hairsalon.jingames.net Open in urlscan Pro
185.80.49.249 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://hairsalon.jingames.net/
Effective URL:
https://hairsalon.jingames.net/
Submission: On December 09 via api (December 9th 2023, 10:24:59 am UTC) from US — Scanned from DE

Summary HTTP 172 Redirects Links 82 Behaviour Indicators

Summary

This website contacted 21 IPs in 4 countries across 12 domains to perform 172 HTTP transactions. The main IP is 185.80.49.249, located in Lovasbereny, Hungary and belongs to RACKFOREST-AS, HU. The main domain is hairsalon.jingames.net.
TLS certificate: Issued by R3 on October 1st 2023. Valid for: 3 months.

This is the only time hairsalon.jingames.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 19	185.80.49.249 185.80.49.249	62214 (RACKFORES...) (RACKFOREST-AS)
29	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
25	146.75.120.193 146.75.120.193	54113 (FASTLY) (FASTLY)
1	199.232.196.193 199.232.196.193	54113 (FASTLY) (FASTLY)
1 14	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
32	216.58.206.33 216.58.206.33	15169 (GOOGLE) (GOOGLE)
6	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
1	178.250.1.17 178.250.1.17	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
7	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
12	178.250.1.3 178.250.1.3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	178.250.1.6 178.250.1.6	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
6	178.250.1.15 178.250.1.15	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3	172.217.16.202 172.217.16.202	15169 (GOOGLE) (GOOGLE)
4	172.217.16.134 172.217.16.134	15169 (GOOGLE) (GOOGLE)
1	216.58.206.35 216.58.206.35	15169 (GOOGLE) (GOOGLE)
2	178.250.1.25 178.250.1.25	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	178.250.1.10 178.250.1.10	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	142.250.185.226 142.250.185.226	15169 (GOOGLE) (GOOGLE)
4	142.250.185.70 142.250.185.70	15169 (GOOGLE) (GOOGLE)
1	216.58.212.164 216.58.212.164	15169 (GOOGLE) (GOOGLE)
172	21

19 185.80.49.249 (Lovasbereny, Hungary) 1 redirects

ASN62214 (RACKFOREST-AS, HU)
PTR: gw1.c-host.hu

hairsalon.jingames.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
main.jingames.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 146.75.120.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.196.193 (United States)

ASN54113 (FASTLY, US)

imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 142.250.181.226 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

32 216.58.206.33 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s10-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.1.17 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 178.250.1.3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.1.6 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.nl3.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 178.250.1.15 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

imageproxy.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.16.202 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f202.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.16.134 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f6.1e100.net

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.35 (United States)

ASN15169 (GOOGLE, US)
PTR: mil07s07-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.1.25 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.1.10 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.nl3.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.185.70 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.164 (United States)

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f164.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
61	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 102 tpc.googlesyndication.com — Cisco Umbrella Rank: 148	643 KB
26	imgur.com i.imgur.com — Cisco Umbrella Rank: 7364 imgur.com — Cisco Umbrella Rank: 5239	2 MB
20	criteo.net static.criteo.net — Cisco Umbrella Rank: 631 imageproxy.eu.criteo.net — Cisco Umbrella Rank: 10143 csm.eu.criteo.net — Cisco Umbrella Rank: 9625	149 KB
19	jingames.net 1 redirects hairsalon.jingames.net main.jingames.net	2 MB
18	doubleclick.net 1 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 ad.doubleclick.net — Cisco Umbrella Rank: 139	201 KB
8	gstatic.com www.gstatic.com fonts.gstatic.com	80 KB
6	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 206	383 KB
4	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 300	197 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	2 KB
3	criteo.com ads.eu.criteo.com — Cisco Umbrella Rank: 9522 cat.nl3.eu.criteo.com — Cisco Umbrella Rank: 10971 rtb.nl3.eu.criteo.com — Cisco Umbrella Rank: 16218	53 KB
2	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 138
1	google.com www.google.com — Cisco Umbrella Rank: 2	1 KB
172	12

	Domain	Requested by
32	tpc.googlesyndication.com	googleads.g.doubleclick.net www.gstatic.com tpc.googlesyndication.com hairsalon.jingames.net pagead2.googlesyndication.com
29	pagead2.googlesyndication.com	hairsalon.jingames.net pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
25	i.imgur.com	hairsalon.jingames.net
16	hairsalon.jingames.net	1 redirects hairsalon.jingames.net
14	googleads.g.doubleclick.net	1 redirects pagead2.googlesyndication.com googleads.g.doubleclick.net hairsalon.jingames.net
12	static.criteo.net	ads.eu.criteo.com
7	www.gstatic.com	googleads.g.doubleclick.net
6	imageproxy.eu.criteo.net	ads.eu.criteo.com
6	www.googletagservices.com	googleads.g.doubleclick.net hairsalon.jingames.net
4	ad.doubleclick.net	hairsalon.jingames.net
4	s0.2mdn.net	tpc.googlesyndication.com googleads.g.doubleclick.net hairsalon.jingames.net
3	fonts.googleapis.com	ads.eu.criteo.com googleads.g.doubleclick.net
3	main.jingames.net	hairsalon.jingames.net
2	www.googleadservices.com	hairsalon.jingames.net
2	csm.eu.criteo.net	ads.eu.criteo.com
1	www.google.com	tpc.googlesyndication.com
1	rtb.nl3.eu.criteo.com	googleads.g.doubleclick.net
1	fonts.gstatic.com	fonts.googleapis.com
1	cat.nl3.eu.criteo.com	ads.eu.criteo.com
1	ads.eu.criteo.com	googleads.g.doubleclick.net
1	imgur.com	hairsalon.jingames.net
172	21

This site contains links to these domains. Also see Links.

Domain
main.jingames.net
dbcserver1710.jingames.net
hdskin.jingames.net
serverlist.jingames.net
dl.jingames.net
www.youtube.com
www.facebook.com
i.imgur.com
imgur.com

Subject Issuer	Validity	Valid
hairsalon.jingames.net R3	`2023-10-01` - `2023-12-30`	3 months	crt.sh
main.jingames.net R3	`2023-10-01` - `2023-12-30`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.imgur.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-13` - `2024-03-12`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.eu.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-01` - `2024-03-01`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-09` - `2024-01-06`	3 months	crt.sh
*.nl3.eu.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-03` - `2024-02-28`	3 months	crt.sh
*.eu.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-17` - `2024-01-18`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh

This page contains 26 frames:

Primary Page: https://hairsalon.jingames.net/
Frame ID: 0B24884BEF3E973DA40A5CE8AFA2D56A
Requests: 54 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20190131/zrt_lookup_fy2021.html?hello=world
Frame ID: DAB1AA1C6B828318F1A48F90F6A4A1E6
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3861338687785014&output=html&h=90&slotname=9914328682&adk=2757561866&adf=178305755&pi=t.ma~as.9914328682&w=728&lmt=1702117493&format=728x90&url=https%3A%2F%2Fhairsalon.jingames.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702117493355&bpp=2&bdt=487&idt=279&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&correlator=4965530886452&frm=20&pv=2&ga_vid=955479272.1702117494&ga_sid=1702117494&ga_hid=753171646&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=262&ady=601&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079922%2C31079930%2C31079980%2C42531706%2C44809003%2C95320884&oid=2&pvsid=1199840782855224&tmod=833450862&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=289
Frame ID: A16C145DCB9E50CBD642BD2B220CE19D
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3861338687785014&output=html&h=90&slotname=3867795080&adk=2782272358&adf=1612621598&pi=t.ma~as.3867795080&w=728&lmt=1702117493&format=728x90&url=https%3A%2F%2Fhairsalon.jingames.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702117493357&bpp=1&bdt=490&idt=293&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90&correlator=4965530886452&frm=20&pv=1&ga_vid=955479272.1702117494&ga_sid=1702117494&ga_hid=753171646&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=267&ady=3811&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079922%2C31079930%2C31079980%2C42531706%2C44809003%2C95320884&oid=2&pvsid=1199840782855224&tmod=833450862&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=296
Frame ID: 9EA4F43A5B638028F254B0B764E2A981
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3861338687785014&output=html&h=600&slotname=2391061885&adk=3543907923&adf=2961538820&pi=t.ma~as.2391061885&w=300&lmt=1702117493&format=300x600&url=https%3A%2F%2Fhairsalon.jingames.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702117493358&bpp=1&bdt=490&idt=296&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C728x90&correlator=4965530886452&frm=20&pv=1&ga_vid=955479272.1702117494&ga_sid=1702117494&ga_hid=753171646&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1042&ady=813&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079922%2C31079930%2C31079980%2C42531706%2C44809003%2C95320884&oid=2&pvsid=1199840782855224&tmod=833450862&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=299
Frame ID: FF14A23D840B2B30F2BFF4DCB24A1435
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3861338687785014&output=html&adk=1812271804&adf=3025194257&lmt=1702117493&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=236x1080_l%7C236x1080_r&format=0x0&url=https%3A%2F%2Fhairsalon.jingames.net%2F&ea=0&pra=7&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&aslcwct=150&asacwct=25&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702117493395&bpp=1&bdt=528&idt=264&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C728x90%2C300x600&nras=1&correlator=4965530886452&frm=20&pv=1&ga_vid=955479272.1702117494&ga_sid=1702117494&ga_hid=753171646&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079922%2C31079930%2C31079980%2C42531706%2C44809003%2C95320884&oid=2&pvsid=1199840782855224&tmod=833450862&uas=0&nvt=1&fsapi=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&dtd=277
Frame ID: A48BEEEAA013860287E77223531B5AD1
Requests: 1 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZXRAdQALWMUH4_KVAA7PFtpOMvYK58pSg-x6EQ&u=%7CAWj7BNqWcd8c7bHGwuafZ0aHYZsBGMs06YGCgpkh5uM%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_ArHr9DlvVwUA0Lh10Pk2WlfeyBMX_as4AVFYMbMe0Cm1aUAeLqHS1XVd8ignL3tIcBrRdqTYwtgX58WItR-reKl2oOcsY12g3aB7dxn-r71MOrObAuCc1tweMrMBdFzj_IJluOlLHxL5MQXgqMCnJOk6CzW0Zm8LIMECMhDlCdYV45CC22GjqcVfHGFRmLs1MaHR165jjhA6VcI9jWLkAHpIqTwWjSPPYopWkqu9DCaYbcg-RDgoHGjIL0DQm3QDqvOSwh5lUyZaeSsZ_aL2yVEGYTIfsuL2QlTgdKScWAfFP6r_bBXpOvcigTxdstj3eSdF92ccRhJg0h7mA8yYp_pxKn16UBOwL9iouswh4BC81iC5akoH9zd1yoD4tDbeXtHiW7aSyG64ecV1SYiN_li1Uh-YIR3M_SWd1YaOYAFgW_AATvtYuEultnT2colz6i0PJIb-yad83w3XlJ6_t0K4-yLniqGC9B5aFeVZr69oVav-2uVBrleiWlQ8hpA2LToZoKSA6hlE4Im6YRoOwFU9KNN0BjgarpQgLcard1uk8p1PGKchJVa5tLHzkZZ4HXeX-KW3amjF4PPdEduXfxQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCF5RcdUB0ZcWxLZXlj-8Plp67-A7JntKxXNWdkfdwwI23ARABIABglcqlgrAHggEXY2EtcHViLTM4NjEzMzg2ODc3ODUwMTTIAQmpAmItiH_3DrI-qAMByAMCqgTbAU_Qc3-fpM4R0fjz6Ycr2tJCTY-b8CrIpLkhkr_D216fVXWdFS82mV76o-MtSkyUog5ZFYrCdlzH0_F3GoHs9tI2bAy71pFIrl3muCJ2OQfllifWIjrrhlhcMIX0utZl9JTW-ZjXY7rUx4GxSnZmXo-rq3ZbTdm2j24I7hDvNkUp6cmWU-Pr1TSUWKcGmWkDA8hsl306vgQ3Sex1oLeezoPAUL49ChooHxFHvVRyTJ-9ticqB4I5vFXp1h99Igh_Z5slHxxdYw4WEyuOQsSTJ-Ribvw8g8rnB_43j4AGq-7fsO7dlNnsAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB0IgOGAcBABMgLrAjoCgEBIvf3BOljJjs_kkYKDA_oLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0Q0HaiXpNJsWitBztN-POMu1wiLg%26client%3Dca-pub-3861338687785014%26adurl%3D
Frame ID: 342CA19D8B7CF4E36D1D69F1B518652E
Requests: 24 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12967609719255064532/728x90_Warrior/scr_728x90.html
Frame ID: 8D3A98F290568279E94EF2A8C17AEBE0
Requests: 7 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/5hpSdEAdCYypbNizbkAw91vLZEBHsYzw3rH5Fshj8SY.js
Frame ID: 51546B13D3BD412F1C7EE52D8CB7428B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Frame ID: 6DD667AE8DD192B1B3880901389DDAF7
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Frame ID: 2CAFC86561CB77572234C731516E0F99
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Frame ID: 73622EC1A58AB90079D7835581F47E68
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Frame ID: E8FEC6E10FF31D4C0899025B1855129B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLbFxQEQq9bcARiQ9b7cATAB&v=APEucNUPDj3-x1Bz95xln9-Q80EMCvHTROsVcojgTyEzKoJVuXI6Va_wjAK4yvAkv50Qy1gxJ6-5ZrrNBHXBX0tK3tqjdK7OUA
Frame ID: CF15A6F1B2B3BCF1A1722CAC92280DEF
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite_fy2021.js
Frame ID: FAEBA5CC4E701B04ECFA5E450A09CEB8
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLbFxQEQq9bcARiQ9b7cATAB&v=APEucNW8DxJxTgI4NK_5II_c7gwbjrh22jW5ryuN6u6gmd4HOEEauCrWp7obLbssHR8ir95EsygowaTgEPWe1eICYxuhfASyCQ
Frame ID: FB100663D4CFEA200AD71D6AAE44F47F
Requests: 1 HTTP requests in this frame

Frame: https://s0.2mdn.net/simgad/5349205049379303910
Frame ID: 581541229E85DB050F5E33D3121E2D2A
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLbFxQEQq9bcARiP9b7cATAB&v=APEucNVIaDExAMxN6gv-oRznTLKMhegoUTCFZ9NK6ZXHMO35WrDGOKsMRZKId6OYyIjyP8nU3HvFl7xTJr0SyIhImdLBpg0xhw
Frame ID: 0CF0180D7AB269C99B0230323396A836
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite_fy2021.js
Frame ID: 76FFA4ABDD641F153107FD7F49695280
Requests: 12 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Frame ID: 43769E9496EBF128FCDAA1AAD079191D
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 5B6737AAF6862705C253CD0A9AF2F538
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 2F31C5460ED3D0A9A16563FAD8E484A6
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: DBFEAA5C3172E4118E0C75222CC82BAD
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/5hpSdEAdCYypbNizbkAw91vLZEBHsYzw3rH5Fshj8SY.js
Frame ID: 568523AD932049ED9E1DBD1A7545E642
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: F318EEC1FBBD93C9CE4E200F6A62CA43
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 23BE1F95CE856120B46D777EEC57D480
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

JinGames Hair Salon

Page URL History Show full URLs

http://hairsalon.jingames.net/ HTTP 301
https://hairsalon.jingames.net/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Lightbox (JavaScript Libraries) Expand

Zepto (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

zepto.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

172
Requests

98 %
HTTPS

0 %
IPv6

12
Domains

21
Subdomains

21
IPs

4
Countries

6536 kB
Transfer

10533 kB
Size

7
Cookies

82 Outgoing links

These are links going to different origins than the main page.

