.71.185 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-54-71-185.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:42 GMT
usersync.aspx
server.cpmstar.com/ Frame 6001
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEC0MqaNJWOFQe9MUzdQtH8A&google_cver=1&google_push=AXcoOmQTgIi2sD_DCOdYOSTNbXFi8AOslmIcXdMEC4OjrnUe3_Jzkms219QkxPdTDfL0iVA0P2zWOk4USeCX-Oo2YvJF...
  • https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEC0MqaNJWOFQe9MUzdQtH8A&google_cver=1&google_push=AXcoOmQTgIi2sD_DCOdYOSTNbXFi8AOslmIcXdMEC4OjrnUe3_Jzkms219QkxPdTDfL0iVA0P2zWOk4USeCX-O...
  • https://server.cpmstar.com/usersync.aspx?bsw_custom_parameter=a4aa8fa7-9617-489f-a8fd-b4612be68449&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%26ssp...
0
0
pixel
cm.g.doubleclick.net/ Frame 6001
Redirect Chain
  • https://s.uuidksinc.net/match/47/?remote_uid=CAESEK596AFpYLNqQN2M0TAlIKc&c_param1=AXcoOmSXnyvwRWucvDa2qsQN-GlCY-QeaofCyC51YKKBH4HGweqJBjzwwjhaZYGjVxSQ9ow-JqH1NlOMpwrHUOQsReBBM6m7s_Vr&gdpr=%%GDPR%%&...
  • https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmSXnyvwRWucvDa2qsQN-GlCY-QeaofCyC51YKKBH4HGweqJBjzwwjhaZYGjVxSQ9ow-JqH1NlOMpwrHUOQsReBBM6m7s_Vr
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmSXnyvwRWucvDa2qsQN-GlCY-QeaofCyC51YKKBH4HGweqJBjzwwjhaZYGjVxSQ9ow-JqH1NlOMpwrHUOQsReBBM6m7s_Vr
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmSXnyvwRWucvDa2qsQN-GlCY-QeaofCyC51YKKBH4HGweqJBjzwwjhaZYGjVxSQ9ow-JqH1NlOMpwrHUOQsReBBM6m7s_Vr
date
Fri, 01 Dec 2023 01:58:43 GMT
server
nginx/1.23.2
content-length
0
pixel
cm.g.doubleclick.net/ Frame 6001
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESENIYEwgeHHWG-aMYTsCt0B4&google_cver=1&google_push=AXcoOmQlm91gEvJpUcNsqEanJ3RNExK9jxdYV7Ql2hlL8KFMH3-IymAePMyIDLn4XjG0dwXQJrTGQzUUOhMsnL1...
  • https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=GnXLSWpRUlpUMgCssutHlbnVUKQ&google_push=AXcoOmQlm91gEvJpUcNsqEanJ3RNExK9jxdYV7Ql2hlL8KFMH3-IymAePMyIDLn4XjG0dwXQJrTGQzUUOhMsnL...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=GnXLSWpRUlpUMgCssutHlbnVUKQ&google_push=AXcoOmQlm91gEvJpUcNsqEanJ3RNExK9jxdYV7Ql2hlL8KFMH3-IymAePMyIDLn4XjG0dwXQJrTGQzUUOhMsnL1LtqYjGBPZd-zw
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=GnXLSWpRUlpUMgCssutHlbnVUKQ&google_push=AXcoOmQlm91gEvJpUcNsqEanJ3RNExK9jxdYV7Ql2hlL8KFMH3-IymAePMyIDLn4XjG0dwXQJrTGQzUUOhMsnL1LtqYjGBPZd-zw
Date
Fri, 01 Dec 2023 01:58:42 GMT
Connection
keep-alive
Content-Length
242
Content-Type
text/html; charset=utf-8
pixel
cm.g.doubleclick.net/ Frame 6001
Redirect Chain
  • https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEOpiMJLJp_KuF6gU5UVeqEM&google_cver=1&google_push=AXcoOmSKp5nlvDALTz7gZDHIcKTrs8gQp-5UZgmTaWONzhtzCbbr_Gtr01KopQnN-GEQH37ZocQ3A0dqBrg5...
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSKp5nlvDALTz7gZDHIcKTrs8gQp-5UZgmTaWONzhtzCbbr_Gtr01KopQnN-GEQH37ZocQ3A0dqBrg57cUQCKt18Yt3j2yf
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSKp5nlvDALTz7gZDHIcKTrs8gQp-5UZgmTaWONzhtzCbbr_Gtr01KopQnN-GEQH37ZocQ3A0dqBrg57cUQCKt18Yt3j2yf
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSKp5nlvDALTz7gZDHIcKTrs8gQp-5UZgmTaWONzhtzCbbr_Gtr01KopQnN-GEQH37ZocQ3A0dqBrg57cUQCKt18Yt3j2yf
strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
pixel
cm.g.doubleclick.net/ Frame 6001
Redirect Chain
  • https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESECoXUKp0P-orFYDQk_lnj8M&google_cver=1&google_push=AXcoOmRIerYAFXINskYJFMU_i6UBFePQHiJ6-n9TUoFTHsq2gfD1VF8KPWwe8swr7ifxKIPOU0TAtSXTZH7xewFpD...
  • https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESECoXUKp0P-orFYDQk_lnj8M&google_cver=1&google_push=AXcoOmRIerYAFXINskYJFMU_i6UBFePQHiJ6-n9TUoFTHsq2gfD1VF8KPWwe8swr7ifxKIPOU0TAtSXTZH7xewFpD...
  • https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=MWIxNzhjNWMxYjY1ODJiMw&google_push=AXcoOmRIerYAFXINskYJFMU_i6UBFePQHiJ6-n9TUoFTHsq2gfD1VF8KPWwe8swr7ifxKIPOU0TAtSXTZH7xewFpD-D8-3IA...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=MWIxNzhjNWMxYjY1ODJiMw&google_push=AXcoOmRIerYAFXINskYJFMU_i6UBFePQHiJ6-n9TUoFTHsq2gfD1VF8KPWwe8swr7ifxKIPOU0TAtSXTZH7xewFpD-D8-3IAYey5Iw
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:44 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=MWIxNzhjNWMxYjY1ODJiMw&google_push=AXcoOmRIerYAFXINskYJFMU_i6UBFePQHiJ6-n9TUoFTHsq2gfD1VF8KPWwe8swr7ifxKIPOU0TAtSXTZH7xewFpD-D8-3IAYey5Iw
date
Fri, 01 Dec 2023 01:58:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
server
nginx
content-length
0
attr
cm.g.doubleclick.net/pixel/ Frame 6001 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LEAwAdnO--qPEGqWwUgK_pLe-TtI66E0jNQyhZORecLID0Oz5BTvU9Qp7XZ0rRNyRPl7d6ug
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
atp
neural40.cdnwebcloud.com/ Frame 3297 		74 B
322 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://neural40.cdnwebcloud.com/atp?768400754660=&n_o_aut_tc=329167526&nonhm=true&gdpr_consent=CMP_NOT_FOUND
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.50.63.24 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-50-63-24.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
01b58ddb2f86a768f91751b62f25395417f6cf526191a4aefc1ebe4f8beacdcb

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 01 Dec 2023 01:58:42 GMT
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
74
content-type
image/png
zYX9KVElMYYaJe8bpLHnCwDKjQ76AIFsdA.woff2
fonts.gstatic.com/s/ibmplexsans/v19/ Frame 8867 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v19/zYX9KVElMYYaJe8bpLHnCwDKjQ76AIFsdA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:600|IBM+Plex+Sans:700
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f94.1e100.net
Software
sffe /
Resource Hash
31535a91ce3f6b8ed3ddedadab1e49957e2220263a640df1a3f14f6fdfe15eb6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://s0.2mdn.net
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 03:17:20 GMT
x-content-type-options
nosniff
age
81681
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20356
x-xss-protection
0
last-modified
Tue, 02 May 2023 16:19:23 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 29 Nov 2024 03:17:20 GMT
zYX9KVElMYYaJe8bpLHnCwDKjWr7AIFsdA.woff2
fonts.gstatic.com/s/ibmplexsans/v19/ Frame 8867 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v19/zYX9KVElMYYaJe8bpLHnCwDKjWr7AIFsdA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:600|IBM+Plex+Sans:700
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f94.1e100.net
Software
sffe /
Resource Hash
fff71a83690454ee6ea9014780a6797408918cb90cde1f0f3be65ea28a03c678
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://s0.2mdn.net
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 02:48:05 GMT
x-content-type-options
nosniff
age
83436
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
19440
x-xss-protection
0
last-modified
Tue, 02 May 2023 16:08:34 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 29 Nov 2024 02:48:05 GMT
Enabler_01_247.js
s0.2mdn.net/879366/ Frame 4CFB 		118 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/Enabler_01_247.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=8O1s7uYT4p&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=8O1s7uYT4p&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 02:54:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
83037
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
41099
x-xss-protection
0
last-modified
Mon, 27 Sep 2021 18:45:07 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 01 Dec 2023 02:54:44 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame 80D2 		8 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
f96f99241bb1bafb3576ff45090979daf6b57da0e74f27e58d853e8bff989e4c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
5906
x-xss-protection
0
view
ad.doubleclick.net/pcs/ Frame 3297 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/pcs/view?xai=AKAOjsuEjYn8AzuFggnha06KnwHmk_jqAu62u89b8AmN-cyZ7frgVWdGC4FbjcvNAUWBwdc8VlrBx78Ios3hLTey5c8NbYZxe4zodJ6JlB7fSfZfM5M50fOWK4CoKXMANS_VhLF9IFRcIJFroxwoTqRUK0zBifPOIV8ccm6aPpzi4idMTRjFvFVujjw7eASLQyAns95PsaPXtV85x-cWEjvoC-M2gQBySk3k87HgR97n7_L7tQezx1UI0OyycksZngJyFvXG6Jm494YiuRqxueTiUjpImvUc1h9sTSq-_wmSPaapVoXn4WvTfpP1IPR-TdU3uWSFV1jku6Nj-0DcN8dEnAVmx6SW9QbqXveBRidxbTKioeIyQzE541xGfhsOckqFUrcKdN6sW4rF9c5Gta0U_cv_o0HjR_whmHxXq8946kNKFgRbwT7M27_B3foBwTDFnSBM_MYL8npaOIz3u3VDBCjlHMod_dK2d-Q8-UG6advjCr09WNqhqQBK3Ih7OAyAIqbW4bG2q0g8CXH7d2cU-eWNbDAQutvidgBlG76GX-h2y4q3Q6EFH-We6hJeSJiyx2A6skaPsQHX8CnpHgt4TkgiBX0eecOvkjskGIc4xPEza-qZiUrgPgBWDDiSyolsO9dloiHV_Ki0obuELPoV5PfkAcAZljgenbULEIwtvPrhgEMXQi6bRghGfQOiP_Jo36XI985_0IT4vQi1b474AUgtyF6cccPMQSLdCNFAic7hTF-DX2l3tXZvT3fGoJZM4NXGag7DvUcWqeTfwqszR_1e_KohdDWEOEOkHpCp8S_h-qye43OP_uXUsopzzomu1tf9sCWwA746aLajpeCjv49hc0-L1Dy5Dx9D2TLFrSj1S_XK-5Jbh_sLaUuKmm5JTx4_oNnazF_PAswUrKbW4PnlVLA7UrJjP-pWgUocyNQa5PFH3VmCYJG3qbj4lL9u5jdM4A-dkWPkRtMRVeQZHCHndWqhoXCIebpqxKQBr0WD0sjUrz2tAa_FXv3C9cSRKrYO2QH0Tz_l8H5SfcKayStmmS74Txo2lfXobNtqDHWWIldkj7OBpO5ZsMDwjX_Eh4FGLwU1jb6A-Tj_F45_5CXRJzQh4ucpLv0pyhLn8R7fx0uvXb6o0JXgQN7SYQJqTiYlVRpm17eZnrwMQTCvE7IIz-_rnfgYRMHeZjVUga32iJmrNCOHrWhslP0NhGsjS9yZZDcOsKHXpbJUvtRK4nOXjTeCORccmcz_KtIJS-bnm5BonksJBmtpW9KPxBLABIVfRwqHcZDGGzNLfwDc4EEapdEmt1N9XSda5albm9t7MhZQe20uJfSOcz6e1S9CzGo02nRxr8c7Oc5545GzN54rW-fwWVn9NAwnm85rDKNT8Z2wHuDxzmPkLcDfCfzkF21JZ4TE0BjhIKKcBUHpIBhrbKCXuYaUVDI_5JR-9hG3jVb6uVWt_qa2r2dqvdkN5SHs6A40ABpwtBMXBLYHn9rlUymlrnTf&sai=AMfl-YQboJlWjKkevojvqCuZi5L8aVjbzeMTxW-iaWxvRHXyXlHjDtUeEUV6G4fJ8KT5q7O-mBWf_jClWlDLTfx57hrTRe3VrhirY6pZeqYMDzeWllfmdGcCEs_odOCVhHZArRHXYiko9t9tWiRD9cY6yHIAWeIYKblQkv-ak5vQqURPwvAyeP9qgY55ZRz1ltZG33ypEj5JtVSxA1Bo8BiJv07WHqZzmgpXrrbzRv-u9ZMXEImEv-9U9BqbSIuovmfbyV5VhJ3QKezdR9v1tPgpGG_N3s5U5ckstyGTvVEi5Gtw1AQ5YYZ9VXeOkPspzMaCJgqIZxjYwC15OMBiqxSy0YbdxBwS5wDAmkyeBeFXYRRaIAlL0mcV8-SUbwdeqBAnH4lF6bHPVW8bUWfE_G0j3hdPESoHOIl4JHUS8hTDXoCew_WY4LE&sig=Cg0ArKJSzMo9b3nO6QBCEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iYWhpYS1wcmluY2lwZS5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=639&vt=11&dtpt=420&dett=3&cstd=210&cisv=r20231129.83636&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f149.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
noah.min.js
bucket.cdnwebcloud.com/ Frame BD09 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bucket.cdnwebcloud.com/noah.min.js?1701395921747
Requested by
Host: bucket.cdnwebcloud.com
URL: https://bucket.cdnwebcloud.com/n_one_vway_bahia-principe-es_np.js?n_o_nu=not&n_o_aut_tc=329167526&ord=333506464
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.151.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-151-88.iad66.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3949bc357609db6e9bc5796a30a25a1865ba837e2cada69a1832b03e0814a51d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 14:51:51 GMT
content-encoding
gzip
via
1.1 316ff1e97338bc9bbb335af58b00d0aa.cloudfront.net (CloudFront)
last-modified
Mon, 04 Sep 2023 14:02:49 GMT
server
AmazonS3
x-amz-cf-pop
IAD66-C2
age
40011
x-amz-server-side-encryption
AES256
etag
W/"3c5a63b88b693279fc4d9dcff91d29c1"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
GQPAR_-XBus-kMruJtob5Kl1d5K8drT790cmICtqAgphrLQpdvtIhw==
Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
pagead2.googlesyndication.com/bg/ Frame 37B4 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
sffe /
Resource Hash
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 00:33:55 GMT
content-encoding
br
x-content-type-options
nosniff
age
5086
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15165
x-xss-protection
0
last-modified
Tue, 28 Nov 2023 18:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 30 Nov 2024 00:33:55 GMT
Gotham-Bold.otf
s0.2mdn.net/sadbundle/16527439329884676748/ Frame 4CFB 		154 KB
69 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/16527439329884676748/Gotham-Bold.otf
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=8O1s7uYT4p&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
183be4309aa229c11d790bb79b82a6a181a3f76cd009635a145a9d65c9c80766
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=8O1s7uYT4p&t=1&renderingType=2&ev=01_250
Origin
https://s0.2mdn.net
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 11:16:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
52946
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
70565
x-xss-protection
0
last-modified
Thu, 25 Nov 2021 15:48:57 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
font/otf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 11:16:15 GMT
Gotham-Medium.otf
s0.2mdn.net/sadbundle/16527439329884676748/ Frame 4CFB 		126 KB
59 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/16527439329884676748/Gotham-Medium.otf
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=8O1s7uYT4p&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
e8183507b37f3df80ea253b144745ed58784f5b4465b5216fbf9e314df592d06
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=8O1s7uYT4p&t=1&renderingType=2&ev=01_250
Origin
https://s0.2mdn.net
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 11:16:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
52946
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
60432
x-xss-protection
0
last-modified
Thu, 25 Nov 2021 15:48:57 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
font/otf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 11:16:15 GMT
view
ad.doubleclick.net/pcs/ Frame ED73 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/pcs/view?xai=AKAOjssJLDwCkJfwLiGr2YI2hEkogjew6SiujIO81A72vvNoxQy8x3yf6ckXcrbCi_o6pBbMSsER3RcypiV7AVx_GBCj-KzuHq3p7ahw2jabE8bHX_lap3GaLeKrstxhgeTZt8PAEpn1AW_kRBm9fMHhP4ghARdtZ_NqnkiVP9AWM3Xxa6ghtt3bmB6vd018KU3AdigORWX80vI9sZzbFGj5oL4-b5-OZfVthbgjMPFWsC2DVGpygiifZ1OI0TXPy4zG9WEbCu6LvLooZy8M3EUkQXskUDkKQtccELP_y3zm6lDa0XE_MXFRBTOW857nN_IglPk1SnqhqQ0V-Qu3LYFjPbRqpKcALMwwd_KMe7g6f4ZxVKpMt49WpHXE3uURmjXEaqhIeFJxBFlQ1JkMty2mcgftXFGlDuWOj59B8-nbdU0xvRd98cN5S8as4mPzL_LQM8AIsi08vbmUeNwK8qOL7vy-20a0-MX48ArhCgb3xDwsQYMPsLE9M6LPCspxVT8dHyg7a77umj8PwkPyQamW6hZtGooJlRfeJ09g2xrPrnfXwA2kGRLql1B1sewBWPH-_aCsgrh9sa6vQ3dXMfeg48lRNwsprksmnICh0seqdwVlqYf75P25x320eVcCJ6J_jn5NA4BCaF4aYwkTWPldJZf00RzH6yoh0kmYReSDqK3DlgDAhsW4qbIeg4FiJgH-nu1m_pm_cyZQyb_YmRjNEaTkmIUE8qEuxdQZPVl9HMo7_Ex8pY7S8waZYC8nBvYcCB4C4fw1nbU7N1IhGXVzowfjEkHURx_M_TH0D-ZjaXPctCsR96d4crmBQ2O5uFSwXeo111x8A5e9y-I6VRl_HKbIH0BZfXOYWe6s5LKmBJ0lDWN0i3tAStKcNip2MqI3f3y7O4j8WDVyUL0XHx7bntr4N7nzewjrWdb1x4utWfQ4IhO7Lf7vyDhDEEnbLmjL43uBh8B9t3Lr2uRCtwus6C6J7g-C_zZSzGgnaUBOJZU8vFD7yIsIvawCHDbGh_RkHAmF-5gHcPYQtGAOwq6GM8H025ytOsWuwTUyOCbwyrI1-iTmMdIAT0dTGdTIWE4RqZNwRoY_RgxvyXJiI-bOQYyyLA2LkiJvUCzwYy3fjUv1TBVItpmQZHhKrq7FD0BZw0WcROve27maez80bPfroZtwGXayoQgqQUSN2GrKJnswOwo1cZnUW4ZLbumMs5APFCUxPMwL51Fkvk4LFfgc2enz8qXVT4LM_WmXb7DajB94tDIhwITbeSBSvvh8wYeMRtceWpm-bNycS_w1zYRjeG0HcXzFa2KPTB_aC6pKbYRD7utJOU7Sk-4r-cx9Yl-bYkswZ09aKuDtsH6eE4zCUqfzIurGHGLfjLmBv9EEodVojw7URfqhUiILqy30BjN_asMLP4Fx62QvfVIgDtINNns&sai=AMfl-YQC4WzK5VpCHckhI8h_k9ugmSaMnrxyVWAvcOK8k93X6s6PRa6N3EazJi1RO1_Cl4TOhIjYRb21xc41hk7VXXzAwAqdaBb-zcxB7qATgmBYb7nX5shMohmUmIpPS-ul93jdW-2dNNFqqWIl5cHoHJ2wPRpstE34154GhWnWDkGgQVvrYcmHbYbkwNzP5SSIZsh9LUwHDkx2cdcbHjp7_UZgbRG34QuwqBiSfUT9kpzbws08LJmlqyY5oSkm5onY2-I06rEHVFG0Ui3Ooo4HVlS-Ya7dj432iXN5vgwB8NdqOZTcc5EukxW4fRCoJ_1louZYbSFiZyduqmD5M4lr3FL8EzpBf2SpIdu2UrO57c37BmVWqjVf7rlBc8BkzJjACAvXGmWOoGkWaYnqxzKWi6_5sKU2nj441FlmmO-EpveboGM&sig=Cg0ArKJSzBGgojPHkcvgEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iaXRkZWZlbmRlci5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=730&vt=11&dtpt=491&dett=3&cstd=236&cisv=r20231129.63422&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f149.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 80D2 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Fri, 01 Dec 2023 01:58:41 GMT
view
ad.doubleclick.net/pcs/ Frame BD09 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/pcs/view?xai=AKAOjstzPKe6jQ80v3D38zoyividFjXz4EF0DYXWdgHSIqcvt9lcFX7Fy0d_8p6F4i7K6LjbRkmCmHouHLozzTcUkjHdDALUyQVTPFH0hf7GfwsA-ddEwjDoY0hgMr1A65H-gK-evc4LabpJrRa1iLzOkwWkqEy2kgW0mM3Nr-L5hf0QsnE7s1sarnoJRc3JSauDrW1KoQUWD-uIts4gM43wqbnPELXnojmmQGyVxhOfsDnjyzubPx7jNC0W2SQfqtPgbokWU2BZ7cZeGjpVn-R5DbhcyejsAKu5B-PQIp0Llx77gD4xy_e--NXLvJXvluhJEQs03DowBd2mVXYzg7g0N_gTaAPogBi-B1dmxPvX7bViGvHQwzJ8juH3tBzW_bX7uMqKTA9xgEtz3uZg4Lk48LBC5l4eDWkf80eYjjePFt7ll965nAnATBSr8q3AWZEzCB1nRis-vRn1ZdEz7YYqhPohoCE4ES7OfaCrvfBah4KwRloHWYTNk1HAweqM1BLBiqlUDspBAam7UP9z6oDVRgq9Hw-f4yBEIKsOfhx-YOUjuhB5Uk8GrNnbjcmyXuJXwBe95S9KjxdxTIE__DnCTrmRlrNkD1AjfOZxwLC8VsvK8JW742-0JoMWIzsNXBZUl0vLh-sfhkUFjzAwLy4yeH9N16DudmIGO-wcIZgQRT6heRJYFADwckYiqpvROAKVwXL3ElhTGthcLtEKnscTJ0CbTseitx6pe0sPyoxdRL66ZwKwcvm9BjV0BmfsutTbDVMSvcNJ5e_BeCLaedl6LKVP_YDrD3jb0lcuQtzhXnqoCYXJ9htAJv_GkuRxwhtjp-5pCAZ4_qYxhJkCEFKp1MFLuwRZM-SOurFfT4tHYZ48X8plJt4yAgzXvmLN9F9Eq3pXBxSZhQM34whMap7hRwNoN_aDkiWGELR_DntrpAnQanKHq8bff7QbInNsi2HxW869yoE_SsR6jWznk5oQupSHz2yB03lOp7RschpRk_s7cz1ncF1aZDM41gpdcfUY4OWYZQcgX0P5_-m-Pa3jcsvCBARdPYC93wHo8mP8o9hwMXtoErVKOZ7Z3dP2sK0ZajuaanIpRMoPapP9BmY4QVgSCmN0ph2uwrqxWu5J_P2HMwNi0WyAT89gZKPeGnXIigwO89lD0WbRnYkkousLiQ4TbtcIr7BEx2SHfl7wNk2iqxru4mj4w67OLNH_YVm3DJM-FEo_yNiIh7hLB3Maw6_YpDDfgTR9XGs7W5AH_T0W7GXLKglheaGyYJtw3ZT2XRf_nfxsu5A4ywF6tQWP7eS1XVa1YcwfpsSuYteqdSt7PMxEFCWbwuUgpEK5LxFFTwpefXIO6vrT2-q3z0GTjyBAJBzMDH7a5NBvGfDhI7D0H3R2FipVtDNputOHQK_p5Ri5exFxQqM4BXpBM_Ekfqh8vIFpl-xaZn1zASHjfMSFHmzlpK6fQoV4lYDYSIkj7xArOciYcP1UodI&sai=AMfl-YSsb81Z_tsbW84tcstDL7QbCo9zDQ3IT3OevgcFCF_5iMjGVzV2GXODDOKRMYgt0RO9PNQBA3v1Wq-CxlPOrVQTCGrKNtM8ASV7y4xq7UyMmJMsHl-VKTPIR2oxitfN-yDWTncAaPhV0N9Yee0qNughMkBbIP5Ufi2B04FkPa69lQeCyxALxcWTLfNmdida-8jFyGirNXmLhc-IMwdxdt1JFjzo6MzxqWwTsyd0s4JDhIu1aUx834jphtxagIUM398bNZMwis7y305rhMEK_cGJ_xaQLEbpVjGoUj3i6IVqqY4_2s62Nm9vU9LgMc_duIZ6epDBDN59WyZ1psbIg8XC7e-OZr0U8-oKHtsfd9Bhpq93lRWCq8Yga1CCiYi6Z7dbnZ4ZDMitVPorKTn1ke1O9T5B0MgQHwKhNs6tvk3g7-HBwaAOKww&sig=Cg0ArKJSzBBLHtSv1SjKEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iYWhpYS1wcmluY2lwZS5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=355&vt=11&dtpt=217&dett=3&cstd=131&cisv=r20231129.17723&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f149.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
gen_204
pagead2.googlesyndication.com/pagead/ Frame BED8 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BWgh_0D1pZefQHKGRhQbSlZygCAAAAAA4AeAEAg&bg=!0tGl0Z7NAAY3kmNgF5I7ADQBe5WfOCkapZCIlqzLQyOALBWAWYzFG__NoHTCmC3zEVCJzrpykaJjm4EljWHMMEY2mxm7AgAAAShSAAAAAmgBB5kDAggjL9-bg68W_yvZxy0BvVA9Ddg1s6hQZDjRBjZzUsi2c3x1ErdZhTfEHurbzdDzUqelz36tBRmwchK5IfbUN21UdESbIHyLOksYmRLiRb5bUwSFwnnogv9qn9i5N-BxeYMJDfdw9xxRldKJta-I2-r84ndG8-KxoSmUV2lRKNH_cg0VM4YY1bCrLkQ1b1eNqpAtUVWC0jmZOXiUyUlZdvOzMLs_M_Ml_K4IDi-Hze-4iXbJwevgoAajHe9rumX1uccWkkDY4eRSA-MH0xYsysuyw4Q7jpuWpUlqtMOOfkiDpD4t3Bcn3N-J1YTSkioc2jsHfBxD3iD1gckmrvuI1MIAm-fjdzO6Qx8_sd2qpt61B9-PSRjW6HpZuOXcKomheHdobXeWPtMpe7--JBQdPYO78h3aJlx-Jq1gMUUdhBo-f_y6DaZhi8TJTNSmxgXyJmsGOTskOjz9tKSngQ_txg4Zi07dvyUUEynhH3KTSCUrYQK53wcW5qF49ZvhmCfso188iDT-rV2bPmmxvOj_PpWv7wgbTMqhUbmseZu3AbyRgnno9HLfH1SLwTbWlxXLG6lwBObbbiI4PSNnuKuVGXpAJlX_2cjRhtQNDGoMi33sXRY9AJrb7RD2QtsWsmGfSKqUNFvi6PfaFZ2LoeLBcsyJt1ReJDT0K2Cy96tNDHxmdzADN1oEPDVL3KtE1Qr_P0OIr561ZNNAq08pQbNnA8ot4BvPpChAGacJ6txOdFEhKmRwFBK2GRa_HBafU3KCSUzE_rozNY45CC-2GUXmazDxdDA3HXIgCOTKelr6FP_-n-giF0CiKkBp75JPv4PGb9JFN3HOZQTbKtjqpVQGLrWXt90OBx0UNxnZXgMmglzIckyEgR8J0uVJqhTKpXlGWcfX1jHwUgK3TYgs5wuxHQFcSQ75Id3DoF8UlOf9UA5V4Gl-bggfjvBDjUVjDa8TKzNfqb95RcuTaLSDsbN2WRcWMA0VP-o3sMDaCCAhMll0MID6oX-7VtwSlaGtPFWS_PnC
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 1F6B 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BWkpY0D1pZdHyHNiRrr4P7bCE2AsAAAAAOAHgBAI&bg=!u7iluPfNAAY3kmNgF5I7ADQBe5WfOPyuaY0x0-ROLIJdYq7PLaJXHXUOXt5sLBOrU1UbopOrX6tof1REMvlmzk6JawcqAgAAAQFSAAAAAmgBB5kDA7ikFWBFNXWCv8dayn0lc9rbi8YfMz6fTD2_O6WnR7J6GXAQm9tT864NQ7bKMvRulVqlqdJgofPHNl4VcaIPz8TgNuqX6GpMtJhc9vvAr4KYRZNe5Qxre7m_MUOgxNsc6SptzPPxtPrzL8g86CTCxu_rFyZB7ji8fT_KoiNFCOTgj3CNqRILHp9NL_u7nuL-qePQYtzxoVy5wy2D0IZZTqU2fVQtUoHnKojvrhq5kzNouK-YgpZZNn5wvM0PB7zzxnXRE6mlzqvZP7daYPqhrLSg-cbrgQozBqYU-8wnhsxiigp3LscANTPKZlmoONHXfAib2FECzIdgFOWhonexbe60Pit1vYn_AT996pZaMuAlfeqg0SwLPEYHjAJaA68hqmJ6IorL5bZxONnzWktae7E_LFFPVkg8bf7vWVjOLUoIWzP1BdjOAszR4hDnUGwomypI-phDc68VVHC9tstcOd3ColrF8wRejcbVLKSxLhJfXkLPsX8bcP44zbeoUf3DSxapfb1EKPATzDpb3aHy9cJ_jEte5lpmoIGXfSDqjti_h2By3y2lGcEIYlHCS3GSgeflV0T9-REUA4cb29p6f3iklUU9al3LzPRFWnB_H65XPg2cwhYxjmq6yHAu5COJGofNOhcDiEYZGuPlGU6_TCmZyk7re7u3tkBWNuT9ErZK_R9l911gpqP_0SPz4aQCucDh_tgRhUbCmvnumhTQTaV9gXBJ7CL2Qsuo1qEe3Pkaf7tIfSb_Hz7D0NRQ_3DbS13wtV4TS83EfEmFXduy39o-Xmq5VyTNSWOGwEdxTvolpqC_vxpM0G1nu9o7d-jM6CBQevDHG-cKeedERvrkOzfaVdbWvchCeumKG5uxWNbsLyUoMz6fov4az1DN-0iw1bP7GpJrnISk4465kJtl2qxVDJcw59Lv0yK4soDR4lLVa5QVXPQa6QGRutCDJ0_vE8Cao-JBadcdWiNGoMKcW8mtss3iCVUCprbPTcec_COWer7aFzutIF2wB-XMO2l0X977VA
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:41 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
css
fonts.googleapis.com/ Frame 8867 		2 KB
653 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=IBM+Plex+Sans:400
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16640302357973241815/a60923bbda08a39de3899dc6e900156f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f95.1e100.net
Software
ESF /
Resource Hash
4d43d655b35d6e4823b64ba37eca2c3cec4735f4f3d6d5afa9da67fe6e18ab84
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 01 Dec 2023 01:58:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 01 Dec 2023 01:29:16 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 01 Dec 2023 01:58:41 GMT
atp
neural40.cdnwebcloud.com/ Frame BD09 		74 B
323 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://neural40.cdnwebcloud.com/atp?250513753632=&n_o_aut_tc=329167526&nonhm=true&gdpr_consent=CMP_NOT_FOUND
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.50.63.24 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-50-63-24.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
01b58ddb2f86a768f91751b62f25395417f6cf526191a4aefc1ebe4f8beacdcb

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 01 Dec 2023 01:58:42 GMT
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
74
content-type
image/png
732e6b6c27a20285e7b8e3ff8714511a.png
s0.2mdn.net/sadbundle/16640302357973241815/media/ Frame 8867 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/16640302357973241815/media/732e6b6c27a20285e7b8e3ff8714511a.png
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
0aa1be81fda06de2efd9639b18bd2580f814320b13ccbef13a8d1c30f5ee3d4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16640302357973241815/index.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 09:35:18 GMT
x-content-type-options
nosniff
age
59003
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4840
x-xss-protection
0
last-modified
Mon, 13 Nov 2023 15:05:38 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 09:35:18 GMT
14a5357efe026c52e8c22f698ff46157.png
s0.2mdn.net/sadbundle/16640302357973241815/media/ Frame 8867 		794 B
821 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/16640302357973241815/media/14a5357efe026c52e8c22f698ff46157.png
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
5bce27ce4b302cea70cf511c73d44c7dd0e38aa5b4744101662253be55946b31
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16640302357973241815/index.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 18:46:48 GMT
x-content-type-options
nosniff
age
25913
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
794
x-xss-protection
0
last-modified
Mon, 13 Nov 2023 15:05:38 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 18:46:48 GMT
c16184f967ef0aa68e4960402d920774.png
s0.2mdn.net/sadbundle/16640302357973241815/media/ Frame 8867 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/16640302357973241815/media/c16184f967ef0aa68e4960402d920774.png
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
98fd2b5a818cc924222ce20be58a36e91f730654b487c484f3c524894411e4a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16640302357973241815/index.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 23:02:42 GMT
x-content-type-options
nosniff
age
96959
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9705
x-xss-protection
0
last-modified
Mon, 13 Nov 2023 15:05:38 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 28 Nov 2024 23:02:42 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame 4CFB 		8 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
4284d118bc337f2ed4a2506c95e676770285e204ec96124b4c4f33903e7c5bc2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
5868
x-xss-protection
0
Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
pagead2.googlesyndication.com/bg/ Frame 5605 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
sffe /
Resource Hash
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 00:33:55 GMT
content-encoding
br
x-content-type-options
nosniff
age
5086
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15165
x-xss-protection
0
last-modified
Tue, 28 Nov 2023 18:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 30 Nov 2024 00:33:55 GMT
texto_logo.svg
s0.2mdn.net/sadbundle/16527439329884676748/ Frame 4CFB 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/16527439329884676748/texto_logo.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
cbbd6285bb18a8c92cc59574c958877754850f795f0f4dad205c79fd21d1d467
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=8O1s7uYT4p&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 11:16:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
52946
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2125
x-xss-protection
0
last-modified
Thu, 25 Nov 2021 15:48:57 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 11:16:15 GMT
sol_logo.svg
s0.2mdn.net/sadbundle/16527439329884676748/ Frame 4CFB 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/16527439329884676748/sol_logo.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
08bb8bf8ea037474da111ae1a70781e3210f7a0b29ac2f61cc5e88a3e37b920d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=8O1s7uYT4p&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 11:16:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
52946
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1118
x-xss-protection
0
last-modified
Thu, 25 Nov 2021 15:48:57 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 11:16:15 GMT
PALM.svg
s0.2mdn.net/sadbundle/16527439329884676748/ Frame 4CFB 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/16527439329884676748/PALM.svg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
afcd6ebf6cf7124e138218f69982d6c9ca1820345967c9263d243dbf5631d204
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=8O1s7uYT4p&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 11:16:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
52946
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1519
x-xss-protection
0
last-modified
Thu, 25 Nov 2021 15:48:57 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 11:16:15 GMT
palmera2.png
s0.2mdn.net/sadbundle/16527439329884676748/ Frame 4CFB 		960 KB
961 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/16527439329884676748/palmera2.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
73f6add564f8d8c794d4b1bd49749c1770990b44616591ea59ce7333cf05a574
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=8O1s7uYT4p&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 11:16:15 GMT
x-content-type-options
nosniff
age
52946
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
983441
x-xss-protection
0
last-modified
Thu, 25 Nov 2021 15:48:57 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 11:16:15 GMT
palmera.png
s0.2mdn.net/sadbundle/16527439329884676748/ Frame 4CFB 		941 KB
941 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/16527439329884676748/palmera.png
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
22e99768051bfffd5038e9ead749c8beab5ed5f1042a82eaa188096b2c63d4a1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=8O1s7uYT4p&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 11:14:57 GMT
x-content-type-options
nosniff
age
53024
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
963679
x-xss-protection
0
last-modified
Thu, 25 Nov 2021 15:48:57 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 11:14:57 GMT
alwaysOn.jpg_1688031171872_alwaysOn.jpg
s0.2mdn.net/dynamic/2/10889189/s0.2mdn.net/creatives/assets/4372216/ Frame 4CFB 		170 KB
170 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/dynamic/2/10889189/s0.2mdn.net/creatives/assets/4372216/alwaysOn.jpg_1688031171872_alwaysOn.jpg
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
a47ca510e702a8bb97e5fdf139d5fc1b038e1613bba446a49905dbd653e8f028
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=8O1s7uYT4p&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 18:46:58 GMT
x-content-type-options
nosniff
age
25903
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
173580
x-xss-protection
0
last-modified
Thu, 29 Jun 2023 09:32:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-programmable"
report-to
{"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 29 Nov 2024 18:46:58 GMT
zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2
fonts.gstatic.com/s/ibmplexsans/v19/ Frame 8867 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v19/zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:400
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f94.1e100.net
Software
sffe /
Resource Hash
db71f8a28ad8501544fb4e7668e3c6d0b731760b6f20de3525ebaeba597f1922
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://s0.2mdn.net
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 04:35:38 GMT
x-content-type-options
nosniff
age
76983
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
19156
x-xss-protection
0
last-modified
Tue, 02 May 2023 16:04:22 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 29 Nov 2024 04:35:38 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 4CFB 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Fri, 01 Dec 2023 01:58:41 GMT
json
gum.criteo.com/sid/ Frame 		0
0
/
id.a-mx.com/sync/ 		0
0
fed
ups.analytics.yahoo.com/ups/58713/ 		391 B
662 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ups.analytics.yahoo.com/ups/58713/fed?v=1&1p=0&gdpr=0&gdpr_consent=&us_privacy=&url=https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file&pixelId=58713
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.225.218.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-225-218-10.compute-1.amazonaws.com
Software
ATS/9.1.10.87 /
Resource Hash
418548cce5d9d5e080275efcc3c726d9b7f9c401e0672aa79778e503f0c122c8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

date
Fri, 01 Dec 2023 01:58:42 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
vary
Origin
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
access-control-allow-origin
https://www.mediafire.com
content-type
application/json
access-control-allow-credentials
true
json
gum.criteo.com/sid/ 		0
0
pbhid
id.hadron.ad.gt/api/v1/ 		0
0
prebid
id5-sync.com/api/config/ 		135 B
417 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/api/config/prebid
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.120 Frankfurt am Main, Germany, ASN16276 (OVH, FR),
Reverse DNS
ns31533571.ip-162-19-138.eu
Software
/
Resource Hash
e6cead609d342bd202f23b8fa86aff54f2503372d68ae63acca87e7dca2bec15
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
https://www.mediafire.com
date
Fri, 01 Dec 2023 01:58:41 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-credentials
true
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type
application/json;charset=UTF-8
id
id.crwdcntrl.net/ 		152 B
826 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://id.crwdcntrl.net/id
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.93.99.238 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-93-99-238.compute-1.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
1a1e169d351e8b8552576f28514a6ec48b79794ea47097ff65e5e5ca4e60ca2b

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
server
Jetty(9.4.38.v20210224)
content-type
application/json;charset=utf-8
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache
x-server
10.40.56.254
access-control-allow-credentials
true
content-length
152
expires
0
/
onetag-sys.com/usync/ Frame E911 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?cb=1701395917061
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
94fc6c44effd6f774a81a66ef08c3006c7aec05a5ec5cc962886c9226fdff42f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control
no-transform, no-cache
content-encoding
gzip
content-length
1484
content-type
text/html
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security
max-age=15552000
sync
eb2.3lift.com/ Frame 9C7E
Redirect Chain
  • https://eb2.3lift.com/sync?
  • https://eb2.3lift.com/sync?&ld=1
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://eb2.3lift.com/sync?&ld=1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
a60af4664aa2dd8297af074e53a549a7997127e069aedac99b76800475608c59

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
1343
content-type
text/html; charset=utf-8
date
Fri, 01 Dec 2023 01:58:42 GMT
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control
no-cache, no-store, must-revalidate
content-length
0
date
Fri, 01 Dec 2023 01:58:42 GMT
location
/sync?&ld=1
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
csync
sync.adtelligent.com/ Frame CB04
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D743293%26extuid%3D%24UID%26traffic_source%3Dsnippet%26session%3D139C6587B24895D4%26sp%3D678634%26...
  • https://sync.adtelligent.com/csync?t=a&ep=743293&extuid=9135305356218733899&traffic_source=snippet&session=139C6587B24895D4&sp=678634&pb=493076&c=709112&a=743293&domain=https://www.mediafire.com/fi...
43 B
456 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.adtelligent.com/csync?t=a&ep=743293&extuid=9135305356218733899&traffic_source=snippet&session=139C6587B24895D4&sp=678634&pb=493076&c=709112&a=743293&domain=https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
23.227.146.18 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software
Adtelligent /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Content-Length
43
Content-Type
image/gif
Date
Fri, 01 Dec 2023 01:58:42 GMT
Etag
5d0db918b2e135a4
Server
Adtelligent

Redirect headers

content-length
0
content-type
text/plain
date
Fri, 01 Dec 2023 01:58:42 GMT
location
https://sync.adtelligent.com/csync?t=a&ep=743293&extuid=9135305356218733899&traffic_source=snippet&session=139C6587B24895D4&sp=678634&pb=493076&c=709112&a=743293&domain=https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
server
nginx
isync
visitor.omnitagjs.com/visitor/ Frame 0823 		5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d3d62958d10f2be750b5edb8145df9e3357db4b4f29e80de1ed4273e0d965c62
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-length
1482
content-type
text/html; charset=UTF-8
date
Fri, 01 Dec 2023 01:58:45 GMT
expires
0
p3p
CP="CAO PSA OUR"
pragma
no-cache
vary
Accept-Encoding
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
x-kong-upstream-latency
33
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame CA11 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=162948
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.215.40.199 McAllen, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-215-40-199.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=147559
content-encoding
gzip
content-length
5622
content-type
text/html
date
Fri, 01 Dec 2023 01:58:42 GMT
expires
Sat, 02 Dec 2023 18:58:01 GMT
last-modified
Thu, 16 Nov 2023 09:11:44 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
/
csync.smilewanted.com/ Frame 819A 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2b996fdc66d9abf1696965fbb8afdcb5b7b9aea5219da13e11d11512f3a101c

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
82e7ba0099be36b7-YYZ
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 01 Dec 2023 01:58:42 GMT
server
cloudflare
vary
Accept-Encoding
isyn
prebid.a-mo.net/ Frame BA56 		2 KB
996 B 		Document
General
Check archive.org
Download Go to
Full URL
https://prebid.a-mo.net/isyn?gdpr_consent=&gdpr=0&us_privacy=&gpp=&gpp_sid=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
7c7737d1d724c2d3d73b641009a5e65aefdcd385b0e9af3f936d07944f346186