URL: http://main.jingames.net/license/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: http://dbcserver1710.jingames.net/
Title: JinGames DBC Server

Search URL Search Domain Scan URL

URL: https://main.jingames.net/hair-salon/
Title: Hair Salon

Search URL Search Domain Scan URL

URL: http://hdskin.jingames.net/
Title: HD Skin Upload Page

Search URL Search Domain Scan URL

URL: https://main.jingames.net/do-not-sell-my-personal-information/
Title: Do Not Sell My Personal Information

Search URL Search Domain Scan URL

URL: https://main.jingames.net/
Title: Home

Search URL Search Domain Scan URL

URL: https://main.jingames.net/forums/forum/jingames-forums/
Title: Forums

Search URL Search Domain Scan URL

URL: http://serverlist.jingames.net/
Title: Minecraft Server List

Search URL Search Domain Scan URL

URL: https://dl.jingames.net/
Title: Minecraft Downloads

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/jinryuus-mods-core-mod/
Title: JinRyuu’s Mod’s Core mod

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/jinryuus-mods-core-mod/mission-system/
Title: Mission System

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/dragon-block-c/
Title: Dragon Block C

Search URL Search Domain Scan URL

URL: https://main.jingames.net/how-to-play-dragon-block-c-guide/
Title: How to play Dragon Block C Guide

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/dragon-block-c/features-now/
Title: Features Now

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/dragon-block-c/recipes/
Title: Recipes

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/dragon-block-c/43-2/
Title: Screenshots

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/dragon-block-c/downloads-and-installation/
Title: Downloads and Installation

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/dragon-block-c/usage/
Title: Usage

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/naruto-c/
Title: Naruto C

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/naruto-c/recipes/
Title: Recipes

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/naruto-c/screenshots/
Title: Screenshots

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/naruto-c/downloads-and-installation/
Title: Downloads and Installation

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/naruto-c/usage/
Title: Usage

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/jinryuus-family-c/
Title: JinRyuu’s Family C

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/jinryuus-family-c/downloads-and-installation/
Title: Downloads and Installation

Search URL Search Domain Scan URL

URL: https://main.jingames.net/jinryuus-years-c/
Title: JinRyuu’s Years C

Search URL Search Domain Scan URL

URL: https://main.jingames.net/jinryuus-years-c/features-now/
Title: Features now

Search URL Search Domain Scan URL

URL: https://main.jingames.net/jinryuus-years-c/recipes/
Title: Recipes

Search URL Search Domain Scan URL

URL: https://main.jingames.net/jinryuus-years-c/downloads-and-installation/
Title: Downloads and Installation

Search URL Search Domain Scan URL

URL: https://main.jingames.net/jinryuus-years-c/usage/
Title: Usage

Search URL Search Domain Scan URL

URL: https://main.jingames.net/jinryuus-hair-c/
Title: JinRyuu’s Hair C [1.7.10-1.20]

Search URL Search Domain Scan URL

URL: https://main.jingames.net/jinryuus-hair-c/#feature
Title: Features

Search URL Search Domain Scan URL

URL: https://main.jingames.net/jinryuus-hair-c/#recipes
Title: Recipes

Search URL Search Domain Scan URL

URL: https://main.jingames.net/jinryuus-hair-c/#screen
Title: Screenshots

Search URL Search Domain Scan URL

URL: https://main.jingames.net/jinryuus-hair-c/#down
Title: Downloads and Installation

Search URL Search Domain Scan URL

URL: https://main.jingames.net/jinryuus-hair-c/#usage
Title: Usage

Search URL Search Domain Scan URL

URL: https://main.jingames.net/jinryuus-hair-c/#issues
Title: Known Issues

Search URL Search Domain Scan URL

URL: https://main.jingames.net/jinryuus-hd-skins-mod/
Title: JinRyuu’s HD Skins Mod

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/sword-art-online-c/
Title: Sword Art Online C

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/sword-art-online-c/#feature
Title: Features

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/sword-art-online-c/#screen
Title: Screenshots

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/sword-art-online-c/#down
Title: Download and Installation

Search URL Search Domain Scan URL

URL: https://main.jingames.net/minecraft-mods/sword-art-online-c/#usage
Title: Usage

Search URL Search Domain Scan URL

URL: https://main.jingames.net/texture-pack-addon/
Title: Texture Pack

Search URL Search Domain Scan URL

URL: https://main.jingames.net/bens-custom-hud-creator/
Title: Ben’s Custom HUD Creator

Search URL Search Domain Scan URL

URL: https://main.jingames.net/faq/
Title: FAQ

Search URL Search Domain Scan URL

URL: https://main.jingames.net/contact/
Title: Contact

Search URL Search Domain Scan URL

URL: https://main.jingames.net/more/
Title: MORE

Search URL Search Domain Scan URL

URL: https://main.jingames.net/about/
Title: About

Search URL Search Domain Scan URL

URL: https://main.jingames.net/dragon-ball-fan-book/
Title: Dragon Ball Fan Book

Search URL Search Domain Scan URL

URL: http://www.youtube.com/user/Ryoutenma

Search URL Search Domain Scan URL

URL: https://www.facebook.com/JinRyuusMinecraftMods/

Search URL Search Domain Scan URL

URL: http://www.facebook.com/groups/504955132870414/

Search URL Search Domain Scan URL

URL: http://i.imgur.com/gYgWKaD.png?1

Search URL Search Domain Scan URL

URL: http://i.imgur.com/v5DA1SP.png?1

Search URL Search Domain Scan URL

URL: http://i.imgur.com/Dh4n4Qc.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/btkpmDV.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/F7CnMIb.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/VZaWeJV.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/C0w4Rlw.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/DAFF1Dr.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/p8EDQ1b.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/zrjmZhG.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/Xg4YaHE.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/CJ2penH.png

Search URL Search Domain Scan URL

URL: https://i.imgur.com/5ddSaLa.pnghttps://i.imgur.com/hh3NDIP.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/Nl3oCEP.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/DHtHMWq.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/wYr2w7r.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/tv5ytF6.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/UhYUyNH.jpg

Search URL Search Domain Scan URL

URL: http://i.imgur.com/2uUfq06.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/gPnJgTg.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/nxadgkN.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/4GGx1z4.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/eJrM2Tu.png

Search URL Search Domain Scan URL

URL: http://i.imgur.com/qjqksvI.png

Search URL Search Domain Scan URL

URL: http://imgur.com/wYmmLJi][img]

Search URL Search Domain Scan URL

URL: http://i.imgur.com/wYmmLJi.png[/img][/url]

Search URL Search Domain Scan URL

URL: http://main.jingames.net/wp-login.php?redirect_to=hair-salon/
Title: Login

Search URL Search Domain Scan URL

URL: http://main.jingames.net/wp-login.php?action=register
Title: Register

Search URL Search Domain Scan URL

URL: http://main.jingames.net/contact/
Title: Tamás (JinRyuu) Nagy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://hairsalon.jingames.net/ HTTP 301
https://hairsalon.jingames.net/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 99

https://googleads.g.doubleclick.net/pagead/adview?ai=C2LPgdUB0ZaL1LYuz_tMPvtOB8AePmpXXdM2DnID6EWQQASDF-s4fYJWqs4LAB6AB98ruqSnIAQmoAwHIA0iqBN8BT9AQF-VfYWDsPRTyJH_Sj8QSeiO8B0k_AKaMaTXY2nBlRSapYJ05IYGmxXynGmINtJpKNkVJVicIatFMFdeFr1TVLwEvCTxvXbVeJM-xapx5gCtL560r0g2G9ABcqRk-vPSH9DjnnN-bs1TS7zZAXO1WskeolDYZZtqzRbXtk3UKmDFqFcJ4rwjlKCeMAOphBajARKdOr50MIvHVpvCgeiD9s61ZU_5KjdAq9TREmZi46zqG3y4cHa8RyCO2icX-xrvabv1qdEqblvtwTSPsGhsU8RAQU6VRVIyTYcmM4sAEypSluM4EiAWW3L-sTZIFBAgEGAGSBQQIBRgEoAYugAf3gr-JBKgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcEEL_yD9IIHwiA4YBwEAEYHzIC6wI6AoBASL39wTpYgtvO5JGCgwOaCShodHRwczovL3hzb2xsYS5jb20vbWFrZS1tb3JlLXRoYW4tYS1nYW1lgAoByAsBogwcKhoKGOS0sQLutbECtbixAqy6sQLktLEC7rWxAtgTAogUAdAVAZgWAYAXAbIXHAoaCAASFHB1Yi0zODYxMzM4Njg3Nzg1MDE0GAA&sigh=s62uJ_gTpoM&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTgDICaaNE-Xd-p5jTe35Sh92_KpgGL8JZu8A5kFiohEw8X1ZK_5CknJ72FWXCyjSOkjcqjh463thNczXvgJW_Of4rHnTqByK44ote3dIKRgB&template_id=419&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%221337816467744633032%22,%22debug_reporting%22:true,%22destination%22:%22https://xsolla.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211093648759%22],%224%22:[%2212-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2211681147986513644785%22}&andc=true

172 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
hairsalon.jingames.net/
Redirect Chain

http://hairsalon.jingames.net/
https://hairsalon.jingames.net/

85 KB
14 KB

956ms
828ms

Document
text/html

185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hairsalon.jingames.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx / PHP/5.6.40-68+0~20230902.80+debian10~1.gbpa2012b
Resource Hash: c14ade80fd908bfa3fbd8d1d6f93d18ef515507fad06db09aaca1dc400695d2d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 13269
content-type: text/html; charset=UTF-8
date: Sat, 09 Dec 2023 10:24:52 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
front-end-https: on
pragma: public
server: nginx
vary: Accept-Encoding
x-powered-by: PHP/5.6.40-68+0~20230902.80+debian10~1.gbpa2012b

Redirect headers

Connection: keep-alive
Content-Length: 162
Content-Type: text/html
Date: Sat, 09 Dec 2023 10:24:51 GMT
Location: https://hairsalon.jingames.net/
Server: nginx

GET
H2 200 main.css
hairsalon.jingames.net/css/ 22 KB
6 KB 176ms
162ms Stylesheet
text/css 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hairsalon.jingames.net/css/main.css
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: 1644a837db5cf4f3b0224c2518dc0d29fdbc830ef844a0cbcd3c4f0fcea22c91

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:52 GMT
content-encoding: gzip
last-modified: Thu, 01 Dec 2016 18:23:22 GMT
server: nginx
etag: "58c8-5429cea9c5a80-gzip"
vary: Accept-Encoding
front-end-https: on
content-type: text/css
accept-ranges: bytes
content-length: 6328

GET
H2 200 jquery-1.11.0.min.js Show response
hairsalon.jingames.net/js/ 94 KB
33 KB 87ms
74ms Script
application/javascript 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hairsalon.jingames.net/js/jquery-1.11.0.min.js
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:52 GMT
content-encoding: gzip
last-modified: Thu, 01 Dec 2016 18:23:22 GMT
server: nginx
etag: "1787d-5429cea9c5a80-gzip"
vary: Accept-Encoding
front-end-https: on
content-type: application/javascript
accept-ranges: bytes
content-length: 33369

GET
H2 200 main.js Show response
hairsalon.jingames.net/js/ 1 KB
760 B 83ms
70ms Script
application/javascript 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hairsalon.jingames.net/js/main.js
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: 505022d86f149fc0ca5e56db8f7def31acbd780372ae4e72b05aeaa67e751094

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:52 GMT
content-encoding: gzip
last-modified: Thu, 01 Dec 2016 18:23:22 GMT
server: nginx
etag: "43f-5429cea9c5a80-gzip"
vary: Accept-Encoding
front-end-https: on
content-type: application/javascript
accept-ranges: bytes
content-length: 562

GET
H2 200 lmcbutton.js Show response
hairsalon.jingames.net/js/ 1 KB
834 B 175ms
162ms Script
application/javascript 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hairsalon.jingames.net/js/lmcbutton.js
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: ef5bbf104b13a29fd500a221f3a81babce750e791dd462fde66d9f90865ad8f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:52 GMT
content-encoding: gzip
last-modified: Thu, 01 Dec 2016 18:23:22 GMT
server: nginx
etag: "5a8-5429cea9c5a80-gzip"
vary: Accept-Encoding
front-end-https: on
content-type: application/javascript
accept-ranges: bytes
content-length: 637

GET
H2 200 javascript-gebc-1.0.1.js Show response
hairsalon.jingames.net/js/ 2 KB
1005 B 176ms
162ms Script
application/javascript 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hairsalon.jingames.net/js/javascript-gebc-1.0.1.js
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: 6d9ed1d11bf10386253e7b950a51fcb1ea0cb8b4079e7147c7917132df636ac3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:52 GMT
content-encoding: gzip
last-modified: Thu, 01 Dec 2016 18:23:22 GMT
server: nginx
etag: "968-5429cea9c5a80-gzip"
vary: Accept-Encoding
front-end-https: on
content-type: application/javascript
accept-ranges: bytes
content-length: 807

GET
H2 200 lightbox.css
hairsalon.jingames.net/css/ 4 KB
1 KB 175ms
162ms Stylesheet
text/css 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hairsalon.jingames.net/css/lightbox.css
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: b6516367a4082d9ff4d26b2e592acb604cbc4006c682bfdaa249ee1d3591c480

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:52 GMT
content-encoding: gzip
last-modified: Thu, 01 Dec 2016 18:23:22 GMT
server: nginx
etag: "f3a-5429cea9c5a80-gzip"
vary: Accept-Encoding
front-end-https: on
content-type: text/css
accept-ranges: bytes
content-length: 1007

GET
H2 200 cropped-header1.png
hairsalon.jingames.net/css/ 285 KB
285 KB 174ms
161ms Image
image/png 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hairsalon.jingames.net/css/cropped-header1.png
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: 859fbca443befc30e88c800971f32a91d0928d9a708fb9cb01e28447320e2345

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:52 GMT
last-modified: Mon, 28 Nov 2016 18:27:48 GMT
server: nginx
etag: "47239-54260a0f11100"
front-end-https: on
content-type: image/png
accept-ranges: bytes
content-length: 291385

GET
H2 200 YouTube.png
main.jingames.net/wp-content/themes/mantra/images/socials/ 3 KB
3 KB 325ms
64ms Image
image/png 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://main.jingames.net/wp-content/themes/mantra/images/socials/YouTube.png
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: 4066df2bffec203ba6a727276b94b7997c435b47f17eb30d6938a1e1f1aa58bb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
last-modified: Mon, 28 Nov 2016 19:04:27 GMT
server: nginx
etag: "c48-54261240324c0"
front-end-https: on
content-type: image/png
accept-ranges: bytes
content-length: 3144

GET
H2 200 Facebook.png
main.jingames.net/wp-content/themes/mantra/images/socials/ 2 KB
2 KB 123ms
62ms Image
image/png 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://main.jingames.net/wp-content/themes/mantra/images/socials/Facebook.png
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: 29cda2ed62ac6a68ee82b7a52fca3b306b467fe15093f3ca755842a186a86257

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
last-modified: Mon, 28 Nov 2016 19:04:27 GMT
server: nginx
etag: "87e-54261240324c0"
front-end-https: on
content-type: image/png
accept-ranges: bytes
content-length: 2174

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 148 KB
51 KB 195ms
122ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

e308aef7270562fbba067db0695f5744ac0834621b18d8c1d6796ffd46b1f7bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51855
x-xss-protection: 0
server: cafe
etag: 12162990818315541123
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 09 Dec 2023 10:24:53 GMT

GET
H2 200 gYgWKaD.png
i.imgur.com/ 19 KB
19 KB 117ms
34ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/gYgWKaD.png?1

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

3b4854276d704345a017d873d14e45dceab9ad1aa7cd09f3b5015ec16a249cc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: MIA3-P5
age: 3345908
x-cache: Miss from cloudfront, HIT, HIT
content-length: 19646
x-served-by: cache-iad-kjyo7100109-IAD, cache-fra-etou8220040-FRA
last-modified: Thu, 16 Jun 2016 19:10:51 GMT
server: cat factory 1.0
x-timer: S1702117493.170014,VS0,VE1
etag: "46f725261d98437026c1924da8736da6"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: qi-gWRo_RCJj72-coGGtOawYeg6xEIEuUa-ANuBQeqkeiFWZ10i-IA==
x-cache-hits: 335, 1

GET
H2 200 v5DA1SP.png
i.imgur.com/ 12 KB
12 KB 112ms
29ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/v5DA1SP.png?1

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

dd3426e528a9a8b6a8edc8a7f3836ef6b445f488dd807fb4daf1f3549d802ae9

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD89-P1
age: 3975362
x-cache: Miss from cloudfront, HIT, HIT
content-length: 12150
x-served-by: cache-iad-kjyo7100168-IAD, cache-fra-etou8220040-FRA
last-modified: Thu, 16 Jun 2016 19:13:13 GMT
server: cat factory 1.0
x-timer: S1702117493.170045,VS0,VE1
etag: "de8763470879fe251fad2334292c4a48"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: Qrs8JTkARmY1GyzbRQryTziZ8ufYrieWfp3p3g3XEf54b_HyRPAIRA==
x-cache-hits: 135, 1

GET
H2 200 Dh4n4Qc.png
i.imgur.com/ 236 KB
236 KB 205ms
122ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/Dh4n4Qc.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

83b348246d8b17459fbb72c53547b83a27bb25a95b1398f7af301eb15b3dd8b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: MIA3-P1
age: 3361927
x-cache: Miss from cloudfront, HIT, HIT
x-amz-storage-class: STANDARD_IA
content-length: 241364
x-served-by: cache-iad-kjyo7100101-IAD, cache-fra-etou8220040-FRA
last-modified: Fri, 30 Sep 2016 03:09:57 GMT
server: cat factory 1.0
x-timer: S1702117493.170089,VS0,VE2
etag: "657eadb02ac175931cf09238447ca396"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: hnL_Pms1ZgVkdn6hqATct7vAInAlQC37pFqs4zak9WurQcOsjRH2Ww==
x-cache-hits: 314, 1

GET
H2 200 btkpmDV.png
i.imgur.com/ 316 KB
316 KB 206ms
122ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/btkpmDV.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

4fb39048b8810113fcf3acfe101ba586a97ae9481fc02804712e2f4cf96706f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: MIA3-C4
age: 2677400
x-cache: Miss from cloudfront, HIT, HIT
x-amz-storage-class: STANDARD_IA
content-length: 323362
x-served-by: cache-iad-kjyo7100175-IAD, cache-fra-etou8220040-FRA
last-modified: Thu, 23 Jun 2016 17:21:14 GMT
server: cat factory 1.0
x-timer: S1702117493.169990,VS0,VE12
etag: "d3b533f647c27debb5f6920dca8b2fe4"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: HjM6iZ76ySgQAYiDsuXQIcQ2nb7Q3XsWfPlKwq2bzNlFCw2cRdNscg==
x-cache-hits: 336, 1

GET
H2 200 F7CnMIb.png
i.imgur.com/ 30 KB
30 KB 117ms
33ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/F7CnMIb.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

1efbd89776d2711d93abdcbe92ba4680258af85c690358896a3d1a31c0a03f4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: PHL50-C1
age: 5002123
x-cache: Miss from cloudfront, HIT, HIT
content-length: 30905
x-served-by: cache-iad-kcgs7200147-IAD, cache-fra-etou8220040-FRA
last-modified: Sun, 30 Oct 2016 18:15:57 GMT
server: cat factory 1.0
x-timer: S1702117493.169932,VS0,VE1
etag: "e1da1e6875267e5b2a2e8a1b4dcae2a3"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: w0w10XWkFmxClLEnQFOOkxqL2IsUuaV1MnPnxNXlXpVWcCTS69b6-g==
x-cache-hits: 104, 1

GET
H2 200 VZaWeJV.png
i.imgur.com/ 222 KB
223 KB 145ms
62ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/VZaWeJV.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

452acd09eda3c896c51d1e583b8a1486ebafd773e55a8985ca23cc918be2f6c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: MIA3-P5
age: 2819782
x-cache: Miss from cloudfront, HIT, HIT
x-amz-storage-class: STANDARD_IA
content-length: 227597
x-served-by: cache-iad-kjyo7100027-IAD, cache-fra-etou8220040-FRA
last-modified: Wed, 20 Jul 2016 00:48:50 GMT
server: cat factory 1.0
x-timer: S1702117493.169874,VS0,VE2
etag: "f7099ff33d01987d34330dec5514ce0c"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: Rmp-oE8KksDQEa2zZyBkk9iX9QAIWFWnJvrX14v4P7pf0CjAgtNySg==
x-cache-hits: 16, 1

GET
H2 200 C0w4Rlw.png
i.imgur.com/ 20 KB
20 KB 106ms
103ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/C0w4Rlw.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

60dc0148688852de8c26cba837c86045099c4f40cb5f763da74d9a62b2b62eff

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD12-P2
age: 2662819
x-cache: Miss from cloudfront, HIT, HIT
content-length: 20463
x-served-by: cache-iad-kcgs7200175-IAD, cache-fra-etou8220040-FRA
last-modified: Wed, 20 Apr 2016 20:58:02 GMT
server: cat factory 1.0
x-timer: S1702117493.207134,VS0,VE2
etag: "ae24e75ec0e7fff3328c60917efd0d13"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: NV5r0T2H4GmMGPhjsBkpN2Ek3OIsxt-ErGmUSgGIOYat0EAj4t8CfQ==
x-cache-hits: 139, 1

GET
H2 200 DAFF1Dr.png
i.imgur.com/ 24 KB
24 KB 107ms
104ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/DAFF1Dr.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

93bb199d3abd68c438e4e11b1169223fbb7a123329a7d46a5a1a34617441acb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD55-P2
age: 900544
x-cache: Miss from cloudfront, HIT, HIT
content-length: 24220
x-served-by: cache-iad-kiad7000128-IAD, cache-fra-etou8220040-FRA
last-modified: Sat, 10 Jun 2017 15:26:05 GMT
server: cat factory 1.0
x-timer: S1702117493.208066,VS0,VE2
etag: "1a3984a83cf866e7f11499ef0ca721d3"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: cJxScv9ODfjBRjb2A3lc3Ehv83J-Ihkzt9a0OI13VbGrpj4tkFdjXA==
x-cache-hits: 1, 1

GET
H2 200 p8EDQ1b.png
i.imgur.com/ 18 KB
18 KB 106ms
103ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/p8EDQ1b.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

6a87fdfa3fe7951f4d71c11f58f5ccee7bf291e8d8f227306cfda9e9d970ec61

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD89-P1
age: 2682889
x-cache: Miss from cloudfront, HIT, HIT
content-length: 18206
x-served-by: cache-iad-kiad7000051-IAD, cache-fra-etou8220040-FRA
last-modified: Tue, 13 Dec 2016 20:53:43 GMT
server: cat factory 1.0
x-timer: S1702117493.208001,VS0,VE1
etag: "715165daeb0f70e5f8ceeaf254ce9bcf"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 35VW6q_q2PZZn9l0TajjsySANMEhDynv1ObBiScvAs6QAeDQINN0yQ==
x-cache-hits: 291, 1

GET
H2 200 zrjmZhG.png
i.imgur.com/ 59 KB
59 KB 106ms
103ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/zrjmZhG.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

6647fea76ad0ed167fd4fc0b54086de7e609c148f3a8a26be643601bd7ea31ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD55-P2
age: 785655
x-cache: Miss from cloudfront, HIT, HIT
content-length: 60083
x-served-by: cache-iad-kiad7000092-IAD, cache-fra-etou8220040-FRA
last-modified: Fri, 12 May 2017 16:07:56 GMT
server: cat factory 1.0
x-timer: S1702117493.207815,VS0,VE2
etag: "54dec885f27371f520cafb1ea44f7981"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 2q-VZG6epFLTo3bDLZ9RVpgwXzWcN12BbVAuVtZwvz9my5LGb7DJyw==
x-cache-hits: 13, 1

GET
H2 200 Xg4YaHE.png
i.imgur.com/ 16 KB
16 KB 108ms
105ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/Xg4YaHE.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

aed37d23a522a77ad4e3568eafcc17e69f780286608f3b70c2e16b193cd26ccc

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD12-P2
age: 3374671
x-cache: Miss from cloudfront, HIT, HIT
content-length: 16536
x-served-by: cache-iad-kiad7000089-IAD, cache-fra-etou8220040-FRA
last-modified: Tue, 28 Feb 2017 15:28:33 GMT
server: cat factory 1.0
x-timer: S1702117493.207799,VS0,VE4
etag: "5f9687c0c090f7b002462294d2957871"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: WIEnvi9RF65rjPzwlCLiH_Z3GEFhrc0VmPNDg7ref0zjskM1BUcvhg==
x-cache-hits: 145, 1

GET
H2 200 noImage.png
hairsalon.jingames.net/images/ 3 KB
3 KB 130ms
98ms Image
image/png 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hairsalon.jingames.net/images/noImage.png
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: 951af233b9948bf5f4b5a6baea6256641df11a61aacaa0e179bbcd45dbd98d9a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
last-modified: Mon, 28 Nov 2016 18:27:45 GMT
server: nginx
etag: "b16-54260a0c34a40"
front-end-https: on
content-type: image/png
accept-ranges: bytes
content-length: 2838

GET
H2 200 CJ2penH.png
i.imgur.com/ 22 KB
22 KB 106ms
103ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/CJ2penH.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

83dbaa0bc2d7e537bb62d602123d3d667b37448d448b59045d504d93ee9553c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: ORD56-P4
age: 3287812
x-cache: Miss from cloudfront, HIT, HIT
content-length: 22136
x-served-by: cache-iad-kjyo7100029-IAD, cache-fra-etou8220040-FRA
last-modified: Tue, 28 Feb 2017 15:14:59 GMT
server: cat factory 1.0
x-timer: S1702117493.207786,VS0,VE2
etag: "76482ab7386e74f59bc213856a6c16e6"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 62duCQUohcknSa9iCKkxe-ZAIttF5N0ygoHG1GFHv6FMu9Odx5_mLA==
x-cache-hits: 229, 1

GET
H2 200 hh3NDIP.png
i.imgur.com/5ddSaLa.pnghttps://i.imgur.com/ 24 KB
25 KB 108ms
105ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/5ddSaLa.pnghttps://i.imgur.com/hh3NDIP.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

0bcc9959e25dea025ee9a70a550c2a127fc3ff29d9b71c3ab81602f5ada5a9c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD12-P2
age: 3817384
x-cache: Miss from cloudfront, HIT, HIT
content-length: 24748
x-served-by: cache-iad-kiad7000136-IAD, cache-fra-etou8220040-FRA
last-modified: Tue, 24 Oct 2017 20:29:57 GMT
server: cat factory 1.0
x-timer: S1702117493.209078,VS0,VE2
etag: "d8cceaa4f0e7d4974e6ec3bafed2049d"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 74zVB7NADk5RnPdXwYxQl-QQvfYQ3MSIig2ZB_HX2COGbda4TK3HTA==
x-cache-hits: 294, 1

GET
H2 200 Nl3oCEP.png
i.imgur.com/ 10 KB
11 KB 107ms
104ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/Nl3oCEP.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

2fda446210f480afd2c2dfb33be25b8943de1e00b741e07bfc1c22369ad2beb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD89-P1
age: 4494366
x-cache: Miss from cloudfront, HIT, HIT
content-length: 10558
x-served-by: cache-iad-kiad7000086-IAD, cache-fra-etou8220040-FRA
last-modified: Fri, 09 Dec 2016 01:22:02 GMT
server: cat factory 1.0
x-timer: S1702117493.209415,VS0,VE1
etag: "6a6e7b26833fd4a44450d24d107f6f8f"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: gzE_Hubyuthy0sp4Vh0Bahhjf3MnVf4d_lfopqi5DYlEajJGX9TOMA==
x-cache-hits: 51, 1

GET
H2 200 DHtHMWq.png
i.imgur.com/ 10 KB
10 KB 107ms
105ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/DHtHMWq.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

88d3342019cb40e7abd7e305bf58270653db34eaca0cd8f631dfbfdbd5772302

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: PHL50-C1
age: 5064502
x-cache: Miss from cloudfront, HIT, HIT
content-length: 10369
x-served-by: cache-iad-kcgs7200083-IAD, cache-fra-etou8220040-FRA
last-modified: Fri, 09 Dec 2016 01:19:38 GMT
server: cat factory 1.0
x-timer: S1702117493.209065,VS0,VE2
etag: "910d8291a48467861c0ce93c11ec3277"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 0hSEalSaVs7jBQXVkmacR3RfDnceN0Dj_6zQeRwpv6ZIypCiZuB8ww==
x-cache-hits: 104, 1

GET
H2 200 wYr2w7r.png
i.imgur.com/ 11 KB
12 KB 106ms
103ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/wYr2w7r.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

5c9bca654e3b4508bbfb85cf1b871ad4ecb67554664c4203a927e1df12bb8296

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD12-P2
age: 2763463
x-cache: Miss from cloudfront, HIT, HIT
content-length: 11652
x-served-by: cache-iad-kiad7000055-IAD, cache-fra-etou8220040-FRA
last-modified: Fri, 09 Dec 2016 01:17:32 GMT
server: cat factory 1.0
x-timer: S1702117493.209100,VS0,VE1
etag: "7c0fadf88a05e2190cb4ca36e5281c51"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: -qe2o5aEZO2TWgZVDZSh0DUnGX8-kDx9voOAzmmOQdnqBlL8Uc_dlw==
x-cache-hits: 120, 1

GET
H2 200 tv5ytF6.png
i.imgur.com/ 10 KB
10 KB 107ms
105ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/tv5ytF6.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

89fdc3682ba7b435d92947f318c9a8a1c4544ee02922f6012fe2e450799f59f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD12-P2
age: 7494061
x-cache: Miss from cloudfront, HIT, HIT
content-length: 9923
x-served-by: cache-iad-kiad7000111-IAD, cache-fra-etou8220040-FRA
last-modified: Fri, 09 Dec 2016 01:12:40 GMT
server: cat factory 1.0
x-timer: S1702117493.208772,VS0,VE2
etag: "6c05d68e4068b5bdd8db4798f71b2a11"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: h-olzL5eI3mC692KVN2NaIJc2AHxeE4cnTdXblGjvOy-5mH5QGa46w==
x-cache-hits: 400, 1

GET
H2 200 UhYUyNH.jpg
i.imgur.com/ 271 KB
271 KB 108ms
105ms Image
image/jpeg 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/UhYUyNH.jpg

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

d1a9fd0bd6b1014d1ad42f71f7e1d0cb7823df0fc0337e21ad05567523309852

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD55-P2
age: 3886170
x-cache: Miss from cloudfront, HIT, HIT
x-amz-storage-class: STANDARD_IA
content-length: 277377
x-served-by: cache-iad-kjyo7100100-IAD, cache-fra-etou8220040-FRA
last-modified: Thu, 05 May 2016 13:25:30 GMT
server: cat factory 1.0
x-timer: S1702117493.208814,VS0,VE3
etag: "c63c9edfa09f157fb9ab8adbf98da04d"
access-control-allow-methods: GET, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: BIy7Jxzh_Je24zQUbFIecs9J0O0GW6K-S1dKQylJ8hmWW4i23btBcw==
x-cache-hits: 199, 1

GET
H2 200 2uUfq06.png
i.imgur.com/ 7 KB
7 KB 106ms
104ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/2uUfq06.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

0ae8d2ebd4d24ebebb1d850ddbc48c3394b7fb79ac01ab6dc227e6489aeaa862

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD55-P2
age: 2135088
x-cache: Miss from cloudfront, HIT, HIT
content-length: 7191
x-served-by: cache-iad-kjyo7100086-IAD, cache-fra-etou8220040-FRA
last-modified: Fri, 09 Dec 2016 01:24:45 GMT
server: cat factory 1.0
x-timer: S1702117493.208736,VS0,VE1
etag: "9579e9b9b7335b30380384a36aa8c9df"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: fpbltQhbw0krvb8_1YnvZXTbBfTLAo7bQsoO2D0BCojwQ8hxIQzrfg==
x-cache-hits: 91, 1

GET
H2 200 gPnJgTg.png
i.imgur.com/ 7 KB
7 KB 107ms
104ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/gPnJgTg.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

4e1d7d234c7a5927859f10908ad09106aef746b68e34370ca4fc695e64f89957

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD89-P1
age: 752070
x-cache: Miss from cloudfront, HIT, HIT
content-length: 6739
x-served-by: cache-iad-kjyo7100096-IAD, cache-fra-etou8220040-FRA
last-modified: Fri, 09 Dec 2016 01:26:24 GMT
server: cat factory 1.0
x-timer: S1702117493.208742,VS0,VE2
etag: "2f050516e9b7142133ebf4b4edca9aa8"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: lQW2FCRnBAQ-rLrJ9mQG01Yk_pPPOqHKi6eWtVZJnxFLlP7ZC3XoWQ==
x-cache-hits: 115, 1

GET
H2 200 nxadgkN.png
i.imgur.com/ 8 KB
8 KB 106ms
104ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/nxadgkN.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

ba1a686b053caeabf630e5eb0f5585b0559c2c1014a37624b51045763fd5c78c

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD12-P2
age: 2045115
x-cache: Miss from cloudfront, HIT, HIT
content-length: 8447
x-served-by: cache-iad-kjyo7100150-IAD, cache-fra-etou8220040-FRA
last-modified: Fri, 09 Dec 2016 01:29:13 GMT
server: cat factory 1.0
x-timer: S1702117493.208721,VS0,VE2
etag: "c5a084db8a09f11b96548be43a0865da"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: X4nm4gLkw8-gHC9lWceisv8935X4ioZk-qLmRfEg7YqTAlJQmq030A==
x-cache-hits: 208, 1