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
max-age=0, private, must-revalidate
content-encoding
gzip
content-length
661
content-type
text/html; charset=utf-8
date
Fri, 01 Dec 2023 01:58:41 GMT
server
envoy
vary
accept-encoding
x-envoy-upstream-service-time
2
pbcas
ads.yieldmo.com/ Frame E954 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.yieldmo.com/pbcas?us_privacy=&gdpr=0&gdpr_consent=&type=iframe
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.88.209.131 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-88-209-131.compute-1.amazonaws.com
Software
/
Resource Hash
7460c2565d60627bdc9cbe2619e3005711788a6f0e3a0bce44bd04f138b71ca7

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-headers
Cache-Control, Pragma, *
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-origin
*
content-encoding
gzip
content-type
text/html;charset=utf-8
date
Fri, 01 Dec 2023 01:58:42 GMT
pragma
no-cache
vary
accept-encoding
setuid
a-prebid.vidoomy.com/
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fa-prebid.vidoomy.com%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
  • https://a-prebid.vidoomy.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=8961910970674910848
86 B
634 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a-prebid.vidoomy.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=8961910970674910848
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
HTTP/1.1
Server
212.36.83.245 Sant Vicenç dels Horts, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS
lb1.vdmy.dtic.es
Software
nginx /
Resource Hash
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:43 GMT
Server
nginx
Vary
Accept-Encoding, Origin
Content-Type
image/png
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
86
Expires
0

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
an-x-request-uuid
526a6e5f-feb6-469a-8e22-8479f5bfd909
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://a-prebid.vidoomy.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=8961910970674910848
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
setuid
a-prebid.vidoomy.com/
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58531/occ?gdpr=0&gdpr_consent=
  • https://ups.analytics.yahoo.com/ups/58531/occ?gdpr=0&gdpr_consent=&verify=true
  • https://a-prebid.vidoomy.com/setuid?bidder=verizonmedia&uid=y-xv9cScBE2uEqP4mZbM8DQ8.FiwBsqMDOo3P8nz8-~A&gdpr=0
86 B
678 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a-prebid.vidoomy.com/setuid?bidder=verizonmedia&uid=y-xv9cScBE2uEqP4mZbM8DQ8.FiwBsqMDOo3P8nz8-~A&gdpr=0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
HTTP/1.1
Server
212.36.83.245 Sant Vicenç dels Horts, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS
lb1.vdmy.dtic.es
Software
nginx /
Resource Hash
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:43 GMT
Server
nginx
Vary
Accept-Encoding, Origin
Content-Type
image/png
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
86
Expires
0

Redirect headers

location
https://a-prebid.vidoomy.com/setuid?bidder=verizonmedia&uid=y-xv9cScBE2uEqP4mZbM8DQ8.FiwBsqMDOo3P8nz8-~A&gdpr=0
date
Fri, 01 Dec 2023 01:58:42 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
setuid
a-prebid.vidoomy.com/
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fa-prebid.vidoomy.com%2Fsetuid%3Fbidder%3Dadf%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
  • https://a-prebid.vidoomy.com/setuid?bidder=adf&gdpr=0&gdpr_consent=&uid=9135305356218733899
86 B
630 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a-prebid.vidoomy.com/setuid?bidder=adf&gdpr=0&gdpr_consent=&uid=9135305356218733899
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
HTTP/1.1
Server
212.36.83.245 Sant Vicenç dels Horts, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS
lb1.vdmy.dtic.es
Software
nginx /
Resource Hash
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:43 GMT
Server
nginx
Vary
Accept-Encoding, Origin
Content-Type
image/png
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
86
Expires
0

Redirect headers

location
https://a-prebid.vidoomy.com/setuid?bidder=adf&gdpr=0&gdpr_consent=&uid=9135305356218733899
date
Fri, 01 Dec 2023 01:58:42 GMT
server
nginx
content-length
0
content-type
text/plain
cookie
a.vidoomy.com/api/rtbserver/
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=120&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fa.vidoomy.com%2Fapi%2Frtbserver%2Fcookie%3Fi%3DCEN%26uid%3D%7BuserId%7D
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=120&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fa.vidoomy.com%2Fapi%2Frtbserver%2Fcookie%3Fi%3DCEN%26uid%3D%7BuserId%7D
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553&partner_url=https%3A%2F%2Fa.vidoomy.com%2Fapi%2Frtbserver%2Fcookie%3Fi%3D...
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553&partner_url=https%3A%2F%2Fa.vidoomy.com%2Fapi%2Frtbserver%2Fcookie%...
  • https://a.vidoomy.com/api/rtbserver/cookie?i=CEN&uid=736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553
43 B
670 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.vidoomy.com/api/rtbserver/cookie?i=CEN&uid=736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
HTTP/1.1
Server
212.36.83.246 Sant Vicenç dels Horts, Spain, ASN15699 (AS_ADAM Adam Datacenter, ES),
Reverse DNS
lb2.vdmy.dtic.es
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date
Fri, 01 Dec 2023 01:58:47 GMT
Content-Encoding
none
Server
nginx
Access-Control-Allow-Methods
HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-VD-C
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
43

Redirect headers

date
Fri, 01 Dec 2023 01:58:46 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
Jetty(11.0.13)
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin
*
location
https://a.vidoomy.com/api/rtbserver/cookie?i=CEN&uid=736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sync
x.bidswitch.net/ 		43 B
235 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.bidswitch.net/sync?ssp=vidoomy
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.211.178.172 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
172.178.211.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date
Fri, 01 Dec 2023 01:58:42 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
ads
securepubads.g.doubleclick.net/gampad/ 		109 KB
45 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3378551494251738&correlator=3513428170213714&eid=31079808%2C44807689%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=21732118914%3A183096492%2Cmediafire_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=13&didk=2994273263&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3D8ed23798d17fef2e%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_MYa84XzsqA-d-Y6sn06Y8FEKt-Mkw&gpic=UID%3D00000da4eba87dbb%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_MYNqbDdY9cfK7DMkmU6DodsZiNUzA&abxe=1&dt=1701395922004&lmt=1701395922&adxs=0&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&vis=1&aee=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1675868932.1701395917&ga_sid=1701395919&ga_hid=846692808&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABj50uWYwjFIABIZCgpwdWJjaWQub3JnGLXq5ZjCMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj80eWYwjFIAFICCGQSFwoIcnRiaG91c2UY9tzlmMIxSABSAghqEhkKCnVpZGFwaS5jb20Y_NHlmMIxSABSAghkEj4KBW9wZW54EixleUpwSWpvaVFXTmFhRFpLVlROU0x6SkxiMWRrZVVkWFUyTnpVVDA5SW4wPRji6-WYwjFIABIbCgxpZDUtc3luYy5jb20Y19nlmMIxSABSAghq&dlt=1701395915992&idt=906&prev_scp=a%3D%257C0%257C%26iid1%3D5203464651626414%26eid%3D5203464651626414%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D5302779%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dmediafire_com-edge-1-5203464651626414%26eb_br%3D295bc01864bf3dbd0117e0a3f7f6bc96%2C291d27313eb66c50243129b23df8a579%26eba%3D1%26ebss%3D10061%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D34%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D10%26br2%3D30%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C4276%2C5747%2C6293%2C6294%2C6295%2C5136%2C774%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C835%2C2693%2C3053%2C18%2C1428%2C2693%2C3052%2C3053%2C3856%26hb_bidder%3Dadtelligent%26hb_adid%3D939d55580a5e57d%26hb_format%3Dbanner%26hb_ssid%3D11316%26hb_opt%3D0.11%26hb_rt%3Dclient%26lb%3D30%26reqt%3D1701395920934%26adxf%3D1%26nam%3D1&adks=3297035300&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
e395cbf603998dec778aafaed35a7d66f0b9dc3f7c9c32b6a37fd13f34e4ef36
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:42 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
45998
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
avw
neural40.cdnwebcloud.com/ Frame 3297 		0
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://neural40.cdnwebcloud.com/avw?1054884060446&n_o_aut_tc=329167526
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.50.63.24 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-50-63-24.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 01 Dec 2023 01:58:42 GMT
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
gen_204
pagead2.googlesyndication.com/pagead/ Frame 37B4 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BekkQ0D1pZdbwNpKJhAXJ6ZfgBAAAAAA4AeAEAg&bg=!Pj2lPXLNAAY3kmNgF5I7ADQBe5WfOB9fFtp15HGedWozp1Zrenn30K1KEtknY8Wyk28hk8Pful16ePIeJjt5vtcQ0-UDAgAAAJRSAAAABGgBBwoAhFcxlK4JFwyb2i3WaJ8L4YWro4QYTqQyXVQXtNYAV4-82d30TTu1vX2t1ZXoWlLJtfj7jiKK_KslSpk3B4tOLyBrodms9-42pZz8iCpZ8fYZ13fZw13Q_u1nMIe9HqLw5SDHaRFlX5bWicPhYbpASSL68WzM5la6Z2xvVub5pFLAIZNvl5kDCoMLvmKjwyvCWZxzYxA7aDlkdWAJR4H4bHWsdlYqkMlq4JqVc6QTKRlT9j3AZtXOlyBEOg1m13uvhqL8AbA76Sprc00hgOCuko5v-DoogJmHN6VmXO9t9VxQ-91hoOuxonSQR5Ls21GriVlPmWsYBTdT0_U7wzPD1C1eh1JVKLSKJ1qre5Oz_HTp4G97FZhCshsQR12XyfuhI8hBKN-gtV8nAnSacbAqH2V_qnI3_URiTJGWjh3Ybm29LtpFodRg5j0JS-KUS5SyrNLo6xkJ4hOiI3TWHYPv4SlooEoPGBjPEPIw653pgSfGclvxfg7mUNSpjU4pwucszN9ZnY9NGje8HHl_B0oa5-Hdr3ypuvqzCIPmot8VTY466tHAjCGph_RXKtckikFTSHIe_asoF06lfQ4VIuYoURi3dj0hn_iMeaQ966B3PV0sDrhrby7ymVlg703UJSmAR3lLbdCIF7gxx5yiN6J7lurkae8-F5pMxu-cWvCaVtudyAcAmiwlLFCs60NHAQrBxRKrpYnv7G2c87xwE1ojs1-zSZtaKbv2un9Hi9jxX27x7FvMYzKo0Ygr2lxIlyVVy8dXDwgsIvXxOotdroEByj2qlmq5yf-EuNMB-dq27y_-f0DXDrZKzhdD2EWU3CgL7hMSlTqBlmatB58xgHml6rUC8OAn8Sy4N9kgfJ_D4B46IhX2wer_gMoIFWTRVEGTPzK5tkjBZEKKwwc720aBDQ6jdB7meY98gJb25O7bvAS1vbKnJv5rVVFpgh7rSRn0Ys597OiV3LrGpxh6LDqQkuSpWWCZqckJIsyRwiBzTKtk8Ngg37agzUohDrQsZejtuwnwhzbTsOHdH4wRUyVdq-OZSrk-lcoO09UwBQi7pbqq6gwncAql4jkByS04g2qBlhzWMFXWszxv40ib7OY9Yz4TJz_6H0bdS1PsbpxOL03ZCX5nbf_NTWoOJi6rJ5hIz1QI2jYxtyu9N5akK_uvesCOWB2m0t0eH-66TmgpjSpVYTyYniZYwKz4XIkeQeAN-n4
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
pagead2.googlesyndication.com/bg/ Frame B993 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
sffe /
Resource Hash
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 00:33:55 GMT
content-encoding
br
x-content-type-options
nosniff
age
5087
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15165
x-xss-protection
0
last-modified
Tue, 28 Nov 2023 18:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 30 Nov 2024 00:33:55 GMT
/
onetag-sys.com/match/ Frame E911
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D1%26gdpr_consent%3D
  • https://onetag-sys.com/match/?int_id=1&uid=9ff86569-3dd5-4800-a1c7-b1d0a032f114&gdpr=1&gdpr_consent=
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=1&uid=9ff86569-3dd5-4800-a1c7-b1d0a032f114&gdpr=1&gdpr_consent=
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1701395917061
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date
Fri, 01 Dec 2023 01:58:45 GMT
Server
MT3 1191 303c5b1 master iad iad-pixel-x23 config_version:"2081"
Content-Type
image/gif
Access-Control-Allow-Origin
*
location
https://onetag-sys.com/match/?int_id=1&uid=9ff86569-3dd5-4800-a1c7-b1d0a032f114&gdpr=1&gdpr_consent=
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
0
Expires
Fri, 01 Dec 2023 01:58:44 GMT
sync.php
pixel-eu.rubiconproject.com/exchange/ Frame E911 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=1&gdpr_consent=
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1701395917061
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.80 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
X-RPHost
24dd0e7a336ea1f5a4a3fa7e1bfcb863
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
/
onetag-sys.com/match/ Frame E911
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D1%26gdpr_consent%3D%26uid%3D$UID
  • https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=8961910970674910848
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=8961910970674910848
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1701395917061
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
an-x-request-uuid
6fc6819c-2893-44ec-bb1d-56d0f98f8e30
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=8961910970674910848
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
/
onetag-sys.com/match/ Frame E911
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3679&gdpr=1&gdpr_consent=
  • https://onetag-sys.com/match/?int_id=3&uid=19e74a65c36c6d13014e8a2869ef343&gdpr_consent=&gdpr=1
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=3&uid=19e74a65c36c6d13014e8a2869ef343&gdpr_consent=&gdpr=1
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1701395917061
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:42 GMT
Server
nginx
Access-Control-Allow-Origin
*
Location
https://onetag-sys.com/match/?int_id=3&uid=19e74a65c36c6d13014e8a2869ef343&gdpr_consent=&gdpr=1
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
x-sticky-vk
1701395922350086-1148
tap.php
pixel.rubiconproject.com/ Frame E911 		42 B
927 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=5L_ScCmIe04VLRjc2VnEry0yNqNSktKNq21C2Hw8kMI
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1701395917061
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
/
onetag-sys.com/match/ Frame E911
Redirect Chain
  • https://cs.admanmedia.com/73c1e1bfc3bde354d60b80e601ae3914.gif?puid=[UID]&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D164%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%2...
  • https://onetag-sys.com/match/?int_id=164&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5850f379-36d6-4b94-9eaf-286cf9fb0f17
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=164&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5850f379-36d6-4b94-9eaf-286cf9fb0f17
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1701395917061
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:45 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Server
nginx
Transfer-Encoding
chunked
Location
https://onetag-sys.com/match/?int_id=164&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5850f379-36d6-4b94-9eaf-286cf9fb0f17
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Expires
0
pixel
cm.g.doubleclick.net/ Frame E911
Redirect Chain
  • https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABjCMZfJNv_UiAPAKbInHrmsMEknyn63trSw
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABjCMZfJNv_UiAPAKbInHrmsMEknyn63trSw
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1701395917061
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABjCMZfJNv_UiAPAKbInHrmsMEknyn63trSw
strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
sync
ssbsync-global.smartadserver.com/api/ Frame E911 		0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1701395917061
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.105.12.171 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:45 GMT
content-length
0
ecm3
s.amazon-adsystem.com/ Frame E911
Redirect Chain
  • https://onetag-sys.com/match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
  • https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=5L_ScCmIe04VLRjc2VnEry0yNqNSktKNq21C2Hw8kMI
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=5L_ScCmIe04VLRjc2VnEry0yNqNSktKNq21C2Hw8kMI
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1701395917061
Protocol
HTTP/1.1
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:48 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
842E6HAG21FAZN0RQC6C
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=5L_ScCmIe04VLRjc2VnEry0yNqNSktKNq21C2Hw8kMI
strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
ImgSync
image8.pubmatic.com/AdServer/ Frame E911 		0
42 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D%23PMUID
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1701395917061
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.36.113.110 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:45 GMT
content-length
0
/
onetag-sys.com/match/ Frame E911
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
  • https://onetag-sys.com/match/?int_id=106&google_gid=CAESECGu7pF2HhMHxAjTB__6CXA&google_cver=1
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=106&google_gid=CAESECGu7pF2HhMHxAjTB__6CXA&google_cver=1
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1701395917061
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://onetag-sys.com/match/?int_id=106&google_gid=CAESECGu7pF2HhMHxAjTB__6CXA&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
298
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
occ
ups.analytics.yahoo.com/ups/58488/ Frame E911 		0
15 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=1&gdpr_consent=
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1701395917061
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.225.218.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-225-218-10.compute-1.amazonaws.com
Software
ATS/9.1.10.87 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:42 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
/
onetag-sys.com/match/ Frame E911
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
  • https://onetag-sys.com/match/?int_id=29&uid=a0469c36-bc77-430e-9825-0adde7e331a8&gdpr=0&gdpr_consent=
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=29&uid=a0469c36-bc77-430e-9825-0adde7e331a8&gdpr=0&gdpr_consent=
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1701395917061
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location
https://onetag-sys.com/match/?int_id=29&uid=a0469c36-bc77-430e-9825-0adde7e331a8&gdpr=0&gdpr_consent=
date
Fri, 01 Dec 2023 01:58:42 GMT
server
Kestrel
content-length
233
sync
x.bidswitch.net/ Frame E911 		43 B
235 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.bidswitch.net/sync?ssp=onetag&gdpr=1&gdpr_consent=
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1701395917061
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.211.178.172 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
172.178.211.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date
Fri, 01 Dec 2023 01:58:42 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
sync
ads.yieldmo.com/v000/ Frame E954
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=561118&ev=1&rurl=https%3a%2f%2fads.yieldmo.com/v000/sync?userid=%%VGUID%%&pn_id=pp&gdpr=0&gdpr_consent=&gpp=&gpp_sid=&us_privacy=
  • https://ads.yieldmo.com/v000/sync?userid=oR97ZMVTiSrh&ev=1&pn_id=pp&gpp_sid=&gpp=&us_privacy=&pid=561118&gdpr_consent=&gdpr=0
43 B
596 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?userid=oR97ZMVTiSrh&ev=1&pn_id=pp&gpp_sid=&gpp=&us_privacy=&pid=561118&gdpr_consent=&gdpr=0
Requested by
Host: ads.yieldmo.com
URL: https://ads.yieldmo.com/pbcas?us_privacy=&gdpr=0&gdpr_consent=&type=iframe
Protocol
H2
Server
54.88.209.131 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-88-209-131.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
en-CA
location
https://ads.yieldmo.com/v000/sync?userid=oR97ZMVTiSrh&ev=1&pn_id=pp&gpp_sid=&gpp=&us_privacy=&pid=561118&gdpr_consent=&gdpr=0
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-74c7cffc45-q8bcq
expires
-1
sync
ads.yieldmo.com/v000/ Frame E954
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=yieldmo&ttd_tpi=1&ttd_puid=3zE7aqqnn7qUr6HrdVjl
  • https://ads.yieldmo.com/v000/sync?tdid=a0469c36-bc77-430e-9825-0adde7e331a8
43 B
610 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?tdid=a0469c36-bc77-430e-9825-0adde7e331a8
Requested by
Host: ads.yieldmo.com
URL: https://ads.yieldmo.com/pbcas?us_privacy=&gdpr=0&gdpr_consent=&type=iframe
Protocol
H2
Server
54.88.209.131 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-88-209-131.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

location
https://ads.yieldmo.com/v000/sync?tdid=a0469c36-bc77-430e-9825-0adde7e331a8
date
Fri, 01 Dec 2023 01:58:42 GMT
server
Kestrel
content-length
181
/
onetag-sys.com/match/ Frame E954
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.y...
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.y...
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NTk1OTFCM0YtMzQzOC00QUIyLTg2QzUtMkQ2MTRFNTcwNjIw&gdpr=-1&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
  • https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=476A89A3-0BB0-450F-AC03-2F959BAA28BD
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=476A89A3-0BB0-450F-AC03-2F959BAA28BD
Requested by
Host: ads.yieldmo.com
URL: https://ads.yieldmo.com/pbcas?us_privacy=&gdpr=0&gdpr_consent=&type=iframe
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location
https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=476A89A3-0BB0-450F-AC03-2F959BAA28BD
date
Fri, 01 Dec 2023 01:58:47 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
157
content-type
text/html; charset=utf-8
sync
ads.yieldmo.com/v000/ Frame E954
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=yieldmo_dbm&google_cm&pn_id=c
  • https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEASEEgvHwSkIqDJWnvimmD4&google_cver=1
43 B
607 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEASEEgvHwSkIqDJWnvimmD4&google_cver=1
Requested by
Host: ads.yieldmo.com
URL: https://ads.yieldmo.com/pbcas?us_privacy=&gdpr=0&gdpr_consent=&type=iframe
Protocol
H2
Server
54.88.209.131 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-88-209-131.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEASEEgvHwSkIqDJWnvimmD4&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
299
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sync
ads.yieldmo.com/v000/ Frame E954
Redirect Chain
  • https://ib.adnxs.com/getuid?https://ads.yieldmo.com/v000/sync?userid=$UID&pn_id=an
  • https://ads.yieldmo.com/v000/sync?userid=8961910970674910848&pn_id=an
43 B
599 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?userid=8961910970674910848&pn_id=an
Requested by
Host: ads.yieldmo.com
URL: https://ads.yieldmo.com/pbcas?us_privacy=&gdpr=0&gdpr_consent=&type=iframe
Protocol
H2
Server
54.88.209.131 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-88-209-131.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
an-x-request-uuid
dc49ae9d-c95d-44dd-984c-b6a6641dddc3
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://ads.yieldmo.com/v000/sync?userid=8961910970674910848&pn_id=an
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
cframe.js
assets.a-mo.net/js/ Frame BA56 		0
0
v1
lb.eu-1-id5-sync.com/lb/ 		33 B
277 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://lb.eu-1-id5-sync.com/lb/v1
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),
Reverse DNS
ns31533567.ip-162-19-138.eu
Software
/
Resource Hash
d47c77d905bb87aa5e629cc4da81d335bd377a3a045b7ea326040faa77559033
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
https://www.mediafire.com
date
Fri, 01 Dec 2023 01:58:41 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type
application/json;charset=UTF-8
PugMaster
image6.pubmatic.com/AdServer/ Frame CA11 		5 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=86407503&p=162948&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=162948
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.36.113.112 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
aceb1e9372b58ac7dfdce569c81beefe2f46853e4353310ecf11c390050cce80

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
text/html; charset=UTF-8
date
Fri, 01 Dec 2023 01:58:50 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
xuid
eb2.3lift.com/ Frame 9C7E
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=3658&xuid=a0469c36-bc77-430e-9825-0adde7e331a8&dongle=0cfd&gdpr=0&gdpr_consent=
37 B
355 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=3658&xuid=a0469c36-bc77-430e-9825-0adde7e331a8&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif
date
Fri, 01 Dec 2023 01:58:42 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
https://eb2.3lift.com/xuid?mid=3658&xuid=a0469c36-bc77-430e-9825-0adde7e331a8&dongle=0cfd&gdpr=0&gdpr_consent=
date
Fri, 01 Dec 2023 01:58:42 GMT
server
Kestrel
content-length
251
ebda
eb2.3lift.com/ Frame 9C7E
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDAzMzUzOTcxMTU1NTc4NjA4NDI4NQ%3D%3D
  • https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
37 B
139 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:42 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
content-type
image/gif

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
248
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
xuid
eb2.3lift.com/ Frame 9C7E
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEO25avhk7A3ETOq3Ssp8KD0&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
37 B
355 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEO25avhk7A3ETOq3Ssp8KD0&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif
date
Fri, 01 Dec 2023 01:58:42 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEO25avhk7A3ETOq3Ssp8KD0&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
332
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 9C7E
Redirect Chain
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDAzMzUzOTcxMTU1NTc4NjA4NDI4NQ%3D%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDAzMzUzOTcxMTU1NTc4NjA4NDI4NQ%3D%3D
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDAzMzUzOTcxMTU1NTc4NjA4NDI4NQ%3D%3D
date
Fri, 01 Dec 2023 01:58:42 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
setuid
px.ads.linkedin.com/ Frame 9C7E 		0
844 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=4033539711555786084285&dbredirect=true&gdpr=0&consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:44 GMT
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 180FD7A3E6AD4B3D8B37C2B7072C4453 Ref B: NYCEDGE1308 Ref C: 2023-12-01T01:58:45Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric
prod-lor1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYLaRvARBmJuMYXKq3ITA==
xuid
eb2.3lift.com/ Frame 9C7E
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/4033539711555786084285?gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-fWrWTLFE2oSf5brlw_9UGncr88I1LLJ7XdF0vSzhfA--~A&dongle=0883
37 B
355 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2662&xuid=y-fWrWTLFE2oSf5brlw_9UGncr88I1LLJ7XdF0vSzhfA--~A&dongle=0883
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif
date
Fri, 01 Dec 2023 01:58:43 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date
Fri, 01 Dec 2023 01:58:43 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
location
https://eb2.3lift.com/xuid?mid=2662&xuid=y-fWrWTLFE2oSf5brlw_9UGncr88I1LLJ7XdF0vSzhfA--~A&dongle=0883
content-length
0
xuid
eb2.3lift.com/ Frame 9C7E
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=triplelift&user_id=4033539711555786084285&gdpr=0&gdpr_consent=${GDPR_CONSENT}
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=a4aa8fa7-9617-489f-a8fd-b4612be68449&gdpr=0&gdpr_consent=
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=a4aa8fa7-9617-489f-a8fd-b4612be68449&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=7bf77b4b-d840-4833-9c17-8c93328d985b&ssp=triplelift&expires=30&user_group=5&bsw_param=a4aa8fa7-9617-489f-a8fd-b4612be68449
  • https://eb2.3lift.com/xuid?mid=2409&xuid=a4aa8fa7-9617-489f-a8fd-b4612be68449&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
37 B
355 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2409&xuid=a4aa8fa7-9617-489f-a8fd-b4612be68449&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif
date
Fri, 01 Dec 2023 01:58:42 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location
//eb2.3lift.com/xuid?mid=2409&xuid=a4aa8fa7-9617-489f-a8fd-b4612be68449&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Date
Fri, 01 Dec 2023 01:58:42 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
usersync.aspx
dis.criteo.com/dis/ Frame 9C7E 		0
0
xuid
eb2.3lift.com/ Frame 9C7E
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=0%26gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=3335&xuid=8961910970674910848&dongle=4d58&gdpr=0&gdpr_consent=
37 B
355 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=3335&xuid=8961910970674910848&dongle=4d58&gdpr=0&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif
date
Fri, 01 Dec 2023 01:58:42 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
an-x-request-uuid
e2c645c3-7c88-4853-92b4-d79f8f0d9543
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://eb2.3lift.com/xuid?mid=3335&xuid=8961910970674910848&dongle=4d58&gdpr=0&gdpr_consent=
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
setuid
ib.adnxs.com/prebid/ Frame 9C7E 		43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/prebid/setuid?bidder=triplelift_native&gdpr=0&gdpr_consent=&uid=4033539711555786084285
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.164 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
an-x-request-uuid
f01be2c4-26b3-4229-a76c-fc090a82c850
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
image/gif
cache-control
no-store, no-cache, private
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length
43
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
texto_logo.svg
s0.2mdn.net/sadbundle/16527439329884676748/ Frame 80D2 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/16527439329884676748/texto_logo.svg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
cbbd6285bb18a8c92cc59574c958877754850f795f0f4dad205c79fd21d1d467
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 11:16:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
52947
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2125
x-xss-protection
0
last-modified
Thu, 25 Nov 2021 15:48:57 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 11:16:15 GMT
sol_logo.svg
s0.2mdn.net/sadbundle/16527439329884676748/ Frame 80D2 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/16527439329884676748/sol_logo.svg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
08bb8bf8ea037474da111ae1a70781e3210f7a0b29ac2f61cc5e88a3e37b920d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 11:16:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
52947
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1118
x-xss-protection
0
last-modified
Thu, 25 Nov 2021 15:48:57 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 11:16:15 GMT
PALM.svg
s0.2mdn.net/sadbundle/16527439329884676748/ Frame 80D2 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/16527439329884676748/PALM.svg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
afcd6ebf6cf7124e138218f69982d6c9ca1820345967c9263d243dbf5631d204
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 11:16:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
52947
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1519
x-xss-protection
0
last-modified
Thu, 25 Nov 2021 15:48:57 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 11:16:15 GMT
palmera2.png
s0.2mdn.net/sadbundle/16527439329884676748/ Frame 80D2 		960 KB
961 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/16527439329884676748/palmera2.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
73f6add564f8d8c794d4b1bd49749c1770990b44616591ea59ce7333cf05a574
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 11:16:15 GMT
x-content-type-options
nosniff
age
52947
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
983441
x-xss-protection
0
last-modified
Thu, 25 Nov 2021 15:48:57 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 11:16:15 GMT
palmera.png
s0.2mdn.net/sadbundle/16527439329884676748/ Frame 80D2 		941 KB
941 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/16527439329884676748/palmera.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
22e99768051bfffd5038e9ead749c8beab5ed5f1042a82eaa188096b2c63d4a1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 11:14:57 GMT
x-content-type-options
nosniff
age
53025
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
963679
x-xss-protection
0
last-modified
Thu, 25 Nov 2021 15:48:57 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 11:14:57 GMT
alwaysOn.jpg_1688031171872_alwaysOn.jpg
s0.2mdn.net/dynamic/2/10889189/s0.2mdn.net/creatives/assets/4372216/ Frame 80D2 		170 KB
170 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/dynamic/2/10889189/s0.2mdn.net/creatives/assets/4372216/alwaysOn.jpg_1688031171872_alwaysOn.jpg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
a47ca510e702a8bb97e5fdf139d5fc1b038e1613bba446a49905dbd653e8f028
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/16527439329884676748/index.html?e=69&leftOffset=0&topOffset=0&c=fdH7kAjxRY&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 18:46:58 GMT
x-content-type-options
nosniff
age
25904
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
173580
x-xss-protection
0
last-modified
Thu, 29 Jun 2023 09:32:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-programmable"
report-to
{"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 29 Nov 2024 18:46:58 GMT
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame 819A 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:42 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
238333
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
82e7ba021be436b7-YYZ
expires
Thu, 31 Dec 2037 23:55:55 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 3297 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu6WAfbpibv5hMWqtqN-97VgizYWM7WaSO1vPNOIiuNo8V6gEfwNbvr-eYx0NnM4AuVyJx7hw1fQSeYWZ1p0_kB1aC9T3lnp1q1b1vY8i8oRUxvTAY86wv0unwP-ldR5Ly_Jq6bLV11Xg&sai=AMfl-YQ8ZRokkhnRYJ7Bzr_wEQBZZUz7qrjdcrsyX1WSnrRgLS6-U6g8gjrwjNfjs5Yr3Q7yUmnmk0HbaD5nKNhwX6G2ZFqCc5G8aN0A1HrWo0jT9xiLLYPRggZwihP7iKhuvTPv9Vv24g&sig=Cg0ArKJSzNNymg_UTyZ_EAE&cid=CAQSOwDICaaN7XaaiLCL_O1bfZxGF0t1VeWT3DS-qYQOSHyqVqTTKvwcB5FJ3do6P49gx2JuMARx42OayRawGAE&id=lidar2&mcvt=1002&p=420,320,670,620&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20231129&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2694534479&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701395921003&rpt=268&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
drop_cookie_sw.php
csync.smilewanted.com/ Frame 5005 		0
318 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
82e7ba028c8336b7-YYZ
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 01 Dec 2023 01:58:42 GMT
server
cloudflare
vary
Accept-Encoding
6271432635359966753
csync.smilewanted.com/set_partner_userid_get/smart/ Frame DE0C
Redirect Chain
  • https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid]
  • https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid]&cklb=1
  • https://csync.smilewanted.com/set_partner_userid_get/smart/6271432635359966753
0
409 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smart/6271432635359966753
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
82e7ba05287636b7-YYZ
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 01 Dec 2023 01:58:42 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache,no-store
content-length
0
date
Fri, 01 Dec 2023 01:58:41 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/smart/6271432635359966753
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
pragma
no-cache
activeview
pagead2.googlesyndication.com/pcs/ Frame ED73 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssc32XzUcKcjqpdWx-pWLfzJOrwPAxx22sHuo0R97IUmyaI12gsDp0hqbpVfdw2xohqi0I53OjrEv6M48EzYKnWBxfq09S5Ws1Uza_TUEfldQj61W7Tdi6SliCuoZXVYJ13aqenEqwxpA&sai=AMfl-YQm-7g0B1SyWKO7aTLMkW4sETn6K2kEsl0rog05K1Tsttmbc55l2yT8y5HeuXGmO-9ix8wrUHcjpz91qJG5UEZfzuoiSy9ekRPY8sC4SOwxY5CG_ytM31KtGYj5m6mqslSuGYknhw&sig=Cg0ArKJSzNb3P0E8Orc8EAE&cid=CAQSOwDICaaNu779KG74DNBvZqZnlKWXzyz-Rbb0xxsOh6fIUrkUBLi322NagyGfUswfwNmBHyN9PfeFc-PxGAE&id=lidar2&mcvt=1000&p=10,702,100,1430&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231129&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3863269515&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701395921040&rpt=290&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
8961910970674910848
csync.smilewanted.com/set_partner_userid_get/appnexus/ Frame A50E
Redirect Chain
  • https://secure.adnxs.com/getuid?https://csync.smilewanted.com/set_partner_userid_get/appnexus/$UID
  • https://csync.smilewanted.com/set_partner_userid_get/appnexus/8961910970674910848
0
80 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/appnexus/8961910970674910848
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
82e7ba035dbd36b7-YYZ
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 01 Dec 2023 01:58:42 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
access-control-allow-origin
*
an-x-request-uuid
247baa42-a2d3-426e-a75b-bc680728883c
cache-control
no-store, no-cache, private
content-length
0
content-type
text/html; charset=utf-8
date
Fri, 01 Dec 2023 01:58:42 GMT
expires
Sat, 15 Nov 2008 16:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/appnexus/8961910970674910848
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma
no-cache
server
nginx/1.21.3
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection
0
container.html
c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 3611 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.62.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f132.1e100.net
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 01:58:41 GMT
expires
Sat, 30 Nov 2024 01:58:41 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNTIwMzQ2NDY1MTYyNjQxNCIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tZWRnZS0xLTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiIzIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI1MjAzNDY0NjUxNjI2NDE0IiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1lZGdlLTEtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiMjk1YmMwMTg2NGJmM2RiZDAxMTdlMGEzZjdmNmJjOTYsMjkxZDI3MzEzZWI2NmM1MDI0MzEyOWIyM2RmOGE1NzkifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjUyMDM0NjQ2NTE2MjY0MTQiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicmV2ZW51ZSI6MC4wMDAxLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDEsInN0YXRfc291cmNlX2lkIjozNSwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI1MjAzNDY0NjUxNjI2NDE0IiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1lZGdlLTEtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgyNDExMjM1MTcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjUyMDM0NjQ2NTE2MjY0MTQiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjQ5NzQ5MDI4MzIifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:42 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:42 GMT
4974902832
go.ezodn.com/dac/ 		0
570 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/dac/4974902832
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-3&bv=280&PageSpeed=off
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:42 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2381
alt-svc
h3=":443"; ma=86400
content-length
0
last-modified
Fri, 01 Dec 2023 00:57:11 GMT
server
cloudflare
access-control-max-age
1728000
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.mediafire.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M3%2F1ZxFVDDCA%2Fno%2BoKbiAyqwxmRe4GfhxdFsh0lBc%2B5m%2Bmo5Jf3GWhyvJxYfV694FPdZYrsmy4s2AC3t%2BHcTWNgDltuAeFtRSGMaSZ6ooX8ukdlpN9pxJIXJsbcGRjM%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=14400
access-control-allow-credentials
true
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges
bytes
cf-ray
82e7ba035b154379-EWR
access-control-allow-headers
Content-Type
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNTIwMzQ2NDY1MTYyNjQxNCIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tZWRnZS0xLTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjMtMTEtMzAifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxNyJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI0In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6IjQ4MCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:42 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:42 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNTIwMzQ2NDY1MTYyNjQxNCIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tZWRnZS0xLTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJhdWN0aW9uX2Vwb2NoIjoxNzAxMzk1OTIyLCJhZF9wb3NpdGlvbiI6MTEwMSwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImJpZF9mbG9vcl9pbml0aWFsIjo2MCwiYmlkX2Zsb29yX3ByZXYiOjMwLCJiaWRfZmxvb3JfZmlsbGVkIjo2LCJhdWN0aW9uX2NvdW50IjozLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo0MzcsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjIxNzMyMTE4OTE0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzJ9XQ==
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:42 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:42 GMT
LPLZ7BS5-D-FDIX
csync.smilewanted.com/set_partner_userid_get/rubicon/ Frame 7E05
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-smilewanted&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/rubicon/LPLZ7BS5-D-FDIX?gdpr=0
0
371 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rubicon/LPLZ7BS5-D-FDIX?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
82e7ba03fecd36b7-YYZ
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 01 Dec 2023 01:58:42 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/rubicon/LPLZ7BS5-D-FDIX?gdpr=0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma
no-cache
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
content-length
0
avw
neural40.cdnwebcloud.com/ Frame BD09 		0
105 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://neural40.cdnwebcloud.com/avw?1678502078104&n_o_aut_tc=329167526
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.50.63.24 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-50-63-24.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 01 Dec 2023 01:58:42 GMT
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
457.json
id5-sync.com/g/v2/ 		625 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/g/v2/457.json
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-3-71
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.120 Frankfurt am Main, Germany, ASN16276 (OVH, FR),
Reverse DNS
ns31533571.ip-162-19-138.eu
Software
/
Resource Hash
8a997549f8c0feabf33e6b770a4ecc2d7aa59515179d17619264f9da341885ff
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
https://www.mediafire.com
date
Fri, 01 Dec 2023 01:58:42 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-credentials
true
p3p
CP="CAO PSA OUR"
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type
application/json;charset=UTF-8
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 7FA1 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158810&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fpubmatic%2F
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.215.40.199 McAllen, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-215-40-199.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=147559
content-encoding
gzip
content-length
5622
content-type
text/html
date
Fri, 01 Dec 2023 01:58:42 GMT
expires
Sat, 02 Dec 2023 18:58:01 GMT
last-modified
Thu, 16 Nov 2023 09:11:44 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
pixel
googleads.g.doubleclick.net/xbbe/ Frame F874 		356 B
185 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3AThCB-1gYz4LW-gEwAQ&v=APEucNU8b7PilS76NHiKr6tNhS9OigcP0Cm46YFtYszYVj5mDbOlhe9nyRYpkMDSyxdh7EXCpNXNoE-zX72Prff-0hxALFANq4RAZmhfxRFcSvnd9NQtlQw
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
cafe /
Resource Hash
55f56026d86468db4135723445d1df3498809ce536fa7a518b2847d7e6a27a96
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
br
content-length
165
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 01:58:42 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
express_html_inpage_rendering_lib_200_278.js
s0.2mdn.net/879366/ Frame 3611 		111 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Origin
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 06:39:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
69530
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39806
x-xss-protection
0
last-modified
Tue, 14 Mar 2023 18:44:05 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 01 Dec 2023 06:39:52 GMT
omrhp_fy2021.js
pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/elements/html/ Frame 3611 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/elements/html/omrhp_fy2021.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 22:35:25 GMT
content-encoding
br
x-content-type-options
nosniff
age
12197
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3071
x-xss-protection
0
server
cafe
etag
10674441169935035545
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 22:35:25 GMT
abg_lite_fy2021.js
pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/ Frame 3611 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/abg_lite_fy2021.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
b67ad968ba3668562f331df45b73501e17c7c166bcf7e5443c33633cbc9d5783
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 18:42:45 GMT
content-encoding
br
x-content-type-options
nosniff
age
26157
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9305
x-xss-protection
0
server
cafe
etag
13635642240219548939
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 18:42:45 GMT
Q12zgMmT.js
tpc.googlesyndication.com/sodar/ Frame 3611 		41 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Q12zgMmT.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
sffe /
Resource Hash
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 09:08:53 GMT
content-encoding
br
x-content-type-options
nosniff
age
146989
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13937
x-xss-protection
0
last-modified
Fri, 25 Aug 2023 23:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2024 09:08:53 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 3611 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/window_focus_fy2021.js
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 19:53:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
21896
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 19:53:46 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 93F0 		1 KB
643 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
76984
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=86400
content-encoding
br
content-length
618
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 30 Nov 2023 04:35:38 GMT
etag
48472445140208031
expires
Fri, 01 Dec 2023 04:35:38 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 3611 		20 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
cafe /
Resource Hash
09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 19:53:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
21896
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8544
x-xss-protection
0
server
cafe
etag
17124069415086231762
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 19:53:46 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 3611 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DVjzTE4XjGJd6VSfR-bT76Sv5ZEcnXEh5V-0d2Sk63hXmv6LhHnFZsHD0-ymx6VQnjprSibP7DsWm1GvvDZZCs5QjRfFXekPYsgh2TXRK2bqDsLBE
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
l
www.google.com/ads/measurement/ Frame 3611 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTbN_cEucn-yyAK-84FqKsE4UKfkUXCz3zUfNuSuOZCIc9ZSw0kgm-nOlcJ4L6Lv-nPVtboJWWdO6jnNFz_ranZdiTdyg
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f105.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers
ufs_web_display.js
www.googletagservices.com/activeview/js/current/ Frame 3611 		202 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
sffe /
Resource Hash
1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
65067
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1701261208926228"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 01 Dec 2023 01:58:42 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
63 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQ2OTEyMjQ5NTU4ODc4MiIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTQtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0ODg5ODg4LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE0NjkxMjI0OTU1ODg3ODIiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS00LTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDg4OTg4OCwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxNDY5MTIyNDk1NTg4NzgyIiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtNC0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ4ODk4ODgsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiNjMifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:46 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:46 GMT
032b313a-9bd4-43d9-bcc5-c1d15ae21a9d&partner_id=1010
csync.smilewanted.com/set_partner_userid_get/improve/ Frame E681
Redirect Chain
  • https://ice.360yield.com/server_match?r=https://csync.smilewanted.com/set_partner_userid_get/improve/{PUB_USER_ID}&partner_id=1010
  • https://ice.360yield.com/ul_cb/server_match?r=https://csync.smilewanted.com/set_partner_userid_get/improve/%7BPUB_USER_ID%7D&partner_id=1010
  • https://csync.smilewanted.com/set_partner_userid_get/improve/032b313a-9bd4-43d9-bcc5-c1d15ae21a9d&partner_id=1010
0
575 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/improve/032b313a-9bd4-43d9-bcc5-c1d15ae21a9d&partner_id=1010
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
82e7ba1938f936b7-YYZ
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 01 Dec 2023 01:58:46 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

access-control-allow-origin
*
content-length
0
content-type
text/plain
date
Fri, 01 Dec 2023 01:58:45 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/improve/032b313a-9bd4-43d9-bcc5-c1d15ae21a9d&partner_id=1010
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
62bHydCX.html
tpc.googlesyndication.com/sodar/ Frame 7447 		38 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/62bHydCX.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
sffe /
Resource Hash
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
152038
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
br
content-length
13045
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 29 Nov 2023 07:44:44 GMT
expires
Thu, 28 Nov 2024 07:44:44 GMT
last-modified
Fri, 25 Aug 2023 23:48:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
pixel
cm.g.doubleclick.net/ Frame F874
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&gdpr=0&redir=true
  • https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS16ejFsNnRCRTJ1RlROalYyTDlyWnMxYXNVZURoSEdpOH5B&gdpr=0
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS16ejFsNnRCRTJ1RlROalYyTDlyWnMxYXNVZURoSEdpOH5B&gdpr=0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3AThCB-1gYz4LW-gEwAQ&v=APEucNU8b7PilS76NHiKr6tNhS9OigcP0Cm46YFtYszYVj5mDbOlhe9nyRYpkMDSyxdh7EXCpNXNoE-zX72Prff-0hxALFANq4RAZmhfxRFcSvnd9NQtlQw
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS16ejFsNnRCRTJ1RlROalYyTDlyWnMxYXNVZURoSEdpOH5B&gdpr=0
date
Fri, 01 Dec 2023 01:58:42 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
pixie
jelly.mdhv.io/v4/ Frame F874
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_cm&google_dbm&gdpr=0
  • https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEFdef8FhrmoQJ8DdXumOBp0&google_cver=1&gdpr=0
  • https://1f2e7.v.fwmrm.net/ad/u?_dv=2&dsp_user_mapping=true&127719=19e74a65c36c6d13014e8a2869ef343&rdU=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D1169%26userId%3d%23%7bu...
  • https://ads.stickyadstv.com/user-registering?dataProviderId=1169&userId=umo1a91_7309131076569196210&gdpr=0&gdpr_consent=
  • https://pr-bh.ybp.yahoo.com/sync/stickyads/19e74a65c36c6d13014e8a2869ef343?gdpr=0&gdpr_consent=
  • https://ads.stickyadstv.com/user-registering?dataProviderId=199&userId=y-vNmC.6hE2oPtOk768c6C9fHHUvO.6FFhvH_nRcIW~A
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=stickyads&ttd_tpi=1
  • https://ads.stickyadstv.com/user-registering?dataProviderId=208&userId=a0469c36-bc77-430e-9825-0adde7e331a8&gdpr=0&gdpr_consent=
  • https://match.prod.bidr.io/cookie-sync/stv?gdpr=0&gdpr_consent=
  • https://match.prod.bidr.io/cookie-sync/stv?gdpr=0&gdpr_consent=&_bee_ppp=1
  • https://ads.stickyadstv.com/user-registering?userId=AAB0vk7K0nwAABPqtqAq9A&dataProviderId=817&gdpr=0
  • https://pm.w55c.net/ping_match.gif?st=FREEWHEEL&rurl=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D593&userId=_wfivefivec_&gdpr=0
  • https://pm.w55c.net/ping_match.gif?scc=1&st=FREEWHEEL&rurl=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D593&userId=_wfivefivec_&gdpr=0
  • https://ads.stickyadstv.com/user-registering?dataProviderId=593&userId=ukFBPzdY1R8SNN5&gdpr=0
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D209%26userId%3D$UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0
  • https://ads.stickyadstv.com/user-registering?dataProviderId=209&userId=8961910970674910848&gdpr=0&gdpr_consent=&gdpr=0
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=stickyadstv&append=1&cb=4624239&redirect=https%3A%2F%2Fads.stickyadstv.com%2Fuser-registering%3FdataProviderId%3D690%26userId%3D&gdpr=0&gd...
  • https://ads.stickyadstv.com/user-registering?dataProviderId=690&userId=bf3b4c55-e598-442d-83b3-e58668bc1d22
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=103&gdpr=0&gdpr_consent=
  • https://ads.stickyadstv.com/user-registering?dataProviderId=721&userId=736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553&gdpr=0&gdpr_consent=
  • https://jelly.mdhv.io/v4/pixie?gdpr=0&gdpr_consent=
0
0
pixel
cm.g.doubleclick.net/ Frame F874
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=11
  • https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=MTllNzRhNjVjMzZjNmQxMzAxNGU4YTI4NjllZjM0Mw==&gdpr=0&gdpr_consent=
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=MTllNzRhNjVjMzZjNmQxMzAxNGU4YTI4NjllZjM0Mw==&gdpr=0&gdpr_consent=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3AThCB-1gYz4LW-gEwAQ&v=APEucNU8b7PilS76NHiKr6tNhS9OigcP0Cm46YFtYszYVj5mDbOlhe9nyRYpkMDSyxdh7EXCpNXNoE-zX72Prff-0hxALFANq4RAZmhfxRFcSvnd9NQtlQw
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:42 GMT
Server
nginx
Access-Control-Allow-Origin
*
Location
https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=MTllNzRhNjVjMzZjNmQxMzAxNGU4YTI4NjllZjM0Mw==&gdpr=0&gdpr_consent=
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
x-sticky-vk
1701395922584062-294
truncated
/ Frame 3611 		213 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9eecc85da8f895653a7841f3e97714d4793d4d4c6f681ab0d821eccf3edf49e