GET
H2 200 4GGx1z4.png
i.imgur.com/ 5 KB
6 KB 150ms
148ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/4GGx1z4.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

988688356dc54a7ac123416df30c77f104bf518103d18df67129da00b9de121c

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: JFK50-P6
age: 692315
x-cache: Miss from cloudfront, HIT, HIT
content-length: 5596
x-served-by: cache-iad-kjyo7100144-IAD, cache-fra-etou8220040-FRA
last-modified: Fri, 09 Dec 2016 01:30:28 GMT
server: cat factory 1.0
x-timer: S1702117493.225401,VS0,VE1
etag: "fec282770af80b5d92e184a36da363f8"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: pcBV_QYxXbDmAjsMvCM6mFAIh3NQcQ94ZS8opI0FUPTh74_FknOzTQ==
x-cache-hits: 16, 1

GET
H2 200 eJrM2Tu.png
i.imgur.com/ 845 KB
846 KB 151ms
149ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/eJrM2Tu.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

9404536a8f4d78d41cdbb47bc7bdc5402e81653b6afe022f621aed516a4b7c26

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD55-P2
age: 3886606
x-cache: Miss from cloudfront, HIT, HIT
x-amz-storage-class: STANDARD_IA
content-length: 865788
x-served-by: cache-iad-kjyo7100092-IAD, cache-fra-etou8220040-FRA
last-modified: Wed, 25 Nov 2015 20:48:06 GMT
server: cat factory 1.0
x-timer: S1702117493.224977,VS0,VE3
etag: "7c3f6f594b0c0b2b641cd187b9e00ea2"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: x-IlMHj3DdmlAxQI__NIV6i3cnd3hI4vomr4dFJJfxadS5vBedfrhQ==
x-cache-hits: 38, 1

GET
H2 200 qjqksvI.png
i.imgur.com/ 124 KB
124 KB 150ms
148ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/qjqksvI.png

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

3bb28b38c9b760b981cc53e24f1d45c3b34a8d8e00c7872741d8cebdab943566

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: PHL50-C1
age: 2682889
x-cache: Miss from cloudfront, HIT, HIT
content-length: 126826
x-served-by: cache-iad-kcgs7200119-IAD, cache-fra-etou8220040-FRA
last-modified: Wed, 19 Aug 2015 07:40:14 GMT
server: cat factory 1.0
x-timer: S1702117493.224969,VS0,VE2
etag: "d7840e15abcb2faaee4893e3fb7143bd"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: N-ukfsY8p2hxhCbYzwMSf0weBKvnCn5EZiHn-gvBHJUW_nlpcIGDvA==
x-cache-hits: 22, 1

GET
H2 404 wYmmLJi][img]
imgur.com/ 0
0 212ms
125ms Image
text/html 199.232.196.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imgur.com/wYmmLJi][img]
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.196.193 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H2 200 url]
i.imgur.com/wYmmLJi.png[/img][/ 10 KB
11 KB 150ms
148ms Image
image/png 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/wYmmLJi.png[/img][/url]

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

d3a17df2fd4d04f89533a05d640b202a026f37f06654904f9b746024c948c813

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD89-P1
age: 3361927
x-cache: Miss from cloudfront, HIT, HIT
content-length: 10499
x-served-by: cache-iad-kjyo7100101-IAD, cache-fra-etou8220040-FRA
last-modified: Tue, 10 Jul 2018 18:34:13 GMT
server: cat factory 1.0
x-timer: S1702117493.224938,VS0,VE2
etag: "f8a8ff3b690eddb347795244e3e1a81f"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: fj7i4BWmmN244Rub_STGRZLXvYUg1rOyjq6G4bor1M3OhIUwWHqvzA==
x-cache-hits: 31, 1

GET
H2 200 lightbox-plus-jquery.min.js Show response
hairsalon.jingames.net/js/ 91 KB
32 KB 132ms
98ms Script
application/javascript 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hairsalon.jingames.net/js/lightbox-plus-jquery.min.js
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: 05bb3e7b6befc00816b63a3c50555832495513e28a0f9c5e605fbb79e0d8d495

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
content-encoding: gzip
last-modified: Thu, 01 Dec 2016 18:23:22 GMT
server: nginx
etag: "16b95-5429cea9c5a80-gzip"
vary: Accept-Encoding
front-end-https: on
content-type: application/javascript
accept-ranges: bytes
content-length: 32308

GET login-box-script.js
main.jingames.net/wp-content/plugins/login-box/ 0
0

GET scripts.js
main.jingames.net/wp-content/plugins/login-box/wpclassic/ 0
0

GET style.css
main.jingames.net/wp-content/plugins/login-box/wpclassic/ 0
0

GET
H2 200 bg.png
hairsalon.jingames.net/css/ 2 MB
2 MB 86ms
58ms Image
image/png 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hairsalon.jingames.net/css/bg.png
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: fe0c7255c105a9be331b462dc5a759e1d38850e51884100331506b1308d62977

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
last-modified: Sun, 09 Jan 2022 19:10:14 GMT
server: nginx
etag: "1c27e0-5d52af84b3377"
front-end-https: on
content-type: image/png
accept-ranges: bytes
content-length: 1845216

GET
H2 200 cropped-header1.png
main.jingames.net/wp-content/uploads/2015/01/ 285 KB
285 KB 132ms
128ms Image
image/png 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://main.jingames.net/wp-content/uploads/2015/01/cropped-header1.png
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: 859fbca443befc30e88c800971f32a91d0928d9a708fb9cb01e28447320e2345

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
last-modified: Mon, 28 Nov 2016 18:53:24 GMT
server: nginx
etag: "47239-54260fc7e9100"
front-end-https: on
content-type: image/png
accept-ranges: bytes
content-length: 291385

GET
H2 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312050101/ 398 KB
135 KB 96ms
95ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312050101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-3861338687785014&plah=hairsalon.jingames.net

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

73e415f6a1a6f888f5b9f1c304635503f558ade72057d1a796edade47f739956

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137720
x-xss-protection: 0
server: cafe
etag: 11058585679767666788
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 09 Dec 2023 10:24:53 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231206/r20190131/ Frame DAB1 9 KB
4 KB 76ms
24ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231206/r20190131/zrt_lookup_fy2021.html?hello=world

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hairsalon.jingames.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 49782
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 20:35:11 GMT
etag: 5585625838579639069
expires: Fri, 22 Dec 2023 20:35:11 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 prev.png
hairsalon.jingames.net/images/ 1 KB
1 KB 124ms
124ms Image
image/png 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hairsalon.jingames.net/images/prev.png
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/css/lightbox.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: 7fd9273f20fdb1229c224341271a119020a5eee74ccf6b4605730917c864caf2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/css/lightbox.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
last-modified: Mon, 28 Nov 2016 18:27:45 GMT
server: nginx
etag: "550-54260a0c34a40"
front-end-https: on
content-type: image/png
accept-ranges: bytes
content-length: 1360

GET
H2 200 next.png
hairsalon.jingames.net/images/ 1 KB
1 KB 123ms
123ms Image
image/png 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hairsalon.jingames.net/images/next.png
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/css/lightbox.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: 15b869b02c6fbaa8c6c26445a2dd2d9bad80fd27b1409f8179e5dd89dc89d90a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/css/lightbox.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
last-modified: Mon, 28 Nov 2016 18:27:45 GMT
server: nginx
etag: "546-54260a0c34a40"
front-end-https: on
content-type: image/png
accept-ranges: bytes
content-length: 1350

GET
H2 200 loading.gif
hairsalon.jingames.net/images/ 8 KB
8 KB 123ms
122ms Image
image/gif 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hairsalon.jingames.net/images/loading.gif
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/css/lightbox.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: 225aa88b6ab02c06222ec9468d62e15fa188e39cdb9431d1f55401ad380753ed

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/css/lightbox.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
last-modified: Mon, 28 Nov 2016 18:27:45 GMT
server: nginx
etag: "211c-54260a0c34a40"
front-end-https: on
content-type: image/gif
accept-ranges: bytes
content-length: 8476

GET
H2 200 close.png
hairsalon.jingames.net/images/ 280 B
430 B 125ms
125ms Image
image/png 185.80.49.249
RACKFOREST-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hairsalon.jingames.net/images/close.png
Requested by: Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/css/lightbox.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.49.249 Lovasbereny, Hungary, ASN62214 (RACKFOREST-AS, HU),
Reverse DNS: gw1.c-host.hu
Software: nginx /
Resource Hash: 5d62e6c90005bfb71f6abb440f9e4753681cb23bbd5e60477ab6f442d2f0e69c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/css/lightbox.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
last-modified: Mon, 28 Nov 2016 18:27:45 GMT
server: nginx
etag: "118-54260a0c34a40"
front-end-https: on
content-type: image/png
accept-ranges: bytes
content-length: 280

GET
DATA 200
OK truncated
/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A16C 719 B
554 B 405ms
404ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3861338687785014&output=html&h=90&slotname=9914328682&adk=2757561866&adf=178305755&pi=t.ma~as.9914328682&w=728&lmt=1702117493&format=728x90&url=https%3A%2F%2Fhairsalon.jingames.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702117493355&bpp=2&bdt=487&idt=279&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&correlator=4965530886452&frm=20&pv=2&ga_vid=955479272.1702117494&ga_sid=1702117494&ga_hid=753171646&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=262&ady=601&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079922%2C31079930%2C31079980%2C42531706%2C44809003%2C95320884&oid=2&pvsid=1199840782855224&tmod=833450862&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=289

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312050101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-3861338687785014&plah=hairsalon.jingames.net

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

fc1df364182447bd46fcabde5331fc0a9ad256fc26e54a56274423fa2fffda5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hairsalon.jingames.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 354
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 10:24:54 GMT
expires: Sat, 09 Dec 2023 10:24:54 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9EA4 128 KB
41 KB 494ms
493ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3861338687785014&output=html&h=90&slotname=3867795080&adk=2782272358&adf=1612621598&pi=t.ma~as.3867795080&w=728&lmt=1702117493&format=728x90&url=https%3A%2F%2Fhairsalon.jingames.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702117493357&bpp=1&bdt=490&idt=293&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90&correlator=4965530886452&frm=20&pv=1&ga_vid=955479272.1702117494&ga_sid=1702117494&ga_hid=753171646&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=267&ady=3811&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079922%2C31079930%2C31079980%2C42531706%2C44809003%2C95320884&oid=2&pvsid=1199840782855224&tmod=833450862&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=296

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

1e4aae7472b7c50811747781b8943c51cc23d75f550c37f3d26de8c29b5fed8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hairsalon.jingames.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 41656
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 10:24:54 GMT
expires: Sat, 09 Dec 2023 10:24:54 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame FF14 36 KB
15 KB 418ms
417ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3861338687785014&output=html&h=600&slotname=2391061885&adk=3543907923&adf=2961538820&pi=t.ma~as.2391061885&w=300&lmt=1702117493&format=300x600&url=https%3A%2F%2Fhairsalon.jingames.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702117493358&bpp=1&bdt=490&idt=296&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C728x90&correlator=4965530886452&frm=20&pv=1&ga_vid=955479272.1702117494&ga_sid=1702117494&ga_hid=753171646&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1042&ady=813&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079922%2C31079930%2C31079980%2C42531706%2C44809003%2C95320884&oid=2&pvsid=1199840782855224&tmod=833450862&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=299

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

ca536442d5dad77c7bb6b667002549970998676544998c49f3c2c32b6528f7b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hairsalon.jingames.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 14701
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 10:24:54 GMT
expires: Sat, 09 Dec 2023 10:24:54 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A48B 557 KB
124 KB 814ms
814ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3861338687785014&output=html&adk=1812271804&adf=3025194257&lmt=1702117493&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=236x1080_l%7C236x1080_r&format=0x0&url=https%3A%2F%2Fhairsalon.jingames.net%2F&ea=0&pra=7&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&aslcwct=150&asacwct=25&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702117493395&bpp=1&bdt=528&idt=264&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C728x90%2C300x600&nras=1&correlator=4965530886452&frm=20&pv=1&ga_vid=955479272.1702117494&ga_sid=1702117494&ga_hid=753171646&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079922%2C31079930%2C31079980%2C42531706%2C44809003%2C95320884&oid=2&pvsid=1199840782855224&tmod=833450862&uas=0&nvt=1&fsapi=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&dtd=277

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

2237852527a89a4ec8a6e080d02b93c160abc69a7dd6d66101e14562e81cf2ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hairsalon.jingames.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 127081
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 10:24:54 GMT
expires: Sat, 09 Dec 2023 10:24:54 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame FF14 3 KB
1 KB 78ms
26ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3861338687785014&output=html&h=600&slotname=2391061885&adk=3543907923&adf=2961538820&pi=t.ma~as.2391061885&w=300&lmt=1702117493&format=300x600&url=https%3A%2F%2Fhairsalon.jingames.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702117493358&bpp=1&bdt=490&idt=296&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C728x90&correlator=4965530886452&frm=20&pv=1&ga_vid=955479272.1702117494&ga_sid=1702117494&ga_hid=753171646&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1042&ady=813&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079922%2C31079930%2C31079980%2C42531706%2C44809003%2C95320884&oid=2&pvsid=1199840782855224&tmod=833450862&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=299

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 44576
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 22:01:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame FF14 20 KB
9 KB 74ms
22ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49363
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:42:11 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame FF14 202 KB
64 KB 143ms
89ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 10:24:54 GMT

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 342C 167 KB
53 KB 108ms
50ms Document
text/html 178.250.1.17
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=ZXRAdQALWMUH4_KVAA7PFtpOMvYK58pSg-x6EQ&u=%7CAWj7BNqWcd8c7bHGwuafZ0aHYZsBGMs06YGCgpkh5uM%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_ArHr9DlvVwUA0Lh10Pk2WlfeyBMX_as4AVFYMbMe0Cm1aUAeLqHS1XVd8ignL3tIcBrRdqTYwtgX58WItR-reKl2oOcsY12g3aB7dxn-r71MOrObAuCc1tweMrMBdFzj_IJluOlLHxL5MQXgqMCnJOk6CzW0Zm8LIMECMhDlCdYV45CC22GjqcVfHGFRmLs1MaHR165jjhA6VcI9jWLkAHpIqTwWjSPPYopWkqu9DCaYbcg-RDgoHGjIL0DQm3QDqvOSwh5lUyZaeSsZ_aL2yVEGYTIfsuL2QlTgdKScWAfFP6r_bBXpOvcigTxdstj3eSdF92ccRhJg0h7mA8yYp_pxKn16UBOwL9iouswh4BC81iC5akoH9zd1yoD4tDbeXtHiW7aSyG64ecV1SYiN_li1Uh-YIR3M_SWd1YaOYAFgW_AATvtYuEultnT2colz6i0PJIb-yad83w3XlJ6_t0K4-yLniqGC9B5aFeVZr69oVav-2uVBrleiWlQ8hpA2LToZoKSA6hlE4Im6YRoOwFU9KNN0BjgarpQgLcard1uk8p1PGKchJVa5tLHzkZZ4HXeX-KW3amjF4PPdEduXfxQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCF5RcdUB0ZcWxLZXlj-8Plp67-A7JntKxXNWdkfdwwI23ARABIABglcqlgrAHggEXY2EtcHViLTM4NjEzMzg2ODc3ODUwMTTIAQmpAmItiH_3DrI-qAMByAMCqgTbAU_Qc3-fpM4R0fjz6Ycr2tJCTY-b8CrIpLkhkr_D216fVXWdFS82mV76o-MtSkyUog5ZFYrCdlzH0_F3GoHs9tI2bAy71pFIrl3muCJ2OQfllifWIjrrhlhcMIX0utZl9JTW-ZjXY7rUx4GxSnZmXo-rq3ZbTdm2j24I7hDvNkUp6cmWU-Pr1TSUWKcGmWkDA8hsl306vgQ3Sex1oLeezoPAUL49ChooHxFHvVRyTJ-9ticqB4I5vFXp1h99Igh_Z5slHxxdYw4WEyuOQsSTJ-Ribvw8g8rnB_43j4AGq-7fsO7dlNnsAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB0IgOGAcBABMgLrAjoCgEBIvf3BOljJjs_kkYKDA_oLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0Q0HaiXpNJsWitBztN-POMu1wiLg%26client%3Dca-pub-3861338687785014%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.17 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

7733da1c0eb31d41390cfa1922b2be1d48d2afe4301b7a2e574e283fe9144bf1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 10:24:53 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=tHn-VsvUyRXjdD5IdLe2ht845uVeA7lHY9kNEMxTT4s1jwZ0YlNy3_sX6uUdWQmaox8AMVChcoEYVxf2kURWmVeUOB2xH4qgZxwfoJxk_gRHS6nuxkqoiwXxzbMWyVbigX4BgKF6gfCksIwBwc0KHXoWqnrB4_OpwcfA9FqnpG9Het0GUwzlHOu0LKC8vnCCmKoAGGPgcD-iJwa6ch73O0aZIH0VI5d4ur28AoGoT-kku_Qbxe6_kU3bUENmf-B9Sl99NQ"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 14863245
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 e21910fd923a6283b5d44b2382eabc86.js Show response
www.gstatic.com/mysidia/ Frame 9EA4 9 KB
4 KB 76ms
22ms Script
text/javascript 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/e21910fd923a6283b5d44b2382eabc86.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3861338687785014&output=html&h=90&slotname=3867795080&adk=2782272358&adf=1612621598&pi=t.ma~as.3867795080&w=728&lmt=1702117493&format=728x90&url=https%3A%2F%2Fhairsalon.jingames.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702117493357&bpp=1&bdt=490&idt=293&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90&correlator=4965530886452&frm=20&pv=1&ga_vid=955479272.1702117494&ga_sid=1702117494&ga_hid=753171646&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=267&ady=3811&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079922%2C31079930%2C31079980%2C42531706%2C44809003%2C95320884&oid=2&pvsid=1199840782855224&tmod=833450862&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=296

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

27d5ba2175dc395614adb2c69fe9f4bff9abddef3a7c6e3e30a68587f428a37b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 03:13:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 25895
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4064
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 22:13:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 08 Mar 2024 03:13:19 GMT

GET
H2 200 f3d12415f986ed3504122551351bc1d0.js Show response
www.gstatic.com/mysidia/ Frame 9EA4 42 KB
16 KB 80ms
26ms Script
text/javascript 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f3d12415f986ed3504122551351bc1d0.js?tag=html5_display_upload/html5_exit_api

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

c5bcc597ce8a3ec0c0ef52ee8ece8f284ca9739c1bd1bbac380a3deb672d5446

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 05:53:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 275460
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16637
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 04:10:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 05 Mar 2024 05:53:54 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 9EA4 2 KB
822 B 24ms
24ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:55:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55782
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:55:12 GMT

GET
H2 200 50459845d1cbd526a76ea757de42d266.js Show response
www.gstatic.com/mysidia/ Frame 9EA4 23 KB
10 KB 74ms
23ms Script
text/javascript 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/50459845d1cbd526a76ea757de42d266.js?tag=exit_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

9caffafcdae7b42e3d074103c18a33640d4edf81401c216e99dbb77a15dfa511

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 16:47:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63429
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9842
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 04:10:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 07 Mar 2024 16:47:45 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame 9EA4 24 KB
9 KB 26ms
25ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:54:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55811
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:54:43 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 9EA4 3 KB
1 KB 28ms
27ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 44576
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 22:01:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 9EA4 20 KB
8 KB 22ms
22ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49363
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:42:11 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9EA4 202 KB
64 KB 146ms
146ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 10:24:54 GMT

GET
H2 200 f9d9b65dbd646119ce96bad0f484d579.js Show response
www.gstatic.com/mysidia/ Frame 9EA4 37 KB
15 KB 21ms
21ms Script
text/javascript 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f9d9b65dbd646119ce96bad0f484d579.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 04:32:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 280335
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15460
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 04:10:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 05 Mar 2024 04:32:39 GMT

GET
DATA 200
OK truncated
/ Frame FF14 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2e4f890d949be95fb96ed1655e0fd9685157879afe02efd202455e5fa11de31c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 342C 2 KB
1 KB 130ms
71ms Image
image/svg+xml 178.250.1.3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZXRAdQALWMUH4_KVAA7PFtpOMvYK58pSg-x6EQ&u=%7CAWj7BNqWcd8c7bHGwuafZ0aHYZsBGMs06YGCgpkh5uM%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_ArHr9DlvVwUA0Lh10Pk2WlfeyBMX_as4AVFYMbMe0Cm1aUAeLqHS1XVd8ignL3tIcBrRdqTYwtgX58WItR-reKl2oOcsY12g3aB7dxn-r71MOrObAuCc1tweMrMBdFzj_IJluOlLHxL5MQXgqMCnJOk6CzW0Zm8LIMECMhDlCdYV45CC22GjqcVfHGFRmLs1MaHR165jjhA6VcI9jWLkAHpIqTwWjSPPYopWkqu9DCaYbcg-RDgoHGjIL0DQm3QDqvOSwh5lUyZaeSsZ_aL2yVEGYTIfsuL2QlTgdKScWAfFP6r_bBXpOvcigTxdstj3eSdF92ccRhJg0h7mA8yYp_pxKn16UBOwL9iouswh4BC81iC5akoH9zd1yoD4tDbeXtHiW7aSyG64ecV1SYiN_li1Uh-YIR3M_SWd1YaOYAFgW_AATvtYuEultnT2colz6i0PJIb-yad83w3XlJ6_t0K4-yLniqGC9B5aFeVZr69oVav-2uVBrleiWlQ8hpA2LToZoKSA6hlE4Im6YRoOwFU9KNN0BjgarpQgLcard1uk8p1PGKchJVa5tLHzkZZ4HXeX-KW3amjF4PPdEduXfxQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCF5RcdUB0ZcWxLZXlj-8Plp67-A7JntKxXNWdkfdwwI23ARABIABglcqlgrAHggEXY2EtcHViLTM4NjEzMzg2ODc3ODUwMTTIAQmpAmItiH_3DrI-qAMByAMCqgTbAU_Qc3-fpM4R0fjz6Ycr2tJCTY-b8CrIpLkhkr_D216fVXWdFS82mV76o-MtSkyUog5ZFYrCdlzH0_F3GoHs9tI2bAy71pFIrl3muCJ2OQfllifWIjrrhlhcMIX0utZl9JTW-ZjXY7rUx4GxSnZmXo-rq3ZbTdm2j24I7hDvNkUp6cmWU-Pr1TSUWKcGmWkDA8hsl306vgQ3Sex1oLeezoPAUL49ChooHxFHvVRyTJ-9ticqB4I5vFXp1h99Igh_Z5slHxxdYw4WEyuOQsSTJ-Ribvw8g8rnB_43j4AGq-7fsO7dlNnsAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB0IgOGAcBABMgLrAjoCgEBIvf3BOljJjs_kkYKDA_oLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0Q0HaiXpNJsWitBztN-POMu1wiLg%26client%3Dca-pub-3861338687785014%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 03 Dec 2024 10:24:54 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 342C 2 KB
1 KB 131ms
72ms Image
image/svg+xml 178.250.1.3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 03 Dec 2024 10:24:54 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 342C 308 B
636 B 129ms
71ms Image
image/svg+xml 178.250.1.3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Tue, 03 Dec 2024 10:24:54 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 342C 293 B
621 B 127ms
69ms Image
image/svg+xml 178.250.1.3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Tue, 03 Dec 2024 10:24:54 GMT

GET
H2 200 lg.php
cat.nl3.eu.criteo.com/delivery/ Frame 342C 43 B
348 B 85ms
28ms Image
image/gif 178.250.1.6
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl3.eu.criteo.com/delivery/lg.php?cppv=3&cpp=nb_EByznnKikG6VF4XJurJn40v71PURQPSr13WLd9lJDX_NYemyeqS9kB432SKZpmAkjdoFGozY0cUe5KVc7jyPELmrE9O3vGqxoCwbMCw_DB7v2jt1Et6IeEUEAP91ul9BTBDxFTZLACwjehPfaQWlkbye4ZeeepUHwDfEiRBAn-7MFx9oQTYK44QrKXaJQx5oo5c9ZHZWX67QPvfR_lbGgFcU9EZYzuTzJY_ZE--8z88c2B9W9AcXXYxqB66c_NcBKesm0G5bzCyvZGMYaAnEkUlei4FyyF2bRwQzifYg3fLv2BHPN4Q2Ka67W8wNjKQOHuhsSq5alyHngAwSK0Otuf9S-PlgE5YOphK5em9uv-S-PbisT3Fqj5KqZWZtkTAw8meLpylzqIO83rnIan10D3fWRpd7kq09PShDjfltHWbeE

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.6 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1359568
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 342C 11 KB
11 KB 116ms
57ms Image
image/webp 178.250.1.15
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=19906&q=80&r=0&u=https%3A%2F%2Fmedia.hoeffner.de%2Fmedias%2Fzoom%2F9881982_1-201811271459.jpg&v=3&w=800&rid=4&s=GirNAv1rSbI_fJLd5_GQkIeJ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.15 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

b7b8dd44f5d03fd5e7ff6b3400535d6e2bb22185437b6e1b681f4602836e1384

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 11126
expires: Mon, 11 Nov 2024 09:17:25 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 342C 6 KB
7 KB 155ms
96ms Image
image/webp 178.250.1.15
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=19906&q=80&r=0&u=https%3A%2F%2Fmedia.hoeffner.de%2Fmedias%2Fzoom%2F12126311_2-202108130002.jpg&v=3&w=800&rid=4&s=c8impgXCUnHoofmgVrBwzPWb

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.15 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

59985a0310265813b1340d9106b57fe51516b6b9303ac8ad84ab94c3a1bfaf46

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 6452
expires: Thu, 07 Nov 2024 15:53:01 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 342C 8 KB
8 KB 90ms
31ms Image
image/webp 178.250.1.15
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=19906&q=80&r=0&u=https%3A%2F%2Fmedia.hoeffner.de%2Fmedias%2Fzoom%2F13346347_5-202007311619.jpg&v=3&w=800&rid=4&s=OYrXSXrWlWkC_gpkU1DnDvc7

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.15 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

7d275f5e00a33273cf0464ed50034e22943e11a65941ed30eb7a8e86817c3e6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 7962
expires: Fri, 01 Nov 2024 19:30:52 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 342C 19 KB
20 KB 117ms
72ms Image
image/webp 178.250.1.15
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=19906&q=80&r=0&u=https%3A%2F%2Fmedia.hoeffner.de%2Fmedias%2Fzoom%2F12104622_1-201909092233.jpg&v=3&w=800&rid=4&s=P7i23dYe_RJ5oyLfBAMlzz2E

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.15 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4a9936b2900612831eb4bc27bb0c4cdd5adb5d0c135f37d9abe2a9d3d19c2cff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 19816
expires: Thu, 07 Nov 2024 06:38:23 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 342C 16 KB
16 KB 116ms
71ms Image
image/webp 178.250.1.15
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=19906&q=80&r=0&u=https%3A%2F%2Fmedia.hoeffner.de%2Fmedias%2Fzoom%2F11327089_17-202306061242.jpg&v=3&w=800&rid=4&s=GDXhhRs2qtRnttYLx8Kvp9uF

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.15 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

f35d00f93992bcab90d7f4199080bfaa98bc1e78f24be03431b46d8f88d089db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 15904
expires: Wed, 13 Nov 2024 18:37:21 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 342C 8 KB
8 KB 143ms
98ms Image
image/webp 178.250.1.15
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=19906&q=80&r=0&u=https%3A%2F%2Fmedia.hoeffner.de%2Fmedias%2Fzoom%2F49990023_1-202212211244.jpg&v=3&w=800&rid=4&s=XMJNInfVRsE0cIseOHF0R3wg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.15 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

c57164a49ea8b39cfe0b4ff1913e11e974c9f0713cacc6026b0a4e87698cb975

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:53 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 8266
expires: Tue, 19 Nov 2024 18:33:38 GMT

GET
H2 200 6b12a17767054fcf8fbd506e0398e1c0_06e18b78af5cdb4c84432696bd43432f.png
static.criteo.net/design/dt/19906/220623/ Frame 342C 2 KB
2 KB 171ms
127ms Image
image/png 178.250.1.3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/design/dt/19906/220623/6b12a17767054fcf8fbd506e0398e1c0_06e18b78af5cdb4c84432696bd43432f.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a67f7c40e1f2acac9e9d5623dabb39188083317341d23eb085997779a5f347a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 23 Jun 2022 13:29:17 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "62b46aad-751"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 1873
expires: Tue, 03 Dec 2024 10:24:54 GMT

GET
H2 200 7ae26ba50d194f6186bbbabc026e23d7_f68f8b04a0a914318d795023d9a264aa.png
static.criteo.net/design/dt/19906/220623/ Frame 342C 33 KB
33 KB 99ms
56ms Image
image/png 178.250.1.3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/design/dt/19906/220623/7ae26ba50d194f6186bbbabc026e23d7_f68f8b04a0a914318d795023d9a264aa.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

9ef54ce221fe81933db2f8713dba333bebea4585a77cb4ba52498e5f3f083ada

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 23 Jun 2022 13:29:18 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "62b46aae-8263"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 33379
expires: Tue, 03 Dec 2024 10:24:54 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 342C 3 KB
1 KB 93ms
40ms Stylesheet
text/css 172.217.16.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open%20Sans

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f202.1e100.net

Software

ESF /

Resource Hash

4ddf6973fa3421cc10d8946187a761c0317632b66442c3d20c736024fba1029f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 09 Dec 2023 10:24:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 09 Dec 2023 09:21:55 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 09 Dec 2023 10:24:54 GMT

GET
H2 200 zepto-studio-1.0.1.js Show response
static.criteo.net/zepto/ Frame 342C 28 KB
11 KB 184ms
127ms Script
text/javascript 178.250.1.3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/zepto/zepto-studio-1.0.1.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a558dc731872adb52490cf8550eb796d0d0b448df332e38f815228576dd0cd5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 21 Aug 2019 08:32:15 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5d5d018f-6f5d"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 03 Dec 2024 10:24:54 GMT

GET
H2 206 b0245f871b5542aea7455cf049e211d8_faa142f2f9408d9339822747b59ca228.mp4
static.criteo.net/design/dt/19906/220623/ Frame 342C 48 KB
0 139ms
88ms Media
video/mp4 178.250.1.3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/19906/220623/b0245f871b5542aea7455cf049e211d8_faa142f2f9408d9339822747b59ca228.mp4?ibv=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Range: bytes=0-

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 23 Jun 2022 13:29:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "62b46ab1-de91a"
content-type: video/mp4
access-control-allow-origin: *
Content-Range: bytes 0-911641/911642
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
Content-Length: 911642
expires: Tue, 03 Dec 2024 10:24:54 GMT

GET
H3 200 scr_728x90.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12967609719255064532/728x90_Warrior/ Frame 8D3A 3 KB
1 KB 24ms
24ms Document
text/html 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12967609719255064532/728x90_Warrior/scr_728x90.html

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/f3d12415f986ed3504122551351bc1d0.js?tag=html5_display_upload/html5_exit_api

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

sffe /

Resource Hash

2df2335c3e89071d7b931c3b41ca26de3142e2551fbc2fe363ca60cbaa0272f1

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 95025
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1323
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 08:01:09 GMT
expires: Sat, 07 Dec 2024 08:01:09 GMT
last-modified: Wed, 23 Aug 2023 23:54:36 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 9EA4 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bf1a25ff21e2c773fb34e5dd83207ae099855307fde72b76b8d200a92b3960f3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 8D3A 6 KB
3 KB 25ms
24ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12967609719255064532/728x90_Warrior/scr_728x90.html

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

6f4813e4fe6dd891838e421479bf603f6d3f0d2a55b90517b875a77050471d4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12967609719255064532/728x90_Warrior/scr_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:29:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 50113
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2551
x-xss-protection: 0
server: cafe
etag: 4618035238173732404
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sat, 09 Dec 2023 20:29:41 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 8D3A 34 KB
13 KB 24ms
23ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12967609719255064532/728x90_Warrior/scr_728x90.html

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12967609719255064532/728x90_Warrior/scr_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 19:07:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55054
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sat, 09 Dec 2023 19:07:20 GMT

GET
H2 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 8D3A 236 KB
63 KB 85ms
32ms Script
text/javascript 172.217.16.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12967609719255064532/728x90_Warrior/scr_728x90.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f6.1e100.net

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Dec 2023 10:24:54 GMT

GET
H3 200 scr_728x90.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12967609719255064532/728x90_Warrior/ Frame 8D3A 49 KB
6 KB 28ms
28ms Script
application/x-javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12967609719255064532/728x90_Warrior/scr_728x90.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12967609719255064532/728x90_Warrior/scr_728x90.html