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/png
pixel
cm.g.doubleclick.net/ Frame 93F0
Redirect Chain
  • https://aep.mxptint.net/sn.ashx?google_gid=CAESENQB-rpzQBFSNvIns5aXglU&google_cver=1&google_push=AXcoOmRpkqT6aX94zDC_707sw_bjgzE-org_5aKqQNn-jiMWtQJ7_K3xqXNrVy06dJiRnO5XIYy5aYuEElHnuCG3y8SvPgXKjw
  • https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmRpkqT6aX94zDC_707sw_bjgzE-org_5aKqQNn-jiMWtQJ7_K3xqXNrVy06dJiRnO5XIYy5aYuEElHnuCG3y8SvPgXKjw&google_hm=UjMzNjQ1XzEwQ0ZDQU...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmRpkqT6aX94zDC_707sw_bjgzE-org_5aKqQNn-jiMWtQJ7_K3xqXNrVy06dJiRnO5XIYy5aYuEElHnuCG3y8SvPgXKjw&google_hm=UjMzNjQ1XzEwQ0ZDQUZEQl9BRUExOEJGMw%3D%3D
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:49 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmRpkqT6aX94zDC_707sw_bjgzE-org_5aKqQNn-jiMWtQJ7_K3xqXNrVy06dJiRnO5XIYy5aYuEElHnuCG3y8SvPgXKjw&google_hm=UjMzNjQ1XzEwQ0ZDQUZEQl9BRUExOEJGMw%3D%3D
Date
Fri, 01 Dec 2023 01:58:49 GMT
Cache-Control
private
Strict-Transport-Security
max-age=-384400729; includeSubDomains
P3P
CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE", CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE"
Content-Length
344
Content-Type
text/html; charset=utf-8
pixel
cm.g.doubleclick.net/ Frame 93F0
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEOpAtE_gQ1Sx0ogcj7FSe9s&google_cver=1&google_push=AXcoOmTpCNen9vzoa9lnBqW8MLxLV0bz0CL3rWbGWbuAxoOWpfq5f-iWgURPUm52mMEvBE89Ql3NWSapbqYZCGDKH53B...
  • https://p.rfihub.com/cm?in=1&pub=20513&ssp=google&gdpr=&gdpr_consent=
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=969188722382023932&expires=30&ssp=google
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmQVK6gkRaNEYIFI-iQHYnTQXfz9Ih8crhrQ1-Ax_b3V67_83whxhX9uHrQ7BA6TGdqNWLmsy0bB_oqKhH6PGuj2IPbSLA0ovw&google_hm=pKqPp5YXSJ-o_bRhK-aESQ==
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmQVK6gkRaNEYIFI-iQHYnTQXfz9Ih8crhrQ1-Ax_b3V67_83whxhX9uHrQ7BA6TGdqNWLmsy0bB_oqKhH6PGuj2IPbSLA0ovw&google_hm=pKqPp5YXSJ-o_bRhK-aESQ==
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:46 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
//cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmQVK6gkRaNEYIFI-iQHYnTQXfz9Ih8crhrQ1-Ax_b3V67_83whxhX9uHrQ7BA6TGdqNWLmsy0bB_oqKhH6PGuj2IPbSLA0ovw&google_hm=pKqPp5YXSJ-o_bRhK-aESQ==
Date
Fri, 01 Dec 2023 01:58:46 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
v1
match.sharethrough.com/sync/ Frame 93F0
Redirect Chain
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEIG2LyTobK3Pz4uREu0ePDk&google_cver=1&google_push=AXcoOmQgfRoDX6ntM-yTy8Fgd7MCYFaoBQUNvy2QxWUC5ySZXc2RD-MEVFGD-Vd671d-h86fn7hXYv8tZVu4XDt9...
  • https://match.sharethrough.com/sync/v1?source_id=xTFJbLbs37tyhbKsPP9VC2cm&source_user_id=7a252ca9f1&gdpr=0&gdpr_consent=
68 B
279 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=xTFJbLbs37tyhbKsPP9VC2cm&source_user_id=7a252ca9f1&gdpr=0&gdpr_consent=
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Server
3.226.187.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-226-187-105.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:46 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

date
Fri, 01 Dec 2023 01:58:45 GMT
via
1.1 122cd39a473c6e4835362753fc929a08.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
IAD89-P2
x-cache
Miss from cloudfront
location
https://match.sharethrough.com/sync/v1?source_id=xTFJbLbs37tyhbKsPP9VC2cm&source_user_id=7a252ca9f1&gdpr=0&gdpr_consent=
cache-control
no-cache, must-revalidate
content-length
0
x-amz-cf-id
goCp8AKB2Kzu-TNQI_aDcAiOU36F0fHimMYjB3CwBtqTTp4WlWTbsw==
pub
cs.chocolateplatform.com/ Frame 93F0 		0
0
pixel
cm.g.doubleclick.net/ Frame 93F0
Redirect Chain
  • https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEF-DsbDz9VWB6RVYWA5uxIs&google_cver=1&google_push=AXcoOmTQDMHbUVuQB0x6a0aGBYOFNxKyRxrvEOo3si28IHEE5czlWmgCvmJHDGffD62mCBp16jr38c...
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AXcoOmTQDMHbUVuQB0x6a0aGBYOFNxKyRxrvEOo3si28IHEE5czlWmgCvmJHDGffD62mCBp16jr38cJQPr7zwNK7TDBfITiiiZPu&google_hm=Njc0NjQ0NT...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AXcoOmTQDMHbUVuQB0x6a0aGBYOFNxKyRxrvEOo3si28IHEE5czlWmgCvmJHDGffD62mCBp16jr38cJQPr7zwNK7TDBfITiiiZPu&google_hm=Njc0NjQ0NTgzOTIyNTA3NTI4Mw%3D%3D
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AXcoOmTQDMHbUVuQB0x6a0aGBYOFNxKyRxrvEOo3si28IHEE5czlWmgCvmJHDGffD62mCBp16jr38cJQPr7zwNK7TDBfITiiiZPu&google_hm=Njc0NjQ0NTgzOTIyNTA3NTI4Mw%3D%3D
date
Fri, 01 Dec 2023 01:58:43 GMT
content-length
0
pixel
cm.g.doubleclick.net/ Frame 93F0
Redirect Chain
  • https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEC2LbqsZqbI6R1ZYep-EbaE&google_cver=1&google_push=AXcoOmTGn0Zm_YFGu3go5ywjIfEM_nGQE0o4HF7i5-laNwPbO6YSTyCY3q3NlmDha0q5gK0ZRZrkipOEOUoZfoR0X...
  • https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEC2LbqsZqbI6R1ZYep-EbaE&google_cver=1&google_push=AXcoOmTGn0Zm_YFGu3go5ywjIfEM_nGQE0o4HF7i5-laNwPbO6YSTyCY3q3NlmDha0q5gK0ZRZrkipOEOUoZfoR0X...
  • https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=M2JjMmI1NGU5NmE4NDJmNg&google_push=AXcoOmTGn0Zm_YFGu3go5ywjIfEM_nGQE0o4HF7i5-laNwPbO6YSTyCY3q3NlmDha0q5gK0ZRZrkipOEOUoZfoR0XbD-K5gS...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=M2JjMmI1NGU5NmE4NDJmNg&google_push=AXcoOmTGn0Zm_YFGu3go5ywjIfEM_nGQE0o4HF7i5-laNwPbO6YSTyCY3q3NlmDha0q5gK0ZRZrkipOEOUoZfoR0XbD-K5gST5ngWw
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:44 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=M2JjMmI1NGU5NmE4NDJmNg&google_push=AXcoOmTGn0Zm_YFGu3go5ywjIfEM_nGQE0o4HF7i5-laNwPbO6YSTyCY3q3NlmDha0q5gK0ZRZrkipOEOUoZfoR0XbD-K5gST5ngWw
date
Fri, 01 Dec 2023 01:58:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
server
nginx
content-length
0
google
trace.mediago.io/cs/ Frame 93F0 		0
0
attr
cm.g.doubleclick.net/pixel/ Frame 93F0 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JxRi5AwmpGw2vi5Nm1bd1RHgpS5iKyvArQf1wKPNM_iQ_WAjHJnH4P4Eoy3Mxd4otUs5B1sQk
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:42 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
army.gif
g.ezoic.net/porpoiseant/ 		0
63 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzY5ODAwNjYyMzU4Nzk0MiIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tYm94LTItMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc1NDAyMzE5LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbNzI4LDkwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzY5ODAwNjYyMzU4Nzk0MiIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tYm94LTItMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc1NDAyMzE5LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijc2OTgwMDY2MjM1ODc5NDIiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NTQwMjMxOSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIxNCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:44 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:44 GMT
Ad9-160-600.html
s0.2mdn.net/sadbundle/11674851576237916465/Ad9-160-600/ Frame 7F61 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/11674851576237916465/Ad9-160-600/Ad9-160-600.html?ev=01_250
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
213f0714452c73943317a205b4a11e88004b252469dc4cb5f1603c8f03712f5b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
404350
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
2319
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy
cross-origin
date
Sun, 26 Nov 2023 09:39:32 GMT
expires
Mon, 25 Nov 2024 09:39:32 GMT
last-modified
Mon, 09 Oct 2023 15:48:50 GMT
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-xss-protection
0
view
ad.doubleclick.net/pcs/ Frame 3611 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/pcs/view?xai=AKAOjsvpoL5b_nySFzlK3fyUb_5pFUAkGsi7GWhiutKgbEGkcOIIXZ_lk2u-TcHqc5wEvy6XNnYsoMsJx9cGY5leFf2uQpkkjZiKcIVHKv3CVg4Inn67QjDyloaRTrDrApGR-5icxr2oKN-NULKHquUznhceGMlDUVWIcrSHX80BjO9OiIIHXmuTJbglNYe4fOTnw-gc1OItqDzdKHdH3U4lgRo39rh7WVAy0huTi-WjsAmbs89INjXe15PwFy3WVKAK6-lNuja5xTOG03Ke1pqzQh60L9tAxpPXs-2c3OMCkrcp2UKz90YmIAwjpXP-RUXIoOWOpy2YHNzxAswoXc5Iv__aFdqk2hA39OFHWXlrJl5WULwb96xzJxQNANN6DE8q8fAv9VWkanrfu4ngHBXm3hGaOddI-ji9-8FN6c9il3hQosBeYuhnMlLmQdWm-M-IoClSGsgswdEPs4QZ2gGW5nIEvjDsK9Xcmc2URUrZthD5zcT-US-xJbzvHKCWIATixeC3BnSXcOzPxaFdndjB_kHVL5IN40SjgN2CPVX7fPcl_1p2JjjIbbjY9njgliGyTFj2MZxl6Qi_xAZC9KIixD3bcpx1dc-lTrH1obaclbu4NLlHaztdcnGskW6TzPR3QFFMLcospITNsumSKysQ3lYYpdtP2rBZshg0rCKZ1z8gjt1_5y1HO1QQtnZUd8a4Y1KHUDyNqPLinGrL1_qRLOrmSRGnYDwpfqsYS_XtrFuymS_JR1M1G6p3iD-iuyaqaZCEthJ07RClqL6rNneTiI1LlVJJTkCJuQrFNOP9HleuDnaeCRQcJL1Jy1ef0D76IAcYYwm_MnFxjcVZ4Q75rSDN-jK_xCARa455jRMUUju1O1fUnXJDiLuUisVgdiZ8CJfGcFe1cY2NdaddQaUxoD1L0YKoMh-Vvq9tTtHfEh_XeL7Uzv4IkI0jGYWETdVnnYwqcxgFIk7oELJHjAX_GkzeQZ3-24-vZ4n_PVUA8e0b2da2K-7aQ2TC_nrdP_knpIrH20hVBMGFPoRmsl93PFQBiRp0iutFeODe_RTdPmeUTcnIuZDTiVLBQNJxshWs1stDRKUV1aSdhbtsRWM_kX6t-bwIKxKnZDrleDfr99SIPp4VoTZnMcn7gEK4v4nJZSq3jCcN7TCx1EZfxun0aPS_bZSIuyAEwpvzcYo28FMfwHnbdbLKuAYnmj4kIV89Vmx7y6cMCYrt5cZUs0t-uFKIVwASX5ok9e2fnk1BfCGnQb6GxRvgdbwVfhdC6_wPL8bZRFDSRGsRfxPS2ilTLcAG6dZWuJhJc37NtOKworCdeVfWTO1TdmovwSNeP60UMLJH0b72bs7AZL0WUwjNcdgMw88jWZFePAdIPwCWGucfGH_89dh107_eJAONddow2v0pk_rskA&sai=AMfl-YQl88Ktiez4Hd4zF_ZGTWjG07ksuj8kUFG-gOce4kNSW5A_GJpIBxv68oT2t_vxq0tSGm7F2Tj9c_sEfD4VLdwJnhfk5R3-TUWWHVY_jkRFrOdhchwn0Gcyi4HRto_CjY66V7mPzqwT7mWdgRv_u1nbSn0eCG9cqCUdzyexZ1nA8tGqQODobc0Y--sNKewA1nCWXTRgHtvqVgvOhwP9oxQRsCz8kymfxcvf-MWKgqXsnBYzwsexOit0G_CKyWOG6P91IE8seq07v2XwrkAbGDb93kEoruHxWQS6J6CDE6stnOfAumR8QcS42UkuxSYYzS2A4JVePHU0tk0W0P6VdvtbFBDb9z5Dzcpbft6ZXiC60j6ZACiJNSIXGMj3Sc9EZHJA5ie6Ck0zg8Br-DWs0KMNLaWxqBTGISKtePcgpk0pzRPucq6k&sig=Cg0ArKJSzF6BF6FN3l4EEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9jb3N0YXIuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=106&cbvp=1&cstd=105&cisv=r20231129.31175&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f149.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy
script-src 'none'; object-src 'none'
date
Fri, 01 Dec 2023 01:58:42 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
content-type
image/gif
cache-control
private
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
77209c27-0cd5-4694-9602-687603ff073e
csync.smilewanted.com/set_partner_userid_get/openx/ Frame 8A93
Redirect Chain
  • https://u.openx.net/w/1.0/cm?id=158474f5-20ec-4fcc-8ba8-4c101c556b25&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fopenx%2F
  • https://csync.smilewanted.com/set_partner_userid_get/openx/77209c27-0cd5-4694-9602-687603ff073e
0
427 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/openx/77209c27-0cd5-4694-9602-687603ff073e
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
82e7ba05186336b7-YYZ
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 01 Dec 2023 01:58:42 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
0
content-type
text/html
date
Fri, 01 Dec 2023 01:58:42 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/openx/77209c27-0cd5-4694-9602-687603ff073e
p3p
CP="CUR ADM OUR NOR STA NID"
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
via
1.1 google
Hvu2ZLZHRMHRFVFyQd6nRYRY
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame CAAF
Redirect Chain
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID&sovrn_retry=true
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/Hvu2ZLZHRMHRFVFyQd6nRYRY
0
534 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sovrn/Hvu2ZLZHRMHRFVFyQd6nRYRY
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
82e7ba0b7a6b36b7-YYZ
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 01 Dec 2023 01:58:43 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Fri, 01 Dec 2023 01:58:43 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/sovrn/Hvu2ZLZHRMHRFVFyQd6nRYRY
X-Sovrn-Pod
ad_ap1ewr1
Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
pagead2.googlesyndication.com/bg/ Frame 7447 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
sffe /
Resource Hash
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 00:33:55 GMT
content-encoding
br
x-content-type-options
nosniff
age
5087
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15165
x-xss-protection
0
last-modified
Tue, 28 Nov 2023 18:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 30 Nov 2024 00:33:55 GMT
createjs.min.js
code.createjs.com/1.0.0/ Frame 7F61 		236 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.createjs.com/1.0.0/createjs.min.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11674851576237916465/Ad9-160-600/Ad9-160-600.html?ev=01_250
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
80.239.138.24 , Sweden, ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE),
Reverse DNS
Software
Apache /
Resource Hash
e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:42 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=900
x-n
S
accept-ranges
bytes
expires
Fri, 01 Dec 2023 02:13:42 GMT
Ad9-160-600.js
s0.2mdn.net/sadbundle/11674851576237916465/Ad9-160-600/ Frame 7F61 		11 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/11674851576237916465/Ad9-160-600/Ad9-160-600.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11674851576237916465/Ad9-160-600/Ad9-160-600.html?ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
5afcf693970be0341444be622cad5aff4143555843fac107ea0e7869b107332e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/11674851576237916465/Ad9-160-600/Ad9-160-600.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 26 Nov 2023 09:39:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
404349
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2834
x-xss-protection
0
last-modified
Mon, 09 Oct 2023 15:48:50 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Mon, 25 Nov 2024 09:39:33 GMT
9135305356218733899
csync.smilewanted.com/set_partner_userid_get/adform/ Frame 9E31
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/9135305356218733899
0
622 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/9135305356218733899
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
82e7ba05890136b7-YYZ
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 01 Dec 2023 01:58:42 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Fri, 01 Dec 2023 01:58:42 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/9135305356218733899
server
nginx
activeview
pagead2.googlesyndication.com/pcs/ Frame BD09 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuM2ESExFZxGd-vQA92SX0SK9VpYpth8hISTo4DOVFim_77VEtcq4GXkmP7GPHz6LhRVhAVF92rTxR3al4GdYuFNPzRYzw7xat3wpG0WAP6ivMV4l9zEVXbYmm_eRvNIkh7MrP7u_ee4Q&sai=AMfl-YTWtqvVcz9lCuf8sLLHjaZLbzXRfAjw9FNHiq_QZjLFoldImyhL-L2hqc3UtCbe0oXwv9F3uI_saqGaBtCvCDvMXtZwpNrNa_z-0Eu4hGwqyHvQcqnAnosan3Q3abiyQ1rF261uigI&sig=Cg0ArKJSzD95dcqZL0eEEAE&cid=CAQSPADICaaNtMg-ZUEq3imO8mZyXyckRbw9K2tlw17yWO_8FFNaJXnu6ahisN07W-FLXSQ1zioch12yr_Ef8hgB&id=lidar2&mcvt=1001&p=120,320,370,620&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20231129&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2693153471&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701395921402&rpt=258&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
JthQNRlYKvyYtq8sninV
csync.smilewanted.com/set_partner_userid_get/outbrain/ Frame BB5B
Redirect Chain
  • https://b1sync.zemanta.com/usersync/smilewanted?gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Foutbrain%2F__ZUID__
  • https://b1sync.zemanta.com/usersync/smilewanted?cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Foutbrain%2F__ZUID__&gdpr=0&gdpr_consent=&s=2&us_privacy=
  • https://csync.smilewanted.com/set_partner_userid_get/outbrain/JthQNRlYKvyYtq8sninV?gdpr=0
0
486 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/outbrain/JthQNRlYKvyYtq8sninV?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
82e7ba094ee236b7-YYZ
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 01 Dec 2023 01:58:43 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Content-Length
112
Content-Type
text/html; charset=utf-8
Date
Fri, 01 Dec 2023 01:58:43 GMT
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/outbrain/JthQNRlYKvyYtq8sninV?gdpr=0
P3p
CP="We do not support P3P header."
Pragma
no-cache
ads
securepubads.g.doubleclick.net/gampad/ 		110 KB
45 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3378551494251738&correlator=3860232548192156&eid=31079808%2C44807689%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=21732118914%3A183096492%2Cmediafire_com-box-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C728x90&ifi=14&didk=1698006286&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3D8ed23798d17fef2e%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_MYa84XzsqA-d-Y6sn06Y8FEKt-Mkw&gpic=UID%3D00000da4eba87dbb%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_MYNqbDdY9cfK7DMkmU6DodsZiNUzA&abxe=1&dt=1701395922720&lmt=1701395922&adxs=430&adys=1095&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&vis=1&aee=1&psz=970x90&msz=970x90&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1675868932.1701395917&ga_sid=1701395919&ga_hid=846692808&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABj50uWYwjFIABIZCgpwdWJjaWQub3JnGLXq5ZjCMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj80eWYwjFIAFICCGQSFwoIcnRiaG91c2UY9tzlmMIxSABSAghqEhkKCnVpZGFwaS5jb20Y_NHlmMIxSABSAghkEj4KBW9wZW54EixleUpwSWpvaVFXTmFhRFpLVlROU0x6SkxiMWRrZVVkWFUyTnpVVDA5SW4wPRji6-WYwjFIABIbCgxpZDUtc3luYy5jb20Y19nlmMIxSABSAghq&dlt=1701395915992&idt=906&prev_scp=a%3D%257C0%257C%26iid1%3D6238432755633144%26eid%3D6238432755633144%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1106%26sap%3D1106%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D5302779%26rid%3D99998%26pt%3D3%26al%3D1003%26compid%3D0%26tap%3Dmediafire_com-box-4-6238432755633144%26eb_br%3D780324bcbe122aeb7768d94246861ef2%2Cad0061a38dd7c6f7bcb692aee88dfda4%26eba%3D1%26ebss%3D10061%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D73%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D14%26br2%3D46%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26icsticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C760%2C815%2C817%2C899%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3933%2C4184%2C4185%2C4186%2C4604%2C4605%2C5747%2C6293%2C6294%2C6295%2C5136%2C774%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C835%2C2693%2C3045%2C4276%2C18%2C1428%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%26lb%3D46%26reqt%3D1701395921700%26adxf%3D1&adks=342075838&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
0384a48617604e8750d71ba4665343670c1325de2e499b036ea35a8cc72adaa2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:43 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
46088
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
YudBnxYzY05pE_p4oQJY7XUKcgMgXtb8ClAoiGkl-0U
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame 0DA9
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://creativecdn.com/cm-notify?pi=smilewanted&tc=1
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/YudBnxYzY05pE_p4oQJY7XUKcgMgXtb8ClAoiGkl-0U?pi=smilewanted&tc=1
0
644 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/YudBnxYzY05pE_p4oQJY7XUKcgMgXtb8ClAoiGkl-0U?pi=smilewanted&tc=1
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
82e7ba22995536b7-YYZ
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 01 Dec 2023 01:58:47 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Fri, 01 Dec 2023 01:58:46 GMT Fri, 01 Dec 2023 01:58:46 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/YudBnxYzY05pE_p4oQJY7XUKcgMgXtb8ClAoiGkl-0U?pi=smilewanted&tc=1
pragma
no-cache
gen_204
pagead2.googlesyndication.com/pagead/ Frame 7447 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BC7od0j1pZfecBKH6hAbH-qbYCwAAAAA4AeAEAg&bg=!fH-lfzDNAAY3kmNgF5I7ADQBe5WfOCoCqmqlk4gAR0uALZoG8gHX_EQVcrBghC94BaUlA-3Gn44BN1lw7OYt5VET9iuLAgAAAFpSAAAAA2gBBwoABEJ1Vp6ZAv_8HinwySupCJs_FjuDanzMMThDpoeGl4H9GOowmIBzTSrcNigZIDUVklKaLhsoZZwJrJcELNVxxu-VBFzdWDbAE2aTs3LSUPMEVef392y7nnceJ0qncSoU30KNtvZBwZ7TwYCNvXw9IZFS0_sjY0_ZTtwEJGpDQnGMBK-KpLYtFZBienJpNeO56Whi7sMnjit71cGYwJ4BHseXknZiEuEuRG46p15_Rf2ODRSTs0D7KHLPSAHcqtqmGRemf8rqlp2iuRVyAa7EoQq0yB68pbUp4Zaa-npaKZ2ZOAEN94zZ9t04TG7lERXSYGy37OQAXMHqhskv5ZMMCXarPeP4nj6GAU2Pk9oK306UEzqiRd2SFEeH7RDpDON_XizZaO0nkPrTI9MznHFGkjI8E6ch6m8EsBNi6hPSo23-eTnzRYrfM5YExONLn1Z0CFZlwuTHT80tZwS67qgHdFeXGx4aASFmrLASx6puzf-CckWKdBa9PGT4RTpkl633Sq1OZymPADXYnuN_4YS6-__U40bTbaT9Oq50FXkjgFSXRWPVDdFzga6_lpobCKos2VrmkpbwmdiaRZfYPpy4QYnrf7yOeazJQP4v5E2EnBYYDbWxrKmbLxQCUkPE6tlsdyYh3saj0i2FdHGV1UJEK4zNJU3ObXAgDFxGZJNjmJhHHAeVMAfAKjozrn9t9d1rWfgfFw6Lqc8aBYL3eligy2Xy4GYhinKkcg3HQuBPQc5S9rrPD4ia041P1yCdwZx2Wz_c1IsNBtDv80MfskwbZuyLmamj5-KvRBoOG3kDFB8QUsLNWreIpFcrNVAHL06G10vdhAYHaWkpO2269IDkkATHL_jBqeFF7fkQ3g0S0fiCiWTMK3EONuNSjEKWk88uIuPMVYwpCHisJUikNjc4X8i65Y9raVBI_6eaLqhSO938FtYwVNWfUDJyhnONXRnQWy7RrcPrFyWcbRz3uMI4LsbV1u-rVlZpaHcgJdOsT_eZF0qu2vkbX9tXd3K6eS98EuFpwLrx2A
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:42 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTg5MTQ4NTcwNzYzMTg3MyIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInJldmVudWUiOjAsImJpZF9mbG9vcl9maWxsZWQiOjAsInN0YXRfc291cmNlX2lkIjowLCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NTQwMjMxOSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:42 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:42 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTg5MTQ4NTcwNzYzMTg3MyIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTMtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc1NDAyMzE5LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE4OTE0ODU3MDc2MzE4NzMiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NTQwMjMxOSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxODkxNDg1NzA3NjMxODczIiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzU0MDIzMTksImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiNjMifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:43 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:43 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		110 KB
45 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3378551494251738&correlator=1731195516630516&eid=31079808%2C44807689%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&gdpr=0&us_privacy=1---&iu_parts=21732118914%3A183096492%2Cmediafire_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600&fluid=height&ifi=15&didk=2994425013&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3D8ed23798d17fef2e%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_MYa84XzsqA-d-Y6sn06Y8FEKt-Mkw&gpic=UID%3D00000da4eba87dbb%3AT%3D1701395919%3ART%3D1701395919%3AS%3DALNI_MYNqbDdY9cfK7DMkmU6DodsZiNUzA&abxe=1&dt=1701395923072&lmt=1701395923&adxs=1440&adys=300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&vis=1&aee=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1675868932.1701395917&ga_sid=1701395919&ga_hid=846692808&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABj50uWYwjFIABIZCgpwdWJjaWQub3JnGLXq5ZjCMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRj80eWYwjFIAFICCGQSFwoIcnRiaG91c2UY9tzlmMIxSABSAghqEhkKCnVpZGFwaS5jb20Y_NHlmMIxSABSAghkEj4KBW9wZW54EixleUpwSWpvaVFXTmFhRFpLVlROU0x6SkxiMWRrZVVkWFUyTnpVVDA5SW4wPRji6-WYwjFIABIbCgxpZDUtc3luYy5jb20Y19nlmMIxSABSAghq&dlt=1701395915992&idt=906&prev_scp=a%3D%257C0%257C%26iid1%3D3084741803591765%26eid%3D3084741803591765%26t%3D134%26d%3D484470%26t1%3D134%26pvc%3D0%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D5302779%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Dmediafire_com-edge-2-3084741803591765%26eb_br%3D295bc01864bf3dbd0117e0a3f7f6bc96%2C291d27313eb66c50243129b23df8a579%26eba%3D1%26ebss%3D10061%26bv%3D11%26bvm%3D0%26bvr%3D1%26avc%3D38%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D10%26br2%3D44%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C6293%2C6294%2C6295%2C5136%2C774%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C835%2C2693%2C3045%2C4276%2C18%2C1428%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%26hb_bidder%3Dadtelligent%26hb_adid%3D92c4bfff7e5b226%26hb_format%3Dbanner%26hb_ssid%3D11316%26hb_opt%3D0.11%26hb_rt%3Dclient%26lb%3D46%26reqt%3D1701395922061%26adxf%3D1%26nam%3D1&adks=1509549554&frm=20
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
cafe /
Resource Hash
a43071bbd1b712e759a04d4e11ced1a118ad17e5a301e26fd7a3da8634ffdefd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:43 GMT
content-encoding
br
x-content-type-options
nosniff
observe-browsing-topics
?1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
46311
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
Ad9_160_600_atlas_1.png
s0.2mdn.net/sadbundle/11674851576237916465/Ad9-160-600/images/ Frame 7F61 		159 KB
159 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/11674851576237916465/Ad9-160-600/images/Ad9_160_600_atlas_1.png
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
2118516104d23af6dc43fe754c783346f5c24770e83bf4d9201546454822025f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/11674851576237916465/Ad9-160-600/Ad9-160-600.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 26 Nov 2023 09:39:34 GMT
x-content-type-options
nosniff
age
404349
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
162337
x-xss-protection
0
last-modified
Mon, 09 Oct 2023 15:48:50 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Mon, 25 Nov 2024 09:39:34 GMT
view
ad.doubleclick.net/pcs/ Frame 3611 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/pcs/view?xai=AKAOjsvpoL5b_nySFzlK3fyUb_5pFUAkGsi7GWhiutKgbEGkcOIIXZ_lk2u-TcHqc5wEvy6XNnYsoMsJx9cGY5leFf2uQpkkjZiKcIVHKv3CVg4Inn67QjDyloaRTrDrApGR-5icxr2oKN-NULKHquUznhceGMlDUVWIcrSHX80BjO9OiIIHXmuTJbglNYe4fOTnw-gc1OItqDzdKHdH3U4lgRo39rh7WVAy0huTi-WjsAmbs89INjXe15PwFy3WVKAK6-lNuja5xTOG03Ke1pqzQh60L9tAxpPXs-2c3OMCkrcp2UKz90YmIAwjpXP-RUXIoOWOpy2YHNzxAswoXc5Iv__aFdqk2hA39OFHWXlrJl5WULwb96xzJxQNANN6DE8q8fAv9VWkanrfu4ngHBXm3hGaOddI-ji9-8FN6c9il3hQosBeYuhnMlLmQdWm-M-IoClSGsgswdEPs4QZ2gGW5nIEvjDsK9Xcmc2URUrZthD5zcT-US-xJbzvHKCWIATixeC3BnSXcOzPxaFdndjB_kHVL5IN40SjgN2CPVX7fPcl_1p2JjjIbbjY9njgliGyTFj2MZxl6Qi_xAZC9KIixD3bcpx1dc-lTrH1obaclbu4NLlHaztdcnGskW6TzPR3QFFMLcospITNsumSKysQ3lYYpdtP2rBZshg0rCKZ1z8gjt1_5y1HO1QQtnZUd8a4Y1KHUDyNqPLinGrL1_qRLOrmSRGnYDwpfqsYS_XtrFuymS_JR1M1G6p3iD-iuyaqaZCEthJ07RClqL6rNneTiI1LlVJJTkCJuQrFNOP9HleuDnaeCRQcJL1Jy1ef0D76IAcYYwm_MnFxjcVZ4Q75rSDN-jK_xCARa455jRMUUju1O1fUnXJDiLuUisVgdiZ8CJfGcFe1cY2NdaddQaUxoD1L0YKoMh-Vvq9tTtHfEh_XeL7Uzv4IkI0jGYWETdVnnYwqcxgFIk7oELJHjAX_GkzeQZ3-24-vZ4n_PVUA8e0b2da2K-7aQ2TC_nrdP_knpIrH20hVBMGFPoRmsl93PFQBiRp0iutFeODe_RTdPmeUTcnIuZDTiVLBQNJxshWs1stDRKUV1aSdhbtsRWM_kX6t-bwIKxKnZDrleDfr99SIPp4VoTZnMcn7gEK4v4nJZSq3jCcN7TCx1EZfxun0aPS_bZSIuyAEwpvzcYo28FMfwHnbdbLKuAYnmj4kIV89Vmx7y6cMCYrt5cZUs0t-uFKIVwASX5ok9e2fnk1BfCGnQb6GxRvgdbwVfhdC6_wPL8bZRFDSRGsRfxPS2ilTLcAG6dZWuJhJc37NtOKworCdeVfWTO1TdmovwSNeP60UMLJH0b72bs7AZL0WUwjNcdgMw88jWZFePAdIPwCWGucfGH_89dh107_eJAONddow2v0pk_rskA&sai=AMfl-YQl88Ktiez4Hd4zF_ZGTWjG07ksuj8kUFG-gOce4kNSW5A_GJpIBxv68oT2t_vxq0tSGm7F2Tj9c_sEfD4VLdwJnhfk5R3-TUWWHVY_jkRFrOdhchwn0Gcyi4HRto_CjY66V7mPzqwT7mWdgRv_u1nbSn0eCG9cqCUdzyexZ1nA8tGqQODobc0Y--sNKewA1nCWXTRgHtvqVgvOhwP9oxQRsCz8kymfxcvf-MWKgqXsnBYzwsexOit0G_CKyWOG6P91IE8seq07v2XwrkAbGDb93kEoruHxWQS6J6CDE6stnOfAumR8QcS42UkuxSYYzS2A4JVePHU0tk0W0P6VdvtbFBDb9z5Dzcpbft6ZXiC60j6ZACiJNSIXGMj3Sc9EZHJA5ie6Ck0zg8Br-DWs0KMNLaWxqBTGISKtePcgpk0pzRPucq6k&sig=Cg0ArKJSzF6BF6FN3l4EEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9jb3N0YXIuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=670&vt=11&dtpt=564&dett=3&cstd=105&cisv=r20231129.31175&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f149.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:43 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQ2OTEyMjQ5NTU4ODc4MiIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTQtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInJldmVudWUiOjAsImJpZF9mbG9vcl9maWxsZWQiOjAsInN0YXRfc291cmNlX2lkIjowLCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDg4OTg4OCwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:46 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:46 GMT
container.html
c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 788C 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.62.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f132.1e100.net
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 01:58:41 GMT
expires
Sat, 30 Nov 2024 01:58:41 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNjIzODQzMjc1NTYzMzE0NCIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tYm94LTQtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjYyMzg0MzI3NTU2MzMxNDQiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLWJveC00LTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6Ijc4MDMyNGJjYmUxMjJhZWI3NzY4ZDk0MjQ2ODYxZWYyLGFkMDA2MWEzOGRkN2M2ZjdiY2I2OTJhZWU4OGRmZGE0In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI2MjM4NDMyNzU1NjMzMTQ0IiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1ib3gtNC0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicmV2ZW51ZSI6MC4wMDAxNCwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDAxNCwic3RhdF9zb3VyY2VfaWQiOjM1LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjYyMzg0MzI3NTU2MzMxNDQiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLWJveC00LTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MjQxMTIzNTE3In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI2MjM4NDMyNzU1NjMzMTQ0IiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1ib3gtNC0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjQ5NzQ5MDI4MzIifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:43 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:43 GMT
4974902832
go.ezodn.com/dac/ 		0
566 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/dac/4974902832
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-3&bv=280&PageSpeed=off
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:43 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2382
alt-svc
h3=":443"; ma=86400
content-length
0
last-modified
Fri, 01 Dec 2023 00:57:11 GMT
server
cloudflare
access-control-max-age
1728000
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.mediafire.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K%2Byxm%2B1a5Yr8VASrcpKHucADMQo7MpBc21v7SGHlP45nKJnprhFCuTybwa2f60A0pUPWcRAe8saYErbEJj11kbb2Z9XGQHUDQm5P%2BslN7N7gBwCURYd17Oh%2BidrLqH0%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=14400
access-control-allow-credentials
true
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges
bytes
cf-ray
82e7ba08e9784379-EWR
access-control-allow-headers
Content-Type
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNjIzODQzMjc1NTYzMzE0NCIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tYm94LTQtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMy0xMS0zMCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjE3In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjQifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiNDgwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:46 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:46 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNjIzODQzMjc1NTYzMzE0NCIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tYm94LTQtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsImF1Y3Rpb25fZXBvY2giOjE3MDEzOTU5MjMsImFkX3Bvc2l0aW9uIjoxMTA2LCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiYmlkX2Zsb29yX2luaXRpYWwiOjkwLCJiaWRfZmxvb3JfcHJldiI6NDYsImJpZF9mbG9vcl9maWxsZWQiOjE0LCJhdWN0aW9uX2NvdW50IjozLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo2MTMsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjIxNzMyMTE4OTE0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzJ9XQ==
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:43 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:43 GMT
pixel
googleads.g.doubleclick.net/xbbe/ Frame DF5E 		412 B
228 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3AThCB-1gYuYvW-gEwAQ&v=APEucNWfQIHlBQzSSsV5Pp4oxIYa89ewr-hOuf81tmxqBEIGTzLuXdubX4fQaliBIYbRl0P-IiGM7cc47t0woqQszXLLFTFiCT2hMXaS8Bs0sLnW2hve2kw
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
cafe /
Resource Hash
b5caab4f619e85958d7b9985c51504f31aa65076fba3ecf921eb3f91fe5061e4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
br
content-length
208
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 01:58:43 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
express_html_inpage_rendering_lib_200_278.js
s0.2mdn.net/879366/ Frame 788C 		111 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Origin
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 06:39:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
69531
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39806
x-xss-protection
0
last-modified
Tue, 14 Mar 2023 18:44:05 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 01 Dec 2023 06:39:52 GMT
omrhp_fy2021.js
pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/elements/html/ Frame 788C 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/elements/html/omrhp_fy2021.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 22:35:25 GMT
content-encoding
br
x-content-type-options
nosniff
age
12198
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3071
x-xss-protection
0
server
cafe
etag
10674441169935035545
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 22:35:25 GMT
abg_lite_fy2021.js
pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/ Frame 788C 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/abg_lite_fy2021.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
b67ad968ba3668562f331df45b73501e17c7c166bcf7e5443c33633cbc9d5783
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 18:42:45 GMT
content-encoding
br
x-content-type-options
nosniff
age
26158
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9305
x-xss-protection
0
server
cafe
etag
13635642240219548939
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 18:42:45 GMT
Q12zgMmT.js
tpc.googlesyndication.com/sodar/ Frame 788C 		41 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Q12zgMmT.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
sffe /
Resource Hash
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 09:08:53 GMT
content-encoding
br
x-content-type-options
nosniff
age
146990
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13937
x-xss-protection
0
last-modified
Fri, 25 Aug 2023 23:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2024 09:08:53 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 788C 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/window_focus_fy2021.js
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 19:53:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
21897
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 19:53:46 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame EDA4 		1 KB
643 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
76985
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=86400
content-encoding
br
content-length
618
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 30 Nov 2023 04:35:38 GMT
etag
48472445140208031
expires
Fri, 01 Dec 2023 04:35:38 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 788C 		20 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
cafe /
Resource Hash
09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 19:53:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
21897
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8544
x-xss-protection
0
server
cafe
etag
17124069415086231762
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 19:53:46 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 788C 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CqpGGrIuo-SruL6sdMgf0Xk9T4XMpMrKOhXg4sEO_BHNVnrTpV72f6ncbC4eQaYh8W-vJoAuDJiHxsRYVEZNn-ZziMH50Jpan2gumzI45JqU_aMxw
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
l
www.google.com/ads/measurement/ Frame 788C 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTE6BBpaxXs4DzuzF12WD8g2PJGkWdfIYq_WjDSVLOZOc_5llSGttPS6PDbxLaNRk9ydPkXKxCMj2iJVIDTnwFTgfFpQw
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f105.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers
ufs_web_display.js
www.googletagservices.com/activeview/js/current/ Frame 788C 		202 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
sffe /
Resource Hash
1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
65067
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1701261208926228"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 01 Dec 2023 01:58:43 GMT
container.html
c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6708 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.62.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f132.1e100.net
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mediafire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 01:58:41 GMT
expires
Sat, 30 Nov 2024 01:58:41 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMzA4NDc0MTgwMzU5MTc2NSIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tZWRnZS0yLTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NTQwMjMxOSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiIzIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIzMDg0NzQxODAzNTkxNzY1IiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1lZGdlLTItMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc1NDAyMzE5LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiMjk1YmMwMTg2NGJmM2RiZDAxMTdlMGEzZjdmNmJjOTYsMjkxZDI3MzEzZWI2NmM1MDI0MzEyOWIyM2RmOGE1NzkifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjMwODQ3NDE4MDM1OTE3NjUiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLWVkZ2UtMi0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicmV2ZW51ZSI6MC4wMDAxLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDEsInN0YXRfc291cmNlX2lkIjozNSwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzU0MDIzMTksImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIzMDg0NzQxODAzNTkxNzY1IiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1lZGdlLTItMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc1NDAyMzE5LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgyNDExMjM1MTcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjMwODQ3NDE4MDM1OTE3NjUiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLWVkZ2UtMi0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzU0MDIzMTksImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjQ5NzU0MDIzMTkifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:43 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:43 GMT
4975402319
go.ezodn.com/dac/ 		0
568 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://go.ezodn.com/dac/4975402319
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-3&bv=280&PageSpeed=off
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.137.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:43 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
172
alt-svc
h3=":443"; ma=86400
content-length
0
last-modified
Fri, 01 Dec 2023 00:45:10 GMT
server
cloudflare
access-control-max-age
1728000
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.mediafire.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1xUyqVdhFNldQKDtFsEUdFda10rG1W6xC3%2FoGMEGC4t%2BeSHcK%2BsaT3F3qATTvOlcooiGPIsMiXMXHakoGkpVBXmmVFMsJHfDrtn3%2FYmSgUOUQgnWXuJ1WSLOKRh%2BAaA%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=14400
access-control-allow-credentials
true
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges
bytes
cf-ray
82e7ba098a3b4379-EWR
access-control-allow-headers
Content-Type
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMzA4NDc0MTgwMzU5MTc2NSIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tZWRnZS0yLTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NTQwMjMxOSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjMtMTEtMzAifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxNyJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI0In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6IjQ4MCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:43 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:43 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMzA4NDc0MTgwMzU5MTc2NSIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tZWRnZS0yLTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJhdWN0aW9uX2Vwb2NoIjoxNzAxMzk1OTIzLCJhZF9wb3NpdGlvbiI6MTEwMiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImJpZF9mbG9vcl9pbml0aWFsIjo5MCwiYmlkX2Zsb29yX3ByZXYiOjQ2LCJiaWRfZmxvb3JfZmlsbGVkIjo4LCJhdWN0aW9uX2NvdW50IjozLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjozNTEsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjIxNzMyMTE4OTE0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjQ5NzU0MDIzMTl9XQ==
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:43 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:43 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzY5ODAwNjYyMzU4Nzk0MiIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tYm94LTItMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc1NDAyMzE5LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiI3MDIifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjkyIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNjIzODQzMjc1NTYzMzE0NCIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tYm94LTQtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiI0MzAifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjExNzcifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxODkxNDg1NzA3NjMxODczIiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzU0MDIzMTksImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjMyMCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMzYyIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQ2OTEyMjQ5NTU4ODc4MiIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tbWVkcmVjdGFuZ2xlLTQtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0ODg5ODg4LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIzMjAifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjY2MiJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjMwODQ3NDE4MDM1OTE3NjUiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLWVkZ2UtMi0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzU0MDIzMTksImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjE0NDAifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjMwMCJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoidHJ1ZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:43 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:43 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNTIwMzQ2NDY1MTYyNjQxNCIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tZWRnZS0xLTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMzAwIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJ0cnVlIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:43 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:43 GMT
/
rtb-csync.smartadserver.com/redir/ Frame DF5E
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm&gdpr=0
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEI_NGlBdGpCGad5YGvcZ0xg&gdpr=0&google_cver=1
43 B
416 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEI_NGlBdGpCGad5YGvcZ0xg&gdpr=0&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3AThCB-1gYuYvW-gEwAQ&v=APEucNWfQIHlBQzSSsV5Pp4oxIYa89ewr-hOuf81tmxqBEIGTzLuXdubX4fQaliBIYbRl0P-IiGM7cc47t0woqQszXLLFTFiCT2hMXaS8Bs0sLnW2hve2kw
Protocol
HTTP/1.1
Server
23.83.76.73 Los Angeles, United States, ASN395954 (LEASEWEB-USA-LAX, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEI_NGlBdGpCGad5YGvcZ0xg&gdpr=0&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
327
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
rtb-csync.smartadserver.com/redir/ Frame DF5E
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=GOOGLE_HOSTED_PI&gdpr=0&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_hm...
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_hm=NjI3MTQzMjYzNTM1OTk2Njc1Mw==&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEI_NGlBdGpCGad5YGvcZ0xg&gdpr=0&gdpr_consent=&google_cver=1
43 B
416 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEI_NGlBdGpCGad5YGvcZ0xg&gdpr=0&gdpr_consent=&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3AThCB-1gYuYvW-gEwAQ&v=APEucNWfQIHlBQzSSsV5Pp4oxIYa89ewr-hOuf81tmxqBEIGTzLuXdubX4fQaliBIYbRl0P-IiGM7cc47t0woqQszXLLFTFiCT2hMXaS8Bs0sLnW2hve2kw
Protocol
HTTP/1.1
Server
23.83.76.73 Los Angeles, United States, ASN395954 (LEASEWEB-USA-LAX, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEI_NGlBdGpCGad5YGvcZ0xg&gdpr=0&gdpr_consent=&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
345
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/ Frame 788C 		211 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
729ea2e5bae35bf120079c8e6858db5995ce8b319f72985085f1b7641e18a492