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

sffe /

Resource Hash

e9367e651d2644c8bb8e2ea0e295a13999a8505a5eecc5acdd09414751ea3f32

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12967609719255064532/728x90_Warrior/scr_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 09 Dec 2023 08:01:59 GMT
age: 8575
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5722
x-xss-protection: 0
last-modified: Wed, 23 Aug 2023 23:54:36 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 08 Dec 2024 08:01:59 GMT

GET
H2 206 b0245f871b5542aea7455cf049e211d8_faa142f2f9408d9339822747b59ca228.mp4
static.criteo.net/design/dt/19906/220623/ Frame 342C 26 KB
27 KB 74ms
74ms Media
video/mp4 178.250.1.3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/19906/220623/b0245f871b5542aea7455cf049e211d8_faa142f2f9408d9339822747b59ca228.mp4?ibv=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

b23a9ff408dba1959c07f65527e8cdcb3aa53676c2d439a2813ee09667c03004

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Range: bytes=884736-

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 23 Jun 2022 13:29:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "62b46ab1-de91a"
content-type: video/mp4
access-control-allow-origin: *
Content-Range: bytes 884736-911641/911642
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
Content-Length: 26906
expires: Tue, 03 Dec 2024 10:24:54 GMT

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v36/ Frame 342C 18 KB
19 KB 74ms
22ms Font
font/woff2 216.58.206.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v36/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open%20Sans

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f3.1e100.net

Software

sffe /

Resource Hash

441e23601fe7525a142857c98cbb2784997579d51a17f736d7964dceee609709

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:47:47 GMT
x-content-type-options: nosniff
age: 2227
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18664
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 01:36:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 08 Dec 2024 09:47:47 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 342C 0
128 B 92ms
30ms Ping
text/plain 178.250.1.25
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=tHn-VsvUyRXjdD5IdLe2ht845uVeA7lHY9kNEMxTT4s1jwZ0YlNy3_sX6uUdWQmaox8AMVChcoEYVxf2kURWmVeUOB2xH4qgZxwfoJxk_gRHS6nuxkqoiwXxzbMWyVbigX4BgKF6gfCksIwBwc0KHXoWqnrB4_OpwcfA9FqnpG9Het0GUwzlHOu0LKC8vnCCmKoAGGPgcD-iJwa6ch73O0aZIH0VI5d4ur28AoGoT-kku_Qbxe6_kU3bUENmf-B9Sl99NQ&sds=2&rev=89682&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.25 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sat, 09 Dec 2023 10:24:54 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 342C 2 KB
1 KB 42ms
42ms Image
image/svg+xml 178.250.1.3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 03 Dec 2024 10:24:54 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 342C 2 KB
1 KB 41ms
41ms Image
image/svg+xml 178.250.1.3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 03 Dec 2024 10:24:54 GMT

GET
H2 206 b0245f871b5542aea7455cf049e211d8_faa142f2f9408d9339822747b59ca228.mp4
static.criteo.net/design/dt/19906/220623/ Frame 342C 858 KB
0 29ms
29ms Media
video/mp4 178.250.1.3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/19906/220623/b0245f871b5542aea7455cf049e211d8_faa142f2f9408d9339822747b59ca228.mp4?ibv=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Range: bytes=32768-

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 23 Jun 2022 13:29:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "62b46ab1-de91a"
content-type: video/mp4
access-control-allow-origin: *
Content-Range: bytes 32768-911641/911642
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
Content-Length: 878874
expires: Tue, 03 Dec 2024 10:24:54 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame FF14 0
23 B 61ms
60ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CXuV1dUB0ZcWxLZXlj-8Plp67-A7JntKxXNWdkfdwwI23ARABIABglcqlgrAHggEXY2EtcHViLTM4NjEzMzg2ODc3ODUwMTTIAQmpAmItiH_3DrI-qAMByAMCqgTYAU_Qc3-fpM4R0fjz6Ycr2tJCTY-b8CrIpLkhkr_D216fVXWdFS82mV76o-MtSkyUog5ZFYrCdlzH0_F3GoHs9tI2bAy71pFIrl3muCJ2OQfllifWIjrrhlhcMIX0utZl9JTW-ZjXY7rUx4GxSnZmXo-rq3ZbTdm2j24I7hDvNkUp6cmWU-Pr1TSUWKcGmWkDA8hsl306vgQ3Sex1oLeezoPAUL49ChooHxFHvVRyTJ-9tidoBaOrPMY567mtBdLzR3KBETtX1QQ4C6k6ivk11Vt8QuSkSV7H7oAGq-7fsO7dlNnsAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB0IgOGAcBABMgLrAjoCgEBIvf3BOljJjs_kkYKDA4AKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi0zODYxMzM4Njg3Nzg1MDE0GAA&sigh=jUhZGiRQtjk&uach_m=%5BUACH%5D&cid=CAQSTgDICaaNAwWFqGWAC8cr1wRKM2WVuTaJuot2y4gezdmRn58OoKAHSi2liGcAOHV7XFCVxVt5qBQ3ptBazbLTSALTMjnTFyrrFBs5gbFzJhgB&cbvp=2&vis=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3861338687785014&output=html&h=600&slotname=2391061885&adk=3543907923&adf=2961538820&pi=t.ma~as.2391061885&w=300&lmt=1702117493&format=300x600&url=https%3A%2F%2Fhairsalon.jingames.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702117493358&bpp=1&bdt=490&idt=296&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C728x90&correlator=4965530886452&frm=20&pv=1&ga_vid=955479272.1702117494&ga_sid=1702117494&ga_hid=753171646&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1042&ady=813&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079922%2C31079930%2C31079980%2C42531706%2C44809003%2C95320884&oid=2&pvsid=1199840782855224&tmod=833450862&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=299
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 09 Dec 2023 10:24:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 09 Dec 2023 10:24:54 GMT

GET
H2 200 notify
rtb.nl3.eu.criteo.com/google/auction/ Frame FF14 0
126 B 87ms
29ms Image
text/plain 178.250.1.10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.nl3.eu.criteo.com/google/auction/notify?profile=14&payload=kOz_GN-BMKwC2ASdg2ICAgAAAImFUKjUb1isEHVAdGWufw_uV1Udfz7nAAASAAAKCkFRVUJBUUVCQVE&wp=ZXRAdQALWMUH4_KVAA7PFtpOMvYK58pSg-x6EQ&cbvp=2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 176100
server: Kestrel
content-length: 0

GET
H3 200 scr_728x90_atlas_1.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12967609719255064532/728x90_Warrior/images/ Frame 8D3A 29 KB
29 KB 25ms
24ms Image
image/png 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12967609719255064532/728x90_Warrior/images/scr_728x90_atlas_1.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

sffe /

Resource Hash

e13de906ee74cc523ab3cdf0869c4ab3d5632c75119673a1f7be2b475eb7b53e

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12967609719255064532/728x90_Warrior/scr_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Sat, 09 Dec 2023 08:02:00 GMT
x-content-type-options: nosniff
age: 8574
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29341
x-xss-protection: 0
last-modified: Wed, 23 Aug 2023 23:54:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 08 Dec 2024 08:02:00 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 9EA4
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=C2LPgdUB0ZaL1LYuz_tMPvtOB8AePmpXXdM2DnID6EWQQASDF-s4fYJWqs4LAB6AB98ruqSnIAQmoAwHIA0iqBN8BT9AQF-VfYWDsPRTyJH_Sj8QSeiO8B0k_AKaMaTXY2nBlRSapYJ05IYG...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%221337816467744633032%22,%22debug_reporting%22:true,%22destination%22:%22https://xsolla.com%22,%22event_report_window%22:%22...

0
0

111ms
58ms

Fetch
text/css

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%221337816467744633032%22,%22debug_reporting%22:true,%22destination%22:%22https://xsolla.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211093648759%22],%224%22:[%2212-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2211681147986513644785%22}&andc=true

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"1337816467744633032","debug_reporting":true,"destination":"https://xsolla.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11093648759"],"4":["12-09"],"6":["true"]},"priority":"500","source_event_id":"11681147986513644785"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 09 Dec 2023 10:24:54 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 09 Dec 2023 10:24:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"1337816467744633032","debug_reporting":true,"destination":"https://xsolla.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11093648759"],"4":["12-09"],"6":["true"]},"priority":"500","source_event_id":"11681147986513644785"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 5hpSdEAdCYypbNizbkAw91vLZEBHsYzw3rH5Fshj8SY.js Show response
pagead2.googlesyndication.com/bg/ Frame 5154 51 KB
19 KB 24ms
24ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/5hpSdEAdCYypbNizbkAw91vLZEBHsYzw3rH5Fshj8SY.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

sffe /

Resource Hash

e61a5274401d098ca96cd8b36e4030f75bcb644047b18cf0deb1f916c863f126

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 11:30:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 82452
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19933
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 11:30:42 GMT

GET
H3 200 5hpSdEAdCYypbNizbkAw91vLZEBHsYzw3rH5Fshj8SY.js Show response
pagead2.googlesyndication.com/bg/ Frame 8D3A 51 KB
19 KB 26ms
25ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/5hpSdEAdCYypbNizbkAw91vLZEBHsYzw3rH5Fshj8SY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

sffe /

Resource Hash

e61a5274401d098ca96cd8b36e4030f75bcb644047b18cf0deb1f916c863f126

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 11:30:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 82452
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19933
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 11:30:42 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312050101/ 160 KB
55 KB 77ms
77ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312050101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

247c3a90c91349a79ad2679f40b5dbaa0a60aa2a353ed21ca57af5aa6e94af45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56003
x-xss-protection: 0
server: cafe
etag: 16946842595581085845
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 09 Dec 2023 10:24:54 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 109ms
57ms Preflight
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 09 Dec 2023 10:24:54 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/ Frame 6DD6 9 KB
4 KB 21ms
21ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hairsalon.jingames.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 49088
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 20:46:46 GMT
etag: 5585625838579639069
expires: Fri, 22 Dec 2023 20:46:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/ Frame 2CAF 9 KB
4 KB 21ms
21ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hairsalon.jingames.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 49088
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 20:46:46 GMT
etag: 5585625838579639069
expires: Fri, 22 Dec 2023 20:46:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/ Frame 7362 9 KB
4 KB 21ms
21ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hairsalon.jingames.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 49088
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 20:46:46 GMT
etag: 5585625838579639069
expires: Fri, 22 Dec 2023 20:46:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/ Frame E8FE 9 KB
4 KB 21ms
21ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hairsalon.jingames.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 49088
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 20:46:46 GMT
etag: 5585625838579639069
expires: Fri, 22 Dec 2023 20:46:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame 6DD6 4 KB
744 B 38ms
37ms Stylesheet
text/css 172.217.16.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f202.1e100.net

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 09 Dec 2023 10:24:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 09 Dec 2023 09:23:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 09 Dec 2023 10:24:54 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 6DD6 205 B
229 B 28ms
28ms Image
image/png 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 21:17:49 GMT
x-content-type-options: nosniff
age: 47225
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 07 Dec 2024 21:17:49 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 6DD6 604 B
628 B 29ms
29ms Image
image/png 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 00:12:31 GMT
x-content-type-options: nosniff
age: 36743
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 08 Dec 2024 00:12:31 GMT

GET
H3 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/ Frame 6DD6 16 KB
7 KB 27ms
27ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

b8d99191997f9c3e6794142cba8b2959a673c7cd044871697b0e969620a584ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:58:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6784
x-xss-protection: 0
server: cafe
etag: 2582286893585073394
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:58:21 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/ Frame 6DD6 22 KB
9 KB 25ms
25ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

7612ff33976166c9617f119403de9d0eae9e553ce8e06a265f5a02039cb05fc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 19:17:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 54451
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9231
x-xss-protection: 0
server: cafe
etag: 9385233705467680479
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 19:17:23 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame CF15 0
16 B 64ms
64ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLbFxQEQq9bcARiQ9b7cATAB&v=APEucNUPDj3-x1Bz95xln9-Q80EMCvHTROsVcojgTyEzKoJVuXI6Va_wjAK4yvAkv50Qy1gxJ6-5ZrrNBHXBX0tK3tqjdK7OUA

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 10:24:54 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame FAEB 24 KB
9 KB 23ms
23ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite_fy2021.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55665
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:57:09 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/ Frame FAEB 7 KB
3 KB 24ms
24ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55665
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:57:09 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame FAEB 41 KB
14 KB 29ms
23ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 58786
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 18:05:08 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame FAEB 3 KB
1 KB 31ms
25ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 44576
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 22:01:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame FAEB 20 KB
8 KB 31ms
25ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49363
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:42:11 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame FAEB 202 KB
64 KB 69ms
61ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 10:24:54 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame FAEB 42 B
63 B 64ms
58ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B0uBjpsg2Welxp7YL9H1u_9HS2PF9Fl2rwc4hS0jneStFAphvVfn18buCJa0OgDCt5xKdQBOAL0slykgs8umV128gaiX1eZq76443Up1y0KAhsb3Q

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 10:24:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 5349205049379303910
s0.2mdn.net/simgad/ Frame FAEB 57 KB
57 KB 29ms
23ms Image
image/png 172.217.16.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/5349205049379303910

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f6.1e100.net

Software

sffe /

Resource Hash

82794c3c5fea4628f4e2155d7d2749e56e2d3bd8c9b8d9a9def1fa8d9f2cdf3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 17:55:48 GMT
x-content-type-options: nosniff
age: 59346
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58406
x-xss-protection: 0
last-modified: Sun, 11 Dec 2022 07:06:25 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 07 Dec 2024 17:55:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame FB10 0
16 B 61ms
61ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLbFxQEQq9bcARiQ9b7cATAB&v=APEucNW8DxJxTgI4NK_5II_c7gwbjrh22jW5ryuN6u6gmd4HOEEauCrWp7obLbssHR8ir95EsygowaTgEPWe1eICYxuhfASyCQ

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 10:24:54 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 5349205049379303910
s0.2mdn.net/simgad/ Frame 5815 57 KB
57 KB 28ms
27ms Image
image/png 172.217.16.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/5349205049379303910

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f6.1e100.net

Software

sffe /

Resource Hash

82794c3c5fea4628f4e2155d7d2749e56e2d3bd8c9b8d9a9def1fa8d9f2cdf3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 17:55:48 GMT
x-content-type-options: nosniff
age: 59346
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58406
x-xss-protection: 0
last-modified: Sun, 11 Dec 2022 07:06:25 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 07 Dec 2024 17:55:48 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame 5815 24 KB
9 KB 24ms
23ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite_fy2021.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55665
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:57:09 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/ Frame 5815 7 KB
3 KB 25ms
25ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55665
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:57:09 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 5815 41 KB
14 KB 24ms
23ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 58786
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 18:05:08 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 5815 3 KB
1 KB 33ms
32ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 44576
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 22:01:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 5815 20 KB
8 KB 26ms
24ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49363
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:42:11 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5815 202 KB
64 KB 93ms
91ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 10:24:54 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5815 42 B
63 B 59ms
58ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CDw0eFpNp5vf8Sfsry_uWNPobhc9YNEzNzYqUmWxUI1VYxF5iKO2V8KWFG5S9Z7ZSPG1pPnPX-oD8N6z1udscD_egbt6TO67rhJP-qrcMmAu661cI

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 10:24:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0CF0 0
16 B 61ms
61ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLbFxQEQq9bcARiP9b7cATAB&v=APEucNVIaDExAMxN6gv-oRznTLKMhegoUTCFZ9NK6ZXHMO35WrDGOKsMRZKId6OYyIjyP8nU3HvFl7xTJr0SyIhImdLBpg0xhw

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 10:24:54 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame 76FF 24 KB
9 KB 24ms
23ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite_fy2021.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55665
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:57:09 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/ Frame 76FF 7 KB
3 KB 29ms
29ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55665
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:57:09 GMT