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/png
dpixel
cms.quantserve.com/ Frame EDA4 		35 B
464 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEDI966hDO9y-ZA3k3lwSDz8&google_cver=1&google_push=AXcoOmTiG0mUgszIwK58IMiArv8cI0tDDNyVKasq9spcfPxh8X6F-FUBuXb8pY6_xlweKmaya7jcE5wOnG4UNW20eTo6lR_6i9ew0A
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.184.69.215 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type
image/gif
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame EDA4
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEOpAtE_gQ1Sx0ogcj7FSe9s&google_cver=1&google_push=AXcoOmQVK6gkRaNEYIFI-iQHYnTQXfz9Ih8crhrQ1-Ax_b3V67_83whxhX9uHrQ7BA6TGdqNWLmsy0bB_oqKhH6PGuj2...
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmQVK6gkRaNEYIFI-iQHYnTQXfz9Ih8crhrQ1-Ax_b3V67_83whxhX9uHrQ7BA6TGdqNWLmsy0bB_oqKhH6PGuj2IPbSLA0ovw&google_hm=pKqPp5YXSJ-o_bRhK-aESQ==
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmQVK6gkRaNEYIFI-iQHYnTQXfz9Ih8crhrQ1-Ax_b3V67_83whxhX9uHrQ7BA6TGdqNWLmsy0bB_oqKhH6PGuj2IPbSLA0ovw&google_hm=pKqPp5YXSJ-o_bRhK-aESQ==
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
//cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmQVK6gkRaNEYIFI-iQHYnTQXfz9Ih8crhrQ1-Ax_b3V67_83whxhX9uHrQ7BA6TGdqNWLmsy0bB_oqKhH6PGuj2IPbSLA0ovw&google_hm=pKqPp5YXSJ-o_bRhK-aESQ==
Date
Fri, 01 Dec 2023 01:58:43 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
pixel
cm.g.doubleclick.net/ Frame EDA4
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=wSDjaor_TKCkG2V4PC9mMw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
189 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=wSDjaor_TKCkG2V4PC9mMw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmTgYye1auY30lOewFrPZGgSxqDlqYppQBdmdBNbd1rujaMZx8-uP8GncqtGnBZQtgPcyRaFn5Qcvav0KwdrSGzxw26uh3rubQ
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=wSDjaor_TKCkG2V4PC9mMw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmTgYye1auY30lOewFrPZGgSxqDlqYppQBdmdBNbd1rujaMZx8-uP8GncqtGnBZQtgPcyRaFn5Qcvav0KwdrSGzxw26uh3rubQ
date
Fri, 01 Dec 2023 01:58:50 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame EDA4
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESELeO2L60owA_PBOUHfLY3Ug&google_cver=1&google_push=AXcoOmRGrKJDJuz3m5SJ6SGWdbSMNOe6p_tMJjoCq0Ovg63OIHoMMVOY6RhuswMxnTmFzKewe-RP2aj1TsMZg36...
  • https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=GnXLSWpRUlpUMgCssutHlbnVUKQ&google_push=AXcoOmRGrKJDJuz3m5SJ6SGWdbSMNOe6p_tMJjoCq0Ovg63OIHoMMVOY6RhuswMxnTmFzKewe-RP2aj1TsMZg3...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=GnXLSWpRUlpUMgCssutHlbnVUKQ&google_push=AXcoOmRGrKJDJuz3m5SJ6SGWdbSMNOe6p_tMJjoCq0Ovg63OIHoMMVOY6RhuswMxnTmFzKewe-RP2aj1TsMZg36UvarTKuCHOF_Ikg
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=GnXLSWpRUlpUMgCssutHlbnVUKQ&google_push=AXcoOmRGrKJDJuz3m5SJ6SGWdbSMNOe6p_tMJjoCq0Ovg63OIHoMMVOY6RhuswMxnTmFzKewe-RP2aj1TsMZg36UvarTKuCHOF_Ikg
Date
Fri, 01 Dec 2023 01:58:43 GMT
Connection
keep-alive
Content-Length
244
Content-Type
text/html; charset=utf-8
begin
www.tumblr.com/privacy/consent/ Frame EDA4
Redirect Chain
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEIG2LyTobK3Pz4uREu0ePDk&google_cver=1&google_push=AXcoOmQ4FAJQ0SNxOB71jHdMbVvcgDzKYn_bay7Y2OhDs8JbZiJjHyGRVGwhx0mv3YKgqmRA7NWATo-rjrX6mp5k...
  • https://www.tumblr.com/ads-user-sync?partner=smaato&uid=9658eab955&gdpr=0&gdpr_consent=
  • https://www.tumblr.com/privacy/consent/begin?redirect=https%3A%2F%2Fwww.tumblr.com%2Fads-user-sync%3Fpartner%3Dsmaato%26uid%3D9658eab955%26gdpr%3D0%26gdpr_consent%3D&v=2
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tumblr.com/privacy/consent/begin?redirect=https%3A%2F%2Fwww.tumblr.com%2Fads-user-sync%3Fpartner%3Dsmaato%26uid%3D9658eab955%26gdpr%3D0%26gdpr_consent%3D&v=2
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Server
192.0.77.40 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
assets.tumblr.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Redirect headers

x-nc
yyz 1
date
Fri, 01 Dec 2023 01:58:47 GMT
strict-transport-security
max-age=31536000; preload
server
nginx
p3p
CP="Tumblr's privacy policy is available here: https://www.tumblr.com/policy/en/privacy"
location
https://www.tumblr.com/privacy/consent/begin?redirect=https%3A%2F%2Fwww.tumblr.com%2Fads-user-sync%3Fpartner%3Dsmaato%26uid%3D9658eab955%26gdpr%3D0%26gdpr_consent%3D&v=2
x-rid
fe5e75980428eb74781064dc23682284
content-type
text/html; charset=UTF-8
content-length
0
x-ua-compatible
IE=Edge,chrome=1
pixel
cm.g.doubleclick.net/ Frame EDA4
Redirect Chain
  • https://match.360yield.com/match/ebda?google_gid=CAESEF-u4EHfj8Kht2Skq9pbQss&google_cver=1&google_push=AXcoOmQXqRTCCGYc12A8LEwkO-sMKkKroe1Na8b5uhBcMAilYQXH1JD1IA4CqE2CgCKnc4SFRKeywDkBbgsPVcMabsdV8X...
  • https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEF-u4EHfj8Kht2Skq9pbQss&google_cver=1&google_push=AXcoOmQXqRTCCGYc12A8LEwkO-sMKkKroe1Na8b5uhBcMAilYQXH1JD1IA4CqE2CgCKnc4SFRKeywDkBbgsPVcMa...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=7xT3NXJYS2igUsQIGeD5Bw&google_push=AXcoOmQXqRTCCGYc12A8LEwkO-sMKkKroe1Na8b5uhBcMAilYQXH1JD1IA4CqE2CgCKnc4SFRKeywDkBbgsPVcM...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=7xT3NXJYS2igUsQIGeD5Bw&google_push=AXcoOmQXqRTCCGYc12A8LEwkO-sMKkKroe1Na8b5uhBcMAilYQXH1JD1IA4CqE2CgCKnc4SFRKeywDkBbgsPVcMabsdV8XNm7UCaLA
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:48 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=7xT3NXJYS2igUsQIGeD5Bw&google_push=AXcoOmQXqRTCCGYc12A8LEwkO-sMKkKroe1Na8b5uhBcMAilYQXH1JD1IA4CqE2CgCKnc4SFRKeywDkBbgsPVcMabsdV8XNm7UCaLA
access-control-allow-origin
*
date
Fri, 01 Dec 2023 01:58:48 GMT
content-type
text/plain
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
pub
cs.chocolateplatform.com/ Frame EDA4 		0
0
attr
cm.g.doubleclick.net/pixel/ Frame EDA4 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IjKnMWtJyq6gDW0LcF3MwuKaW3LZvU6-JHWapT_CVNtb1EHi5c_ol8edKqiiQ2Lq4OUDoI
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:43 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
62bHydCX.html
tpc.googlesyndication.com/sodar/ Frame CC6C 		38 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/62bHydCX.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
sffe /
Resource Hash
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
152039
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
br
content-length
13045
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 29 Nov 2023 07:44:44 GMT
expires
Thu, 28 Nov 2024 07:44:44 GMT
last-modified
Fri, 25 Aug 2023 23:48:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
pixel
googleads.g.doubleclick.net/xbbe/ Frame BCBA 		0
16 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3AThCB-1gYh4bW-gEwAQ&v=APEucNWyZ9R-dLpzMwCdQDS8HsjGatwFXWSzs5H1Ig8TS4iIvzgpSELD6784hMnjzJLSqt3zkwVOvH5fjWD3E60jkQMLg6ZDus8OXxF4s8s7bYg7-hWV5yw
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 01:58:43 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
express_html_inpage_rendering_lib_200_278.js
s0.2mdn.net/879366/ Frame 6708 		111 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Origin
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 06:39:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
69531
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39806
x-xss-protection
0
last-modified
Tue, 14 Mar 2023 18:44:05 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 01 Dec 2023 06:39:52 GMT
omrhp_fy2021.js
pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/elements/html/ Frame 6708 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/elements/html/omrhp_fy2021.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 22:35:25 GMT
content-encoding
br
x-content-type-options
nosniff
age
12198
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3071
x-xss-protection
0
server
cafe
etag
10674441169935035545
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 22:35:25 GMT
abg_lite_fy2021.js
pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/ Frame 6708 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/abg_lite_fy2021.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
b67ad968ba3668562f331df45b73501e17c7c166bcf7e5443c33633cbc9d5783
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 18:42:45 GMT
content-encoding
br
x-content-type-options
nosniff
age
26158
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9305
x-xss-protection
0
server
cafe
etag
13635642240219548939
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 18:42:45 GMT
Q12zgMmT.js
tpc.googlesyndication.com/sodar/ Frame 6708 		41 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Q12zgMmT.js
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
sffe /
Resource Hash
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 09:08:53 GMT
content-encoding
br
x-content-type-options
nosniff
age
146990
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13937
x-xss-protection
0
last-modified
Fri, 25 Aug 2023 23:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 28 Nov 2024 09:08:53 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 6708 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/window_focus_fy2021.js
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 19:53:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
21897
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 19:53:46 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 9703 		1 KB
643 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
76985
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=86400
content-encoding
br
content-length
618
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 30 Nov 2023 04:35:38 GMT
etag
48472445140208031
expires
Fri, 01 Dec 2023 04:35:38 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 6708 		20 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
cafe /
Resource Hash
09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 19:53:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
21897
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8544
x-xss-protection
0
server
cafe
etag
17124069415086231762
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 14 Dec 2023 19:53:46 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 6708 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CpzzTu3bPsQttAGbqUfDmzULAQ70OUv2CAcrGpDtMdUel6kTjekJilGO0GqNgLxhcAL0p-oEA8cXGXhnZgOwix1u4oqoXc3rpqWguY6P-sPHy83k4
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
l
www.google.com/ads/measurement/ Frame 6708 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQpMG4hW1vHLoDryl2ZUvF6gCWn9b0qvhg664EgL4DoH5Bq_h11fHlk5nmi34-_1K1xHh6F1YEgTXVRcBFjm31spgZSLQ
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f105.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers
ufs_web_display.js
www.googletagservices.com/activeview/js/current/ Frame 6708 		202 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f154.1e100.net
Software
sffe /
Resource Hash
1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
65067
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1701261208926228"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 01 Dec 2023 01:58:43 GMT
Ad1-970x90.html
s0.2mdn.net/sadbundle/8610173591814663585/AD1-970-90/ Frame DDC7 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/8610173591814663585/AD1-970-90/Ad1-970x90.html?ev=01_250
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
91f9f9411b65f7b63a649f726916a383f3b88ccc5919e902f6beaae9707a3a8d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
156224
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
2311
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy
cross-origin
date
Wed, 29 Nov 2023 06:34:59 GMT
expires
Thu, 28 Nov 2024 06:34:59 GMT
last-modified
Mon, 09 Oct 2023 14:02:33 GMT
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-xss-protection
0
view
ad.doubleclick.net/pcs/ Frame 788C 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/pcs/view?xai=AKAOjstVVtUZJH4sqg9rgrxY1kQvPV7Nnd6adsw1psXo0R5C8dVQiHRVD0X2RBCXsq3XvNgQBUcOPqCz6nP88V2kZB0uM7kPNbGYU_0iZazeBxMOGiG6HC_LOCubFtwtJ2VgTMRt0DaYjmu3CKUYxsplVw8PJt0Mt2t5IoZ-IL3c27-BZpvyRroz0MV1BMxs254RJ0fbDiy8s3-Ux_cPL65VIMWWGmGEZwrSeFS9Dg7N_00uuZ2vd5zQ4U9J4N8RTxdlfX8DiRRjfSzV-gDAYBuATZIPxCg-dlv_Wk1rBMiLsudPmL1pdrSQ1N2R6FzNHm_RJ4jAykTFz-BOvxACpZKysm9WyXF6qv-FcjmbEN_qfJ-_b2i84gtU8gSifPi1B83nMGY0sG9NyiE8rjjOvE83wI0bz6qY-ebkwG6Si4VYMShKmNpZA7_5kKhohPrGmrhC4ifLyJRNpM-EVC0-vAeBdYtJSuTrGC5kEgH9mqxQcIYp_h_zGjqMmlNZjukGje_8EKHfyN2Ea4FfbkeX69dqKdZoqyOURGyph37Fr56eS27SyIE2K05mhmeugUbqUduB6fB2hahCFlFG74kcUr_bPzKM_gZAzrnvgxBYhCSgAkytbIXd2q4NhSF9pgHQgDjc9a6mm6CZ4QIACMtZmJ5ltP1W8cJJJdt4jr57_rOCrbmtIZVA1Gzh9jUuEDq0ClgRaYNxxgVGp1hL4__FJnxnCTMARsQgQdQGelGIoF3wmmXbOayMQ4Fv0phZfJDEDj6ipylpGnZuiSr4lbjOax9Q5ErG6bhAWhCUgCnhOeu_GLjhb0siFeC3La48v8XWkogbDNWBCH6tTG8vyulo10qGMPOr-FSJFNJ6gKJRka8JWapRzHVWrWCT055XH3kt7BwEdoQhEIiwlVGrna_iNy87RIwXNY9SKyDuOd7gEc2k7ucv5QtMgmnFgJFovZoQywfdq15N914vlacQAX5ZKeZ43RyPaO4RLnfb-YMf3ev7B-erqvB_Hk2YNg-tKXwlG3NMgUHpQf42SabZGEzH3sSx7BDwzT-_NP1LxFQfm4Cs6i8yPGIIT-TESOPXmd1A-9VxthU8TtZHUJcx7WsKhPRPhRXZNRFiVI-N0Iy2mnm4OQiC9ePozac4DgiC_bkJuQHxdfBKw3dGHdJej7GjKpf1YvslAUHldIM_rF-wWuUwRojDhgm8ZpUCjDlfwdLS3wLtAFCbJ3UsEETbZYlyc5Re2QTEY6QKBj09sgJVsByJFZH8QWEbnt4dbeGplut5_L4i35JlTHq0g4l8OEM9N6Lc6oXHDoF_EhxsCId7lm2kjipRslWyfGX33Wq2uKKpMeC8ZnHBEiUXTTPC_QY8GKuhMNJWod030bJN5ZqbFtHOWaUwWn6K_59K0gMudfUu3iuzW8WIr1wRTUwhoPXtmgJdqlY&sai=AMfl-YR2y58FvlBfYmqod2Dd36snDTNDSTavSVBWLSJJ5Q6oGKeTNGV5JgsrXYyosEtJ2lkOwHs9plVXpA_nq9NKkLBgmlG3ALr2p5FKXqce46BqFe4Wnu5lcGNrIPLXEFEiIJmfavEa_-TguXs2EZByh5T8Ok6wI2gLYGAAHLEsj0ItGMUp3F_xI350dfpKAZ1OQhrLbYwKxKTKYAtr7bntu296EmbeEZIYxl4K2z9BWfa4hPZlkDsa23wUPUl8plHToruR5gA2xXjnpvtqFTNPRcaJdymfGW4OSUTj_kQRmU1hIxI7bhiZu77UEAK44hgOe-SgaKh4iVytmmI4xg-r0OglmBIzEEsQCnPOQMU_omU-mLLnnUePTC3B7eQpaotOrwtRdvVB_TBn4UxvmkjKQlQBCwfryqOG0MGSRFNCaLS0U6gj1okR&sig=Cg0ArKJSzI4WD7j0MCKfEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9jb3N0YXIuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=150&cbvp=1&cstd=148&cisv=r20231129.08421&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f149.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy
script-src 'none'; object-src 'none'
date
Fri, 01 Dec 2023 01:58:43 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
content-type
image/gif
cache-control
private
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
createjs.min.js
code.createjs.com/1.0.0/ Frame DDC7 		236 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.createjs.com/1.0.0/createjs.min.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8610173591814663585/AD1-970-90/Ad1-970x90.html?ev=01_250
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
80.239.138.24 , Sweden, ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE),
Reverse DNS
Software
Apache /
Resource Hash
e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:43 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=900
x-n
S
accept-ranges
bytes
expires
Fri, 01 Dec 2023 02:13:43 GMT
Ad1-970x90.js
s0.2mdn.net/sadbundle/8610173591814663585/AD1-970-90/ Frame DDC7 		8 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/8610173591814663585/AD1-970-90/Ad1-970x90.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8610173591814663585/AD1-970-90/Ad1-970x90.html?ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
a66ede7f0e5c97456ebe3eb12d7bf326e8c9f5820cdda3f31d4aacf5d4bd5733
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/8610173591814663585/AD1-970-90/Ad1-970x90.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Thu, 30 Nov 2023 18:46:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
25918
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2370
x-xss-protection
0
last-modified
Mon, 09 Oct 2023 14:02:33 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Nov 2024 18:46:45 GMT
Ad1-160-600.html
s0.2mdn.net/sadbundle/12016345264017701978/Ad1-160-600/ Frame 6EFB 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/12016345264017701978/Ad1-160-600/Ad1-160-600.html?ev=01_250
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
5da3028ef8c48c9637ffaee2ae80bf7e97d706fd76784b5350c24527447852ea
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
42536
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
2317
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy
cross-origin
date
Thu, 30 Nov 2023 14:09:47 GMT
expires
Fri, 29 Nov 2024 14:09:47 GMT
last-modified
Mon, 09 Oct 2023 14:02:36 GMT
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-xss-protection
0
view
ad.doubleclick.net/pcs/ Frame 6708 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/pcs/view?xai=AKAOjsvANx_8UZvtmgaIWoZC3Bao5otWgjX8AKJMlwPyZHJPDvl6t-AtFeJavhfl776ipG1iOojwXZDe-jRi5n730_pqthfAbj9wxPK593fiBMnzO70OBCslQiU4JDEjQ1t7mT7TMpjfnCA8Mp0VGbVqAvOAmK8UQnwGcZnBGIfmR9q4Ym29Vq-68F-oZvEidNusly3z1oyZj1gShBAJR-mSep6Lb8Ep5hk464fI2scoqvAe0FGrpctdgbi0tGca2XHFlDwJRjEdqPvQeHcpgPO7FK2LFgZpvrvAvXrS_ThWHsgTkutKVxm2wBQ28Pc1Xvb64MVCYiCieKU35qk8q3_dtKJxll-3lLpWIm3_wqbH2vjMGCw-XWK-vyu3gVcYJIrHvr2P01gNxRE5k7Wb9WFm77XDNg-DQDobxPejXO8jb8U4Eywad7XAGbAlDEVxZLFSV9KEOQoAgnSWMTZktPHj8rYfGP3G4IIGB2qoZ4thfMJxHoMoHHiYBK8B4G1TzOzyxg0jjEq9w-6g4AmoGB-aZJrxWJ9cF9gUHbNhJve5y_qmVpPINHWegq115yPztWSO62Rr19PIb-TEPo4JvIiwGfVEu51n1PQhQcXXHo2GEpx7or_GJDREXiK81OXNDdlYdE86HmnQsLDcEGC474qcTSrhtvEa_hN8L3mPjPNfBnkWmAGa6E6SXldXNXjyJ7D6wD7VVn0KG_fF7kJsyhm26pqdvAKxd06bWh-IgDVHpTaAyWZcKIcg57dQTVRLqaKfoI5TsJ3zQnhtVayoCYJVFJ75_5-2H1vOtAp8aqOtokF4L__hu3SpMXC5bApfKBYi7MwDVXI8w3zJirAmH6a81dPEEmvrzTFx4YO7ecTCwXjsIAwtOIW5FpSIKopS4qu5377AxRVFqi8ppxZPgUvJdLZFAhl_QIVPDfbK0SSa13EwJmYn3hEPp6WKd5Lq4TlEHwA-9-VIJE_DZxwOSKPJXdtKomBYl9SJdvb43CjOI5mRnPxy_OAt7RatPmYJ2JHJ4SDTDAcsgFeGEJwcBJqvf-9b03HgrE0jaKAffOw5_whH5FO8K88BEWDhnZD5UTeZs61lSb-Tjs7W9tglskaDBbV5TY_T2XhrI59vMKxsOMmmdnq_M9HDmquSWRKHU8jtQ-6-tzunIWR5IaQ-Exo_Q8CiRjsnLc5TKWamWzQy-j-WCw4qUnErl4Zi-gFJvV6KpQ6nvnUM-gp9ISvWt1TFU2B9-F8kDRm42WF3yttxi8B4COquynfLbJSlwuBHJMtq0l7KaO_hFk0F1KgEsKTgdFPJt5-mNLdfc_nqsmG5RGDP4sMCx_CIXxOY7m_hOd6RU7DYnTE0wiiG9eU-_r07KBPzCz3QokFl5hX3HUalPCTIAUZ-TgbSTTaRYC_EDPjNsb07rdsv5fgW3nAwvs-USvo&sai=AMfl-YS-CsgXdPiBEZkPobtC-PTm_mMxQ_Dcbew-pHndl9UW0_Uk83yieyNy-nmzz7rxLLMm9Oqd3uJcqZqTTIBFs9bGMOtsG6CDNlOGsWRtqiBZx5XJsheGvMF8dgIfq4NSp0l_GZv4_9_orh0yYJZNvpI5AyfCAq1VB9J2yESnH2hB6C9uvilJdRtYzjZ9JM8rKN-1AZZrBC6dWvhzHxKAgS7RPBJIVLopC0iwL3r45qt0DKb_WFhdL9glQmBmKUA6Q9mp_CIjfXDE5rPMj8qoOoNAZV-cacJY4QH_YlwaNR5YZ4sMXKh3AecSKnLLKAeZQLK8TMIcXsLaucnpmskCDwEMwx9FxToBkpA_1iKIkYaDX2iQpb9Ru8D4gWa6okG9SWav48fOtQkhQRp58ySG9RGajvoBCH8aGuO-M-69_Stqqgqc4EC7&sig=Cg0ArKJSzCoOwVNcA0prEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9jb3N0YXIuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=69&cbvp=1&cstd=67&cisv=r20231129.66387&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f149.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy
script-src 'none'; object-src 'none'
date
Fri, 01 Dec 2023 01:58:43 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
content-type
image/gif
cache-control
private
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
pagead2.googlesyndication.com/bg/ Frame CC6C 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
sffe /
Resource Hash
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 00:33:55 GMT
content-encoding
br
x-content-type-options
nosniff
age
5088
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15165
x-xss-protection
0
last-modified
Tue, 28 Nov 2023 18:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 30 Nov 2024 00:33:55 GMT
62bHydCX.html
tpc.googlesyndication.com/sodar/ Frame 379E 		38 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/62bHydCX.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f132.1e100.net
Software
sffe /
Resource Hash
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
152039
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
br
content-length
13045
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 29 Nov 2023 07:44:44 GMT
expires
Thu, 28 Nov 2024 07:44:44 GMT
last-modified
Fri, 25 Aug 2023 23:48:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame 6708 		213 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
de58a591504b3a24a4e0c5e58d296deb5b611943110a0f09f9cff02013b6d09b

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/png
dpixel
cms.quantserve.com/ Frame 9703 		35 B
465 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEDI966hDO9y-ZA3k3lwSDz8&google_cver=1&google_push=AXcoOmRUiOc8UccIeiSjN04DcL-xeDjnz0WZuGj_jMwarhkKB6e4obDMcyU2C5zMUrSRwxwxhZeG3q6Zs_kHyY1FK7IiX2-E0sA
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.184.69.215 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type
image/gif
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 9703
Redirect Chain
  • https://aep.mxptint.net/sn.ashx?google_gid=CAESENQB-rpzQBFSNvIns5aXglU&google_cver=1&google_push=AXcoOmSZXDpqKPUYS_xt9KZf-mM0Ug8BrGhpJ6EfQiw5MER4msuk9Z1FkfCgMKrq9KMTUx0bepBFkVexAP50YwVlk61BaO14n8k
  • https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmSZXDpqKPUYS_xt9KZf-mM0Ug8BrGhpJ6EfQiw5MER4msuk9Z1FkfCgMKrq9KMTUx0bepBFkVexAP50YwVlk61BaO14n8k&google_hm=UjMzNjQ1XzEwQ0ZDQ...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmSZXDpqKPUYS_xt9KZf-mM0Ug8BrGhpJ6EfQiw5MER4msuk9Z1FkfCgMKrq9KMTUx0bepBFkVexAP50YwVlk61BaO14n8k&google_hm=UjMzNjQ1XzEwQ0ZDQUZEQl9BRUExOEVGOQ%3D%3D
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:49 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmSZXDpqKPUYS_xt9KZf-mM0Ug8BrGhpJ6EfQiw5MER4msuk9Z1FkfCgMKrq9KMTUx0bepBFkVexAP50YwVlk61BaO14n8k&google_hm=UjMzNjQ1XzEwQ0ZDQUZEQl9BRUExOEVGOQ%3D%3D
Date
Fri, 01 Dec 2023 01:58:49 GMT
Cache-Control
private
Strict-Transport-Security
max-age=-384400729; includeSubDomains
P3P
CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE", CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE"
Content-Length
345
Content-Type
text/html; charset=utf-8
pixel
cm.g.doubleclick.net/ Frame 9703
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=wSDjaor_TKCkG2V4PC9mMw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
189 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=wSDjaor_TKCkG2V4PC9mMw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmTAHct2wsKOb2l6OeYU-aQJwKrQaN8mVJHKU-5PFQ4_4aNym7e6hC5fGGpGMGgV1QvHKSsiy-f7mUy19x3Es1Rh5BdghcM
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:50 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=wSDjaor_TKCkG2V4PC9mMw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmTAHct2wsKOb2l6OeYU-aQJwKrQaN8mVJHKU-5PFQ4_4aNym7e6hC5fGGpGMGgV1QvHKSsiy-f7mUy19x3Es1Rh5BdghcM
date
Fri, 01 Dec 2023 01:58:50 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame 9703
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESELeO2L60owA_PBOUHfLY3Ug&google_cver=1&google_push=AXcoOmSoOpmXXRcOp_MC2ZzqvFWxLjeV6V4YK55quXzTD5uy6rd_Lq8BN_G7awXGeTZ4lq_0Ludyz9aBKHIqRNK...
  • https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=GnXLSWpRUlpUMgCssutHlbnVUKQ&google_push=AXcoOmSoOpmXXRcOp_MC2ZzqvFWxLjeV6V4YK55quXzTD5uy6rd_Lq8BN_G7awXGeTZ4lq_0Ludyz9aBKHIqRN...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=GnXLSWpRUlpUMgCssutHlbnVUKQ&google_push=AXcoOmSoOpmXXRcOp_MC2ZzqvFWxLjeV6V4YK55quXzTD5uy6rd_Lq8BN_G7awXGeTZ4lq_0Ludyz9aBKHIqRNKTVKHSVgwipmE
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=GnXLSWpRUlpUMgCssutHlbnVUKQ&google_push=AXcoOmSoOpmXXRcOp_MC2ZzqvFWxLjeV6V4YK55quXzTD5uy6rd_Lq8BN_G7awXGeTZ4lq_0Ludyz9aBKHIqRNKTVKHSVgwipmE
Date
Fri, 01 Dec 2023 01:58:43 GMT
Connection
keep-alive
Content-Length
241
Content-Type
text/html; charset=utf-8
RX-358895dc-82d6-4392-9b03-d569568dac10-005
sync.targeting.unrulymedia.com/csync/ Frame 9703
Redirect Chain
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEIG2LyTobK3Pz4uREu0ePDk&google_cver=1&google_push=AXcoOmS1QGbHJrga_duUX5vQVgQeki10XLQumRlkOSGI518Mk2gNcCJ0H_Z37SWPGa_sp8q86p2pbdiAu8xfSknv...
  • https://sync.1rx.io/usersync/smaato/b7f6348625?gdpr=0&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-358895dc-82d6-4392-9b03-d569568dac10-005
43 B
435 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-358895dc-82d6-4392-9b03-d569568dac10-005
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
HTTP/1.1
Server
199.127.204.142 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date
Fri, 01 Dec 2023 01:58:46 GMT
Connection
keep-alive
Content-Length
43
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:45 GMT
Transfer-Encoding
chunked
Content-Type
text/html
Location
https://sync.targeting.unrulymedia.com/csync/RX-358895dc-82d6-4392-9b03-d569568dac10-005
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Expires
0
pixel
cm.g.doubleclick.net/ Frame 9703
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEM...
  • https://sync.targeting.unrulymedia.com/csync/RX-358895dc-82d6-4392-9b03-d569568dac10-005?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAXcoOmRrnGuitrhSqNNq2jvG0...
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmRrnGuitrhSqNNq2jvG04x_NUetmmoaqqZiUjYNqXhglIKKloEAIcGCURIeZUfp2dB0BUSVrk0zWnbsEt11bppu3X5h3w&google_hm=BTWIldyC1kOSmwPVaVaNrBA
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmRrnGuitrhSqNNq2jvG04x_NUetmmoaqqZiUjYNqXhglIKKloEAIcGCURIeZUfp2dB0BUSVrk0zWnbsEt11bppu3X5h3w&google_hm=BTWIldyC1kOSmwPVaVaNrBA
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmRrnGuitrhSqNNq2jvG04x_NUetmmoaqqZiUjYNqXhglIKKloEAIcGCURIeZUfp2dB0BUSVrk0zWnbsEt11bppu3X5h3w&google_hm=BTWIldyC1kOSmwPVaVaNrBA
Date
Fri, 01 Dec 2023 01:58:43 GMT
Content-Type
text/html
Connection
keep-alive
ETag
RX358895dc82d643929b03d569568dac10005
Transfer-Encoding
chunked
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
pixel
cm.g.doubleclick.net/ Frame 9703
Redirect Chain
  • https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEC2LbqsZqbI6R1ZYep-EbaE&google_cver=1&google_push=AXcoOmR8azaYCbRZSPOEBd3yDCd9P0AjAQJDchN4hdNV-WRZu1KpmtsGHbiKq-9uyObz8gXcF72wfew5bD0A1iIEs...
  • https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEC2LbqsZqbI6R1ZYep-EbaE&google_cver=1&google_push=AXcoOmR8azaYCbRZSPOEBd3yDCd9P0AjAQJDchN4hdNV-WRZu1KpmtsGHbiKq-9uyObz8gXcF72wfew5bD0A1iIEs...
  • https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=NjA5YTRjOWU3NzkzZTM0Yw&google_push=AXcoOmR8azaYCbRZSPOEBd3yDCd9P0AjAQJDchN4hdNV-WRZu1KpmtsGHbiKq-9uyObz8gXcF72wfew5bD0A1iIEsaLXyO8r...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=NjA5YTRjOWU3NzkzZTM0Yw&google_push=AXcoOmR8azaYCbRZSPOEBd3yDCd9P0AjAQJDchN4hdNV-WRZu1KpmtsGHbiKq-9uyObz8gXcF72wfew5bD0A1iIEsaLXyO8rHRFd
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:44 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=NjA5YTRjOWU3NzkzZTM0Yw&google_push=AXcoOmR8azaYCbRZSPOEBd3yDCd9P0AjAQJDchN4hdNV-WRZu1KpmtsGHbiKq-9uyObz8gXcF72wfew5bD0A1iIEsaLXyO8rHRFd
date
Fri, 01 Dec 2023 01:58:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
server
nginx
content-length
0
attr
cm.g.doubleclick.net/pixel/ Frame 9703 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JXf7THlsCPRqk1Qa6_qBnPRwE2OVmG38qEMWeytQJEMMWdDzj2c0D-x3nTH9vs_Ebal3WPvA
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:43 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
activeview
pagead2.googlesyndication.com/pcs/ Frame 3611 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstQg1e6DpupAPTVe0lyTGDLQXQt2vfWdXUZoMbbGYq29qQj5TB3cjkubDPYKtkrZLwFcXS1TLlKVSR8UFjZnvJEbcybubHXGsezq5r8CbrVtEOXvliwWhjkN37646avOAMknek0uSjkiA&sai=AMfl-YSGKs93cfwv0XOqB2A054Qzn38_KohPWDDjJDPy9TUGIslIUaR3Xn1ovR8kockNJowDzuzpBOynl7nmp6WWU_yrXlu2UY_nclgkXCgX3UdIoJcNR4ANsovcGSNkFogb0f20EXdB7hQ&sig=Cg0ArKJSzDyNpVD9LScXEAE&cid=CAQSPADICaaNI8Qb2PYPdulmh13nEgG0im884QYpGkrIo6cfh5LAtozhip6-i823bkADkBAKvfAoOyzbg0nR1RgB&id=lidar2&mcvt=1048&p=300,119,340,160&mtos=1048,1048,1048,1048,1048&tos=1048,0,0,0,0&v=20231129&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3297035300&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701395922436&rpt=146&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
createjs.min.js
code.createjs.com/1.0.0/ Frame 6EFB 		236 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.createjs.com/1.0.0/createjs.min.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12016345264017701978/Ad1-160-600/Ad1-160-600.html?ev=01_250
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
80.239.138.24 , Sweden, ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE),
Reverse DNS
Software
Apache /
Resource Hash
e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:43 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=900
x-n
S
accept-ranges
bytes
expires
Fri, 01 Dec 2023 02:13:43 GMT
Ad1-160-600.js
s0.2mdn.net/sadbundle/12016345264017701978/Ad1-160-600/ Frame 6EFB 		8 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/12016345264017701978/Ad1-160-600/Ad1-160-600.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12016345264017701978/Ad1-160-600/Ad1-160-600.html?ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
45d5fd2dd0b0ce128b8c61e934f685e5ce7275f28566ba422a63e0f2891e5606
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/12016345264017701978/Ad1-160-600/Ad1-160-600.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:51:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
317234
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2374
x-xss-protection
0
last-modified
Mon, 09 Oct 2023 14:02:36 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Nov 2024 09:51:29 GMT
Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
pagead2.googlesyndication.com/bg/ Frame 379E 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
sffe /
Resource Hash
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 00:33:55 GMT
content-encoding
br
x-content-type-options
nosniff
age
5088
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15165
x-xss-protection
0
last-modified
Tue, 28 Nov 2023 18:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 30 Nov 2024 00:33:55 GMT
Ad1_970x90_atlas_1.png
s0.2mdn.net/sadbundle/8610173591814663585/AD1-970-90/images/ Frame DDC7 		74 KB
74 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/8610173591814663585/AD1-970-90/images/Ad1_970x90_atlas_1.png
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
e10274aefd43732b8b3afa290177ed97439e6c30fb73489579f2fd94440d0921
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/8610173591814663585/AD1-970-90/Ad1-970x90.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 01:01:14 GMT
x-content-type-options
nosniff
age
176249
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
75875
x-xss-protection
0
last-modified
Mon, 09 Oct 2023 14:02:33 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 28 Nov 2024 01:01:14 GMT
view
ad.doubleclick.net/pcs/ Frame 788C 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/pcs/view?xai=AKAOjstVVtUZJH4sqg9rgrxY1kQvPV7Nnd6adsw1psXo0R5C8dVQiHRVD0X2RBCXsq3XvNgQBUcOPqCz6nP88V2kZB0uM7kPNbGYU_0iZazeBxMOGiG6HC_LOCubFtwtJ2VgTMRt0DaYjmu3CKUYxsplVw8PJt0Mt2t5IoZ-IL3c27-BZpvyRroz0MV1BMxs254RJ0fbDiy8s3-Ux_cPL65VIMWWGmGEZwrSeFS9Dg7N_00uuZ2vd5zQ4U9J4N8RTxdlfX8DiRRjfSzV-gDAYBuATZIPxCg-dlv_Wk1rBMiLsudPmL1pdrSQ1N2R6FzNHm_RJ4jAykTFz-BOvxACpZKysm9WyXF6qv-FcjmbEN_qfJ-_b2i84gtU8gSifPi1B83nMGY0sG9NyiE8rjjOvE83wI0bz6qY-ebkwG6Si4VYMShKmNpZA7_5kKhohPrGmrhC4ifLyJRNpM-EVC0-vAeBdYtJSuTrGC5kEgH9mqxQcIYp_h_zGjqMmlNZjukGje_8EKHfyN2Ea4FfbkeX69dqKdZoqyOURGyph37Fr56eS27SyIE2K05mhmeugUbqUduB6fB2hahCFlFG74kcUr_bPzKM_gZAzrnvgxBYhCSgAkytbIXd2q4NhSF9pgHQgDjc9a6mm6CZ4QIACMtZmJ5ltP1W8cJJJdt4jr57_rOCrbmtIZVA1Gzh9jUuEDq0ClgRaYNxxgVGp1hL4__FJnxnCTMARsQgQdQGelGIoF3wmmXbOayMQ4Fv0phZfJDEDj6ipylpGnZuiSr4lbjOax9Q5ErG6bhAWhCUgCnhOeu_GLjhb0siFeC3La48v8XWkogbDNWBCH6tTG8vyulo10qGMPOr-FSJFNJ6gKJRka8JWapRzHVWrWCT055XH3kt7BwEdoQhEIiwlVGrna_iNy87RIwXNY9SKyDuOd7gEc2k7ucv5QtMgmnFgJFovZoQywfdq15N914vlacQAX5ZKeZ43RyPaO4RLnfb-YMf3ev7B-erqvB_Hk2YNg-tKXwlG3NMgUHpQf42SabZGEzH3sSx7BDwzT-_NP1LxFQfm4Cs6i8yPGIIT-TESOPXmd1A-9VxthU8TtZHUJcx7WsKhPRPhRXZNRFiVI-N0Iy2mnm4OQiC9ePozac4DgiC_bkJuQHxdfBKw3dGHdJej7GjKpf1YvslAUHldIM_rF-wWuUwRojDhgm8ZpUCjDlfwdLS3wLtAFCbJ3UsEETbZYlyc5Re2QTEY6QKBj09sgJVsByJFZH8QWEbnt4dbeGplut5_L4i35JlTHq0g4l8OEM9N6Lc6oXHDoF_EhxsCId7lm2kjipRslWyfGX33Wq2uKKpMeC8ZnHBEiUXTTPC_QY8GKuhMNJWod030bJN5ZqbFtHOWaUwWn6K_59K0gMudfUu3iuzW8WIr1wRTUwhoPXtmgJdqlY&sai=AMfl-YR2y58FvlBfYmqod2Dd36snDTNDSTavSVBWLSJJ5Q6oGKeTNGV5JgsrXYyosEtJ2lkOwHs9plVXpA_nq9NKkLBgmlG3ALr2p5FKXqce46BqFe4Wnu5lcGNrIPLXEFEiIJmfavEa_-TguXs2EZByh5T8Ok6wI2gLYGAAHLEsj0ItGMUp3F_xI350dfpKAZ1OQhrLbYwKxKTKYAtr7bntu296EmbeEZIYxl4K2z9BWfa4hPZlkDsa23wUPUl8plHToruR5gA2xXjnpvtqFTNPRcaJdymfGW4OSUTj_kQRmU1hIxI7bhiZu77UEAK44hgOe-SgaKh4iVytmmI4xg-r0OglmBIzEEsQCnPOQMU_omU-mLLnnUePTC3B7eQpaotOrwtRdvVB_TBn4UxvmkjKQlQBCwfryqOG0MGSRFNCaLS0U6gj1okR&sig=Cg0ArKJSzI4WD7j0MCKfEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9jb3N0YXIuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=421&vt=11&dtpt=271&dett=3&cstd=148&cisv=r20231129.08421&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f149.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:43 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
Ad1_160_600_atlas_1.png
s0.2mdn.net/sadbundle/12016345264017701978/Ad1-160-600/images/ Frame 6EFB 		97 KB
97 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/12016345264017701978/Ad1-160-600/images/Ad1_160_600_atlas_1.png
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
e55b02e96e56f8d28131566dae4fff47a5520969de93a2090ca37d0641a53f73
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/12016345264017701978/Ad1-160-600/Ad1-160-600.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 02:43:29 GMT
x-content-type-options
nosniff
age
342914
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
99014
x-xss-protection
0
last-modified
Mon, 09 Oct 2023 14:02:36 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 26 Nov 2024 02:43:29 GMT
view
ad.doubleclick.net/pcs/ Frame 6708 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/pcs/view?xai=AKAOjsvANx_8UZvtmgaIWoZC3Bao5otWgjX8AKJMlwPyZHJPDvl6t-AtFeJavhfl776ipG1iOojwXZDe-jRi5n730_pqthfAbj9wxPK593fiBMnzO70OBCslQiU4JDEjQ1t7mT7TMpjfnCA8Mp0VGbVqAvOAmK8UQnwGcZnBGIfmR9q4Ym29Vq-68F-oZvEidNusly3z1oyZj1gShBAJR-mSep6Lb8Ep5hk464fI2scoqvAe0FGrpctdgbi0tGca2XHFlDwJRjEdqPvQeHcpgPO7FK2LFgZpvrvAvXrS_ThWHsgTkutKVxm2wBQ28Pc1Xvb64MVCYiCieKU35qk8q3_dtKJxll-3lLpWIm3_wqbH2vjMGCw-XWK-vyu3gVcYJIrHvr2P01gNxRE5k7Wb9WFm77XDNg-DQDobxPejXO8jb8U4Eywad7XAGbAlDEVxZLFSV9KEOQoAgnSWMTZktPHj8rYfGP3G4IIGB2qoZ4thfMJxHoMoHHiYBK8B4G1TzOzyxg0jjEq9w-6g4AmoGB-aZJrxWJ9cF9gUHbNhJve5y_qmVpPINHWegq115yPztWSO62Rr19PIb-TEPo4JvIiwGfVEu51n1PQhQcXXHo2GEpx7or_GJDREXiK81OXNDdlYdE86HmnQsLDcEGC474qcTSrhtvEa_hN8L3mPjPNfBnkWmAGa6E6SXldXNXjyJ7D6wD7VVn0KG_fF7kJsyhm26pqdvAKxd06bWh-IgDVHpTaAyWZcKIcg57dQTVRLqaKfoI5TsJ3zQnhtVayoCYJVFJ75_5-2H1vOtAp8aqOtokF4L__hu3SpMXC5bApfKBYi7MwDVXI8w3zJirAmH6a81dPEEmvrzTFx4YO7ecTCwXjsIAwtOIW5FpSIKopS4qu5377AxRVFqi8ppxZPgUvJdLZFAhl_QIVPDfbK0SSa13EwJmYn3hEPp6WKd5Lq4TlEHwA-9-VIJE_DZxwOSKPJXdtKomBYl9SJdvb43CjOI5mRnPxy_OAt7RatPmYJ2JHJ4SDTDAcsgFeGEJwcBJqvf-9b03HgrE0jaKAffOw5_whH5FO8K88BEWDhnZD5UTeZs61lSb-Tjs7W9tglskaDBbV5TY_T2XhrI59vMKxsOMmmdnq_M9HDmquSWRKHU8jtQ-6-tzunIWR5IaQ-Exo_Q8CiRjsnLc5TKWamWzQy-j-WCw4qUnErl4Zi-gFJvV6KpQ6nvnUM-gp9ISvWt1TFU2B9-F8kDRm42WF3yttxi8B4COquynfLbJSlwuBHJMtq0l7KaO_hFk0F1KgEsKTgdFPJt5-mNLdfc_nqsmG5RGDP4sMCx_CIXxOY7m_hOd6RU7DYnTE0wiiG9eU-_r07KBPzCz3QokFl5hX3HUalPCTIAUZ-TgbSTTaRYC_EDPjNsb07rdsv5fgW3nAwvs-USvo&sai=AMfl-YS-CsgXdPiBEZkPobtC-PTm_mMxQ_Dcbew-pHndl9UW0_Uk83yieyNy-nmzz7rxLLMm9Oqd3uJcqZqTTIBFs9bGMOtsG6CDNlOGsWRtqiBZx5XJsheGvMF8dgIfq4NSp0l_GZv4_9_orh0yYJZNvpI5AyfCAq1VB9J2yESnH2hB6C9uvilJdRtYzjZ9JM8rKN-1AZZrBC6dWvhzHxKAgS7RPBJIVLopC0iwL3r45qt0DKb_WFhdL9glQmBmKUA6Q9mp_CIjfXDE5rPMj8qoOoNAZV-cacJY4QH_YlwaNR5YZ4sMXKh3AecSKnLLKAeZQLK8TMIcXsLaucnpmskCDwEMwx9FxToBkpA_1iKIkYaDX2iQpb9Ru8D4gWa6okG9SWav48fOtQkhQRp58ySG9RGajvoBCH8aGuO-M-69_Stqqgqc4EC7&sig=Cg0ArKJSzCoOwVNcA0prEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9jb3N0YXIuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=344&vt=11&dtpt=275&dett=3&cstd=67&cisv=r20231129.66387&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f149.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:43 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
gen_204
pagead2.googlesyndication.com/pagead/ Frame CC6C 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B6IlS0j1pZemhMOfirr4PpZeVsAwAAAAAOAHgBAI&bg=!JiWlJWrNAAY3kmNgF5I7ADQBe5WfONJsashJXkV5cv7Jb3xh6WvTeZN5EDhvclRCbn3FHrqZr_NVMbZKQBq9blftgqbSAgAAAJRSAAAAA2gBBwoAIDTFX-WEwB1mZ3TVv8rLuL5LVr1b2gjsQnAtoMmiQjaFmQMPFPCFjfT78jYWZvYrdigJ4uOPloSrqR-By_BjvOL4PybqWkKCYNkAE0seJkyZnv2AMousD7e1rkpjS1oQZwAYrECQQ-eakNbPg2DQpjcWMdiocnIh5L8fy2IM3TLcgZ_PEZ9jJ5QcqSqTpOdxAaOMQFuHk0ARVZNobkyO3Wj9niaTRWS0IuuEliEVR4eqEIs1yhPSdVqLVZX6wvKkPmWbT5h8RipJt-1gnWU-BdT8CWsCmpm9fc_XNpFX95iCg34UMu7ZnIkKNJ9cU6qWFYZUqsKZG6I3M7jEmbJzn9Q1IXT5z2gcP8Wqk-u4wZ70PWezSJIxkEqiYLi0sbiLnJlhzgQBheD1yfW7xkwSoApYXCiwZu5rwI2S2WKufQ37hbcJCNgmHlSlPq4K4w_ptGvSRz2M1kP2SjMHSqx7HANvb1n3oaZp3pt-eShJG-1OVfv16pSoQInhmKnowMibCUlqcc4INVODMqrB2X8EI_u-rl9z21ujhHWUuvpuYdZ95X73k4zy8YttYCj5IKXqhTzoIVsEJ0tyrcYgyDPTfJ6ZkQF8UWpdlL3wzykSSDfoWR_1I6rB75erujr9rgROiZ-CP7Ufi0yPagPFTaa683gpcPJn7kIogbHg_ZNgYfKeEhJj1qcZl2PMxDuD-mAAZsRev0qjx2OYKxjEXAHTDxbvqqd81ijLBaK2SC36zcoBxlDoMsEQKvo6BkZ-8vwr28HXvn4ioINEQIEDMNTK-LirwxvTAJljUtcLKP4yGoT5p2zJfubr1KFMkFEenssML0P09It-I7qFCzje94gdXYhxOmDTHksupAxdE-tsbJ01ho5V6KvCxYIxvYX7KGKT4DE7QhEx51N-0fe4HNmVVCzsZ8SNsq6xq92zkXh0Cj24JZ9396kF48GFeBEjfKKrXic1w2suLLQdR5_o3kpmpCdas6B724DrMRnCdusDqiseh2H02_RBo0XhlugjIbAA1IPuYDTk1QzPGLd-oy1hOiQd8e0fnD0wBJ73nnvpVvaWBt1nyeIkiD06XGhUUKejLP3J
Requested by
Host: c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
URL: https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNTIwMzQ2NDY1MTYyNjQxNCIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tZWRnZS0xLTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzE2MCw2MDBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI1MjAzNDY0NjUxNjI2NDE0IiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1lZGdlLTEtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjUyMDM0NjQ2NTE2MjY0MTQiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:43 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:43 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 379E 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BFofd0z1pZfjlCKX8hAbPuaTwAwAAAAA4AeAEAg&bg=!q6ilqOfNAAY3kmNgF5I7ADQBe5WfOHnz2JTSJNm9-ue4CPnQqoYT4hUYFwkvZsj-YmSl2WNfVmsKetH8cL_zvzsgGAEbAgAAAJRSAAAAA2gBB5kC_3aiQfxzEVZUaDy38QQ_DDMqdHvT5QeeGwdhUvuf7DVDAM1eqlUoKlyN7kvEgPW-0OSqwpICkh_xaytTovII2H2ZSgtx14ue8Pb8d1XbLKY1C8wYHg4_nNf6Y4VtcZ1i6dtzwqV9pURklpyRnE5azzEyPPKdpkVFfXuWytsuX7fwLm8Vsu0fZZ2htMNUGasLqTcMP7WhJzUGVl5Po1p7lCKBh5qxZABJ7tnDJUQLw0u27KIp5hj16bU3xwRlK3JzPTjByxmlde4s3HNN50gU0JjztQ5zmVa0JLAYYETlf5jkQ1JOTOlFeQqdQrXgTLFqmSgvFe2jrAD16LPPttNfzHxnMYPRjmcrjVG8SnS8l_M-jf3ytGRZSAI_L0BpgtybNjR8rRaEt1k5u-U4503P0ZFzs3EO3vWHsI6o0SNaED6TN8Uh5X_YzBoZZewXEM92kmxK-EObuzy4rD2Lm7NXWq3qTlk9eLbwO0LhuKMX8Ku6sHXFyp-xv0EiatyRhu1IKArlKqdKzwqkoPq4qRNaJ9Fd54V8Uo7M2AU2Iw-92iBMAFpL0Sz3Sgcr46j4xCeL4qrddRSuFuEzlgp5wSal-AxwKhRU2-2JW5oRbvLPl0TDnGXkAWTNL6UNFPzvY4EcBRJ7Aqbkn58Pm_AGNa9BpCJdGS6IxiWMej2zeJOdBSqfZ7jdli5WdSKRoMgwytz9H7xDdL8395kYEClkjnwwJTA2FbNSS1Yy04PQaJg05V5iFsWUm9K6StBxroE_ckk-NIiAfJQr7XcOCGsB7mvGk4dlM0Mg_5UpComZwG2e2S4zhOh7G0kUreHOGxhGdXfkGwV1IitzSOxjRC8VaVhuaKYozmjw4xXJ56a5aWr-5N-qqNNbIjbgnt1wIzkJK1HEzGEbvw3IGpbr82FRKgvgQBLVtGFpdge9y4rhEg72xw7a6nh20b6MhcSytcioE-1RQYb4dE6iYz7ewjRWkJDc_Eu0V7e_6TMeJsn6P1zTDmMzU9kq3oRaip4F4RwsKru5
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:43 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 788C 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvxKBr8mk3v0UQD0_49-dvbU2K2Omx0AR-Up778A9MjArU20hhzsPQifEyMLqM70j7kzsDi01xCkgpYaKKgi6CkcOjWhWQIguwzjh-ImsjZnc_dcFJVKx-SCTJxUzFmj5nHwJ21XqWqvg&sai=AMfl-YS0yOhIcCvnWqooXijIif-BOKSJvUcE9R34WcLzfFdNF1s2uM53HKOgmWvL1C4GVgvbsUMjnoj1deUwQyxUfNWKjA8AsufHYu-WikbBhxE2iMvhEEekxEFj_kSCd4TkkXaKVMYSK04&sig=Cg0ArKJSzBd7CnAR-IGQEAE&cid=CAQSPADICaaNxoG_uJYqVcgWKFwX1jIsvX6gTGEWD7cDq_trYSrgl7I0gh1E5WrobeZLmDP6YiFDwCG0LhVz2xgB&id=lidar2&mcvt=1000&p=1095,430,1185,1400&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231129&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=342075838&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701395923328&rpt=180&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:44 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 6708 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu5_pY3Umt48OA2Abvs_hG4JagNDu16H9x2KGNYtIzxlrUqjXhQpgONRpBIt3R7Gt65g9MfdrVtWhsHCjpENDFgTjDTPZwlzyIs2LqGa4pcViHiQJPOvLHRWGC5wJ-9K2CCSra-NRbfuA&sai=AMfl-YTf2PdpgpNpCQuscrNqr3XoiZPV4aDgWR9LgI3hC4DUQ73-E4Q9TnXjN8GLDNGzXHZAHLxz3dU51sLzSuKlfbIngIai1fjr4bGXcVlsDYOnjzD2T_vH9Z7MaTJViPYZ7wa32ogCYGQ&sig=Cg0ArKJSzDsbuwm3iQifEAE&cid=CAQSPADICaaNNEwwn_CD2fs02OM_Ac1Eq-Rt2XIaXrlYVQ8YE6LUqwOYzmZ7uaN0LtI1oKW1UWn-5sJVAVaHrxgB&id=lidar2&mcvt=1000&p=300,1440,900,1600&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231129&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1509549554&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701395923415&rpt=227&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f155.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:44 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNjIzODQzMjc1NTYzMzE0NCIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tYm94LTQtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbOTcwLDkwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNjIzODQzMjc1NTYzMzE0NCIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tYm94LTQtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjYyMzg0MzI3NTU2MzMxNDQiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLWJveC00LTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:44 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:44 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMzA4NDc0MTgwMzU5MTc2NSIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tZWRnZS0yLTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJyZXZlbnVlIjowLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJzdGF0X3NvdXJjZV9pZCI6MCwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzU0MDIzMTksImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:44 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:44 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMzA4NDc0MTgwMzU5MTc2NSIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tZWRnZS0yLTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NTQwMjMxOSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzE2MCw2MDBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIzMDg0NzQxODAzNTkxNzY1IiwiZG9tYWluX2lkIjoiNDg0NDcwIiwidW5pdCI6ImRpdi1ncHQtYWQtbWVkaWFmaXJlX2NvbS1lZGdlLTItMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInBhZ2V2aWV3X2lkIjoiMjZkYWYwZWUtOGRiNS00ZGFiLTQ3MjctOTYxNmJjZTQ4ODM5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc1NDAyMzE5LCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjMwODQ3NDE4MDM1OTE3NjUiLCJkb21haW5faWQiOiI0ODQ0NzAiLCJ1bml0IjoiZGl2LWdwdC1hZC1tZWRpYWZpcmVfY29tLWVkZ2UtMi0wIiwidF9lcG9jaCI6MTcwMTM5NTkxNiwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzU0MDIzMTksImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:44 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:44 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
16 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNjIzODQzMjc1NTYzMzE0NCIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tYm94LTQtMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInJldmVudWUiOjAsImJpZF9mbG9vcl9maWxsZWQiOjAsInN0YXRfc291cmNlX2lkIjowLCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:44 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:44 GMT
sync
visitor-us-west-2.omnitagjs.com/visitor/ Frame 0823
Redirect Chain
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DXandr%2B%25E2%2580%2593%2BInvest%2BDSP%2B-%2BBanner%26ttl%3D720%26uid%3D75d56568a11564bfb79a0...
  • https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP+-+Banner&ttl=720&uid=75d56568a11564bfb79a01d2fa9fdb29&visitor=8961910970674910848&gdpr=0&gdpr_consent=&gdpr=0&gd...
49 B
385 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP+-+Banner&ttl=720&uid=75d56568a11564bfb79a01d2fa9fdb29&visitor=8961910970674910848&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
12
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
an-x-request-uuid
9fece2fd-e37c-4334-b2cd-286e020a3938
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP+-+Banner&ttl=720&uid=75d56568a11564bfb79a01d2fa9fdb29&visitor=8961910970674910848&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
sync
visitor-us-west-2.omnitagjs.com/visitor/ Frame 0823
Redirect Chain
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DXandr%2B%25E2%2580%2593%2BInvest%2BDSP%26ttl%3D720%26uid%3D48d5713d5c563cba2049f505b2d944b6%2...
  • https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP&ttl=720&uid=48d5713d5c563cba2049f505b2d944b6&visitor=8961910970674910848&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
49 B
384 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP&ttl=720&uid=48d5713d5c563cba2049f505b2d944b6&visitor=8961910970674910848&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
9
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
an-x-request-uuid
4b49144d-c616-4a17-bf61-a8deb09228fa
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=Xandr+%E2%80%93+Invest+DSP&ttl=720&uid=48d5713d5c563cba2049f505b2d944b6&visitor=8961910970674910848&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
sync
visitor.omnitagjs.com/visitor/ Frame 0823
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=adyoulike&gdpr=0&gdpr_consent=
  • https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=adyoulike
  • https://x.bidswitch.net/sync?dsp_id=70&user_id=9135305356218733899&ssp=adyoulike
  • https://visitor.omnitagjs.com/visitor/sync?uid=2a62ca3297af454b8f19eb7922ed945f&visitor=a4aa8fa7-9617-489f-a8fd-b4612be68449&name=BIDSWITCH&gdpr=&gdpr_consent=
49 B
385 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor.omnitagjs.com/visitor/sync?uid=2a62ca3297af454b8f19eb7922ed945f&visitor=a4aa8fa7-9617-489f-a8fd-b4612be68449&name=BIDSWITCH&gdpr=&gdpr_consent=
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
1
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
19
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

Location
//visitor.omnitagjs.com/visitor/sync?uid=2a62ca3297af454b8f19eb7922ed945f&visitor=a4aa8fa7-9617-489f-a8fd-b4612be68449&name=BIDSWITCH&gdpr=&gdpr_consent=
Date
Fri, 01 Dec 2023 01:58:45 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
ayl_pixel
api-2-0.spot.im/pixels/ Frame 0823 		0
0
sync
visitor.omnitagjs.com/visitor/ Frame 0823
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=adyoulike&gdpr=0&gdpr_consent=
  • https://creativecdn.com/cm-notify?pi=adyoulike&gdpr=0&gdpr_consent=&tc=1
  • https://visitor.omnitagjs.com/visitor/sync?uid=094e13e3a08b6f25e4d4f7b1fba0b26b&visitor=nJhNX3BFCNmexFG-v6tMoBwZNIldP_0c5HeQ1KUCu0k&name=RTB_HOUSE&pi=adyoulike&gdpr=0&gdpr_consent=&tc=1
49 B
384 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor.omnitagjs.com/visitor/sync?uid=094e13e3a08b6f25e4d4f7b1fba0b26b&visitor=nJhNX3BFCNmexFG-v6tMoBwZNIldP_0c5HeQ1KUCu0k&name=RTB_HOUSE&pi=adyoulike&gdpr=0&gdpr_consent=&tc=1
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:47 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
5
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

location
https://visitor.omnitagjs.com/visitor/sync?uid=094e13e3a08b6f25e4d4f7b1fba0b26b&visitor=nJhNX3BFCNmexFG-v6tMoBwZNIldP_0c5HeQ1KUCu0k&name=RTB_HOUSE&pi=adyoulike&gdpr=0&gdpr_consent=&tc=1
pragma
no-cache
date
Fri, 01 Dec 2023 01:58:47 GMT, Fri, 01 Dec 2023 01:58:47 GMT
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
sync
visitor-us-west-2.omnitagjs.com/visitor/ Frame 0823
Redirect Chain
  • https://csync.smilewanted.com/getuid?source=openrtb&zoneCode=openrtb_adyoulike&redirect=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DSMILE_WANTED%26ttl%3D720%26uid%3De770...
  • https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=SMILE_WANTED&ttl=720&uid=e77031af9e62c4ae76bee5b9517c4ef4&visitor=7b224b57df1db1f14d334ad9f861d9cf&gdpr=0&gdpr_consent=
49 B
385 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=SMILE_WANTED&ttl=720&uid=e77031af9e62c4ae76bee5b9517c4ef4&visitor=7b224b57df1db1f14d334ad9f861d9cf&gdpr=0&gdpr_consent=
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
1
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
34
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

date
Fri, 01 Dec 2023 01:58:45 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
text/html; charset=UTF-8
location
https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=SMILE_WANTED&ttl=720&uid=e77031af9e62c4ae76bee5b9517c4ef4&visitor=7b224b57df1db1f14d334ad9f861d9cf&gdpr=0&gdpr_consent=
access-control-allow-credentials
true
cf-ray
82e7ba158aba36b7-YYZ
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
sync
visitor.omnitagjs.com/visitor/ Frame 0823
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/aul
  • https://match.prod.bidr.io/cookie-sync/aul?_bee_ppp=1
  • https://visitor.omnitagjs.com/visitor/sync?uid=25295ec01618ddaad37302ab4dd9c8ac&visitor=AADi8E7K0nwAABMXtn_NUw&name=BEESWAX
49 B
385 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor.omnitagjs.com/visitor/sync?uid=25295ec01618ddaad37302ab4dd9c8ac&visitor=AADi8E7K0nwAABMXtn_NUw&name=BEESWAX
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:46 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
11
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

location
https://visitor.omnitagjs.com/visitor/sync?uid=25295ec01618ddaad37302ab4dd9c8ac&visitor=AADi8E7K0nwAABMXtn_NUw&name=BEESWAX
Date
Fri, 01 Dec 2023 01:58:46 GMT
strict-transport-security
max-age=2592000; includeSubDomains
Server
gunicorn
Connection
keep-alive
Content-Length
0
sync
visitor.omnitagjs.com/visitor/ Frame 0823
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=k2j3gqp&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://visitor.omnitagjs.com/visitor/sync?uid=8122fdac60517b1efe1389612f3dfb34&visitor=a0469c36-bc77-430e-9825-0adde7e331a8&name=THE_TRADE_DESK
49 B
384 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor.omnitagjs.com/visitor/sync?uid=8122fdac60517b1efe1389612f3dfb34&visitor=a0469c36-bc77-430e-9825-0adde7e331a8&name=THE_TRADE_DESK
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
9
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

location
https://visitor.omnitagjs.com/visitor/sync?uid=8122fdac60517b1efe1389612f3dfb34&visitor=a0469c36-bc77-430e-9825-0adde7e331a8&name=THE_TRADE_DESK
date
Fri, 01 Dec 2023 01:58:45 GMT
server
Kestrel
content-length
319
sync
visitor-us-west-2.omnitagjs.com/visitor/ Frame 0823
Redirect Chain
  • https://b1sync.zemanta.com/usersync/adyoulike/?cb=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_NATIVE_1_2%26ttl%3D720%26uid%3Df2d9136cf53dede7f83ba16171a37fdd%26v...
  • https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ZEMANTA_NATIVE_1_2&ttl=720&uid=f2d9136cf53dede7f83ba16171a37fdd&visitor=JthQNRlYKvyYtq8sninV&gdpr=0&gdpr_consent=&gdpr=0
49 B
385 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ZEMANTA_NATIVE_1_2&ttl=720&uid=f2d9136cf53dede7f83ba16171a37fdd&visitor=JthQNRlYKvyYtq8sninV&gdpr=0&gdpr_consent=&gdpr=0
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
26
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:45 GMT
Content-Type
text/html; charset=utf-8
Location
https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ZEMANTA_NATIVE_1_2&ttl=720&uid=f2d9136cf53dede7f83ba16171a37fdd&visitor=JthQNRlYKvyYtq8sninV&gdpr=0&gdpr_consent=&gdpr=0
P3p
CP="We do not support P3P header."
Cache-Control
no-cache, no-store, must-revalidate
Content-Length
225
Expires
Thu, 01 Dec 1994 16:00:00 GMT
/
onetag-sys.com/match/ Frame 0823
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=159706&pu=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visi...
  • https://image8.pubmatic.com/AdServer/ImgSync?p=159706&pu=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DPUBMATIC%26ttl%3D720%26uid%3D2fe1084ffe44c28350116ec0a0a1c2d1%26visi...
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=N0ZDQkJCRTgtRjE0Qi00QUVFLUE1OEItQzk1RTEyMzgyM0VF&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
  • https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=476A89A3-0BB0-450F-AC03-2F959BAA28BD
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=476A89A3-0BB0-450F-AC03-2F959BAA28BD
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location
https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=476A89A3-0BB0-450F-AC03-2F959BAA28BD
date
Fri, 01 Dec 2023 01:58:47 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
157
content-type
text/html; charset=utf-8
sync
visitor-us-west-2.omnitagjs.com/visitor/ Frame 0823
Redirect Chain
  • https://b1sync.zemanta.com/usersync/adyoulike/?cb=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_BANNER%26ttl%3D720%26uid%3Dbdef6bd95b7450b4e62a32db8c7d8c9d%26visit...
  • https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ZEMANTA_BANNER&ttl=720&uid=bdef6bd95b7450b4e62a32db8c7d8c9d&visitor=JthQNRlYKvyYtq8sninV&gdpr=0&gdpr_consent=&gdpr=0
49 B
384 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ZEMANTA_BANNER&ttl=720&uid=bdef6bd95b7450b4e62a32db8c7d8c9d&visitor=JthQNRlYKvyYtq8sninV&gdpr=0&gdpr_consent=&gdpr=0
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
7
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:45 GMT
Content-Type
text/html; charset=utf-8
Location
https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ZEMANTA_BANNER&ttl=720&uid=bdef6bd95b7450b4e62a32db8c7d8c9d&visitor=JthQNRlYKvyYtq8sninV&gdpr=0&gdpr_consent=&gdpr=0
P3p
CP="We do not support P3P header."
Cache-Control
no-cache, no-store, must-revalidate
Content-Length
221
Expires
Thu, 01 Dec 1994 16:00:00 GMT
/
csync.loopme.me/ Frame 0823 		0
0
sync
visitor-us-west-2.omnitagjs.com/visitor/ Frame 0823
Redirect Chain
  • https://sync.adotmob.com/cookie/adyoulike?r=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DADOTMOB%26ttl%3D720%26uid%3Db989ee06df7dfc250798f7f0dfc4ddee%26visitor%3D%7Bamob_...
  • https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ADOTMOB&ttl=720&uid=b989ee06df7dfc250798f7f0dfc4ddee&visitor=09dd220400f7d56bef5cd80c&gdpr=0&gdpr_consent=&gdpr=0&gdprConsent=
49 B
384 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ADOTMOB&ttl=720&uid=b989ee06df7dfc250798f7f0dfc4ddee&visitor=09dd220400f7d56bef5cd80c&gdpr=0&gdpr_consent=&gdpr=0&gdprConsent=
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:47 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
8
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

location
https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ADOTMOB&ttl=720&uid=b989ee06df7dfc250798f7f0dfc4ddee&visitor=09dd220400f7d56bef5cd80c&gdpr=0&gdpr_consent=&gdpr=0&gdprConsent=
date
Fri, 01 Dec 2023 01:58:46 GMT
access-control-allow-credentials
true
x-powered-by
Express
keep-alive
timeout=5
vary
Origin
content-length
0
sync
visitor.omnitagjs.com/visitor/ Frame 0823
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=33&gdpr=0&gdpr_consent=
  • https://visitor.omnitagjs.com/visitor/sync?uid=74a1ec3b61e72925193cfceeea1b0608&visitor=0-1a75cb49-6a51-525a-5432-00acb2eb4795$ip$185.213.80.164&name=STACKADAPT&gdpr=0&gdpr_consent=
49 B
385 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor.omnitagjs.com/visitor/sync?uid=74a1ec3b61e72925193cfceeea1b0608&visitor=0-1a75cb49-6a51-525a-5432-00acb2eb4795$ip$185.213.80.164&name=STACKADAPT&gdpr=0&gdpr_consent=
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
40
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

Location
https://visitor.omnitagjs.com/visitor/sync?uid=74a1ec3b61e72925193cfceeea1b0608&visitor=0-1a75cb49-6a51-525a-5432-00acb2eb4795$ip$185.213.80.164&name=STACKADAPT&gdpr=0&gdpr_consent=
Date
Fri, 01 Dec 2023 01:58:45 GMT
Connection
keep-alive
Content-Length
220
Content-Type
text/html; charset=utf-8
pixel
ap.lijit.com/ Frame 0823 		0
277 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ap.lijit.com/pixel?redir=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DSOVRN%26ttl%3D720%26uid%3D4b30a0b1f289a261ab592e1e53c126eb%26visitor%3D%24UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
72.251.238.254 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 01 Dec 2023 01:58:45 GMT
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap1ewr1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
sync
visitor-us-west-2.omnitagjs.com/visitor/ Frame 0823
Redirect Chain
  • https://inv-nets.admixer.net/adxcm.aspx?ssp=5E789729-1E92-41CA-8B4F-987C6EDAE9FE&rurl=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DADMIXER%26ttl%3D720%26uid%3D0f4b0fcde45...
  • https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ADMIXER&ttl=720&uid=0f4b0fcde45fe67019618f4c5f35f52e&visitor=1774b204c12b4887abdf5e36871b12e5&gdpr=0&gdpr_consent=
49 B
385 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ADMIXER&ttl=720&uid=0f4b0fcde45fe67019618f4c5f35f52e&visitor=1774b204c12b4887abdf5e36871b12e5&gdpr=0&gdpr_consent=
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
1
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
33
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

Date
Fri, 01 Dec 2023 01:58:45 GMT
Server
nginx
P3p
CP="NID DSP ALL COR"
Access-Control-Allow-Origin
*
Location
https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=ADMIXER&ttl=720&uid=0f4b0fcde45fe67019618f4c5f35f52e&visitor=1774b204c12b4887abdf5e36871b12e5&gdpr=0&gdpr_consent=
Access-Control-Allow-Credentials
true
Connection
keep-alive
Keep-Alive
timeout=25
Content-Length
0
X-Xss-Protection
0
sync
visitor-us-west-2.omnitagjs.com/visitor/ Frame 0823
Redirect Chain
  • https://jadserve.postrelease.com/suid/101967?ntv_r=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DNATIVO%26ttl%3D720%26uid%3D0544850a0778385701c6899403bef718%26visitor%3DNT...
  • https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=NATIVO&ttl=720&uid=0544850a0778385701c6899403bef718&visitor=f616cb2e-ea3f-4a4d-b38a-d37bfae9b5cc&gdpr=0&gdpr_consent=
49 B
385 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=NATIVO&ttl=720&uid=0544850a0778385701c6899403bef718&visitor=f616cb2e-ea3f-4a4d-b38a-d37bfae9b5cc&gdpr=0&gdpr_consent=
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:46 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
14
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:46 GMT
server
nginx
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=NATIVO&ttl=720&uid=0544850a0778385701c6899403bef718&visitor=f616cb2e-ea3f-4a4d-b38a-d37bfae9b5cc&gdpr=0&gdpr_consent=
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
0
expires
Mon, 1 Jan 1990 12:00:00 GMT
sync
visitor.omnitagjs.com/visitor/ Frame 0823
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=44774&callback_url=%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fuid%3Dbf39a6af2a15b80f82f7ff725f351919%26visitor%3D%24%7BUSER_ID%7D%26name%3DBETWEEN...
  • https://ads.betweendigital.com/match?bidder_id=44774&callback_url=%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fuid%3Dbf39a6af2a15b80f82f7ff725f351919%26visitor%3D%24%7BUSER_ID%7D%26name%3DBETWEEN...
  • https://visitor.omnitagjs.com/visitor/sync?uid=bf39a6af2a15b80f82f7ff725f351919&visitor=a2fd180f-1eab-534f-b26c-6b6bd70556be&name=BETWEENX&gdpr=0&gdpr_consent=
49 B
385 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor.omnitagjs.com/visitor/sync?uid=bf39a6af2a15b80f82f7ff725f351919&visitor=a2fd180f-1eab-534f-b26c-6b6bd70556be&name=BETWEENX&gdpr=0&gdpr_consent=
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
12
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

location
https://visitor.omnitagjs.com/visitor/sync?uid=bf39a6af2a15b80f82f7ff725f351919&visitor=a2fd180f-1eab-534f-b26c-6b6bd70556be&name=BETWEENX&gdpr=0&gdpr_consent=
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
sync
visitor.omnitagjs.com/visitor/ Frame 0823
Redirect Chain
  • https://bttrack.com/pixel/cookiesync?source=6b2595d5-cf4e-4298-a4ac-bcc34433eaad&secure=1&gdpr=0&gdpr_consent=
  • https://visitor.omnitagjs.com/visitor/sync?uid=6ca9493fd95af83951a8d0b213a77e8d&visitor=4116a309-2928-4d65-b56c-2c6a48e8a2a7&name=BIDTELLECT&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}
49 B
385 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor.omnitagjs.com/visitor/sync?uid=6ca9493fd95af83951a8d0b213a77e8d&visitor=4116a309-2928-4d65-b56c-2c6a48e8a2a7&name=BIDTELLECT&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:46 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
102
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

x-servername
Track004-iad
pragma
no-cache
date
Fri, 01 Dec 2023 01:58:05 GMT
strict-transport-security
max-age=31536000;
content-type
text/html; charset=utf-8
location
https://visitor.omnitagjs.com/visitor/sync?uid=6ca9493fd95af83951a8d0b213a77e8d&visitor=4116a309-2928-4d65-b56c-2c6a48e8a2a7&name=BIDTELLECT&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}
cache-control
private,no-cache
content-length
315
expires
-1
1000.gif
id.rlcdn.com/ Frame 0823
Redirect Chain
  • https://id.rlcdn.com/711333.gif?&gdpr=0&gdpr_consent=
  • https://id.rlcdn.com/1000.gif?memo=CKW1KxoNCNX7pKsGEgUI6AcQAEIASgA
42 B
310 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/1000.gif?memo=CKW1KxoNCNX7pKsGEgUI6AcQAEIASgA
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
35.244.154.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.154.244.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://visitor.omnitagjs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:45 GMT
via
1.1 google
content-type
image/gif
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

date
Fri, 01 Dec 2023 01:58:45 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://id.rlcdn.com/1000.gif?memo=CKW1KxoNCNX7pKsGEgUI6AcQAEIASgA
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
/
onetag-sys.com/usync/ Frame 7D95 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
a609cb6ccb91d2ea20fd6f47e2fb2439d2bef06eb02fea4dfd6c2cfba35f012d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://visitor.omnitagjs.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control
no-transform, no-cache
content-encoding
gzip
content-length
1488
content-type
text/html
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security
max-age=15552000
usync.html
eus.rubiconproject.com/ Frame 65E5
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
  • https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
281 B
555 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.197.42.81 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-42-81.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://visitor.omnitagjs.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Fri, 01 Dec 2023 01:58:47 GMT
ETag
"280525-119-60930cbd3cec0"
Last-Modified
Thu, 02 Nov 2023 19:57:23 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Fri, 01 Dec 2023 01:58:46 GMT
location
https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
server
AkamaiGHost
usync.html
eus.rubiconproject.com/ Frame 180E
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
  • https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
281 B
555 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.197.42.81 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-42-81.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://visitor.omnitagjs.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Fri, 01 Dec 2023 01:58:47 GMT
ETag
"280525-119-60930cbd3cec0"
Last-Modified
Thu, 02 Nov 2023 19:57:23 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Fri, 01 Dec 2023 01:58:46 GMT
location
https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
server
AkamaiGHost
usync.html
eus.rubiconproject.com/ Frame 6CAC
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
  • https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
281 B
555 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.197.42.81 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-42-81.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://visitor.omnitagjs.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Fri, 01 Dec 2023 01:58:47 GMT
ETag
"280525-119-60930cbd3cec0"
Last-Modified
Thu, 02 Nov 2023 19:57:23 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Fri, 01 Dec 2023 01:58:46 GMT
location
https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
server
AkamaiGHost
sync
ssbsync.smartadserver.com/api/ Frame 83AC 		1009 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.105.12.171 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
3090542cfa480c27139ce97a0a00f3d1c843274bed009a3b1b00cec9e84eb3f3