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 76FF 0
0 122ms
67ms Fetch
image/gif 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsvY6fQa3an_7eL3yRZWOQfJkKXXIgIc0ihYASfBRd9Q_SLQPJSrkaVKrt_4wsYyvz1f3KfsQQDwdrxowy6pLoOWDKnYvkjVkNlQN4l7wPNqpWJp4PI3kPTjAefVnx0rIXNg35hHNC55rRbTtED64AQCaDtJMMKNdmftI8tZtro7_om07FILP0uBQHEL4YAvpLb5AdzqTIeYgEYsapThHOaEL4Gem98CjGDP3L1-AgK7AUZV1gc3eeqYbhuaxohDzPxnUPCwe4QdSxkv3eg9IY-BtX2nhtogru5lT4XXZHqx98Yc9CFEdKacNcBo487AoUbgStZ7rE7b5kpfCzrWPnpLbrQcNaENbkYHDGbWwuJszM56GMQd8NUAXU-cDIx3fZtsXHn5NGLJMyYmNT86WvXAN3S30vdgiU21szEhtfXz1hTtYpoQ7ZbLOdM90Z1qpykWvRO9SkoP2gPbPgvEqIxYg6t2fiQlgkw6rnSiv5mok_DkJFublwRJ4Z76u7YeU4-RQpLKWZ1wIN6ZPnsQzXj0iz4jIePRMlHPIAyKFki36QY2F-XShgW7rzxFcSRMc8wrVMgrH-c2JpRHs_NnuMyM_Bllon47oSp3m0__CxqSgNmnfq-545TiWra1g0xBrdXo7y6-nuZiO4_n_haK2WeYyi4-bnmN0HH9NwU1MGrvUn9dSXR4qzQww-2p3WTXkk_Q4F2Ex2P6_M3gzZkuEmJO1-57igUs5PERpTDlc1yHoY6f6m812A5daLQaYcKwUMTBUEMFK-NLK5JvIZWCh_h4SHA0Z1Vv1ooNuLvhNPrkTpqzj1d_fLADd_F7q166-IyQgtR1eD4LpEVVTV7PLpXTDaMm6OVdOomqWc3UPY6igo4ub3zMNkEWkMkGC-f2JLZK8YAlRfyTJqdAeGqghQMjszAQ30lJAQeFf5cLxxm9JW5weDSW-5AqFXYa0sFVJIGBXHxgyCo3Tm7OwzNoRYMMntM4wWc_o0IBybfPWa0UqKMm9ffbrvX3hdh0WAO6cpkjy9CtOM1eV0IjbWGKRFh4bdhrvT9QdrXCWeHWuvy2kp9nldK0oxqSQqUXqfe_gDxEKWOQrXhEuey975LYGGN-WXQem5liPqaZ1lf3cboMsfKxiTZhM9s22SHG24E6iEZ5fRBPdHiJXV1MNHPk4ZP2xrhJpduqcTZs2Zp_R7o5v_5I6GjasFSTplW6EfRlFyruJU4vDFp0f4DAh7n_D0kPtRFcE367HtTMUtb2ypl2n899Wf0lGI0aqHqJNuSK1aS6C5Zm_oqDY042sGmzD0-Cj2UkHmFnhY4xDZJNuUih9DXllhN-7nRShvYEcIeZa_EytkbOyljYedkqSJFp5UhvwlNfnqT-81iicnVkx4PE8jeRD13Kjg&sai=AMfl-YRAQSAHbp25uxDIGWfNSulPpjBm5lt3niBGPe52KCT1wtPryc9UnYtsVbI-P6eXvb89wn6cqCNfJqv5w7otzvcplAMwpR2TZ9rFP-NShADNfGX8Mt5jHvbqHVJ1wKlD_7zLVHMMGNnDaZuKhgiUZcMVHBFDgcB02MMSNBnf4o3qSGUsT_gOxbYBIU0Eu-xsILWOGLQ0dthRISeD_l-uToQ56Xch0ncFZawZ1pOFgJeJhfZtTEr-tIth7CyQWKvvb8b16AEqWQhwbtAeCsrKOOckig9IAhXIKPoZBqYR7hB745GTplXAPDOrL15GqLImiOeNeR5tTnyXsBwZ1JPWEaWdKbEyAIaFLS560CHU6UFQgWboXu9Ex0XzETIiSFXdFDQtheQdsPAulUtg8ZB07hVc82TSZlPN_ZNs2dv2eDVI7EiLeafiO18ZkQj2372FlX3nDBqurg2htfqrmOvgItRL50rWG8ClN8AyNuEvSa0xUkLk0sfyK8SD1L2MQNLM5Bs3oGc5yhH7&sig=Cg0ArKJSzMcTzIINwYCrEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9maXZlcnIuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20231206.53954&arae=0&ftch=1&adurl=

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 09 Dec 2023 10:24:54 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 76FF 41 KB
14 KB 26ms
26ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 58786
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 18:05:08 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 76FF 3 KB
1 KB 32ms
31ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 44576
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 22:01:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 76FF 20 KB
8 KB 28ms
28ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49363
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:42:11 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 76FF 202 KB
64 KB 73ms
72ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 10:24:54 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 76FF 42 B
63 B 59ms
58ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C-pJTyYuJD-jD6acQEKo5OkBlWaPQsa_ML77bjQaJ-6W17Mu2isgA-C-YtpnA9iawEskyKBo27aNMNLtMarNr53SkO4WBWeo1on9v-UEnZwLcUIMY

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 10:24:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 3311704122601845403
s0.2mdn.net/simgad/ Frame 76FF 19 KB
19 KB 23ms
23ms Image
image/png 172.217.16.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/3311704122601845403

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f6.1e100.net

Software

sffe /

Resource Hash

dc9a623e55aedb7563d96a2bd367237c17bc7d9493bae1300cae0e4e3af8af52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:01:32 GMT
x-content-type-options: nosniff
age: 368602
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19533
x-xss-protection: 0
last-modified: Sun, 11 Dec 2022 07:06:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 04 Dec 2024 04:01:32 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 4376 6 KB
706 B 34ms
34ms Stylesheet
text/css 172.217.16.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f202.1e100.net

Software

ESF /

Resource Hash

9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 09 Dec 2023 10:24:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 09 Dec 2023 09:13:30 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 09 Dec 2023 10:24:54 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 4376 2 KB
822 B 23ms
23ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:55:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55782
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:55:12 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame 4376 24 KB
9 KB 26ms
23ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:54:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55811
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:54:43 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 4376 3 KB
1 KB 31ms
28ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 44576
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 22:01:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 4376 20 KB
8 KB 28ms
25ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49363
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:42:11 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4376 202 KB
64 KB 87ms
85ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 10:24:54 GMT

GET
H3 200 f9d9b65dbd646119ce96bad0f484d579.js Show response
www.gstatic.com/mysidia/ Frame 4376 37 KB
15 KB 25ms
22ms Script
text/javascript 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f9d9b65dbd646119ce96bad0f484d579.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 04:32:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 280335
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15460
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 04:10:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 05 Mar 2024 04:32:39 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 5B67 38 KB
13 KB 24ms
23ms Document
text/html 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 23946
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 03:45:48 GMT
expires: Sun, 08 Dec 2024 03:45:48 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 76FF 0
0 76ms
60ms Fetch
image/gif 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsvY6fQa3an_7eL3yRZWOQfJkKXXIgIc0ihYASfBRd9Q_SLQPJSrkaVKrt_4wsYyvz1f3KfsQQDwdrxowy6pLoOWDKnYvkjVkNlQN4l7wPNqpWJp4PI3kPTjAefVnx0rIXNg35hHNC55rRbTtED64AQCaDtJMMKNdmftI8tZtro7_om07FILP0uBQHEL4YAvpLb5AdzqTIeYgEYsapThHOaEL4Gem98CjGDP3L1-AgK7AUZV1gc3eeqYbhuaxohDzPxnUPCwe4QdSxkv3eg9IY-BtX2nhtogru5lT4XXZHqx98Yc9CFEdKacNcBo487AoUbgStZ7rE7b5kpfCzrWPnpLbrQcNaENbkYHDGbWwuJszM56GMQd8NUAXU-cDIx3fZtsXHn5NGLJMyYmNT86WvXAN3S30vdgiU21szEhtfXz1hTtYpoQ7ZbLOdM90Z1qpykWvRO9SkoP2gPbPgvEqIxYg6t2fiQlgkw6rnSiv5mok_DkJFublwRJ4Z76u7YeU4-RQpLKWZ1wIN6ZPnsQzXj0iz4jIePRMlHPIAyKFki36QY2F-XShgW7rzxFcSRMc8wrVMgrH-c2JpRHs_NnuMyM_Bllon47oSp3m0__CxqSgNmnfq-545TiWra1g0xBrdXo7y6-nuZiO4_n_haK2WeYyi4-bnmN0HH9NwU1MGrvUn9dSXR4qzQww-2p3WTXkk_Q4F2Ex2P6_M3gzZkuEmJO1-57igUs5PERpTDlc1yHoY6f6m812A5daLQaYcKwUMTBUEMFK-NLK5JvIZWCh_h4SHA0Z1Vv1ooNuLvhNPrkTpqzj1d_fLADd_F7q166-IyQgtR1eD4LpEVVTV7PLpXTDaMm6OVdOomqWc3UPY6igo4ub3zMNkEWkMkGC-f2JLZK8YAlRfyTJqdAeGqghQMjszAQ30lJAQeFf5cLxxm9JW5weDSW-5AqFXYa0sFVJIGBXHxgyCo3Tm7OwzNoRYMMntM4wWc_o0IBybfPWa0UqKMm9ffbrvX3hdh0WAO6cpkjy9CtOM1eV0IjbWGKRFh4bdhrvT9QdrXCWeHWuvy2kp9nldK0oxqSQqUXqfe_gDxEKWOQrXhEuey975LYGGN-WXQem5liPqaZ1lf3cboMsfKxiTZhM9s22SHG24E6iEZ5fRBPdHiJXV1MNHPk4ZP2xrhJpduqcTZs2Zp_R7o5v_5I6GjasFSTplW6EfRlFyruJU4vDFp0f4DAh7n_D0kPtRFcE367HtTMUtb2ypl2n899Wf0lGI0aqHqJNuSK1aS6C5Zm_oqDY042sGmzD0-Cj2UkHmFnhY4xDZJNuUih9DXllhN-7nRShvYEcIeZa_EytkbOyljYedkqSJFp5UhvwlNfnqT-81iicnVkx4PE8jeRD13Kjg&sai=AMfl-YRAQSAHbp25uxDIGWfNSulPpjBm5lt3niBGPe52KCT1wtPryc9UnYtsVbI-P6eXvb89wn6cqCNfJqv5w7otzvcplAMwpR2TZ9rFP-NShADNfGX8Mt5jHvbqHVJ1wKlD_7zLVHMMGNnDaZuKhgiUZcMVHBFDgcB02MMSNBnf4o3qSGUsT_gOxbYBIU0Eu-xsILWOGLQ0dthRISeD_l-uToQ56Xch0ncFZawZ1pOFgJeJhfZtTEr-tIth7CyQWKvvb8b16AEqWQhwbtAeCsrKOOckig9IAhXIKPoZBqYR7hB745GTplXAPDOrL15GqLImiOeNeR5tTnyXsBwZ1JPWEaWdKbEyAIaFLS560CHU6UFQgWboXu9Ex0XzETIiSFXdFDQtheQdsPAulUtg8ZB07hVc82TSZlPN_ZNs2dv2eDVI7EiLeafiO18ZkQj2372FlX3nDBqurg2htfqrmOvgItRL50rWG8ClN8AyNuEvSa0xUkLk0sfyK8SD1L2MQNLM5Bs3oGc5yhH7&sig=Cg0ArKJSzMcTzIINwYCrEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9maXZlcnIuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=41&vt=11&dtpt=40&dett=2&cstd=0&cisv=r20231206.53954&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:54 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 2F31 38 KB
13 KB 24ms
23ms Document
text/html 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 23946
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 03:45:48 GMT
expires: Sun, 08 Dec 2024 03:45:48 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame DBFE 38 KB
13 KB 25ms
23ms Document
text/html 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 23946
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 03:45:48 GMT
expires: Sun, 08 Dec 2024 03:45:48 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 76FF 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 00ea2571266ff06371d3de9cedcbfc8673e8c8b400be87cf3fe73e81aabf6e84

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 5B67 39 KB
15 KB 24ms
24ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:50:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56069
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 18:50:25 GMT

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 2F31 39 KB
15 KB 25ms
24ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:50:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56069
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 18:50:25 GMT

GET
DATA 200
OK truncated
/ Frame FAEB 207 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 36c6d0b69ddafb6ccca03f163f243340a569493f763da89c8db792f3e192c119

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame FAEB 0
0 65ms
65ms Fetch
image/gif 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssR-fBj1CFk8DpOZPFMvK-ie9TG-bDqdlU9sqpn5RzyCTMg4LTSF3BnS5Ya7BqsSwx7eDLRHIPO6REDRI5YEI-88vzitVe7rdYhto9KWz40eCZgbaWU1t8ag_VXx3BziqKnQixGK6mtIvcA2aot2Qbo5CF_zO9Up0V63xbq_oSnsNlJSZNNhls4YZrhFgZjR8Yhi8GdyXX5ePo2Bnpeeu3PRNqleLxRiKhjOKp0WEGacExcMYRaaCT8nFSqhZiNvVKLFbbllNAu6c8LurBS2BOPhL-sSUn4a_kbOH5JlAPCr9w3k6DGfRRzMrZRiIOxLIcxkLe__DkLCZM5aNycikevB8lPRyYNv58CKkxQffA9ibX01xWhQ9XwCkfZD40FZR13ExZ2jiIjDYnwD7w2PRigQNUuP_GWDECWCqZO4YbzOrMFUa3E3jwJ5WXoh4LU6pavMu1COEZLaJqj70XX6CQ54ePeTSVKxHiEIIqDLA1tKRpSYk37dm8T8UFEZG4d37r4kakhlNwPGp387jBFc0Hw2b6lRqDVWry_oOAJgILKhN0EiRujJ1SSoZ8vcw79KXmG-uYnxo8IlVgNp_YO_tR9ahaR0u7zqm6BJRMyac9pG0r0knWsd176WfYGzgtNartwbfmLXbOMxVoFmnwdLMAaU-LoNFS1ujiPl__tJgyVeK3yMjjOLd-9cxfzlxCtQ80ZZdbAgskORCQr2YIcaJJmgIxmNqIlEXnLot5KcYimIhb9eEHpTz1O9qDAB_MSkDJt1kfwN2cqfB2-dAu2Rw3P7CCdMO8RCDxlz_hOEZBN6vOnKlpPCco00Tv87xM7uNgbHHQ3R_acOXUMWEwGZ1xP3BHlrgORNxaLwsmVHo-B9KZVzfDEjl5R_F2V-uWlckXH6qgL37wp8mfVTNyfxSQ6k9I83At-_-jZvm0kCL6ljkkMGQ7ddDjNM_nAuXcAUXoFoS128VZWeKwfCb1UPRra3dhZX9LJGxLg1urlxc84gKgrKTBnk8Afn7aC5qqSM08K6ldp0ZBH89Dd1bGTKxM9slXeT3EozZil4-3UlpdWeU-0TsMI3Eu1rGYFro1TEtw4H2ubqZ56J0SPHKqsCQeutMlWMqSlhANihW8yDbPeNzUOE0lkpXp_R0zXX2CJ276jI_0yYhFNL6Thp89MXqhMCPhdg6IMSmKuZEptvYzqspmDVjCjlrlw_J9D0qI_5zN4dQ9ISIcZAEEBbhZujLSqdQ8Wqml4ypvHyqc1ZIOVDEhPqwiV1CLvfl0NMlP-jtQ0SoDgyX0wvUHBO7vqy-MIHXwb7T_SwJatS1r8BOgeOfUPybVKRkHOLytzHNqSX8uL6x67C_NsaEtLoOLTtQIUEnGSesozwRfYkmhSQoW89Pt6dv-a&sai=AMfl-YR-kP81GRrHDZQFOuHkCUojsbw02GzifMaHVNzpjidxkKemYEoYDJ_PTzkfdOCp7sINc1HsndPRNozb-9nPmjaYnGcOceNgsxwsi4PUnNsbXzfeUERrvvJSs81-ii3IoWHdvrrRruqyUaAr70KDb8zjpfX5KBHD2iVV_yct5BhMHHZekg1uMQR0xF17QALE2bG9gsQDelPKqZpNQOXmcvpW1_dM5W_6kmSIwvhlqyAeoT3G-WoAnGbpOHNb0FaQEqtg8fHCLDt1vfUUGFpM237RNVlnJdHUnF8AACUAcGR27I0ZclJTXbD9A3xyPWujLeeMML3GyAic3pzQ4WnvEU85ykzMeo5c1HLBUr4kcALLpVXm7WK87ctS5R8Wm1MMwjjuIHg8nVWkWnfZHTbwEqpvgdD5NH57cnygdfXdTv0nq7KUBan0tqPzl_4jip-j_FE-YEXvmbFU1fGluv6pPm16fWsIkHx0CozbETN3wUQelNSEomwrrnP5tHKzu660Uxgn94df5XCR&sig=Cg0ArKJSzB6XpRVZFVvWEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9maXZlcnIuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=132&cbvp=2&dett=2&cstd=0&cisv=r20231206.56186&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 09 Dec 2023 10:24:54 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame DBFE 39 KB
15 KB 24ms
23ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:50:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56069
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 18:50:25 GMT