Request headers

Referer
https://visitor.omnitagjs.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-length
1009
content-type
text/html
date
Fri, 01 Dec 2023 01:58:44 GMT
tap.php
pixel.rubiconproject.com/ Frame 7D95 		42 B
927 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=5L_ScCmIe04VLRjc2VnEry0yNqNSktKNq21C2Hw8kMI
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
pixel
cm.g.doubleclick.net/ Frame 7D95
Redirect Chain
  • https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABjCMZiZM2_SNeZN2Jr1ZggM8IUFJwTLQK1Q
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABjCMZiZM2_SNeZN2Jr1ZggM8IUFJwTLQK1Q
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABjCMZiZM2_SNeZN2Jr1ZggM8IUFJwTLQK1Q
strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
/
onetag-sys.com/match/ Frame 7D95
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D0%26gdpr_consent%3D
  • https://onetag-sys.com/match/?int_id=1&uid=ad486569-3dd5-4800-ba9a-c274bf6c91fb&gdpr=0&gdpr_consent=
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=1&uid=ad486569-3dd5-4800-ba9a-c274bf6c91fb&gdpr=0&gdpr_consent=
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date
Fri, 01 Dec 2023 01:58:45 GMT
Server
MT3 1191 303c5b1 master iad iad-pixel-x2 config_version:"2081"
Content-Type
image/gif
Access-Control-Allow-Origin
*
location
https://onetag-sys.com/match/?int_id=1&uid=ad486569-3dd5-4800-ba9a-c274bf6c91fb&gdpr=0&gdpr_consent=
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
0
Expires
Fri, 01 Dec 2023 01:58:44 GMT
/
onetag-sys.com/match/ Frame 7D95
Redirect Chain
  • https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=0&gdpr_consent=
  • https://onetag-sys.com/match/?int_id=2&uid=LPLZ7BT1-K-6QY9&gdpr=0
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=2&uid=LPLZ7BT1-K-6QY9&gdpr=0
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://onetag-sys.com/match/?int_id=2&uid=LPLZ7BT1-K-6QY9&gdpr=0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
24dd0e7a336ea1f5a4a3fa7e1bfcb863
Expires
0
/
onetag-sys.com/match/ Frame 7D95
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D0%26gdpr_consent%3D%26uid%3D$UID
  • https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=8961910970674910848
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=8961910970674910848
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
an-x-request-uuid
9e9bdf4a-776f-4a8f-875a-c886fe993195
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=8961910970674910848
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
/
onetag-sys.com/match/ Frame 7D95
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3679&gdpr=0&gdpr_consent=
  • https://onetag-sys.com/match/?int_id=3&uid=19e74a65c36c6d13014e8a2869ef343&gdpr_consent=&gdpr=0
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=3&uid=19e74a65c36c6d13014e8a2869ef343&gdpr_consent=&gdpr=0
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:45 GMT
Server
nginx
Access-Control-Allow-Origin
*
Location
https://onetag-sys.com/match/?int_id=3&uid=19e74a65c36c6d13014e8a2869ef343&gdpr_consent=&gdpr=0
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
x-sticky-vk
1701395925378082-1164
/
onetag-sys.com/match/ Frame 7D95
Redirect Chain
  • https://cs.admanmedia.com/73c1e1bfc3bde354d60b80e601ae3914.gif?puid=[UID]&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D164%26gdpr%3D%24%7BGDPR%7D%26gdpr_consent%3D%24%7BGDPR_STRING%7D%2...
  • https://onetag-sys.com/match/?int_id=164&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5e3b3c30-3b2a-4b86-b01b-9dc4120b1f41
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=164&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5e3b3c30-3b2a-4b86-b01b-9dc4120b1f41
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:45 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Server
nginx
Transfer-Encoding
chunked
Location
https://onetag-sys.com/match/?int_id=164&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=5e3b3c30-3b2a-4b86-b01b-9dc4120b1f41
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Expires
0
/
onetag-sys.com/match/ Frame 7D95
Redirect Chain
  • https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
  • https://onetag-sys.com/match/?int_id=107&uid=6746445839225075283
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=107&uid=6746445839225075283
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location
https://onetag-sys.com/match/?int_id=107&uid=6746445839225075283
date
Fri, 01 Dec 2023 01:58:45 GMT
content-length
0
ecm3
s.amazon-adsystem.com/ Frame 7D95
Redirect Chain
  • https://onetag-sys.com/match/?int_id=113&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
  • https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=LHP9BTcFATj7SsusPnWgknafkm9l-neXw34ShLXSWRg
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=LHP9BTcFATj7SsusPnWgknafkm9l-neXw34ShLXSWRg
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:48 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
PM9J3CST237CEM8DBR55
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=LHP9BTcFATj7SsusPnWgknafkm9l-neXw34ShLXSWRg
strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
/
onetag-sys.com/match/ Frame 7D95
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26u...
  • https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26u...
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NDc2QTg5QTMtMEJCMC00NTBGLUFDMDMtMkY5NTlCQUEyOEJE&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
  • https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=476A89A3-0BB0-450F-AC03-2F959BAA28BD
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=476A89A3-0BB0-450F-AC03-2F959BAA28BD
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location
https://onetag-sys.com/match/?int_id=114&gdpr=${GDPR}&gdpr_consent=${GDPR_STRING}&uid=476A89A3-0BB0-450F-AC03-2F959BAA28BD
date
Fri, 01 Dec 2023 01:58:47 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
157
content-type
text/html; charset=utf-8
/
onetag-sys.com/match/ Frame 7D95
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
  • https://onetag-sys.com/match/?int_id=106&google_gid=CAESECGu7pF2HhMHxAjTB__6CXA&google_cver=1
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=106&google_gid=CAESECGu7pF2HhMHxAjTB__6CXA&google_cver=1
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://onetag-sys.com/match/?int_id=106&google_gid=CAESECGu7pF2HhMHxAjTB__6CXA&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
298
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
onetag-sys.com/match/ Frame 7D95
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=0&gdpr_consent=
  • https://onetag-sys.com/match/?int_id=92&uid=y-xv9cScBE2uEqP4mZbM8DQ8.FiwBsqMDOo3P8nz8-~A
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=92&uid=y-xv9cScBE2uEqP4mZbM8DQ8.FiwBsqMDOo3P8nz8-~A
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location
https://onetag-sys.com/match/?int_id=92&uid=y-xv9cScBE2uEqP4mZbM8DQ8.FiwBsqMDOo3P8nz8-~A
date
Fri, 01 Dec 2023 01:58:45 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
/
onetag-sys.com/match/ Frame 7D95
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=onetag&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=onetag&bsw_param=a4aa8fa7-9617-489f-a8fd-b4612be68449&google_hm=YTRhYThmYTctOTYxNy00ODlmLWE4ZmQtYjQ2MTJiZTY4NDQ5
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESENzNhJKZxC_kW9jQ1k8JCp0&google_cver=1&ssp=onetag&bsw_param=a4aa8fa7-9617-489f-a8fd-b4612be68449
  • https://onetag-sys.com/match/?int_id=30&uid=a4aa8fa7-9617-489f-a8fd-b4612be68449&gdpr=&gdpr_consent=&us_privacy=
0
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=30&uid=a4aa8fa7-9617-489f-a8fd-b4612be68449&gdpr=&gdpr_consent=&us_privacy=
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol
H2
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Location
//onetag-sys.com/match/?int_id=30&uid=a4aa8fa7-9617-489f-a8fd-b4612be68449&gdpr=&gdpr_consent=&us_privacy=
Date
Fri, 01 Dec 2023 01:58:45 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
sync
visitor.omnitagjs.com/visitor/ Frame 7D95 		49 B
385 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor.omnitagjs.com/visitor/sync?uid=f04f5c55f88ffea7a3ce5b2d908a6e71&visitor=5L_ScCmIe04VLRjc2VnEry0yNqNSktKNq21C2Hw8kMI
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
20
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0
sync
visitor.omnitagjs.com/visitor/ Frame 83AC 		49 B
384 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor.omnitagjs.com/visitor/sync?uid=9276a8c8d010b77af50144c60047b781&visitor=6746445839225075283&name=SMARTADSERVER&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
4
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0
/
rtb-csync.smartadserver.com/redir/ Frame 83AC
Redirect Chain
  • https://secure.adnxs.com/getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=8961910970674910848&gdpr=0&gdpr_consent=
43 B
439 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=8961910970674910848&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
23.83.76.73 Los Angeles, United States, ASN395954 (LEASEWEB-USA-LAX, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Fri, 01 Dec 2023 01:58:44 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
an-x-request-uuid
5e14870f-5474-4c64-ae25-eb0aa0b745bc
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=8961910970674910848&gdpr=0&gdpr_consent=
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
v1
match.sharethrough.com/sync/ Frame 83AC
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DS...
  • https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=6746445839225075283&gdpr=0&gdpr_consent=
68 B
280 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=6746445839225075283&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=
Protocol
H2
Server
3.226.187.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-226-187-105.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:46 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

location
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=6746445839225075283&gdpr=0&gdpr_consent=
pragma
no-cache
date
Fri, 01 Dec 2023 01:58:44 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
/
rtb-csync.smartadserver.com/redir/ Frame 83AC
Redirect Chain
  • https://visitor.omnitagjs.com/visitor/bsync?uid=627080440e659fbe0f85333c665ae1de&name=SMARTADSERVER&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D117%26partnerus...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=62ae6d0f7138766890cdfecf38ceff8f&gdpr=0&gdpr_consent=0
43 B
476 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=62ae6d0f7138766890cdfecf38ceff8f&gdpr=0&gdpr_consent=0
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
23.83.76.73 Los Angeles, United States, ASN395954 (LEASEWEB-USA-LAX, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Fri, 01 Dec 2023 01:58:44 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
1
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=62ae6d0f7138766890cdfecf38ceff8f&gdpr=0&gdpr_consent=0
x-kong-upstream-latency
36
content-type
text/html; charset=UTF-8
cache-control
no-cache, no-store, must-revalidate
content-length
0
expires
0
/
rtb-csync.smartadserver.com/redir/ Frame 83AC
Redirect Chain
  • https://cms.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=LkOVBSsSxw81EJJYfkKOBS5BkAw1E8IMexJyU98A
43 B
466 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=LkOVBSsSxw81EJJYfkKOBS5BkAw1E8IMexJyU98A
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
23.83.76.73 Los Angeles, United States, ASN395954 (LEASEWEB-USA-LAX, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Fri, 01 Dec 2023 01:58:44 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:45 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=LkOVBSsSxw81EJJYfkKOBS5BkAw1E8IMexJyU98A
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
army.gif
g.ezoic.net/porpoiseant/ 		0
63 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzY5ODAwNjYyMzU4Nzk0MiIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tYm94LTItMCIsInRfZXBvY2giOjE3MDEzOTU5MTYsInJldmVudWUiOjAsImJpZF9mbG9vcl9maWxsZWQiOjAsInN0YXRfc291cmNlX2lkIjowLCJwYWdldmlld19pZCI6IjI2ZGFmMGVlLThkYjUtNGRhYi00NzI3LTk2MTZiY2U0ODgzOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NTQwMjMxOSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:47 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:47 GMT
collect
analytics.google.com/g/ 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-K68XP6D85D&gtm=45je3bt0v887485693&_p=1701395916156&gcd=11l1l1l1l1&dma=0&tcfd=10000&cid=1675868932.1701395917&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEI&sid=1701395916&sct=1&seg=0&dl=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&dt=NSwish%20texture%20pack&_s=2&tfd=10330
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K68XP6D85D&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.111.101 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bk-in-f101.1e100.net
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mediafire.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:46 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mediafire.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
log
translate.googleapis.com/element/ 		131 B
152 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://translate.googleapis.com/element/log?format=json&hasfast=true&authuser=0
Requested by
Host:
URL: /_/translate_http/_/js/k=translate_http.tr.en_US.NCDVv9o_B5A.O/am=CAM/d=1/rs=AN8SPfpp3nu6l97CsQCuUSY9TVoCT_-UAQ/m=el_conf
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f95.1e100.net
Software
Playlog /
Resource Hash
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Content-Encoding
gzip
Referer
https://www.mediafire.com/
X-Goog-AuthUser
0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type
application/binary

Response headers

date
Fri, 01 Dec 2023 01:58:46 GMT
content-encoding
gzip
server
Playlog
x-frame-options
SAMEORIGIN
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mediafire.com
cache-control
private
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
X-Playlog-Web
content-length
131
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
log
translate.googleapis.com/element/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://translate.googleapis.com/element/log?format=json&hasfast=true&authuser=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f95.1e100.net
Software
Playlog /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
content-encoding,content-type,x-goog-authuser
Access-Control-Request-Method
POST
Origin
https://www.mediafire.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
X-Playlog-Web,authorization,content-encoding,content-type,x-goog-authuser,origin
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://www.mediafire.com
access-control-max-age
86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/plain; charset=UTF-8
date
Fri, 01 Dec 2023 01:58:46 GMT
server
Playlog
x-frame-options
SAMEORIGIN
x-xss-protection
0
usync.js
eus.rubiconproject.com/ Frame 65E5 		46 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.197.42.81 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-42-81.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
94309e82d864813ce190a8c1edfe2433347bd8705b55dc77a28ea55ae29bed05

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date
Fri, 01 Dec 2023 01:58:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Nov 2023 22:59:33 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=75739
Connection
keep-alive
Content-Length
13236
Expires
Fri, 01 Dec 2023 23:01:06 GMT
usync.js
eus.rubiconproject.com/ Frame 6CAC 		46 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.197.42.81 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-42-81.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
94309e82d864813ce190a8c1edfe2433347bd8705b55dc77a28ea55ae29bed05

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date
Fri, 01 Dec 2023 01:58:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Nov 2023 22:59:33 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=75739
Connection
keep-alive
Content-Length
13236
Expires
Fri, 01 Dec 2023 23:01:06 GMT
usync.js
eus.rubiconproject.com/ Frame 180E 		46 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.197.42.81 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-42-81.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
94309e82d864813ce190a8c1edfe2433347bd8705b55dc77a28ea55ae29bed05

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date
Fri, 01 Dec 2023 01:58:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Nov 2023 22:59:33 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=75739
Connection
keep-alive
Content-Length
13236
Expires
Fri, 01 Dec 2023 23:01:06 GMT
khaos.json
token.rubiconproject.com/ Frame 65E5 		7 B
873 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://token.rubiconproject.com/khaos.json?gdpr=0&us_privacy=1---
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://eus.rubiconproject.com
Cache-Control
no-cache,no-store,must-revalidate
access-control-allow-credentials
true
content-length
7
X-RPHost
ad49a0f18e050afeb6359164ab3bd56e
Expires
0
khaos.json
token.rubiconproject.com/ Frame 6CAC 		7 B
873 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://token.rubiconproject.com/khaos.json?gdpr=0&us_privacy=1---
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://eus.rubiconproject.com
Cache-Control
no-cache,no-store,must-revalidate
access-control-allow-credentials
true
content-length
7
X-RPHost
ad49a0f18e050afeb6359164ab3bd56e
Expires
0
khaos.json
token.rubiconproject.com/ Frame 180E 		7 B
873 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://token.rubiconproject.com/khaos.json?gdpr=0&us_privacy=1---
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://eus.rubiconproject.com
Cache-Control
no-cache,no-store,must-revalidate
access-control-allow-credentials
true
content-length
7
X-RPHost
ad49a0f18e050afeb6359164ab3bd56e
Expires
0
sync
visitor.omnitagjs.com/visitor/ Frame 65E5
Redirect Chain
  • https://pixel-eu.rubiconproject.com/exchange/sync.php?p=adyoulike&gdpr=0&gdpr_consent=&gdpr=0&us_privacy=1---&khaos=LPLZ7BT1-K-6QY9
  • https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LPLZ7BT1-K-6QY9&name=RUBICON&gdpr=0&us_privacy=1---
49 B
385 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LPLZ7BT1-K-6QY9&name=RUBICON&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:48 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
20
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LPLZ7BT1-K-6QY9&name=RUBICON&gdpr=0&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
24dd0e7a336ea1f5a4a3fa7e1bfcb863
Expires
0
ecm3
aax-eu.amazon-adsystem.com/s/ Frame 65E5
Redirect Chain
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&gdpr=0&us_privacy=1---
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=kcZydKTuRlKWztfIFMjiAQ&rk=usync-other&gdpr=0
  • https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=kcZydKTuRlKWztfIFMjiAQ&gdpr=0
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=kcZydKTuRlKWztfIFMjiAQ&gdpr=0
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
67.220.228.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:49 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
FWFK9HQ63VFGAZDFAKTF
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=kcZydKTuRlKWztfIFMjiAQ&gdpr=0
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
setuid
px.ads.linkedin.com/ Frame 65E5
Redirect Chain
  • https://token.rubiconproject.com/token?pid=36584&gdpr=0&us_privacy=1---
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
0
143 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:47 GMT
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 2B313F65BEEE4FCA98A8205D1EF6DAAC Ref B: NYCEDGE1308 Ref C: 2023-12-01T01:58:48Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lor1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYLaRvqgBnSUR4pS03RXw==

Redirect headers

Location
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
ad49a0f18e050afeb6359164ab3bd56e
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
ecm3
s.amazon-adsystem.com/ Frame 65E5
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&gdpr=0&us_privacy=1---
  • https://s.amazon-adsystem.com/ecm3?id=LPLZ7BT1-K-6QY9&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1---
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=LPLZ7BT1-K-6QY9&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:48 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
H12CD341D3GX6Y739RJ6
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://s.amazon-adsystem.com/ecm3?id=LPLZ7BT1-K-6QY9&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
Expires
0
tap.php
pixel.rubiconproject.com/ Frame 65E5
Redirect Chain
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0&us_privacy=1---
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=a0469c36-bc77-430e-9825-0adde7e331a8&gdpr=0&gdpr_consent=&expires=30
42 B
939 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=a0469c36-bc77-430e-9825-0adde7e331a8&gdpr=0&gdpr_consent=&expires=30
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=a0469c36-bc77-430e-9825-0adde7e331a8&gdpr=0&gdpr_consent=&expires=30
date
Fri, 01 Dec 2023 01:58:48 GMT
server
Kestrel
content-length
289
ecm3
s.amazon-adsystem.com/ Frame 65E5
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr=0&us_privacy=1---
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=qlXVDL0GTHm4wPYJ1Li8Zg&rk=usync-na&gdpr=0
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=qlXVDL0GTHm4wPYJ1Li8Zg&gdpr=0
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=qlXVDL0GTHm4wPYJ1Li8Zg&gdpr=0
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:49 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
AY6JHJCFSDRFY5P2C5C0
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=qlXVDL0GTHm4wPYJ1Li8Zg&gdpr=0
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame 65E5
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&gdpr=0&us_privacy=1---
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEGbEL0JXCMAzjP1mQ9hmVtA&google_cver=1
42 B
939 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEGbEL0JXCMAzjP1mQ9hmVtA&google_cver=1
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:48 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEGbEL0JXCMAzjP1mQ9hmVtA&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
337
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 65E5
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr=0&us_privacy=1---
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YmEwZjQyODg0OTVlOTRmMmIwMzc3YzkyOGIyMDQwNzNiMTdiMzJjMQ&gdpr=0&us_privacy=1---
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YmEwZjQyODg0OTVlOTRmMmIwMzc3YzkyOGIyMDQwNzNiMTdiMzJjMQ&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:48 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YmEwZjQyODg0OTVlOTRmMmIwMzc3YzkyOGIyMDQwNzNiMTdiMzJjMQ&gdpr=0&us_privacy=1---
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
ad49a0f18e050afeb6359164ab3bd56e
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
pixel
cm.g.doubleclick.net/ Frame 65E5
Redirect Chain
  • https://token.rubiconproject.com/token?pid=25470&gdpr=0&us_privacy=1---
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TFBMWjdCVDEtSy02UVk5&gdpr=0&us_privacy=1---
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&gdpr=0&google_gid=CAESENH3npdsUJSdslP1pQnH6Zs&google_cver=1
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBMWjdCVDEtSy02UVk5&google_push=&gdpr=0
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBMWjdCVDEtSy02UVk5&google_push=&gdpr=0
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H3
Server
172.253.62.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f154.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:48 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBMWjdCVDEtSy02UVk5&google_push=&gdpr=0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
Expires
0
tap.php
pixel.rubiconproject.com/ Frame 65E5
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&gdpr=0&us_privacy=1---
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/I6nyO-4KxCWEfeDPvzIwWQ?csrc=&gdpr=0&us_privacy=1---
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-QJ2VS_lE2oIwrTZua5d920hqzGcTVsJXdumV6A--~A
42 B
939 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-QJ2VS_lE2oIwrTZua5d920hqzGcTVsJXdumV6A--~A
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date
Fri, 01 Dec 2023 01:58:48 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
location
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-QJ2VS_lE2oIwrTZua5d920hqzGcTVsJXdumV6A--~A
content-length
0
tap.php
pixel.rubiconproject.com/ Frame 65E5
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&gdpr=0&us_privacy=1---
  • https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AADi8E7K0nwAABMXtn_NUw&expires=30&gdpr=0
42 B
939 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AADi8E7K0nwAABMXtn_NUw&expires=30&gdpr=0
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AADi8E7K0nwAABMXtn_NUw&expires=30&gdpr=0
Date
Fri, 01 Dec 2023 01:58:48 GMT
strict-transport-security
max-age=2592000; includeSubDomains
Server
gunicorn
Connection
keep-alive
Content-Length
0
ProfilesEngineServlet
sync1.intentiq.com/profiles_engine/ Frame 65E5
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=primis&gdpr=0&us_privacy=1---
  • https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
  • https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LPLZ7BT1-K-6QY9
  • https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LPLZ7BT1-K-6QY9&ckls=true&ci=cCawVhmeDc&nc=false&trid=941298698
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LPLZ7BT1-K-6QY9&ckls=true&ci=cCawVhmeDc&nc=false&trid=941298698
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.85.132.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-132-15.iad50.r.cloudfront.net
Software
Apache-Coyote/1.1 /
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:48 GMT
via
1.1 65e185f36e65abff9322e261be3491d4.cloudfront.net (CloudFront)
server
Apache-Coyote/1.1
x-amz-cf-pop
IAD50-C2
x-cache
Miss from cloudfront
p3p
CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=86400
content-length
43
x-amz-cf-id
iHzel7a6X-FFWMc0fASe0mPAdzlfZcTSvqr0KmDDLi4dt_kW5LpeSA==
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:48 GMT
via
1.1 65e185f36e65abff9322e261be3491d4.cloudfront.net (CloudFront)
server
Apache-Coyote/1.1
x-amz-cf-pop
IAD50-C2
x-cache
Miss from cloudfront
p3p
CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LPLZ7BT1-K-6QY9&ckls=true&ci=cCawVhmeDc&nc=false&trid=941298698
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
patent
https://www.almondnet.com/ip
alt-svc
h3=":443"; ma=86400
content-length
43
x-amz-cf-id
ogV6m4YpPhHEO_hdpyRBqjHRjiZiubzlB7l82rU9U_s7o-Y9cII6pQ==
expires
Thu, 01 Jan 1970 00:00:00 GMT
magnite
prebid.a-mo.net/setuid/ Frame 65E5
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&gdpr=0&us_privacy=1---
  • https://prebid.a-mo.net/setuid/magnite?uid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
0
150 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://prebid.a-mo.net/setuid/magnite?uid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:47 GMT
cache-control
max-age=0, private, must-revalidate
x-envoy-upstream-service-time
1
server
envoy
vary
Accept-Encoding

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://prebid.a-mo.net/setuid/magnite?uid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
Expires
0
receive
pixel.tapad.com/idsync/ex/ Frame 65E5
Redirect Chain
  • https://token.rubiconproject.com/token?pid=37556&a=1&gdpr=0&us_privacy=1---
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
95 B
124 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H3
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
Jetty(11.0.13) /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:48 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
Jetty(11.0.13)
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95

Redirect headers

Location
https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
ad49a0f18e050afeb6359164ab3bd56e
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame 65E5
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&gdpr=0&us_privacy=1---
  • https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=bf3b4c55-e598-442d-83b3-e58668bc1d22&expires=30&gdpr=0&us_privacy=1---
42 B
939 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=bf3b4c55-e598-442d-83b3-e58668bc1d22&expires=30&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=bf3b4c55-e598-442d-83b3-e58668bc1d22&expires=30&gdpr=0&us_privacy=1---
Date
Fri, 01 Dec 2023 01:58:48 GMT
Connection
keep-alive
X-CI-RTID
24788057-eca8-4057-9465-02e5d62ae7fb
Content-Length
175
Content-Type
text/html; charset=utf-8
cksync
hb.yahoo.net/ Frame 65E5
Redirect Chain
  • https://token.rubiconproject.com/token?pid=26594&gdpr=0&us_privacy=1---
  • https://ups.analytics.yahoo.com/ups/58160/sync?_origin=1&uid=LPLZ7BT1-K-6QY9&redir=true&gdpr=0&us_privacy=1---
  • https://ups.analytics.yahoo.com/ups/58824/sync?_origin=0&dpid=58160&ovsid=LPLZ7BT1-K-6QY9&gdpr=0&redir=true&us_privacy=1---
  • https://hb.yahoo.net/cksync?cs=63&axid_e=eS16ejFsNnRCRTJ1RlROalYyTDlyWnMxYXNVZURoSEdpOH5B&gdpr=0&ovsid=LPLZ7BT1-K-6QY9&dpid=58160&us_privacy=1---
53 B
646 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://hb.yahoo.net/cksync?cs=63&axid_e=eS16ejFsNnRCRTJ1RlROalYyTDlyWnMxYXNVZURoSEdpOH5B&gdpr=0&ovsid=LPLZ7BT1-K-6QY9&dpid=58160&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
80.239.138.59 -, , ASN (),
Reverse DNS
Software
Apache /
Resource Hash
9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470
Security Headers
Name Value
Strict-Transport-Security max-age=86400 ; includeSubDomains, max-age=604800

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=86400 ; includeSubDomains, max-age=604800
date
Fri, 01 Dec 2023 01:58:50 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
content-length
53
x-mnet-hl2
E
expires
Fri, 01 Dec 2023 01:58:50 GMT

Redirect headers

location
https://hb.yahoo.net/cksync?cs=63&axid_e=eS16ejFsNnRCRTJ1RlROalYyTDlyWnMxYXNVZURoSEdpOH5B&gdpr=0&ovsid=LPLZ7BT1-K-6QY9&dpid=58160&us_privacy=1---
date
Fri, 01 Dec 2023 01:58:48 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.87
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
setuid
ib.adnxs.com/prebid/ Frame 65E5
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn&gdpr=0&us_privacy=1---
  • https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
68.67.179.164 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:49 GMT
an-x-request-uuid
2c61ee4b-7835-4a01-be98-1220c55e6119
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
image/gif
cache-control
no-store, no-cache, private
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length
43
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
Expires
0
merge
ce.lijit.com/ Frame 6CAC
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn&gdpr=0&us_privacy=1---
  • https://ce.lijit.com/merge?pid=80&3pid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
43 B
663 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=80&3pid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
23.92.190.68 Houston, United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:48 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Type
image/gif
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap2ewr1
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://ce.lijit.com/merge?pid=80&3pid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
Expires
0
pixel
capi.connatix.com/us/ Frame 6CAC
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=19564&gdpr=0&us_privacy=1---
  • https://capi.connatix.com/us/pixel?puid=LPLZ7BT1-K-6QY9&pId=11&gdpr=&gdpr_consent=&us_privacy=&gdpr=0&us_privacy=1---
  • https://capi.connatix.com/us/pixel?puid=LPLZ7BT1-K-6QY9&pId=11&gdpr=&gdpr_consent=&us_privacy=&gdpr=0&us_privacy=1---&final=true
82 B
82 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://capi.connatix.com/us/pixel?puid=LPLZ7BT1-K-6QY9&pId=11&gdpr=&gdpr_consent=&us_privacy=&gdpr=0&us_privacy=1---&final=true
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
172.64.146.152 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:49 GMT
cf-cache-status
DYNAMIC
server
cloudflare
surrogate-control
no-cache, no-store, must-revalidate, max-age=0
vary
Accept-Encoding
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate, max-age=0
cf-ray
82e7ba2e0c627151-YUL
access-control-allow-headers
x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Fri, 01 Dec 2023 01:58:49 GMT
cf-cache-status
DYNAMIC
server
cloudflare
location
https://capi.connatix.com/us/pixel?puid=LPLZ7BT1-K-6QY9&pId=11&gdpr=&gdpr_consent=&us_privacy=&gdpr=0&us_privacy=1---&final=true
cache-control
no-cache, no-store, must-revalidate, max-age=0
cf-ray
82e7ba2d9ba47151-YUL
access-control-allow-headers
x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length
0
alt-svc
h3=":443"; ma=86400
v1
match.sharethrough.com/sync/ Frame 6CAC
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=18694&gdpr=0&us_privacy=1---
  • https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
68 B
279 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
3.226.187.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-226-187-105.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:48 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
Expires
0
tap.php
pixel.rubiconproject.com/ Frame 6CAC
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=1164&gdpr=0&us_privacy=1---
  • https://pixel.rubiconproject.com/tap.php?v=14240&nid=2676&put=9135305356218733899
42 B
939 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=14240&nid=2676&put=9135305356218733899
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
GET
location
https://pixel.rubiconproject.com/tap.php?v=14240&nid=2676&put=9135305356218733899
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
usersync.aspx
dis.criteo.com/dis/ Frame 6CAC 		0
0
Rubicon
s.seedtag.com/cs/cookiesync/ Frame 6CAC
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=seedtag&gdpr=0&us_privacy=1---
  • https://s.seedtag.com/cs/cookiesync/Rubicon?channeluid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
0
0
tap.php
pixel.rubiconproject.com/ Frame 6CAC
Redirect Chain
  • https://bttrack.com/pixel/cookiesync?source=c91bfcce-bb43-46f7-b14e-567c0a4332b3&gdpr=0&us_privacy=1---
  • https://pixel.rubiconproject.com/tap.php?v=71772&nid=3664&put=4116a309-2928-4d65-b56c-2c6a48e8a2a7
42 B
939 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=71772&nid=3664&put=4116a309-2928-4d65-b56c-2c6a48e8a2a7
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

x-servername
Track003-iad
pragma
no-cache
date
Fri, 01 Dec 2023 01:58:07 GMT
strict-transport-security
max-age=31536000;
content-type
text/html; charset=utf-8
location
https://pixel.rubiconproject.com/tap.php?v=71772&nid=3664&put=4116a309-2928-4d65-b56c-2c6a48e8a2a7
cache-control
private,no-cache
content-length
223
expires
-1
tap.php
pixel.rubiconproject.com/ Frame 6CAC
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=14&gdpr=0&us_privacy=1---
  • https://pixel.rubiconproject.com/tap.php?v=731524&nid=3858&put=GnXLSWpRUlpUMgCssutHlbnVUKQ
42 B
939 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=731524&nid=3858&put=GnXLSWpRUlpUMgCssutHlbnVUKQ
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location
https://pixel.rubiconproject.com/tap.php?v=731524&nid=3858&put=GnXLSWpRUlpUMgCssutHlbnVUKQ
Date
Fri, 01 Dec 2023 01:58:48 GMT
Connection
keep-alive
Content-Length
121
Content-Type
text/html; charset=utf-8
tap.php
pixel.rubiconproject.com/ Frame 6CAC
Redirect Chain
  • https://secure.adnxs.com/getuidnb?https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4894%26nid%3D1986%26put%3D$UID%26expires%3D30&gdpr=0&us_privacy=1---
  • https://pixel.rubiconproject.com/tap.php?v=4894&nid=1986&put=8961910970674910848&expires=30&gdpr=0&us_privacy=1---
42 B
939 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=4894&nid=1986&put=8961910970674910848&expires=30&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:48 GMT
an-x-request-uuid
090b8a58-594d-4a43-980f-6d92489d2f84
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://pixel.rubiconproject.com/tap.php?v=4894&nid=1986&put=8961910970674910848&expires=30&gdpr=0&us_privacy=1---
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
tap.php
pixel.rubiconproject.com/ Frame 6CAC
Redirect Chain
  • https://ad.turn.com/r/cs?pid=6&gdpr=0&us_privacy=1---
  • https://pixel.rubiconproject.com/tap.php?v=4212&nid=1185&put=2401794706099336508&expires=60&gdpr=0&gdpr_consent=
42 B
939 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=4212&nid=1185&put=2401794706099336508&expires=60&gdpr=0&gdpr_consent=
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=4212&nid=1185&put=2401794706099336508&expires=60&gdpr=0&gdpr_consent=
pragma
no-cache
date
Fri, 01 Dec 2023 01:58:47 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
tap.php
pixel.rubiconproject.com/ Frame 6CAC
Redirect Chain
  • https://sync.1rx.io/usersync2/rubicon?gdpr=0&us_privacy=1---
  • https://sync.targeting.unrulymedia.com/csync/RX-358895dc-82d6-4392-9b03-d569568dac10-005?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D186028%26nid%3D4112%26put%3DRX-358895dc-82d6-43...
  • https://pixel.rubiconproject.com/tap.php?v=186028&nid=4112&put=RX-358895dc-82d6-4392-9b03-d569568dac10-005&expires=30&us_privacy=1---
42 B
939 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=186028&nid=4112&put=RX-358895dc-82d6-4392-9b03-d569568dac10-005&expires=30&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location
https://pixel.rubiconproject.com/tap.php?v=186028&nid=4112&put=RX-358895dc-82d6-4392-9b03-d569568dac10-005&expires=30&us_privacy=1---
Date
Fri, 01 Dec 2023 01:58:48 GMT
Content-Type
text/html
Connection
keep-alive
ETag
RX358895dc82d643929b03d569568dac10005
Transfer-Encoding
chunked
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
esync
token.rubiconproject.com/ Frame 6CAC
Redirect Chain
  • https://id.rlcdn.com/709414.gif?gdpr=0&us_privacy=1---
  • https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e
0
214 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Expires
0
Pragma
no-cache
Cache-Control
no-cache,no-store,must-revalidate
X-RPHost
ad49a0f18e050afeb6359164ab3bd56e
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date
Fri, 01 Dec 2023 01:58:48 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
143
match.deepintent.com/usersync/ Frame 6CAC 		0
338 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.deepintent.com/usersync/143?gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
169.197.150.8 -, , ASN (),
Reverse DNS
Software
b /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif
date
Fri, 01 Dec 2023 01:58:50 GMT
server
b
content-length
0
p3p
policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
match
events-ssc.33across.com/ Frame 6CAC
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=33across&gdpr=0&us_privacy=1---
  • https://ssc-cms.33across.com/ps/?xi=1&xu=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
  • https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LPLZ7BT1-K-6QY9&ts=1701395930&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1---
0
0
cs
cs.yellowblue.io/ Frame 6CAC
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=rise_engage&gdpr=0&us_privacy=1---
  • https://cs.yellowblue.io/cs?aid=11590&id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
0
326 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.yellowblue.io/cs?aid=11590&id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
34.203.168.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-203-168-193.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:49 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://eus.rubiconproject.com/
access-control-allow-credentials
true
x-envoy-upstream-service-time
0
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://cs.yellowblue.io/cs?aid=11590&id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
Expires
0
setuid
s2s.t13.io/ Frame 6CAC
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-triple13&gdpr=0&us_privacy=1---
  • https://s2s.t13.io/setuid?bidder=rubicon&uid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
86 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s2s.t13.io/setuid?bidder=rubicon&uid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
34.107.140.113 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:49 GMT
content-encoding
gzip
via
1.1 google
content-type
image/png
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://s2s.t13.io/setuid?bidder=rubicon&uid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
Expires
0
cookie-sync
sync.outbrain.com/ Frame 180E
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=outbrain&gdpr=0&us_privacy=1---
  • https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LPLZ7BT1-K-6QY9&obUid=&initiator=&gdpr=0&us_privacy=1---
0
287 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LPLZ7BT1-K-6QY9&obUid=&initiator=&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
70.42.32.191 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date
Fri, 01 Dec 2023 01:58:49 GMT
Cache-Control
no-cache
X-TraceId
bec2abd6fdaa6b72fbaa6e5e7e396b66
Content-Length
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LPLZ7BT1-K-6QY9&obUid=&initiator=&gdpr=0&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
Expires
0
sync
visitor.omnitagjs.com/visitor/ Frame 180E
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=adyoulike&gdpr=0&us_privacy=1---
  • https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LPLZ7BT1-K-6QY9&name=RUBICON&gdpr=0&us_privacy=1---
49 B
385 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LPLZ7BT1-K-6QY9&name=RUBICON&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
52.88.192.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-192-204.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:48 GMT
via
kong/2.8.3
x-content-type-options
nosniff
x-kong-proxy-latency
0
vary
Accept-Encoding
p3p
CP="CAO PSA OUR"
content-type
image/gif
x-kong-upstream-latency
13
cache-control
no-cache, no-store, must-revalidate
content-length
49
expires
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://visitor.omnitagjs.com/visitor/sync?uid=3496f2c9155784213a7b528f78bb441a&visitor=LPLZ7BT1-K-6QY9&name=RUBICON&gdpr=0&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
Expires
0
cs
cs.minutemedia-prebid.com/ Frame 180E
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=minute_media&gdpr=0&us_privacy=1---
  • https://cs.minutemedia-prebid.com/cs?aid=21479&id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
0
326 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.minutemedia-prebid.com/cs?aid=21479&id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
34.203.168.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-203-168-193.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:48 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://eus.rubiconproject.com/
access-control-allow-credentials
true
x-envoy-upstream-service-time
2
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://cs.minutemedia-prebid.com/cs?aid=21479&id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
Expires
0
60909
i6.liadm.com/s/ Frame 180E
Redirect Chain
  • https://token.rubiconproject.com/token?pid=49096&gdpr=0&us_privacy=1---
  • https://i.liadm.com/s/60909?bidder_id=227664&bidder_uuid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
  • https://i.liadm.com/s/60909?gdpr=0&bidder_id=227664&bidder_uuid=LPLZ7BT1-K-6QY9&_li_chk=true&us_privacy=1---&previous_uuid=1a39f2bf14f74a96a87f091187cddd6a
  • https://i6.liadm.com/s/60909?gdpr=0&bidder_id=227664&bidder_uuid=LPLZ7BT1-K-6QY9&us_privacy=1---&us_privacy=1---
43 B
274 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i6.liadm.com/s/60909?gdpr=0&bidder_id=227664&bidder_uuid=LPLZ7BT1-K-6QY9&us_privacy=1---&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
107.23.186.129 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date
Fri, 01 Dec 2023 01:58:48 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
0
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/60909?gdpr=0&bidder_id=227664&bidder_uuid=LPLZ7BT1-K-6QY9&us_privacy=1---&us_privacy=1---
Date
Fri, 01 Dec 2023 01:58:48 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
0
Request-Time
2
RX-358895dc-82d6-4392-9b03-d569568dac10-005
sync.targeting.unrulymedia.com/csync/ Frame 180E
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=unruly&gdpr=0&us_privacy=1---
  • https://sync.1rx.io/usersync/rubicon/LPLZ7BT1-K-6QY9?gdpr=0&us_privacy=1---
  • https://sync.targeting.unrulymedia.com/csync/RX-358895dc-82d6-4392-9b03-d569568dac10-005
43 B
435 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-358895dc-82d6-4392-9b03-d569568dac10-005
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
199.127.204.142 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
/
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date
Fri, 01 Dec 2023 01:58:48 GMT
Connection
keep-alive
Content-Length
43
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Pragma
no-cache
Date
Fri, 01 Dec 2023 01:58:48 GMT
Transfer-Encoding
chunked
Content-Type
text/html
Location
https://sync.targeting.unrulymedia.com/csync/RX-358895dc-82d6-4392-9b03-d569568dac10-005
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Expires
0
redirect
exchange.mediavine.com/usersync/ Frame 180E
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=17404&gdpr=0&us_privacy=1---
  • https://exchange.mediavine.com/usersync/redirect?partner=rubicon&partnerId=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
0
186 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://exchange.mediavine.com/usersync/redirect?partner=rubicon&partnerId=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
44.214.40.113 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:49 GMT
cache-control
private, no-cache
access-control-allow-credentials
true
content-encoding
gzip
vary
Origin, Accept-Encoding
content-type
text/html; charset=utf-8

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://exchange.mediavine.com/usersync/redirect?partner=rubicon&partnerId=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
Expires
0
btu4jd3a
sync-tm.everesttech.net/upi/pid/ Frame 180E 		0
0
tap.php
pixel.rubiconproject.com/ Frame 180E
Redirect Chain
  • https://um.simpli.fi/rb_match?gdpr=0&us_privacy=1---
  • https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=172B0C337EA24A8F83EA8C8A4B595618&expires=365
42 B
939 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=172B0C337EA24A8F83EA8C8A4B595618&expires=365
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date
Fri, 01 Dec 2023 01:58:48 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=172B0C337EA24A8F83EA8C8A4B595618&expires=365
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Thu, 30 Nov 2023 01:58:48 GMT
tap.php
pixel.rubiconproject.com/ Frame 180E
Redirect Chain
  • https://cm.adgrx.com/bridge?AG_SETCOOKIE&AG_PID=rubicon&gdpr=0&us_privacy=1---
  • https://cm.adgrx.com/bridge.gif?AG_PID=rubicon&gdpr=0&us_privacy=1---
  • https://pixel.rubiconproject.com/tap.php?v=144054&nid=4032&put=2b7a36e8-8fed-11ee-8e97-8536f0308748&expires=60
42 B
939 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=144054&nid=4032&put=2b7a36e8-8fed-11ee-8e97-8536f0308748&expires=60
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:49 GMT
server
Cowboy
content-type
image/gif
location
https://pixel.rubiconproject.com/tap.php?v=144054&nid=4032&put=2b7a36e8-8fed-11ee-8e97-8536f0308748&expires=60
access-control-allow-origin
*
p3p
CP="NOI OTC OTP OUR NOR"
cache-control
no-cache, no-store, must-revalidate, proxy-revalidate
x-realserver-nx
lga-delivery-5
content-length
0
expires
Thu, 23 Sep 2004 17:42:04 GMT
tap.php
pixel.rubiconproject.com/ Frame 180E
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2046&pt=n&a=1&gdpr=0&us_privacy=1---
  • https://rubicon-match.dotomi.com/match/bounce/current?networkId=12783&version=1&nuid=8PvYAksz_7pYkW-n9zOznQ&gdpr=0&us_privacy=1---
  • https://rubicon-match.dotomi.com/match/bounce/current?DotomiTest=68180ae3495d14be&is_secure=true&networkId=12783&version=1&nuid=8PvYAksz_7pYkW-n9zOznQ&gdpr=0&us_privacy=1---
  • https://pixel.rubiconproject.com/tap.php?v=5364|1|90&nid=2046&put=AAAGditm25Iy9wMXWiNQAAAAAAA&expiration=1701482328&nuid=8PvYAksz_7pYkW-n9zOznQ&is_secure=true&us_privacy=1---&gdpr=0
42 B
939 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=5364|1|90&nid=2046&put=AAAGditm25Iy9wMXWiNQAAAAAAA&expiration=1701482328&nuid=8PvYAksz_7pYkW-n9zOznQ&is_secure=true&us_privacy=1---&gdpr=0
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:48 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://pixel.rubiconproject.com/tap.php?v=5364|1|90&nid=2046&put=AAAGditm25Iy9wMXWiNQAAAAAAA&expiration=1701482328&nuid=8PvYAksz_7pYkW-n9zOznQ&is_secure=true&us_privacy=1---&gdpr=0
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
rubicon
tr.blismedia.com/v1/api/sync/ Frame 180E 		0
173 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tr.blismedia.com/v1/api/sync/rubicon?gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.105.96.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:48 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
/
dsp.adfarm1.adition.com/cookie/ Frame 180E 		0
0
sync
ads.yieldmo.com/ Frame 180E
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=yieldmo&gdpr=0&us_privacy=1---
  • https://ads.yieldmo.com/sync?pn_id=rc&id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
43 B
598 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/sync?pn_id=rc&id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
54.88.209.131 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-88-209-131.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:49 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://ads.yieldmo.com/sync?pn_id=rc&id=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
Expires
0
Rubicon
crb.kargo.com/api/v1/dsync/ Frame 180E
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=11864&gdpr=0&us_privacy=1---
  • https://crb.kargo.com/api/v1/dsync/Rubicon?exid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
0
0
cookiesyncendpoint
sync.aniview.com/ Frame 180E
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=17184&gdpr=0&us_privacy=1---
  • https://sync.aniview.com/cookiesyncendpoint?biddername=5&auid=&key=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
0
251 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.aniview.com/cookiesyncendpoint?biddername=5&auid=&key=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
96.46.186.182 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:51 GMT
content-length
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://sync.aniview.com/cookiesyncendpoint?biddername=5&auid=&key=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
Expires
0
setuid
prebid-s2s.media.net/ Frame 180E
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-medianet&gdpr=0&us_privacy=1---
  • https://prebid-s2s.media.net/setuid?bidder=rubicon&uid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
86 B
518 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://prebid-s2s.media.net/setuid?bidder=rubicon&uid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Requested by
Host: visitor.omnitagjs.com
URL: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4
Protocol
H2
Server
34.107.148.139 -, , ASN (),
Reverse DNS
Software
envoy /
Resource Hash
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:49 GMT
via
1.1 google
server
envoy
content-type
image/png
access-control-allow-origin
cache-control
no-cache, no-store, must-revalidate
x-envoy-upstream-service-time
0
access-control-allow-credentials
true
alt-svc
clear
expires
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://prebid-s2s.media.net/setuid?bidder=rubicon&uid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f31d5fb12ac7ec11f837ad8263e0f6c
Expires
0
army.gif
g.ezoic.net/porpoiseant/ 		0
63 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNTIwMzQ2NDY1MTYyNjQxNCIsImRvbWFpbl9pZCI6IjQ4NDQ3MCIsInVuaXQiOiJkaXYtZ3B0LWFkLW1lZGlhZmlyZV9jb20tZWRnZS0xLTAiLCJ0X2Vwb2NoIjoxNzAxMzk1OTE2LCJyZXZlbnVlIjowLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJzdGF0X3NvdXJjZV9pZCI6MCwicGFnZXZpZXdfaWQiOiIyNmRhZjBlZS04ZGI1LTRkYWItNDcyNy05NjE2YmNlNDg4MzkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by
Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-3&cb=30
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.213.98.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-98-197.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mediafire.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin
https://www.mediafire.com
x-middleton-display
ezp_sol
date
Fri, 01 Dec 2023 01:58:48 GMT
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
vary
Accept-Encoding
expires
Thu, 30 Nov 2023 01:58:48 GMT
dcm
s.amazon-adsystem.com/ Frame A6BB 		43 B
855 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=C120E36A-8AFF-4CA0-A41B-65783C2F6633&redir=true&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=162948
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Fri, 01 Dec 2023 01:58:50 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid
RAVEMFPNHFA67CTHRERV
services
sync.technoratimedia.com/ Frame E790
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFEaThFN0swbndBQUJNWHRuX05Vdw&gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&b...
  • https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
  • https://sync.technoratimedia.com/services?uid=AADi8E7K0nwAABMXtn_NUw&srv=cs&pid=73&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpp%252Cpm%26bee_sync_cu...
0
0
Pug
simage2.pubmatic.com/AdServer/ Frame 1078
Redirect Chain
  • https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8961910970674910848&gdpr=0&gdpr_consent=
42 B
298 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8961910970674910848&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=162948
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
8.28.7.83 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Thu, 30 Nov 2023 16:57:17 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
access-control-allow-origin
*
an-x-request-uuid
c823b7a6-cf72-40a8-a292-8b11c8c80d66
cache-control
no-store, no-cache, private
content-length
0
content-type
text/html; charset=utf-8
date
Fri, 01 Dec 2023 01:58:50 GMT
expires
Sat, 15 Nov 2008 16:00:00 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8961910970674910848&gdpr=0&gdpr_consent=
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma
no-cache
server
nginx/1.21.3
x-proxy-origin
185.213.80.164; 185.213.80.164; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection
0
Pug
image2.pubmatic.com/AdServer/ Frame 3CA3
Redirect Chain
  • https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=43ij_OYp8fb4K6Shs3m4_ON6pvX4KPT1timfRy2f
42 B
416 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=43ij_OYp8fb4K6Shs3m4_ON6pvX4KPT1timfRy2f
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=162948
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Thu, 30 Nov 2023 23:29:25 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
date
Fri, 01 Dec 2023 01:58:50 GMT
expires
Fri, 04 Aug 1978 12:00:00 GMT
location
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=43ij_OYp8fb4K6Shs3m4_ON6pvX4KPT1timfRy2f
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma
no-cache
strict-transport-security
max-age=86400
141
match.deepintent.com/usersync/ Frame 4D55 		0
243 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=162948
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
169.197.150.8 -, , ASN (),
Reverse DNS
Software
b /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-length
0
content-type
image/gif
date
Fri, 01 Dec 2023 01:58:50 GMT
p3p
policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server
b
b9pj45k4
sync-tm.everesttech.net/upi/pid/ Frame 9043 		0
0
Pug
simage2.pubmatic.com/AdServer/ Frame 4722
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:ukFBPzdY1R8SNN5&gdpr=0&gdpr_consent=
42 B
221 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:ukFBPzdY1R8SNN5&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=162948
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
8.28.7.83 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Fri, 01 Dec 2023 01:58:50 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Date
Fri, 01 Dec 2023 01:58:50 GMT
Expires
Fri, 01 Jan 1990 00:00:00 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:ukFBPzdY1R8SNN5&gdpr=0&gdpr_consent=
Pragma
no-cache
Server
PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-09b27255ec1776ada@us-east-1e@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
Pug
simage2.pubmatic.com/AdServer/ Frame 3BF9
Redirect Chain
  • https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=2b7a36e8-8fed-11ee-8e97-8536f0308748
42 B
324 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=2b7a36e8-8fed-11ee-8e97-8536f0308748
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=162948
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
8.28.7.83 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Fri, 01 Dec 2023 01:58:50 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, proxy-revalidate
content-length
0
content-type
image/gif
date
Fri, 01 Dec 2023 01:58:50 GMT
expires
Thu, 23 Sep 2004 17:42:04 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=2b7a36e8-8fed-11ee-8e97-8536f0308748
p3p
CP="NOI OTC OTP OUR NOR"
pragma
no-cache
server
Cowboy
x-realserver-nx
lga-delivery-5
usersync.aspx
dis.criteo.com/dis/ Frame E8D8 		0
0
bsw_sync
sync.aralego.com/ Frame CF8C
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
  • https://sync.aralego.com/bsw_sync?ucf_nid=par-E2B44D84BBBDED8A0B297323E4B4A68&dsp_id=445&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=a4aa8fa7-9617-489f-a8fd-b4612be68449&gdpr=0&gdpr_consent=&gdp...
0
0
i.match
a.tribalfusion.com/ Frame CAB9 		0
0
Pug
image2.pubmatic.com/AdServer/ Frame 80E6
Redirect Chain
  • https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969188722382023932
42 B
291 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969188722382023932
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=162948
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Fri, 01 Dec 2023 01:58:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Content-Length
0
Date
Fri, 01 Dec 2023 01:58:50 GMT
Location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969188722382023932
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server
Jetty(9.4.51.v20230217)
tum
ums.acuityplatform.com/ Frame 6EE5 		0
0
pubmatic
ad.mrtnsvr.com/sync/ Frame BE04 		0
0
Pug
simage2.pubmatic.com/AdServer/ Frame 2B8B
Redirect Chain
  • https://b1sync.zemanta.com/usersync/pubmatic/?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:JthQNRlYKvyYtq8sninV&gdpr=0&gdpr_consent=&gdpr=0
42 B
201 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:JthQNRlYKvyYtq8sninV&gdpr=0&gdpr_consent=&gdpr=0
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=162948
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
8.28.7.83 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Fri, 01 Dec 2023 01:58:50 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Content-Length
196
Content-Type
text/html; charset=utf-8
Date
Fri, 01 Dec 2023 01:58:50 GMT
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:JthQNRlYKvyYtq8sninV&gdpr=0&gdpr_consent=&gdpr=0
P3p
CP="We do not support P3P header."
Pragma
no-cache
Pug
image2.pubmatic.com/AdServer/ Frame 7375
Redirect Chain
  • https://t.adx.opera.com/pub/sync?pubid=pub8730968190912
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU8cd00b679a4d4a4fb282885d711e45a0
42 B
278 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU8cd00b679a4d4a4fb282885d711e45a0
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=162948
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Fri, 01 Dec 2023 01:58:50 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods
POST, GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
content-length
166
content-type
text/html; charset=utf-8
date
Fri, 01 Dec 2023 01:58:50 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU8cd00b679a4d4a4fb282885d711e45a0
pragma
no-cache
server
nginx
usersyncsupply
cm-supply-web.gammaplatform.com/adx/ Frame ABE0 		0
0
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame CA11
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=wSDjaor_TKCkG2V4PC9mMw%3D%3D&gdpr=0&gdpr_consent=
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Server
23.215.40.199 McAllen, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-215-40-199.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:50 GMT
content-encoding
gzip
last-modified
Thu, 16 Nov 2023 09:11:44 GMT
server
Apache
vary
Accept-Encoding
content-type
text/html
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
max-age=147551
accept-ranges
bytes
content-length
5622
expires
Sat, 02 Dec 2023 18:58:01 GMT

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:50 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
301
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
receive
pixel.tapad.com/idsync/ex/ Frame CA11
Redirect Chain
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=C120E36A-8AFF-4CA0-A41B-65783C2F6633
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=785428a7-1311-49b6-8148-11f15b1f4e66%252C%252C&gdpr=0&gdpr_consent=
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=a0469c36-bc77-430e-9825-0adde7e331a8&ttd_puid=785428a7-1311-49b6-8148-11f15b1f4e66%2C%2C
95 B
124 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=a0469c36-bc77-430e-9825-0adde7e331a8&ttd_puid=785428a7-1311-49b6-8148-11f15b1f4e66%2C%2C
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H3
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
Jetty(11.0.13) /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:50 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
Jetty(11.0.13)
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95

Redirect headers

location
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=a0469c36-bc77-430e-9825-0adde7e331a8&ttd_puid=785428a7-1311-49b6-8148-11f15b1f4e66%2C%2C
date
Fri, 01 Dec 2023 01:58:50 GMT
server
Kestrel
content-length
359
FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3A...
us01.z.antigena.com/l/ Frame CA11 		0
0
xuid
eb2.3lift.com/ Frame CA11 		37 B
355 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=7976&xuid=C120E36A-8AFF-4CA0-A41B-65783C2F6633&dongle=u6nf&gdpr=0&gdpr_consent=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif
date
Fri, 01 Dec 2023 01:58:50 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
Pug
image2.pubmatic.com/AdServer/ Frame CA11
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QzEyMEUzNkEtOEFGRi00Q0EwLUE0MUItNjU3ODNDMkY2NjMz&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
42 B
95 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Thu, 30 Nov 2023 22:17:18 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:50 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame CA11
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEIJWLQbIDq1CaCPrnV5WzHg&google_cver=1
42 B
270 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEIJWLQbIDq1CaCPrnV5WzHg&google_cver=1
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Fri, 01 Dec 2023 01:58:50 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:50 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEIJWLQbIDq1CaCPrnV5WzHg&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
379
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame CA11
Redirect Chain
  • https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:172B0C337EA24A8F83EA8C8A4B595618
42 B
321 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:172B0C337EA24A8F83EA8C8A4B595618
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Fri, 01 Dec 2023 01:58:50 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date
Fri, 01 Dec 2023 01:58:50 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:172B0C337EA24A8F83EA8C8A4B595618
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Thu, 30 Nov 2023 01:58:50 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame CA11
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=a0469c36-bc77-430e-9825-0adde7e331a8&gdpr=0&gdpr_consent=
42 B
543 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=a0469c36-bc77-430e-9825-0adde7e331a8&gdpr=0&gdpr_consent=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Server
8.28.7.83 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Thu, 30 Nov 2023 16:55:26 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=a0469c36-bc77-430e-9825-0adde7e331a8&gdpr=0&gdpr_consent=
date
Fri, 01 Dec 2023 01:58:50 GMT
server
Kestrel
content-length
355
SPug
image4.pubmatic.com/AdServer/ Frame CA11
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=C120E36A-8AFF-4CA0-A41B-65783C2F6633&redir=true&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-Mo47knJE2uWnuwfndhFQ2mNqVoGxaos-~A&gdpr=0
0
0
C120E36A-8AFF-4CA0-A41B-65783C2F6633
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame CA11 		43 B
603 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/pubmatic/C120E36A-8AFF-4CA0-A41B-65783C2F6633?gdpr=0&gdpr_consent=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.202.221.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-202-221-201.compute-1.amazonaws.com
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 01:58:50 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
content-length
43
Pug
simage2.pubmatic.com/AdServer/ Frame CA11
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=bf3b4c55-e598-442d-83b3-e58668bc1d22&gdpr=0&gdpr_consent=
1 B
238 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=bf3b4c55-e598-442d-83b3-e58668bc1d22&gdpr=0&gdpr_consent=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Server
8.28.7.83 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
text/html; charset=utf-8
date
Fri, 01 Dec 2023 01:58:50 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=bf3b4c55-e598-442d-83b3-e58668bc1d22&gdpr=0&gdpr_consent=
Date
Fri, 01 Dec 2023 01:58:50 GMT
Connection
keep-alive
X-CI-RTID
e6bc9603-6e81-4713-a1d0-f2118b72e971
Content-Length
205
Content-Type
text/html; charset=utf-8
Pug
simage2.pubmatic.com/AdServer/ Frame CA11
Redirect Chain
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2401794706099336508&gdpr=0&gdpr_consent=&us_privacy=1---
1 B
298 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2401794706099336508&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Server
8.28.7.83 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
text/html; charset=utf-8
date
Fri, 01 Dec 2023 01:58:49 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2401794706099336508&gdpr=0&gdpr_consent=&us_privacy=1---
pragma
no-cache
date
Fri, 01 Dec 2023 01:58:50 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Pug
simage2.pubmatic.com/AdServer/ Frame CA11
Redirect Chain
  • https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=C120E36A-8AFF-4CA0-A41B-65783C2F6633&gdpr=0&gdpr_consent=
  • https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=50289e14251a110b&is_secure=true&networkId=17100&version=1&nuid=C120E36A-8AFF-4CA0-A41B-65783C2F6633&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAHJxg86EGjDQMeQ1JHAAAAAAA&expiration=1701482330&nuid=C120E36A-8AFF-4CA0-A41B-65783C2F6633&...
42 B
297 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAHJxg86EGjDQMeQ1JHAAAAAAA&expiration=1701482330&nuid=C120E36A-8AFF-4CA0-A41B-65783C2F6633&is_secure=true&gdpr_consent=&gdpr=0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Server
8.28.7.83 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Fri, 01 Dec 2023 01:58:50 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:50 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAHJxg86EGjDQMeQ1JHAAAAAAA&expiration=1701482330&nuid=C120E36A-8AFF-4CA0-A41B-65783C2F6633&is_secure=true&gdpr_consent=&gdpr=0
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
Pug
image2.pubmatic.com/AdServer/ Frame CA11
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553&gdpr=0&gdpr_consent=
42 B
343 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553&gdpr=0&gdpr_consent=
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Fri, 01 Dec 2023 01:58:50 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:49 GMT
server
A
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553&gdpr=0&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame CA11
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=9135305356218733899
42 B
322 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=9135305356218733899
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Server
8.28.7.83 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Thu, 30 Nov 2023 16:29:22 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Fri, 01 Dec 2023 01:58:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
GET
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=9135305356218733899
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
sn.ashx
pmp.mxptint.net/ Frame CA11 		0
0
Pug
simage2.pubmatic.com/AdServer/ Frame CA11
Redirect Chain
  • https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMTUmdGw9MTI5NjAw&piggybackCookie=cuid_2709aa30-8fed-11ee-bb78-125335d52042&gdpr=0
42 B
327 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMTUmdGw9MTI5NjAw&piggybackCookie=cuid_2709aa30-8fed-11ee-bb78-125335d52042&gdpr=0
Requested by
Host: www.mediafire.com
URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
Protocol
H2
Server
8.28.7.83 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Fri, 01 Dec 2023 01:58:49 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMTUmdGw9MTI5NjAw&piggybackCookie=cuid_2709aa30-8fed-11ee-bb78-125335d52042&gdpr=0
date
Fri, 01 Dec 2023 01:58:50 GMT
content-type
text/plain

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
rt.marphezis.com
URL
https://rt.marphezis.com/hb
Domain
tlx.3lift.com
URL
https://tlx.3lift.com/header/auction?lib=prebid&v=8.16.0&referrer=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F4jpxw5szul7blh2%2FNSwish_texture_pack.rar%2Ffile&tmax=2000
Domain
trace.mediago.io
URL
https://trace.mediago.io/cs/google?google_gid=CAESEBL364KfY3MRSVJfzgnJm1M&google_cver=1&google_push=AXcoOmS_wB70Dr_baxbzixhyl3XUGcP0qxgFcaN62Q1VM-0xKYSVyu5sN7wVdGLtEGgJ20TJRa8EhCFnh8nGCJ0d2ew0f2nm5Xjw7A
Domain
fksnk.com
URL
https://fksnk.com/cs/google?google_gid=CAESEGQ6gaKLHPpCwbr4aohWF3Y&google_cver=1&google_push=AXcoOmQR3yOCXGJCGG3ZbFkrY3gJ7dwsviovBOhEPpr0ir8pP7wFOk48ojmWdEl6fNZB2TBsYOk4Ul9dbSFe4Vo93at68NUSL_4
Domain
mweb.ck.inmobi.com
URL
https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESEJU8Dsfk-7fo3nAWkBHe_s4&google_cver=1&google_push=AXcoOmRFsThdDZjqnsurkGuhQDQtm4xrYBYC1S2UbsZLgGMmyP8LrEh89sK797UPDkIj5YyOux5BiTPM8MGI_AprOoxSZKjh1A
Domain
sync.search.spotxchange.com
URL
https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&uid=CAESEJN68q_Bm143upm1uztSI0k&google_cver=1
Domain
sync.search.spotxchange.com
URL
https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
Domain
server.cpmstar.com
URL
https://server.cpmstar.com/usersync.aspx?bsw_custom_parameter=a4aa8fa7-9617-489f-a8fd-b4612be68449&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%26ssp%3Dgoogle%26user_id%3D%24UID
Domain
gum.criteo.com
URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&cw=1&pbt=1&lsw=1
Domain
id.a-mx.com
URL
https://id.a-mx.com/sync/?tagId=&ref=null&u=https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file&tl=https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file&nf=0&rt=true&v=8.16.0&av=2.0&vg=epbjs&us_privacy=null&am=null&gdpr=0&gdpr_consent=
Domain
gum.criteo.com
URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.mediafire.com%2F&domain=www.mediafire.com&cw=1&pbt=1&lsw=1
Domain
id.hadron.ad.gt
URL
https://id.hadron.ad.gt/api/v1/pbhid?partner_id=524&_it=prebid
Domain
assets.a-mo.net
URL
https://assets.a-mo.net/js/cframe.js
Domain
dis.criteo.com
URL
https://dis.criteo.com/dis/usersync.aspx?r=44&p=75&cp=triplelift&cu=1&gdpr=0&gdpr_consent=&us_privacy=&gpp=${GPP_STRING_28}&gpp_sid=&url=https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D2711%26xuid%3D%40%40CRITEO_USERID%40%40%26dongle%3D013b
Domain
jelly.mdhv.io
URL
https://jelly.mdhv.io/v4/pixie?gdpr=0&gdpr_consent=
Domain
cs.chocolateplatform.com
URL
https://cs.chocolateplatform.com/pub?pid=ebda&google_gid=CAESEGuLYU6XgXRyB-I3WjlSVNA&google_cver=1&google_push=AXcoOmSiDPCxByEjgANtMEkDQL9y7W9il38auXa_58yhoYIW602cKXYkfdgFzVJjmVM4miv2dQYuuMmCY7tiuhiyMng0Lr5VDWO4
Domain
trace.mediago.io
URL
https://trace.mediago.io/cs/google?google_gid=CAESEA4T-3reW80npmsCpY9kQGs&google_cver=1&google_push=AXcoOmRvmZ9DRQvGgmBu6aGp3T_3p23wxwUykchnuQML8Tv9aOY9MrfyJe6uHQfS5Ct9Kvz0C8CgK6Acw2K9xYN2B86Wcr1F8NGnLg
Domain
cs.chocolateplatform.com
URL
https://cs.chocolateplatform.com/pub?pid=ebda&google_gid=CAESEGuLYU6XgXRyB-I3WjlSVNA&google_cver=1&google_push=AXcoOmTE3Fw1P0c-h7Rd1X0atdk1ZPICzXtBVCNLh1rrkhoEMEqdc8_It14uBylpNbbQoUqfIymqAISXZ7UCH6pODkPFY5r9byhrpA
Domain
api-2-0.spot.im
URL
https://api-2-0.spot.im/pixels/ayl_pixel?ayl_id=62ae6d0f7138766890cdfecf38ceff8f
Domain
csync.loopme.me
URL
https://csync.loopme.me/?pubid=11480&redirect=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fuid%3D68c72dd412a8d0f3f6d2276db2509939%26name%3DLOOPME%26visitor%3D%7Bdevice_id%7D%0A&gdpr=0&gdpr_consent=
Domain
dis.criteo.com
URL
https://dis.criteo.com/dis/usersync.aspx?r=6&p=70&cp=Rubicon&cu=1&url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D6434%26nid%3D2149%26put%3D%40%40CRITEO_USERID%40%40&gdpr=0&us_privacy=1---
Domain
s.seedtag.com
URL
https://s.seedtag.com/cs/cookiesync/Rubicon?channeluid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Domain
events-ssc.33across.com
URL
https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LPLZ7BT1-K-6QY9&ts=1701395930&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1---
Domain
sync-tm.everesttech.net
URL
https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D&gdpr=0&us_privacy=1---
Domain
dsp.adfarm1.adition.com
URL
https://dsp.adfarm1.adition.com/cookie/?ssp=7&gdpr=0&us_privacy=1---
Domain
crb.kargo.com
URL
https://crb.kargo.com/api/v1/dsync/Rubicon?exid=LPLZ7BT1-K-6QY9&gdpr=0&us_privacy=1---
Domain
sync.technoratimedia.com
URL
https://sync.technoratimedia.com/services?uid=AADi8E7K0nwAABMXtn_NUw&srv=cs&pid=73&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpp%252Cpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2&gdpr=0
Domain
sync-tm.everesttech.net
URL
https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=
Domain
dis.criteo.com
URL
https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Domain
sync.aralego.com
URL
https://sync.aralego.com/bsw_sync?ucf_nid=par-E2B44D84BBBDED8A0B297323E4B4A68&dsp_id=445&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=a4aa8fa7-9617-489f-a8fd-b4612be68449&gdpr=0&gdpr_consent=&gdpr_pd=&usprivacy=
Domain
a.tribalfusion.com
URL
https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Domain
ums.acuityplatform.com
URL
https://ums.acuityplatform.com/tum?umid=6
Domain
ad.mrtnsvr.com
URL
https://ad.mrtnsvr.com/sync/pubmatic?gdpr=0&gdpr_consent=
Domain
cm-supply-web.gammaplatform.com
URL
https://cm-supply-web.gammaplatform.com/adx/usersyncsupply?pid=7&t=pixel
Domain
us01.z.antigena.com
URL
https://us01.z.antigena.com/l/FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3AWUAJgUx%20C120E36A-8AFF-4CA0-A41B-65783C2F6633&rnd=RND
Domain
image4.pubmatic.com
URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-Mo47knJE2uWnuwfndhFQ2mNqVoGxaos-~A&gdpr=0
Domain
pmp.mxptint.net
URL
https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=

Verdicts & Comments Add Verdict or Comment

519 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| 21 object| 22 object| 23 object| 24 object| 25 object| 26 object| 27 object| documentPictureInPicture boolean| displayAds function| __setCMPv2RequestData function| __getCMPv2InitialSelectedLanguage object| _CMPv2RequestData object| ezstandalone object| googletag string| sAdSupplier boolean| bDelayAds string| sStartSrc object| adLazyLoadQueue function| fLoadGoogleAds function| checkEzoicSplitResult function| gtag object| dataLayer object| amp object| amplitude function| initDownload object| sticky object| compatSelect object| compat object| nonCompat function| googFooterTranslate function| isInRect function| getDownloadUrl boolean| InfShowNewAds object| allowed undefined| current boolean| isAllowed object| el function| rAb function| InfCustomFPSTAMobileFunc function| InfCustomSTAMobileFunc function| InfCustomFPSTAFunc function| InfCustomerCallback function| InfPreFastPopAttachCallback function| InfSkipBindDocumentClick function| InfMediafireMobileFunc number| iAdCountInterval function| acceptCookieFooter function| reloadPage function| noop function| ClearStatusMessages function| setCookieSeconds function| Re function| aU function| setCookie function| getCookie function| loadHotjar function| registerGoogleLang function| closeStatusMessage function| showStatusMessage function| downloadOptIn function| showTDOptInDialog function| closeMobileTD function| trackTurboDownload function| showDesktopDownloadArrow function| hideDesktopDownloadArrow function| onLegacyCopyLink function| openShareDialog function| saveToMyfiles function| copyShareLink function| startLazyLoad object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| __cfBeacon function| _DumpException object| default_tr object| _F_toggles string| MSG_TRANSLATE string| MSG_CANCEL string| MSG_CLOSE function| MSGFUNC_PAGE_TRANSLATED_TO function| MSGFUNC_TRANSLATED_TO string| MSG_GENERAL_ERROR string| MSG_LEARN_MORE function| MSGFUNC_POWERED_BY string| MSG_TRANSLATE_PRODUCT_NAME string| MSG_TRANSLATION_IN_PROGRESS function| MSGFUNC_TRANSLATE_PAGE_TO function| MSGFUNC_VIEW_PAGE_IN string| MSG_RESTORE string| MSG_SSL_INFO_LOCAL_FILE string| MSG_SSL_INFO_SECURE_PAGE string| MSG_SSL_INFO_INTRANET_PAGE string| MSG_SELECT_LANGUAGE function| MSGFUNC_TURN_OFF_TRANSLATION function| MSGFUNC_TURN_OFF_FOR string| MSG_ALWAYS_HIDE_AUTO_POPUP_BANNER string| MSG_ORIGINAL_TEXT string| MSG_FILL_SUGGESTION string| MSG_SUBMIT_SUGGESTION string| MSG_SHOW_TRANSLATE_ALL string| MSG_SHOW_RESTORE_ALL string| MSG_SHOW_CANCEL_ALL string| MSG_TRANSLATE_TO_MY_LANGUAGE function| MSGFUNC_TRANSLATE_EVERYTHING_TO string| MSG_SHOW_ORIGINAL_LANGUAGES string| MSG_OPTIONS string| MSG_TURN_OFF_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_SUGGESTION string| MSG_ALT_ACTIVITY_HELPER_TEXT string| MSG_USE_ALTERNATIVES string| MSG_DRAG_TIP string| MSG_CLICK_FOR_ALT string| MSG_DRAG_INSTUCTIONS string| MSG_SUGGESTION_SUBMITTED string| MSG_MANAGE_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_AND_CONTRIBUTE_ACTIVITY_HELPER_TEXT string| MSG_ORIGINAL_TEXT_NO_COLON string| MSG_LANGUAGE_UNSUPPORTED string| MSG_LANGUAGE_TRANSLATE_WIDGET string| MSG_RATE_THIS_TRANSLATION string| MSG_FEEDBACK_USAGE_FOR_IMPROVEMENT string| MSG_FEEDBACK_SATISFIED_LABEL string| MSG_FEEDBACK_DISSATISFIED_LABEL string| MSG_TRANSLATION_NO_COLON function| _exportVersion function| _getCallbackFunction function| _exportMessages function| _loadJs function| _loadCss function| _isNS function| _setupNS object| google object| regeneratorRuntime string| ezAnalyticsDefine string| ezStandaloneCookies boolean| _ez_sa object| __ez object| _ezaq number| did string| ezoTemplate function| create_ezolpl function| attach_ezolpl string| ezdomain boolean| bEzoicSelected object| g367CB268B1094004A3689751E7AC568F undefined| adscoreVerificationStatus undefined| freqms undefined| elapsed undefined| waitForAdscoreSignature function| UAParser object| __bt object| __bt_intrnl object| __bt_tag_d object| __bt_tag_am object| gaGlobal object| closure_lm_921599 string| ezStandaloneDefine string| ezStandaloneDisplay object| ezSelectedPlaceholders object| ezSelectedPlaceholdersMap function| __ez_vig_close_wrapper string| __sellerid string| __schain_domain string| __ez_nid string| __ez_gcb object| ez_ad_units object| ezslots object| ezrpos object| ezsrqt boolean| __ez_fad_haspo boolean| __ez_fad_hascp object| __ez_fad_po function| ezSetTargetingFromMap function| ezSetSlotTargeting function| ezGetSlotById function| __ez_close_anchor function| __ez_handle_init_scroll number| ieIdx function| __ez_hb_render object| ezCriteo object| ezAMX object| ezOneTag object| ezSmile object| ezAYL object| ezRise object| ezAdtelligent object| ezBrightcom object| ezVidoomy object| ezYieldmo function| ezjsps object| epbjs boolean| __enableAnalytics object| __s2sbidders object| __s2sinstreambidders object| __allBidders string| ez__id5pd string| ez__uIdHash string| ez__sspDomain object| __ezPwtBidders object| __ezPwtFloors object| PWT object| owpbjs function| openwrapRequestAdUnits function| openwrapRefreshSlot function| openwrapBidsBackHandler function| getSlotForhb object| __advertiserRule object| ezaxmns object| ezaucmns object| __ez_fad_floating function| __ez_init_slot object| ezslot_6_raw object| ezslot_2_raw object| ezslot_0_raw object| ezslot_4_raw object| ezslot_3_raw object| ezslot_1_raw object| ezslot_5_raw object| ezasVars boolean| __ezasAggressive object| divNode object| parentNode object| __banger_pmp_deals object| _ezim_d function| __ez_fad_position boolean| __ez_edge_a number| __ez_edge_mw string| __ez_edge_v string| __ez_edge_h number| __ez_edge_m object| ezslots_raw object| ezslotdivs boolean| isEZABL number| ezmadspc boolean| ezoViewCheck boolean| ezDisableInitialLoad boolean| ezhbopt function| __ez_get_largest_ad_size function| ezogetbrkey boolean| ezoll string| ezoadxnc string| ezoadhb function| handleResponsiveAdsense object| google_reactive_ads_global_state function| ezasBuild function| ezasvEvent function| ezaslEvent function| ezoAdBackFill object| ezaslWatch object| ezoSTPixels function| ezoSTPixelAdd function| ezoGetSlotById function| ezoGetSlotNum function| ezoSTPixelFire boolean| __bt_already_invoked function| getEzErrorURL function| reportEzError undefined| hREED function| __ezDotData object| gaplugins object| gaData function| newEzVignette object| ezoVideoInserter boolean| hasInsertedMagicPlayer function| sidebarWall function| __ez_close_rail function| __ez_handle_rail_loaded object| __ezsbwcmd object| PrebidImpressionController function| PrebidImpression object| ezoptbid function| epbjsRequestAdUnits function| epbjsBidRequest function| epbjsApplyResponsiveSizes function| epbjsRefreshSlot function| setAuctionActive function| setAuctionFinished function| isValid256Hash string| ezoScriptHost object| IL11ILILIIlLLLILILLLLIILLLIIL11111LLILiiLIliLlILlLiiLLIiILL number| ezobv function| ezoSyncToDfp function| ezoGetDFPSlot object| ezomash boolean| ezowwinit function| ezbanger function| ezvt function| ezvb function| ezsr function| ezosethbbid function| ezosetowbids function| ezosethbbids function| ezGetSlotViewedTime function| formatBid function| fetchezoibfh object| ezoibfh number| ezoibfhHF function| adjustHbValues function| ezorefgsl object| ggeac object| google_js_reporting_queue object| epbjsChunk object| _pbjsGlobals object| ADAGIO object| mnet string| nobidVersion object| nobid object| ezoic_mash number| ez_tos_track_count number| ez_last_activity_count object| metricNameMap function| ezlogVital object| webVitals function| initEzux function| ez_attachEvent function| ez_attachEventWithCapture function| ez_detachEvent function| ez_getQueryString object| riveted object| ezux boolean| google_measure_js_timing object| ezslot_interstitial boolean| __ez_fad_ezpbinitd function| __ez_fad_pb object| featureMap object| Criteo object| LOTCC_4545 object| LOTCC object| default_ContributorServingResponseClientJs object| __googlefc string| __fcInvoked string| __fcexpdef string| MmU5YmQ0NTEzNWY5MDRiYWxvYWRlcl9qcw== string| MmU5YmQ0NTEzNWY5MDRiYWNhY2hlZF9qcw== object| googlefc object| __fcInternalApiManager boolean| __fcInternalApiPostMessageReady object| __tcfapiEventListeners function| __tcfapi object| __tcfapiManager boolean| __tcfapiPostMessageReady function| __uspapi object| __uspapiManager boolean| __uspapiPostMessageReady object| __gppEventListeners function| __gpp object| __gppManager boolean| __gppPostMessageReady function| lotameIsCompatible function| sync16589_aa function| sync16589_c undefined| sync16589_d undefined| sync16589_ba undefined| sync16589_e function| sync16589_f object| sync16589_h function| sync16589_ca function| sync16589_j function| sync16589_da object| sync16589_ object| sync16589_ga object| sync16589_v object| sync16589_oa object| sync16589_xa object| sync16589_ya function| sync16589_a function| sync16589_b function| sync16589_g function| sync16589_i function| sync16589_k function| sync16589_l function| sync16589_m function| sync16589_n function| sync16589_o function| sync16589_p function| sync16589_q function| sync16589_r function| sync16589_fa function| sync16589_ea function| sync16589_s function| sync16589_t function| sync16589_u function| sync16589_w function| sync16589_ha function| sync16589_ia function| sync16589_y function| sync16589_ja function| sync16589_z function| sync16589_A function| sync16589_x function| sync16589_B function| sync16589_ka function| sync16589_C function| sync16589_D function| sync16589_E function| sync16589_F function| sync16589_G function| sync16589_H function| sync16589_I function| sync16589_J function| sync16589_K function| sync16589_L function| sync16589_la function| sync16589_ma function| sync16589_na function| sync16589_M function| sync16589_N function| sync16589_pa function| sync16589_O function| sync16589_qa function| sync16589_ra function| sync16589_sa function| sync16589_P function| sync16589_ta function| sync16589_ua function| sync16589_va function| sync16589_wa function| sync16589_Q function| sync16589_R function| sync16589_za function| sync16589_S function| sync16589_T function| sync16589_U function| sync16589_V function| sync16589_Aa function| sync16589_W function| sync16589_X function| sync16589_Y function| sync16589_Z function| sync16589__ function| sync16589_0 function| sync16589_Ea function| sync16589_Ba function| sync16589_1 function| sync16589_Da function| sync16589_Ca function| sync16589_2 function| sync16589_3 function| sync16589_4 function| sync16589_5 function| sync16589_Ga function| sync16589_Ha function| sync16589_Ja function| sync16589_Fa function| sync16589_7 function| sync16589_Ia function| sync16589_La function| sync16589_Ka function| sync16589_8 function| sync16589_6 function| sync16589_9 function| sync16589_Ma function| sync16589_Na function| sync16589_Oa function| sync16589_Pa function| sync16589_$ function| sync16589_Qa function| sync16589_Ra function| sync16589_Sa function| sync16589_Ta object| lotame_sync_16589 object| owpbjsChunk object| partnersWithoutErrorAndBids object| matchedimpressions object| ucTag object| OWT object| __AMPLITUDE__ object| sas object| apntag object| _ADAGIO boolean| e218414f-6e5b-4978-bf62-8f41f68ac5c9 object| ezslot_2 object| ezslot_3 object| ezslot_4 object| ezslot_5 object| ezslot_0 object| ezslot_1 number| google_unique_id number| google_srt object| google_persistent_state_async object| google_logging_queue number| tmod object| google_ad_modifications object| adsbygoogle string| google_user_agent_client_hint object| criteo_pubtag object| criteo_pubtag_prebid_144 object| Criteo_prebid_144 object| Criteo_identitytag_144 object| pbjs object| ox_esp object| __uid2SecureSignalProvider object| __uid2 number| ezouspvv object| buttonElem object| e

203 Cookies

Domain/Path Name / Value
www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar Name: g36FastPopSessionRequestNumber
Value: 1
.3lift.com/sync Name: sync
Value: CgoIoQEQzfnlmMIxCgoIkQIQzfnlmMIxCgoItAIQzfnlmMIxCgoI5gEQzfnlmMIxCgoIhwIQzfnlmMIxCgoItwIQzfnlmMIxCgkIOhDN-eWYwjEKCgiMAhDN-eWYwjEKCQhfEM355ZjCMQoJCB8QzfnlmMIx
i.liadm.com/s Name: _li_ss
Value: CgsKCQj_____BxDaFg
.mediafire.com/ Name: ukey
Value: y67mxmwo2loxbg25oekqjrc2e6bg4yvr
.mediafire.com/ Name: 4jvw
Value: 1
.mediafire.com/ Name: conv_tracking_data-2
Value: %7B%22mf_source%22%3A%22regular_download-51%22%2C%22mf_content%22%3A%22Free%22%2C%22mf_medium%22%3A%22windows%5C%2FChrome%22%2C%22mf_campaign%22%3A%224jpxw5szul7blh2%22%2C%22mf_term%22%3A%229e2e24a15afff19c8d8a10cd00dfc3b6%22%7D
.mediafire.com/ Name: __cf_bm
Value: M0cL0naxaP.oKAZqqPsdYSGci_0IiOoqToQ_QFpMQ7U-1701395915-0-AaiMEUsKp5BTSjI3H1lAxPgEaNx8z/FqQu2bcHZwIjn9pPyM43WxoRbEEk28A5Q22ZciwffUtT1lOxZCyKfdTBk=
.mediafire.com/ Name: ezoadgid_484470
Value: -1
.mediafire.com/ Name: ezoref_484470
Value:
.mediafire.com/ Name: ezosuibasgeneris-1
Value: 2c4b70e5-34c9-4247-5d17-71a06555a21c
.mediafire.com/ Name: ezoab_484470
Value: mod1
.mediafire.com/ Name: lp_484470
Value: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file
.mediafire.com/ Name: ezovuuidtime_484470
Value: 1701395916
.mediafire.com/ Name: ezovuuid_484470
Value: eb714dbb-435a-4cbf-74e6-b23184965c80
.mediafire.com/ Name: active_template::484470
Value: pub_site.1701395916
www.mediafire.com/ Name: ezstandaloneuser
Value: true
.mediafire.com/ Name: ezopvc_484470
Value: 2
.mediafire.com/ Name: ezepvv
Value: 26
otnolatrnup.com/ Name: IKSR
Value: {}
otnolatrnup.com/ Name: INF_DFL8
Value: false
otnolatrnup.com/ Name: IUID
Value: 445a8d83-18c6-4ece-961e-210e05fb7c6d
otnolatrnup.com/ Name: ISSH
Value: 6FA8D6
otnolatrnup.com/ Name: VMI
Value:
otnolatrnup.com/ Name: CHN
Value: #[]
otnolatrnup.com/ Name: MSSH
Value: #{}
otnolatrnup.com/ Name: MSRH
Value: #{}
otnolatrnup.com/ Name: ILP
Value: {"Profile":{"Audiences":{"Audience":[],"ThirdPartyAudience":[]}},"CreatedDate":"2023-12-01T01:58:36.5593949Z"}
otnolatrnup.com/ Name: ILPLU
Value: #12/1/2023 1:58:36 AM
otnolatrnup.com/ Name: ILEALC
Value: #12/1/2023 1:58:36 AM
otnolatrnup.com/ Name: ILMPF
Value: #True
otnolatrnup.com/ Name: IPMPLU
Value: #
otnolatrnup.com/ Name: IPMUID
Value: #
otnolatrnup.com/ Name: BSWUID
Value: #
otnolatrnup.com/ Name: IBL
Value: #[]
otnolatrnup.com/ Name: ISH
Value: #{"101":[{"SId":"6FA8D6","D":"23/11/30T17:58:36"}]}
otnolatrnup.com/ Name: ISH_Q
Value: #[101]
.mediafire.com/ Name: _ga
Value: GA1.2.1675868932.1701395917
.mediafire.com/ Name: _gid
Value: GA1.2.458481660.1701395917
.mediafire.com/ Name: _gat_gtag_UA_829541_1
Value: 1
.mediafire.com/ Name: cf_clearance
Value: Ftuqa2OtSwM2BFiXqX43vJR2hudUys1C1rnDyTS0VKQ-1701395916-0-1-bc51f92e.17e39e06.eb50a6ce-0.2.1701395916
.mediafire.com/ Name: _sharedid
Value: 402b364a-8993-4464-a3d9-61f38d2a050b
.mediafire.com/ Name: _sharedid_cst
Value: zix7LPQsHA%3D%3D
.crwdcntrl.net/ Name: _cc_dc
Value: 0
.crwdcntrl.net/ Name: _cc_id
Value: 2bedb36599cd55339a628fc6efa59605
.mediafire.com/ Name: _cc_id
Value: 2bedb36599cd55339a628fc6efa59605
.omnitagjs.com/ Name: ayl_visitor
Value: 62ae6d0f7138766890cdfecf38ceff8f
www.mediafire.com/ Name: _pbjs_userid_consent_data
Value: 6683316680106290
.mediafire.com/ Name: amp_28916b
Value: wha2aE6X6LDPMRTsOdWIvu...1hghhiqjh.1hghhiqji.0.1.1
.mediafire.com/ Name: FCNEC
Value: %5B%5B%22AKsRol_2JQLtYSuKg234uJi5lARkOCHhbVhcEZBJ5KmLpdmkdpu0ewpRebx5BdZvi3FYTi4DSdxW-G9y3RuWKIMDadk9QQG1-CGutwvs-XTNpIVMnMA3LijjxrLF_tsxAUPnoq-HTgY2jqVHqT2YHzA7oO5VXJayzw%3D%3D%22%5D%2Cnull%2C%5B%5D%5D
.openx.net/ Name: i
Value: 01c661e8-9537-47fd-8aa1-677219649cb1|1701395920
.openx.net/ Name: pd
Value: v2|1701395920|n0vNvQiygu
.adform.net/ Name: C
Value: 1
.adform.net/ Name: uid
Value: 9135305356218733899
.adsrvr.org/ Name: TDID
Value: a0469c36-bc77-430e-9825-0adde7e331a8
.openx.net/ Name: univ_id
Value: 537072971|a0469c36-bc77-430e-9825-0adde7e331a8|1701395920827187
.doubleclick.net/ Name: IDE
Value: AHWqTUmynYTCXvfyd09Q4pP_XVp2Sk9SPT2CCUwES3rP4XKB8mZOa0EtFx_8D5vb8vc
www.mediafire.com/ Name: ezouspvh
Value: 40
.amazon-adsystem.com/ Name: ad-id
Value: A_SNyy8koE-gswUyVoTGX_4
.amazon-adsystem.com/ Name: ad-privacy
Value: 0
.mediafire.com/ Name: __gads
Value: ID=8ed23798d17fef2e:T=1701395919:RT=1701395919:S=ALNI_MYa84XzsqA-d-Y6sn06Y8FEKt-Mkw
.mediafire.com/ Name: __gpi
Value: UID=00000da4eba87dbb:T=1701395919:RT=1701395919:S=ALNI_MYNqbDdY9cfK7DMkmU6DodsZiNUzA
.casalemedia.com/ Name: CMID
Value: ZWk90VgNqmwBwKie5PdSRAAA
.casalemedia.com/ Name: CMPS
Value: 3664
.casalemedia.com/ Name: CMPRO
Value: 3664
.simpli.fi/ Name: suid
Value: 172B0C337EA24A8F83EA8C8A4B595618
.adnxs.com/ Name: uuid2
Value: 8961910970674910848
.turn.com/ Name: uid
Value: 2401794706099336508
.1rx.io/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-358895dc-82d6-4392-9b03-d569568dac10-005%22%7D
.targeting.unrulymedia.com/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-358895dc-82d6-4392-9b03-d569568dac10-005%22%7D
.adentifi.com/ Name: adtheorent[cuid]
Value: cuid_2709aa30-8fed-11ee-bb78-125335d52042
.yieldmo.com/ Name: yieldmo_id
Value: 3zE7aqqnn7qUr6HrdVjl%7C1701388800000%7C0
.ads.yieldmo.com/ Name: re_sync
Value: pp%3D1182364%7Cc%3D1182364%7Ct%3D1182364%7Cpub%3D1182364%7Can%3D1182364
.a-mo.net/ Name: amuid2
Value: 9ef378cd-676d-4a64-b60d-7608cfdfdf10
.prebid.a-mo.net/ Name: sd_amuid2
Value: 9ef378cd-676d-4a64-b60d-7608cfdfdf10
.bidswitch.net/ Name: tuuid
Value: a4aa8fa7-9617-489f-a8fd-b4612be68449
.bidswitch.net/ Name: c
Value: 1701395922
.bidswitch.net/ Name: tuuid_lu
Value: 1701395922
.crwdcntrl.net/ Name: _cc_cc
Value: "ACZ4XmNQMEpKTUkyNjO1tExOMTU1NrZMNDOySEs2S01LNLU0MzBlAILUTNtL%2F4GAH8SBAAC98w7d"
.crwdcntrl.net/ Name: _cc_aud
Value: "ABR4XmNgYGBIzbS9BKSgAAAWzwHe"
sync.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-1a75cb49-6a51-525a-5432-00acb2eb4795.k3r6EnV9ori9kBZTnGTYHdprTGdaIzKAoGdKvOnj8kU
.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-1a75cb49-6a51-525a-5432-00acb2eb4795.k3r6EnV9ori9kBZTnGTYHdprTGdaIzKAoGdKvOnj8kU
sync.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AGnXLSWpRUlpUMgCssutHlbnVUKQ.%2BkSzHOOZ%2FhRzOaXYVSFdOfA7s9AwUhySgQFlKVyvD1U
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AGnXLSWpRUlpUMgCssutHlbnVUKQ.%2BkSzHOOZ%2FhRzOaXYVSFdOfA7s9AwUhySgQFlKVyvD1U
sync.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKIO71qB_WvaRb3XOYAFITxesfg171xAfVUGKhO8viQobPEHwYBCDS-6SrBjABOgSVjvJGQgQwB4il.M0WO4QsuNzV5c7Qv7aHbbrRXu4r4TFcbBMcYpKQyjTI
.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKIO71qB_WvaRb3XOYAFITxesfg171xAfVUGKhO8viQobPEHwYBCDS-6SrBjABOgSVjvJGQgQwB4il.M0WO4QsuNzV5c7Qv7aHbbrRXu4r4TFcbBMcYpKQyjTI
.mediafire.com/ Name: panoramaId_expiry
Value: 1701482321990
.mediafire.com/ Name: panoramaId
Value: 1abe72d1d036d6a83e09ce1a2951a9fb927a55f3965d51aa4f509825a4ba876e
.3lift.com/ Name: tluid
Value: 4033539711555786084285
.ads.yieldmo.com/ Name: ptran
Value: 8961910970674910848
.ads.yieldmo.com/ Name: ptrt
Value: a0469c36-bc77-430e-9825-0adde7e331a8
.yahoo.com/ Name: A3
Value: d=AQABBNI9aWUCEEXvn-5G58wp2TJGhz9FKYcFEgEBAQGPamVzZSXcxyMA_eMAAA&S=AQAAAouXUSXk94p5a7aIpSXHYGs
.ads.yieldmo.com/ Name: ptrc
Value: CAESEASEEgvHwSkIqDJWnvimmD4
.neural40.cdnwebcloud.com/ Name: n_one
Value: 26d3b533-8fed-11ee-9d1a-0242ac110002
.mediafire.com/ Name: connectId
Value: %7B%22puid%22%3A%22bf566dd1503e1de75e391240f1d36b6a6b3fe616dbce0c099d4cc82975670811%22%2C%22vmuid%22%3A%22vskxSs485V5_3RlcLQ8xYqSXzr7Ub5Vyyd-XZDt_MmEzvl8hO73_gV_4D8-A7NWzfAX4Ln2qu4QdB9eN8zXKRQ%22%2C%22connectid%22%3A%22vskxSs485V5_3RlcLQ8xYqSXzr7Ub5Vyyd-XZDt_MmEzvl8hO73_gV_4D8-A7NWzfAX4Ln2qu4QdB9eN8zXKRQ%22%2C%22connectId%22%3A%22vskxSs485V5_3RlcLQ8xYqSXzr7Ub5Vyyd-XZDt_MmEzvl8hO73_gV_4D8-A7NWzfAX4Ln2qu4QdB9eN8zXKRQ%22%2C%22ttl%22%3A24%2C%22lastSynced%22%3A1701395922193%2C%22lastUsed%22%3A1701395922193%7D
.adnxs.com/ Name: anj
Value: dTM7k!M4.gDYRWSF']wIg2GVOvtRZ=!]tb:8i_iqf!oN/@E'zz<*Z0Qro0R8r*F#][k6`FYzbgP^eUuQ/Ai@GcV+%9TD._*Pl[gSnU+i7n#Dm$3O*lL`TXu#4h:0N`pOZF3NXoj)yAFHAnA1U!!)ET.]%lh
.adnxs.com/ Name: uids
Value: eyJ0ZW1wVUlEcyI6eyJ0cmlwbGVsaWZ0X25hdGl2ZSI6eyJ1aWQiOiI0MDMzNTM5NzExNTU1Nzg2MDg0Mjg1IiwiZXhwaXJlcyI6IjIwMjQtMDItMjlUMDE6NTg6NDJaIn19LCJiaXJ0aGRheSI6IjIwMjMtMTItMDFUMDE6NTg6NDJaIn0=
.ads.stickyadstv.com/ Name: UID
Value: 19e74a65c36c6d13014e8a2869ef343
pixel.rubiconproject.com/ Name: receive-cookie-deprecation
Value: 1
.rubiconproject.com/ Name: khaos
Value: LPLZ7BT1-K-6QY9
.creative-serving.com/ Name: tuuid
Value: 7bf77b4b-d840-4833-9c17-8c93328d985b
.creative-serving.com/ Name: c
Value: 1701395922
.creative-serving.com/ Name: tuuid_lu
Value: 1701395922
.ads.stickyadstv.com/ Name: uid-bp-159
Value: CAESEFdef8FhrmoQJ8DdXumOBp0
.smartadserver.com/ Name: TestIfCookieP
Value: ok
.smartadserver.com/ Name: pbw
Value: %24b%3d16999%3b%24o%3d11100
.adtelligent.com/ Name: vmuid
Value: 5d0db918b2e135a4
.adtelligent.com/ Name: a743293
Value: 9135305356218733899
.id5-sync.com/ Name: 3pi
Value:
.id5-sync.com/ Name: id5
Value: 15775e68-4802-7299-abab-5f2c2ac4da5e#1701395922980#1
.uuidksinc.net/ Name: jcsuuid
Value: RSBu98zMYB2lsyn7xqP1
.vidoomy.com/ Name: uids
Value: eyJ0ZW1wVUlEcyI6eyJhZGYiOnsidWlkIjoiOTEzNTMwNTM1NjIxODczMzg5OSIsImV4cGlyZXMiOiIyMDIzLTEyLTE1VDAxOjU4OjQzLjI1MTg2NTk1WiJ9fSwiYmRheSI6IjIwMjMtMTItMDFUMDE6NTg6NDMuMjUxODM5Njg5WiJ9
.zemanta.com/ Name: zuid
Value: JthQNRlYKvyYtq8sninV
.contextweb.com/ Name: V
Value: oR97ZMVTiSrh
.contextweb.com/ Name: pb_rtb_ev
Value: 3-1oak|7TZ.0.1
bh.contextweb.com/ Name: INGRESSCOOKIE
Value: 56b92317b9caaeed
www.mediafire.com/ Name: ezouspvv
Value: 112
www.mediafire.com/ Name: ezouspva
Value: 6
.ads.yieldmo.com/ Name: ptrpp
Value: oR97ZMVTiSrh
.mediafire.com/ Name: _ga_K68XP6D85D
Value: GS1.1.1701395916.1.0.1701395923.53.0.0
.lijit.com/ Name: ljt_reader
Value: Hvu2ZLZHRMHRFVFyQd6nRYRY
.smartadserver.com/ Name: pid
Value: 6746445839225075283
.quantserve.com/ Name: mc
Value: 65693dd3-f1df4-96730-ea0cd
.fwmrm.net/ Name: _uid
Value: umo1a91_7309131076569196210
.ads.stickyadstv.com/ Name: uid-bp-36033
Value: umo1a91_7309131076569196210
.ads.stickyadstv.com/ Name: MRM_UID
Value: umo1a91_7309131076569196210
.ads.stickyadstv.com/ Name: uid-bp-717
Value: y-vNmC.6hE2oPtOk768c6C9fHHUvO.6FFhvH_nRcIW~A
.ads.stickyadstv.com/ Name: uid-bp-892
Value: a0469c36-bc77-430e-9825-0adde7e331a8
.teads.tv/ Name: tt_viewer
Value: b07681c1-18c3-43c0-817e-1c231a0c99a4
.adx.opera.com/ Name: UID
Value: OPU8cd00b679a4d4a4fb282885d711e45a0
sync-dmp.mobtrakk.com/ Name: chk
Value: 1
sync-dmp.mobtrakk.com/ Name: pid
Value: M2JjMmI1NGU5NmE4NDJmNg
.sitescout.com/ Name: ssi
Value: 736aff63-fa26-48f3-902b-9cb7a7c89000#1701395925133
.onetag-sys.com/ Name: OTP
Value: LHP9BTcFATj7SsusPnWgknafkm9l-neXw34ShLXSWRg
.linkedin.com/ Name: li_sugr
Value: 8768c3e9-229e-451f-a8bf-6e65a9f6a9ac
.linkedin.com/ Name: bcookie
Value: "v=2&2742a539-3bc6-447d-8254-e33d6f3c6436"
.linkedin.com/ Name: lidc
Value: "b=OGST08:s=O:r=O:a=O:p=O:g=2702:u=1:x=1:i=1701395925:t=1701482325:v=2:sig=AQFys-8fBYdkqVd0H8ThYHrqlI4bah1u"
.admanmedia.com/ Name: ac_r
Value: CS253
.admanmedia.com/ Name: admtr
Value: 5e3b3c30-3b2a-4b86-b01b-9dc4120b1f41
.quantserve.com/ Name: d
Value: ECcBEAHHKoEP6b0Q
.mathtag.com/ Name: uuid
Value: ad486569-3dd5-4800-ba9a-c274bf6c91fb
.admixer.net/ Name: am-uid
Value: 1774b204c12b4887abdf5e36871b12e5
.smartadserver.com/ Name: csync
Value: 76:CAESEI_NGlBdGpCGad5YGvcZ0xg|86:8961910970674910848|117:62ae6d0f7138766890cdfecf38ceff8f
.betweendigital.com/ Name: dc
Value: was1
.betweendigital.com/ Name: tuuid
Value: a2fd180f-1eab-534f-b26c-6b6bd70556be
.betweendigital.com/ Name: ss
Value: 1
.betweendigital.com/ Name: ut
Value: ZWk91QAKf4Ddztye8MLVK-RJ0Yiz04WdS938vA==
.smaato.net/ Name: SCMu
Value: b7f6348625
.smaato.net/ Name: SCMs
Value: 7a252ca9f1
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAA_-MSsjSzNLSwMDcyMrYwMjAytjQ2EuIz1E1JM04vryrN9413LgAALkczDyQAAAA
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAA_-MSsjSzNLSwMDcyMrYwMjAytjQ2EuIz1E1JM04vryrN9413LgAALkczDyQAAAA
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAA_1vFwmtobmBobGlqaWRqaWYBAKNH6bkQAAAA
.smaato.net/ Name: SCM
Value: 9658eab955
.smaato.net/ Name: SCMtu
Value: 9658eab955
.sharethrough.com/ Name: stx_user_id
Value: 7030884b-dd5c-44cd-87f5-1230673423ab
.bttrack.com/ Name: GLOBALID
Value: 2uKlc8-sIBd987FnJwbCGpv6A44CJ9T_8nA45Qu1JUMIPERqCPDE1PpImJqs5IwuJ2r2byPx6ZQC4TM1
.tapad.com/ Name: TapAd_TS
Value: 1701395926338
.tapad.com/ Name: TapAd_DID
Value: 785428a7-1311-49b6-8148-11f15b1f4e66
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value:
.bidr.io/ Name: bitoIsSecure
Value: ok
.ads.stickyadstv.com/ Name: uid-bp-26913
Value: AAB0vk7K0nwAABPqtqAq9A
.bidr.io/ Name: bito
Value: AADi8E7K0nwAABMXtn_NUw
.pubmatic.com/ Name: KTPCACOOKIE
Value: YES
.postrelease.com/ Name: visitor
Value: f616cb2e-ea3f-4a4d-b38a-d37bfae9b5cc
.postrelease.com/ Name: status
Value: 1
.pubmatic.com/ Name: SyncRTB3
Value: 1702598400%3A220
.pubmatic.com/ Name: KADUSERCOOKIE
Value: 476A89A3-0BB0-450F-AC03-2F959BAA28BD
.adotmob.com/ Name: uid
Value: 09dd220400f7d56bef5cd80c
.adotmob.com/ Name: uuid
Value: 09dd220400f7d56bef5cd80c
.adotmob.com/ Name: partners
Value: AYL%3A1701395926996
.w55c.net/ Name: wfivefivec
Value: ukFBPzdY1R8SNN5
.w55c.net/ Name: matchfreewheel
Value: 5
.ads.stickyadstv.com/ Name: uid-bp-23329
Value: ukFBPzdY1R8SNN5
.ads.stickyadstv.com/ Name: uid-bp-951
Value: 8961910970674910848
.ipredictive.com/ Name: cu
Value: bf3b4c55-e598-442d-83b3-e58668bc1d22|1701395927422
.creativecdn.com/ Name: u
Value: 39kS9KlLocJJLYWukcAY
.creativecdn.com/ Name: g
Value: 39kS9KlLocJJLYWukcAY_1701395926755
.creativecdn.com/ Name: ts
Value: 1701395926
.ads.stickyadstv.com/ Name: uid-bp-25746
Value: bf3b4c55-e598-442d-83b3-e58668bc1d22
.sitescout.com/ Name: _ssuma
Value: eyI1OSI6MTcwMTM5NTkyNzQ4MSwiMzkiOjE3MDEzOTU5MjUxNjMsIjciOjE3MDEzOTU5MjUxNjN9
.ads.stickyadstv.com/ Name: uid-bp-25522
Value: 736aff63-fa26-48f3-902b-9cb7a7c89000-65693dd5-5553
.smilewanted.com/ Name: sw_user_params_infos
Value: P%2BWkeOTgeNs0vjzq4He6HXQh6hIKNIzcPScFkAiqMI9fpHW%2BW8g1v13xG3vZE4LLBdN3XJ%2FaH%2BqOoVi%2Fl4cly95BDqQAOlWaAUwEZjjLfY32oyBIAHyiwv10vyjXtzmbw9wgRfTEt3z3HNkvaTrtQrj4dAQO52tOI2N3x%2FN7bktyecXQdrpfcCSyLE61%2B6h4xXpyMW784iR8Atxg5R0DZSWNGSHCexFVQaDQKupOOO2ToNclEflY2t9yMxIbxASE5ZpQIP2F1L2ZOEMKkbCanHZSoFTd6LkKSSTx%2BeWvjzfwyfsloBhzFZ190V4GX61Sxy4EK8Kr%2BOZnBSRSIhE0Ncu%2B5ENJdScPbonGFBOv0VaFBiWyMrxr19lRTzbrRA3KYyn86d6b0%2Bpa1VJ1yS40w3gh342jb%2Fv9Ftg%2BepJjySsXjTPWaZs4KPUeSc2rdzoklnUnKCu14jt6uYXCFTFtYPAsaYPJmYSBEWl6j8ExgwsJ%2FyAlEpUs4MJupXFMk9ho
.vidoomy.com/ Name: vidoomy-uids
Value: eyJ1aWRzIjp7IkNFTiI6eyJ1aWQiOiI3MzZhZmY2My1mYTI2LTQ4ZjMtOTAyYi05Y2I3YTdjODkwMDAtNjU2OTNkZDUtNTU1MyIsImV4cGlyZXMiOjE3MDM5ODc5Mjd9fX0=
.adsrvr.org/ Name: TDCPM
Value: CAESFgoHc3Z4OXQ1MBILCK7ok7rihrk8EAUSFgoHcnViaWNvbhILCN6m9vHihrk8EAUYASACKAIyCwjCrtiF-Ya5PBAFOAFaB2syajNncXBgAg..
.rlcdn.com/ Name: rlas3
Value: aGwWQNxas3UxbRclN/2JWtolXogLFKfIlPh2imFRO6o=
.rlcdn.com/ Name: pxrc
Value: CNX7pKsGEgUI6AcQABIGCJC8KxAD
.pubmatic.com/ Name: pi
Value: 159706:3
.pubmatic.com/ Name: chkChromeAb67Sec
Value: 2
.lijit.com/ Name: _ljtrtb_80
Value: LPLZ7BT1-K-6QY9
.blismedia.com/ Name: b
Value: 65693DD88912D3898F76690EBLIS
.liadm.com/ Name: lidid
Value: 1a39f2bf-14f7-4a96-a87f-091187cddd6a
.360yield.com/ Name: tuuid_lu
Value: 1701395928
.360yield.com/ Name: tuuid
Value: ef14f735-7258-4b68-a052-c40819e0f907
.dotomi.com/ Name: DotomiTest
Value: 68180ae3495d14be
.primis.tech/ Name: csuuid
Value: 65693dd8664f1
.analytics.yahoo.com/ Name: IDSYNC
Value: "195v~2fcp:18yl~2fcp:194o~2fcp:18vk~2fcp:19e0~2fcp"
pixel-eu.rubiconproject.com/ Name: receive-cookie-deprecation
Value: 1
.intentiq.com/ Name: IQver
Value: 1.9
.intentiq.com/ Name: intentIQ
Value: cCawVhmeDc
.intentiq.com/ Name: intentIQCDate
Value: 1701395928590
.intentiq.com/ Name: CSDT
Value: UEQ6MTUxMDZfMCZUeDlIdlUw
.intentiq.com/ Name: ASDT
Value: 0
.intentiq.com/ Name: IQPData
Value: 3117764772#1701395928587#0#1701395928587
.rubiconproject.com/ Name: audit
Value: 1|xQ6Ms+Yx/qDxQB7g+MUs+yHoNNuLNLIq2n61c8aVAxs5NmZCyxBa+natzCd8BXH2MSjEd8hFs2iM1KxoLazIt6NWShwHx7KI6rocrMY9/A/Vgd/ddViNLV6NTKQdfVeUqtS3cimZdyRrBJceafkLGPGyCbxTORwgbTzM79qkyz1S2cCtv7Yhf3hxoNbkHDLm0t4i1Iq21d0=

10 Console Messages

Source Level URL
Text
security warning URL: https://www.mediafire.com/file/4jpxw5szul7blh2/NSwish_texture_pack.rar/file(Line 1212)
Message:
document.domain mutation is ignored because the surrounding agent cluster is origin-keyed.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'ambient-light-sensor'.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'bluetooth'.
security warning
Message:
Error with Permissions-Policy-Report-Only header: Unrecognized feature: 'document-domain'.
network error URL: https://rtb.adxpremium.services/openrtb2/auction
Message:
Failed to load resource: the server responded with a status of 400 (Bad Request)
network error URL: https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&uid=CAESEJN68q_Bm143upm1uztSI0k&google_cver=1
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://cs.chocolateplatform.com/pub?pid=ebda&google_gid=CAESEGuLYU6XgXRyB-I3WjlSVNA&google_cver=1&google_push=AXcoOmSiDPCxByEjgANtMEkDQL9y7W9il38auXa_58yhoYIW602cKXYkfdgFzVJjmVM4miv2dQYuuMmCY7tiuhiyMng0Lr5VDWO4
Message:
Failed to load resource: net::ERR_CONNECTION_CLOSED
network error URL: https://jelly.mdhv.io/v4/pixie?gdpr=0&gdpr_consent=
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network error URL: https://cs.chocolateplatform.com/pub?pid=ebda&google_gid=CAESEGuLYU6XgXRyB-I3WjlSVNA&google_cver=1&google_push=AXcoOmTE3Fw1P0c-h7Rd1X0atdk1ZPICzXtBVCNLh1rrkhoEMEqdc8_It14uBylpNbbQoUqfIymqAISXZ7UCH6pODkPFY5r9byhrpA
Message:
Failed to load resource: net::ERR_CONNECTION_CLOSED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a-prebid.vidoomy.com
a.tribalfusion.com
a.vidoomy.com
aax-eu.amazon-adsystem.com
ad-delivery.net
ad.crwdcntrl.net
ad.doubleclick.net
ad.mrtnsvr.com
ad.turn.com
ads.betweendigital.com
ads.creative-serving.com
ads.pubmatic.com
ads.stickyadstv.com
ads.yieldmo.com
aep.mxptint.net
analytics.google.com
analytics.pangle-ads.com
ap.lijit.com
api-2-0.spot.im
api.amplitude.com
api.btloader.com
assets.a-mo.net
b1sync.zemanta.com
bcp.crwdcntrl.net
bh.contextweb.com
bidder.criteo.com
bshr.ezodn.com
btloader.com
bttrack.com
bucket.cdnwebcloud.com
c1.adform.net
c180d6785da2355d0d96f757abe42fb8.safeframe.googlesyndication.com
capi.connatix.com
cdn.amplitude.com
cdn.id5-sync.com
cdn.jsdelivr.net
cdn.otnolatrnup.com
cdn.prod.uidapi.com
ce.lijit.com
cm-supply-web.gammaplatform.com
cm.adform.net
cm.adgrx.com
cm.g.doubleclick.net
cms.quantserve.com
code.createjs.com
crb.kargo.com
creativecdn.com
cs.admanmedia.com
cs.chocolateplatform.com
cs.minutemedia-prebid.com
cs.yellowblue.io
csync.loopme.me
csync.smilewanted.com
d.vidoomy.com
dclk-match.dotomi.com
dis.criteo.com
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
events-ssc.33across.com
exchange.mediavine.com
fksnk.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
g.ezodn.com
g.ezoic.net
ghb.adtelligent.com
go.ezodn.com
google-bidout-d.openx.net
googleads.g.doubleclick.net
gum.criteo.com
hb-api.omnitagjs.com
hb.yahoo.net
hb.yellowblue.io
hbopenbid.pubmatic.com
i.liadm.com
i6.liadm.com
ib.adnxs.com
ice.360yield.com
id.a-mx.com
id.crwdcntrl.net
id.hadron.ad.gt
id.rlcdn.com
id5-sync.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
image8.pubmatic.com
inv-nets.admixer.net
invstatic101.creativecdn.com
jadserve.postrelease.com
jelly.mdhv.io
lb.eu-1-id5-sync.com
live.primis.tech
match.360yield.com
match.adsrvr.org
match.deepintent.com
match.prod.bidr.io
match.sharethrough.com
mweb.ck.inmobi.com
neural40.cdnwebcloud.com
oa.openxcdn.net
oajs.openx.net
onetag-sys.com
otnolatrnup.com
p.rfihub.com
pagead2.googlesyndication.com
partners.tremorhub.com
pixel-eu.rubiconproject.com
pixel-sync.sitescout.com
pixel.rubiconproject.com
pixel.tapad.com
pm.w55c.net
pmp.mxptint.net
pr-bh.ybp.yahoo.com
prebid-s2s.media.net
prebid.a-mo.net
prebid.smilewanted.com
privacy.gatekeeperconsent.com
pubmatic-match.dotomi.com
px.ads.linkedin.com
r.turn.com
rt.marphezis.com
rtb-csync.smartadserver.com
rtb.adentifi.com
rtb.adxpremium.services
rubicon-match.dotomi.com
s.ad.smaato.net
s.amazon-adsystem.com
s.seedtag.com
s.uuidksinc.net
s0.2mdn.net
s2s.t13.io
script.4dex.io
secure-assets.rubiconproject.com
secure.adnxs.com
securepubads.g.doubleclick.net
server.cpmstar.com
simage2.pubmatic.com
ssbsync-global.smartadserver.com
ssbsync.smartadserver.com
ssum-sec.casalemedia.com
static.cloudflareinsights.com
static.criteo.net
static.mediafire.com
static.smilewanted.com
static.xx.fbcdn.net
stats.g.doubleclick.net
sync-dmp.mobtrakk.com
sync-tm.everesttech.net
sync.1rx.io
sync.adotmob.com
sync.adtelligent.com
sync.aniview.com
sync.aralego.com
sync.crwdcntrl.net
sync.intentiq.com
sync.ipredictive.com
sync.mathtag.com
sync.outbrain.com
sync.search.spotxchange.com
sync.smartadserver.com
sync.srv.stackadapt.com
sync.targeting.unrulymedia.com
sync.teads.tv
sync.technoratimedia.com
sync1.intentiq.com
t.adx.opera.com
tags.crwdcntrl.net
the.gatekeeperconsent.com
tlx.3lift.com
token.rubiconproject.com
tpc.googlesyndication.com
tr.blismedia.com
trace.mediago.io
translate.google.com
translate.googleapis.com
u.openx.net
um.simpli.fi
ums.acuityplatform.com
ups.analytics.yahoo.com
us-u.openx.net
us01.z.antigena.com
ut.pubmatic.com
visitor-us-west-2.omnitagjs.com
visitor.omnitagjs.com
www.ezojs.com
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.mediafire.com
www.tumblr.com
x.bidswitch.net
a.tribalfusion.com
ad.mrtnsvr.com
api-2-0.spot.im
assets.a-mo.net
cm-supply-web.gammaplatform.com
crb.kargo.com
cs.chocolateplatform.com
csync.loopme.me
dis.criteo.com
dsp.adfarm1.adition.com
events-ssc.33across.com
fksnk.com
gum.criteo.com
id.a-mx.com
id.hadron.ad.gt
image4.pubmatic.com
jelly.mdhv.io
mweb.ck.inmobi.com
pmp.mxptint.net
rt.marphezis.com
s.seedtag.com
server.cpmstar.com
sync-tm.everesttech.net
sync.aralego.com
sync.search.spotxchange.com
sync.technoratimedia.com
tlx.3lift.com
trace.mediago.io
ums.acuityplatform.com
us01.z.antigena.com
104.16.113.74
104.16.56.101
104.18.36.155
104.19.214.37
104.21.28.48
104.22.53.86
104.26.2.70
104.36.113.107
104.36.113.110
104.36.113.112
107.22.47.225
107.23.186.129
108.138.85.84
13.107.42.14
13.32.151.88
130.211.23.194
142.250.31.97
142.251.111.101
142.251.16.132
147.28.129.37
151.101.193.229
157.240.244.1
157.240.244.35
162.19.138.116
162.19.138.120
169.197.150.8
172.253.115.100
172.253.115.101
172.253.115.149
172.253.115.95
172.253.122.105
172.253.122.155
172.253.122.94
172.253.62.132
172.253.62.154
172.253.63.149
172.253.63.154
172.64.137.15
172.64.146.152
172.67.10.198
172.67.170.144
172.67.41.60
172.67.75.241
173.231.178.85
178.128.135.204
18.213.98.197
18.67.76.70
184.84.195.97
185.106.140.18
185.167.164.49
185.184.8.90
185.64.189.112
185.98.54.153
192.0.77.40
192.132.33.69
192.184.69.215
198.148.27.131
199.127.204.142
199.38.167.131
204.237.133.242
205.180.85.204
207.198.113.203
212.36.83.245
212.36.83.246
213.19.162.80
216.239.36.178
23.105.12.171
23.197.41.36
23.197.42.81
23.215.40.199
23.227.146.18
23.227.151.194
23.45.180.209
23.83.76.73
23.83.76.89
23.92.190.68
3.212.153.35
3.225.218.10
3.226.187.105
3.33.220.150
3.93.99.238
34.102.146.192
34.107.140.113
34.107.148.139
34.111.113.62
34.120.135.53
34.196.127.236
34.202.221.201
34.203.168.193
34.96.105.8
34.96.70.87
34.98.64.218
35.161.33.4
35.194.66.159
35.211.178.172
35.244.154.8
35.71.139.29
37.157.2.229
38.98.69.175
44.214.40.113
44.235.17.74
45.137.176.88
5.161.188.99
50.116.194.21
50.17.66.232
51.222.39.187
52.46.130.91
52.5.229.57
52.50.63.24
52.54.71.185
52.85.132.15
52.85.150.163
52.85.151.39
52.86.218.58
52.88.192.204
54.161.26.122
54.165.74.222
54.205.205.150
54.83.134.184
54.87.125.83
54.88.209.131
54.88.4.137
63.251.28.134
67.220.228.201
68.67.179.164
69.10.32.226
70.42.32.191
70.42.32.255
72.251.238.254
74.119.119.129
74.119.119.131
74.121.140.211
8.28.7.83
8.43.72.97
80.239.138.24
80.239.138.59
80.77.87.163
82.145.213.8
96.46.186.182
96.46.186.57
99.84.222.71
01b58ddb2f86a768f91751b62f25395417f6cf526191a4aefc1ebe4f8beacdcb
0384a48617604e8750d71ba4665343670c1325de2e499b036ea35a8cc72adaa2
03c8d2dc7d985c3004ff2cd6d8148dd03560f37ed15efdf6c2d7f4d771d0e599
079f59405da9aed3725440b658577d5b8f974dc7cc3a87f9cbe0dc82d235c13d
084d109cd724591b96f08d010168646de2d2e910fbdf47a7c23e5d86ef438add
0887e40d9c66ba2d2fd9769ab474ff53090a126f9ddb1dce0042f77d2cbfc955
08bb8bf8ea037474da111ae1a70781e3210f7a0b29ac2f61cc5e88a3e37b920d
09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff
0aa1be81fda06de2efd9639b18bd2580f814320b13ccbef13a8d1c30f5ee3d4e
0ae875f5cc7243e4c142dc754a0cd30f482aaace7507790a4cdc434a96c89175
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
10c5779cae461daba4b2f636f90df6cbf420e8c3dbe5a326bd937e7392c2b8df
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
183be4309aa229c11d790bb79b82a6a181a3f76cd009635a145a9d65c9c80766
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
1a1e169d351e8b8552576f28514a6ec48b79794ea47097ff65e5e5ca4e60ca2b
1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0
1f0eb9334bd3f2bafab2dcb4753d04b50c3ef2cbbf505ef3c3af63fddee7f056
2118516104d23af6dc43fe754c783346f5c24770e83bf4d9201546454822025f
213f0714452c73943317a205b4a11e88004b252469dc4cb5f1603c8f03712f5b
22e99768051bfffd5038e9ead749c8beab5ed5f1042a82eaa188096b2c63d4a1
24434236112e2c40b190268b75b5a499d50fa6a4cd93664b9ec82f7852865ebf
2450e5580136f94bda7ccf95e3167b57e15b05b513a430967943a50036fa47a4
26305a08644b4f51b55812cf0ecf879c22da303a365b3d2769baa1b54c028c4d
287ac8c1d32b483d2754bf885e8248c50db2472780b9b0c459554438fabef745
2a0f8c3fd005ec5df2e677c030eae66ce97a2bb198934560885798d7fe42a7ee
2b104db680a9d1df48409a24d2f18c31e2867e67e921c44b00c72b22d9762bb8
2c34f09169d2a10e8f5863960e81575ab70f88b52f4bd3386ce5e41e73a94487
2cb36489072c0eb085096a47bfcced826b7a973e5f294d5a2b54bf16df3449d9
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2ef1cb1bb38376f511d26358f2fa6077b097d2af2596c6a294bc6748deca0c39
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
3090542cfa480c27139ce97a0a00f3d1c843274bed009a3b1b00cec9e84eb3f3
31535a91ce3f6b8ed3ddedadab1e49957e2220263a640df1a3f14f6fdfe15eb6
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
31f4e4abd5d8e145d6bd5505ae3ee469f66e6aba53fcc6cf04741d0a802ebc3d
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
35b7b500dca7f0e16292ca2253d16e372786ac3030c1b18288ba3d71823a1363
3949bc357609db6e9bc5796a30a25a1865ba837e2cada69a1832b03e0814a51d
3d41b5eccb6d46de2253c6c225a6aef2009f266fc4180385b9d1ad17c19e7329
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
418548cce5d9d5e080275efcc3c726d9b7f9c401e0672aa79778e503f0c122c8
4284d118bc337f2ed4a2506c95e676770285e204ec96124b4c4f33903e7c5bc2
4342feac38021c4fe3069eba0edf1c2e1b4345e2b548b0afb7ab21b7369b3bc8
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
4448e430d3c53bad548a5d135e1c7e2f9593e806ba47892640d430ea752e979e
45d5fd2dd0b0ce128b8c61e934f685e5ce7275f28566ba422a63e0f2891e5606
45d8ab66850adf85d81feb47d7909f5e63eb86cbe3e5feb8404bd6afd79bb8b8
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d43d655b35d6e4823b64ba37eca2c3cec4735f4f3d6d5afa9da67fe6e18ab84
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4daf293be350b22d032f276ada21dc44225dcbf92e09f067d45dded786e44b0f
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f1c44da767ba20c7bf97816c0c57781f859f80a038dd2aeddfac69c2930394f
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
50fbbe164918e6fb86e26b49d99c193d1c36ec6bbf9a51b9967ca74f2282ccde
52ba10a405c7340216d2843e2ea9a5641748ac3dca01c50b4188c3496d68c0f5
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
549bd3e9e2cfe91e355ba68c1fe15c0af27e0391123630b9ccfbbbd559cdba47
55f56026d86468db4135723445d1df3498809ce536fa7a518b2847d7e6a27a96
574e1db830eca18f0ea1dff860d8d6708d9e0e4fadfc2ca28e13644f3526acc8
58644b7dfa826a3291e2e5d6c2974b47906616e1aa03a2f757fdd1bde7796621
5887ea0717fc39d653a3453200bea15c7aa04dc6d97ef19905f3dac89f7262ea
5afcf693970be0341444be622cad5aff4143555843fac107ea0e7869b107332e
5bce27ce4b302cea70cf511c73d44c7dd0e38aa5b4744101662253be55946b31
5da3028ef8c48c9637ffaee2ae80bf7e97d706fd76784b5350c24527447852ea
5e8240895c0b0bcbde2c9a2fe1fa1278624007f99fe00cce07d21ab47d1f9255
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
61799b7d2a46cf04fc19dc02d3b99a560da6c2e06fce8feae39848086c3f30da
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
654229c7db9f22ea2aa458bd0c5b7d07c77170d1e78b1cdd24d7bff6347079ed
663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707
66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507
66f8ecd359ccf9d79ae9c4ad10312de1a65db446344b2667e54d604f25d3165b
67659f4ba232982072a6adad0db2297cda97402e9f3a95da3e63ec34c0566f93
6bc3c2d3634a070f17cafad43c9287130fe07c8ce95ff5aac28fbf50685aa4e0
6c144d4227c26d96577d0683d8ae46e5dfe9c15c5c9979aa9bce3de4f8b1b039
6e276fa730247ab06d00f83c944608d9ec16d9f81d3c8ec88d0ea431a768ac44
71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3
720671166ac43aba99e3952b0b9341ab4e0fee1fd891db54e2a07f05db653142
729ea2e5bae35bf120079c8e6858db5995ce8b319f72985085f1b7641e18a492
72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc
73f6add564f8d8c794d4b1bd49749c1770990b44616591ea59ce7333cf05a574
74130e91791cf3496d353724953e6466d3240ea308838a482dff16cd6c119aa0
7460c2565d60627bdc9cbe2619e3005711788a6f0e3a0bce44bd04f138b71ca7
777e7af804814e50ee22a4a349b603a523f5555b666a5e42d98b862520cc2b83
7af805fc2bda263e9826c3433adb07b0e8881afecb62d611961d767d68c3ac05
7ba1bc2084def769e77a7dbf97cd91d68fe6c6d55b5d183a7d36630da8da2b02
7c7737d1d724c2d3d73b641009a5e65aefdcd385b0e9af3f936d07944f346186
7e071e5b39d13cef80f7a46d854de133fd73c15d1351ebcf7e1f1b48821e7aeb
7e6c76bdc96abb91eed5f6a493da23b69aa461a78711d9112561e82bb08703a6
7f1ed1a4cb16ea8035d7947f8d83cf8da5073cbaf1a7f39502e787c3346fe5a8
7f569bb6b66b59ce3243c4dc7bce8075f400de17232b3eab9fa89c67703b8a9a
8015a89c7e50b71a6597cfc7bc2be462212ae1f57c37e40878a79e7550768ccd
81e788698a5fcd072967d0756cd2533ce5f93416731845be47eae0dbc1b4aada
823ca0c131fa4cab24e6f5a49a7db2c0b21a66d9ec77f4faa17dbe55cbc971af
82b94716473aa225e715e117802145c5d2d725aa1ba9d476d61a5d3da16a8c26
8539c91ae0a82f8cab27d481ea38ac4e66d1e5b36701fe295bcba4399b9255bd
853aa761562ba4ba9a2686df56d9c15dfd9213cf5dc95e3a6836569d3da1ecac
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
86edd1bd7bd5f3251da12cd3c5b391deb666745d36daf364bfaf0a5aa5d59bc5
87fd9927f7d9a0b0f9073d53fa43c07b867798afbf8b8dd029cbd8899d5f79b7
8866fbe187560750670602bf4de0584c42839c187723d78a2f6617c3d7e04cba
88a06e3771c8b67e7728885dbb75764937a70bae70c754904f991fe2d0de789d
892e60dbfc3ed039098df6041eae6e7ecc9401632e6692e709067f9dd8a8b7fa
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a1ca667f8be1d9635b262dc3b15aeecc9d61e0fc2457a1f95ccf6d0bc25a37a
8a997549f8c0feabf33e6b770a4ecc2d7aa59515179d17619264f9da341885ff
8bd69d0dddab8bc553263c254faad469c2a3e08bfb0b737e763f7feabe571225
8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652
91f9f9411b65f7b63a649f726916a383f3b88ccc5919e902f6beaae9707a3a8d
92ae764151ea5966b63780dc3ab63859adee978abb6c3494e99cbc99688706cd
94309e82d864813ce190a8c1edfe2433347bd8705b55dc77a28ea55ae29bed05
94fc6c44effd6f774a81a66ef08c3006c7aec05a5ec5cc962886c9226fdff42f
95b6520c97d4d4becbd22b3debb53342de4dc99284af87a03bd1d54dc9bf5e62
966f3ac430cb4b37e8df3ecb24ba675d4a307f902fa767cd5102b0b46fc1d24a
96e593fff7a5fda6f458924a800242ec31fd51f682b20c7dac093fafaa885823
98f6e8c47cc9172e4c8c74ec2a4b4a8df8988dd3b77803cd88bc435c42db2936
98fd2b5a818cc924222ce20be58a36e91f730654b487c484f3c524894411e4a2
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470
9f6e245ec73203f99ecb888db309a2bdaf91f8696c1cebaa94e477a953fab30a
a017ff6b8ae193889bf7cc3fd35ed7b22ddf106b22ec1ec9b3c581e97dfac943
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1a256244f073b9ed474c52d16f8b7d0ed5d92ca4129042d6ee150817671bcd9
a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e
a2b996fdc66d9abf1696965fbb8afdcb5b7b9aea5219da13e11d11512f3a101c
a43071bbd1b712e759a04d4e11ced1a118ad17e5a301e26fd7a3da8634ffdefd
a47ca510e702a8bb97e5fdf139d5fc1b038e1613bba446a49905dbd653e8f028
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
a609cb6ccb91d2ea20fd6f47e2fb2439d2bef06eb02fea4dfd6c2cfba35f012d
a60af4664aa2dd8297af074e53a549a7997127e069aedac99b76800475608c59
a66ede7f0e5c97456ebe3eb12d7bf326e8c9f5820cdda3f31d4aacf5d4bd5733
a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678
a76af442cfc0fba4c4ddfc213c7ba282359ad64fc4abdb293e20a7e31f3310ca
a7ca18584d5b719a63b6250da424c7111365a767bb5ee7e941d28f4633e54085
ab0755e32905c4c823f523f750f0360e004ee6d13419a81a3f15caaf3212b43e
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
aceb1e9372b58ac7dfdce569c81beefe2f46853e4353310ecf11c390050cce80
adbd4855a8c8b406e9f528883f91e4cad19d3051400f5bdba7dadf446a8d6815
aed2504f1be6c286ea63059738a63c91ace7762624ccf5e750d452dd754eb52c
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
afcd6ebf6cf7124e138218f69982d6c9ca1820345967c9263d243dbf5631d204
b01d53596221a10ad89cd142297dd43310bbe0531fe4694fd590fdbeebf5a18d
b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154
b0dc9f241ec7f0549db655a6d4aaa8c5540e5c82a1c908b8b83750e6853cd2cf
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2c75da950a2de4abb65dc7cbbf775d56d969b4f46a558d47f21cef8015be7b6
b407f3b563fcd301acdef748df9d5f3f908e0d166fc764b3855899c1f3482863
b5caab4f619e85958d7b9985c51504f31aa65076fba3ecf921eb3f91fe5061e4
b5d1ad93140fad26133258f38d9c8a0aaf8a2a41ea5697a3e36349f712c79d18
b67ad968ba3668562f331df45b73501e17c7c166bcf7e5443c33633cbc9d5783
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb98377ce3cea0d9070bca9d68aa2125f8933bb1699127d59da3ae6079aab819
bfad213dc2566a8f25d84d36ce9c8f5f695547d5274192c0bf6ec68de6932bd0
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c27c396b7f4c1ff33d934d2c66f082c7f81193203971648a114f862c9143c234
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf
c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146
c65bb06b181f59165b6d9906e6dcd6ffc956d43cb39d7fdebb3b4005820abe2b
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cbb99c4149249b280f1d3d924d9bdd29a4a14cba1e71775fb3bdbdf13ebd5a48
cbbd6285bb18a8c92cc59574c958877754850f795f0f4dad205c79fd21d1d467
ce80d85b86dd086d02878eb4bfe069dae65844b65dbd364c8a1b9a69db2f4cf0
cebc0ded9f2ef3dd4e3c6d6010538dee890c24a070d6ba991e0c93e451d96ccd
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d050c56b76cb2dae10e3eadd8e8f5e83594db0916d25946bec2f662f69dd776d
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
d1eeab0a5d6afce29d878f65b23d8353d4275b45b21ba69b06bf13c8de1ffa4c
d3d62958d10f2be750b5edb8145df9e3357db4b4f29e80de1ed4273e0d965c62
d47c77d905bb87aa5e629cc4da81d335bd377a3a045b7ea326040faa77559033
d51d6b611f47875116c593b131e1310e5ec32c822b63e4e94a73dec8370519ad
d65f4b2e8eee94ddc7f762d098de19558d879a3b597c8913b4d075532e3ed4b4
d68373f27557bdc1c9772cc016d385b78c2e078666267d17826c02d216c15465
d81afbabdbd5a49876a5de55e9f667f261a18548ccfb3d4a1ae1a4dc9f4f9664
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
d9eecc85da8f895653a7841f3e97714d4793d4d4c6f681ab0d821eccf3edf49e
db71f8a28ad8501544fb4e7668e3c6d0b731760b6f20de3525ebaeba597f1922
dc54b817820f14ce6395ba2a037f37d4bb0af75d5b017336140793fbe2f7f738
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de58a591504b3a24a4e0c5e58d296deb5b611943110a0f09f9cff02013b6d09b
de73d0db16257218a30cb9f69aa6964fc3b770ec05ab5d276fe79dc72e2797ae
dfc128586fee9486ced3ab7fd7011f0620be545c6a4d55f48f8268917213c943
e10274aefd43732b8b3afa290177ed97439e6c30fb73489579f2fd94440d0921
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
e395cbf603998dec778aafaed35a7d66f0b9dc3f7c9c32b6a37fd13f34e4ef36
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5
e55b02e96e56f8d28131566dae4fff47a5520969de93a2090ca37d0641a53f73
e6cead609d342bd202f23b8fa86aff54f2503372d68ae63acca87e7dca2bec15
e80f1f484b9bcfc06df1b6b984b0f3304338338d5c8bc8f85807c682660e9605
e8183507b37f3df80ea253b144745ed58784f5b4465b5216fbf9e314df592d06
e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2
e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389
ead8e45499426a960090b63835ac9a2544a43497b16d4390606caeb885600004
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
ed8ab2f9385a7f58d695bf0aecf88a5851b20ab17f7fd501e4a488383908e7e0
ee644d330c66fd73672ac55d7f2dc8a80e124fe598e3babb36a1f7571ac536b6
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2e858e11bbfe82d0150dd8fc768dfdb4577415c0ee84435e0d6c51a50e6cb64
f52a0c7d9fa7ae8e45916c491ae7193f9a1e289f128f05264122c53d8da970db
f917a9105c311331b1d40f4d2bdbf11233c1c465616c1a9c46232f451463b061
f96f99241bb1bafb3576ff45090979daf6b57da0e74f27e58d853e8bff989e4c
fb07d2959ec9548dfe750dfdea160a300ece939c9e018faba07c8a71dfe887f2
fcdf52e788354566e130d669c261443a03d3738fc83b908c727e7be6e6f9950d
fe4333a37764543c3a81178aeea86317eab5d7e47cf9deec31e97c6ca477a0ec
fff71a83690454ee6ea9014780a6797408918cb90cde1f0f3be65ea28a03c678