GET
DATA 200
OK truncated
/ Frame 5815 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c5854934ec7208509825a4e86bbbcb60c69b8e31e25b7db15c9a4c9b96b11d49

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 5815 0
0 66ms
63ms Fetch
image/gif 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssS7rlkmcuiPMKOKrp9ZoLW-kA6Xyicgj-ZYzAJr56Lf7ULHJt6yWlYb0_tsq7opqE0F_XYYGLH6lTdRIhqgtb4KC7ci99wyIoaMAnkFWXcrvHjwD8Xmf_mBXNGbVpihA5H4HbuEk6q8dPcvN7-G99khHT-GohqNysn7o8YQPfCtVOjmYcPs2cF-h5-_w1F3YtpwsamPGTbNOmCmk7HBePcs5thqZoJIxq3eRfUXzbCjK1QM4tfp057Zu1oS18za2MKCKqb1WU2qb2rpSTsF75aB33WGqteDPmD-XClmFTdh4AxGvYzQx7u1Lcc2b4pgAzuWWajm_hlLXyqaF_Wwe1wMpEblbFpipvE1GFIvUpAU3pEuVs-0V2DlYzbbOTUe1qVLKo8EXy364hwL098hG7fMU8dVtTzEGaASLUV5OnKSWproPtqO0pxkVtx6qNSRCW5gS-ygoPA078rmBSXGCEcdsXi9OvDAfWvAJsrI13-EgKb3hAfMMwYMl080oJsyBCmxdIBAq_fFVFWGsujcTyGc5fkbmHeU-tsOj2Tbic8jhHdA2Pq-zmH-hAmvcIDc-0OZgqQiB50qt_AgN9lnwevKp9I6kGM_VThcEdauH3jjwTrCPguHPhPuO6LkHIFkIY3zL2e1ENjjFDFlESPfsJhYIU4Ucj3ISeAW57fKIM3DukGTrUpUpetFd6NRaHjV2iAdscHEbAe_UnmPj9jH6IDCZk2BkKuP1amYSk7Pkmmp-6vHaZvDhfayTsxCpGjic0zJQNeLML-K_AIICnz3lcU2UkYfBRYlFKDMix5byTZ2CGq3g_dUApG0RCAybkZIZxxqU-g3MBbpbetMxFoCdekhmM3JRdWWgGm2RUbqPL6A_aIEhbPFOmFspqLT91YTfMZ7decjkJZu83603gAvien30dpSGVefZnIXNNC_UnBdyPbNRsOusAvShWujoCz1O2rAwqicKLXIVaqhwRgYKxHrq8jNdCivcmXdSlehWShKlP062fDGaQOf9VH6eLy_qoVwqZ7rvPfoekkM_2ZhQgJXcbW3k4pYHR3Je62HusG9kTENF0W5NYGiCTGtrMmh6W6XAfL9kMEFQAx_VhtWJNp4btp9fNbxzuDw_WZZR6ExMUEAGh-tQCJG5zTtL812akdY_OYmanBjIluSdKq8CenE_DESx1aclbdWlN1fMJezD8-t2N-lsDo5vX9H6IX1bFO3gb6STJLlNXyfGtX12qLAcMPOwFMWgslm0Lke0l7s6MwvY4_pJCpUtDOBjGbgv-Vqq-Dq-C2hAKITCVqjSKKTIxZKzQedaRVxquMe4xZnM43U-89wZ3Ubw1jegX4rJPTyHda72Pea90W9wItT6RD3vFy8vmtGQbBHEmhvceVQLNvoOMQ&sai=AMfl-YTRSZGhhiXE8vXWRO2rvG6tB81f11myE9kgQuXdehC10-a8LHuPqqvUkyR8keoqktxIkf_PGC1izU_HXpeUtxA9uazCihgXmXP4ArPWi7xkbWg8WVeUd5-twcbUyklwmB43IeaBazCZdelSmt1iGTlAorEPaa1YP0YqnlMDRxxIRbpXwddaJ3yTP1fRVa0tuGKoFvzUCugnGC4xL4guu5WNkXtjhjhNpEPyzIy7Vu09Zft6SR7gGeQJshZX636DngDi8mKEWuDhTDWUV3_QO0jedZZO_VpC8lntD4E5RcPugd7nb4MlVNgg3XxAdq3q343FfYOScFzwdM9iWmjNwm_5wGxejkp0o1vxxXdQ7dguFty6Jjy5gyNhW1XAmjs8dtv4Kv8OYcMF5AacdHBZRYJfX03ARgVRZEU1m62QJDtc0MUg5v23GCDnmzejjiUG_NDTt8Ot8saqwsu5HPJR5IJolcY1V0Fk8ZPFRyeZiDrARWVcCI40W3y_vpzl780Dl462dsHoYGVC&sig=Cg0ArKJSzPwa_H0oSfMzEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9maXZlcnIuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=229&cbvp=2&dett=2&cstd=0&cisv=r20231206.01883&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 09 Dec 2023 10:24:55 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 118ms
73ms XHR
application/json 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231206&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

0e8ff9e9656cb9622f1bfef0f431dc90c626b24cc914c07d1100480accae63c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12371
x-xss-protection: 0

GET
H3 200 5hpSdEAdCYypbNizbkAw91vLZEBHsYzw3rH5Fshj8SY.js Show response
pagead2.googlesyndication.com/bg/ Frame 5685 51 KB
19 KB 24ms
23ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/5hpSdEAdCYypbNizbkAw91vLZEBHsYzw3rH5Fshj8SY.js

Requested by

Host: hairsalon.jingames.net
URL: https://hairsalon.jingames.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

sffe /

Resource Hash

e61a5274401d098ca96cd8b36e4030f75bcb644047b18cf0deb1f916c863f126

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 11:30:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 82453
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19933
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 11:30:42 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5B67 0
20 B 61ms
61ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BG5swdUB0ZdH9Ls_O0_wPlZ2O6AUAAAAAOAHgBAI&bg=!JySlJGvNAAY3kmNgF5I7ADQBe5WfOB76k6gfEjOYx2OK_4DH4q4gUVe5RY9sk9PyLhbXSZ_9JZYWRa2o_KQ213rfH2bcAgAAALtSAAAAAWgBB5kDQ-R7CgmvIUX6gDRtLaGOTsMAX4dPU6TrsctMhyyb8-4dyubj-UZo5_F-W4vE4tAOw_lUeSLzR9K8kqDD0QgHE-bmrGYSeji4uPIxxGJzOYO6bN9EWwztfMSJP4cpxxfZHqkU1hoTxCg8gbO9xKrscBUiL4FIOsEQ05V98hQFZmRwir3yHzsY4sn0sb09ybMx8RTjV6zO8jl9m3lmpSKDHVptU2fJKRSDThULLQCrmYsJoS11bgTid1C-Sa3hFPaNZmDJSk0jVX5rKz5ksgEKkAUM9HVe1WzEE5rSuR6WMzL5Er2GC8-8ZcfP73J0ndZ9cb90CPtTSvGBV1y4RavnQ20DsbO6ILtdKrIUolHSHNibV9h-dfrI39-yR0xKJCduP15hC0Lzpn2rTM40OGmaTJu6O8vuLN2szCw5mPbu-nJUpenePszP38c8QBcnu-0YA-b1JcgCpnAdMvaX48B3naM4c-xvsELnwWCInPdW0VBBdLPKPjQkke41TRPYk5tnzhFaZMe6WHHYcP5_PAhKk-IPCUzORIGOoKcRFafmv6l3j9HBO5_qRhR9cuRkcsGLU69igqChdTll8J85vw7vodihGK8GClIqO7MPeuKRCGvx9n--GDUrG1dbjSG_l_2KpsDMzATA5TN5HZ3n4Ypo9nxG2xZnmq8J4lh2RDY3Cc8hFyeXwJ3MDq92RYbQNBInBhfaxKw491-ufe-tibS0z3fq4EZrdEgks2XbRhCLbbdfV4zBawgfQNd2pK73-lj__kquj-AWCWoSwkSulc2X8caaHzp4TPSMSOsCxm1A7JHTw4xX6lijKANENFcXKYJLK2Wp5al9kMpby52WceRXcPXpHNyYleY1fei9tOZVt21TVwSNkeE1Ow_mFJeGhaEjR44A864paKlWfZexWOrska6cte9909CTsHPnuSB1b4bACs6eeD8thql2XVNcTa9s99hIgkRJd9ZBX6GGtdFbbhTCe7eYynpqbA_OIFwoHs61UNKlW6OUF8uAcCmA94Si5CKjD8SJZ24p49TfPhf6fo3mlzGyj8vUc3Xw6Brue_7BB-eTkH-9YGIOkg7NgJCb5Z4wIwMBFy33W6Y0P--tcTNWuoo

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 10:24:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2F31 0
20 B 61ms
61ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B61_ZdUB0ZdL9Ls_O0_wPlZ2O6AUAAAAAOAHgBAI&bg=!PD-lP3DNAAY3kmNgF5I7ADQBe5WfOHcE3Ar6hfGmK-HdwLC9iqNPvxvjjBqbNYkarkQASdguKnPViXw3-H5_CH-KQ-XuAgAAALVSAAAAAWgBB5kDXijtffRaTjDBYtitkdBonv6vnI3p2XCqN2T4bs01caRvPGZMd8U0P3DbqRqIdvBscdfE2cFLB8EXeABLaacjpI9DSbMzDcduZOZT2l8ev02TTtAp1pQOF-4fTI47a4Y5jvKwbebeDuRJQ78dAOxnFTDDjp-PJT_03QjI-e2MvuAcYClnsOEozptyIgSWO5jL9DFujVETVIPWMv_s5jEh75oiV5sSyMC4dnuq0pOAO_Ul4DFBBZfrFDJXUaU3PuFH6BIJ1NYFMhh8J7gKa5NXgKiVQGZro9FhCJ4TEEbmZ6hRT_HxlXe82Hev2-ms6vYGzRdIhMjP7C4kEpbQkPl_uGU3jFdTuLO5EIQN4sF__esxap7rR601cm8n4nNO7DG-4fj2W9KiAAxQpz5cOkCE_1p_smyHDKfJyI03klLSHTGWyNmfiRdLj0pfwnxL_rxujenPD9kRC3rM7I5IpiBU2FxP4jx7qIOcDVNLx7kggqucS0nPvAqh6mK0T2oiTlK9ItyfRMOw6jXpnp1ydDL1fNiXIdZntA89n05gVHiY34C3S_2cGUrhwXPJfG0Pw3YKU3IIkEJdHSw-PBauxL7rrnPi0s5vwaD-nZ8RZTkFo6BuUgWpr_RvllN2x1lzcgCear0MPpANQGmJbdga6-IWDyNmpeoj6-y7M3yqFO_DFwR1umesjPUwjYo0tiELYlmc1ITpm15jE9vfTJ0YxCzw_43GvnCIc_KX-dDhYjJMf2aCIVZp4BwVrmF0N8QY5DeYSvwUvPha2uaJJ8bEzBcIdh7HmNadWWOpwb3XlNgY6uWdphpOMy5ClloBiMYdHI2iykwKGubQmrQE_F9PJ0AsqlbVcEhG4I6cPPB-NBcsmd6iJnRw_i-vd2sHzbCc27DqZRx2fch0nZ0on76wgkyi8rOi2REFCys7ay5NSawocedbgdp_wHar8Y9rb6Z6UDWacQaQGDw5vRvB9KE7vnoi4X5gjNRAsQUKVlq0vcM5D0uTPDLe7cKcSvQbuVcmE4mUNva11PwEZckWTrFOuIWC_fjmu3tDGsjG0ZabMA8yOLkLf5FUP4PRXW0mINXN8owYGRjN8Nqn4iOuP4ibGC0vTcx9aSsthspPGPXHQ37XTGSgfKiCSYBh6viFen0nPu4

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 10:24:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 36ms
36ms Script
text/javascript 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 09 Dec 2023 10:24:55 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DBFE 0
20 B 61ms
61ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BdqsvdUB0ZdP9Ls_O0_wPlZ2O6AUAAAAAOAHgBAI&bg=!lpWlldrNAAY3kmNgF5I7ADQBe5WfODxQTAh-j2-l5sd9X9WqGiV42BEFFYUbjCiZAk9S8at4BhW1NUhypOcS1B24VWFdAgAAAHRSAAAAAmgBB5kDQV1wriaeyLSkRkonBSa-k1u5Sem92JXGH4giq0tTsD-U9io7vZJn0iLBZjoGnIbcOnyh_j9EPCcOQUkNedWaKnsE8wMKFzJk94vysS1fwflxbf6elmRAGR1KepiJrPjID6eS9ElyZexU4oCO_1zSkfyFcDTPiacvtfFKU05mWw5MyYjkSo675Sie3f3fQwAmv3r3PIqzuZvPWIh3Kdf5YUh4OtkhtctzMqGZIlVMTxKHl-UcAoNbUuStv8i6soSbQWKwYi_k0exZe1BfGitw7BWIdrM6kZ-uVdpw7mJKxMgHNVynkWkCkGJ4ncLxah0VBRXWXWKm8otJegBx9oXpLcp0fvuO3vq5hXErMC5EpvMgmi21oTqnBE174NerJ4DWOhTOn02lE3AzuARJoshkUkSDE6Kh3ddp06DJ_oAfKXkycZpFCXrZkBfbQlZdJJQpxuENEE-ybm_2mLm7EtfOo1e7duXTdckCGGFhPBEKbguG_KVFRFUEmROHUh3MW1bjA83q-IAAk1HT8Xsr-ZwasCPx_gdL4pTU-S7ENlUQLL5wiQRtSkPnL3dAUYmrKJQF0kX1Pa8-9mg4ga2iHjbLNLORFyCOG-eRNpp87QT-XdqxUinlLXm49OsEPa0sFLBzHbH8b3E-wPfy82Gsbr-dJZNgksuSCoJinrpux_QWWLENrYFtmpwyWCjOFLcFgN9pnhV0NDlFe_KQHvVxgW9lpvnRUyephvZgdbTpH553aq9KWe9ddVyQ2ZKiGsz_iDfE4JA_EzPxhyv9xjmtNGXuNEOWshBplhQApc26eeK2_z9-5ZCutGszqGoAYbu8EB6wmPf2d2-c8InlD_BygIX6Ep1C-Ljyv7_y6Y5TXhI8iIZKZaUWSO9SAc27SRuk61rU1skP6FzWjLd9EoDhPdP-0dTNCf2nKiZcaHOna0JXrJ6P4Ow1u4ukODfY-TbAZ1alsmkNmVdvteCzmI719LU2Inuoi_l3TyPvoKees8t8vzsHeYNUttx0Wum7cVM6HJKvJwhx3_EJoqgR8xAETQXjLlRuA5GadFCMH5ltN3WyPQw14ST9_al1JEHL5xRUWTKmNh9Xg4yLtGUp-Uo27H1bfggp

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 10:24:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame F318 13 KB
5 KB 24ms
23ms Document
text/html 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f1.1e100.net

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hairsalon.jingames.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 39681
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 23:23:34 GMT
expires: Sat, 07 Dec 2024 23:23:34 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 23BE 829 B
1 KB 81ms
32ms Document
text/html 216.58.212.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f164.1e100.net

Software

GSE /

Resource Hash

56261242a0778635a10082c1e3cbf96b7e94d01af6fbbe9d8c6b23a469b80611

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-UJtmMc2N24tiKXhhbw3T4w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://hairsalon.jingames.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-UJtmMc2N24tiKXhhbw3T4w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 10:24:55 GMT
expires: Sat, 09 Dec 2023 10:24:55 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame F318 39 KB
15 KB 24ms
24ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:50:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56070
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 18:50:25 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 23BE 0
0 58ms
58ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231206&jk=1199840782855224&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s06-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame F318 0
12 B 23ms
23ms Image
text/plain 216.58.206.33
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?6gYG0w
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.58.206.33 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lhr35s10-in-f1.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:24:55 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FF14 42 B
64 B 60ms
60ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstfw5nOLk26XwwA4dw7YCueskJLWPHtLQcLmhnBn6kjMwUMaRPP8QSlOpQtozQ30H5GiP32zzLjfKGAHitG04WAh52ZuoCBb9AAC6ioMDCO2s0Y6eRM&sig=Cg0ArKJSzKdVkgEi1eQMEAE&id=lidar2&mcvt=1000&p=0,0,600,300&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&v=20231206&bin=7&avms=nio&bs=0,0&mc=0.65&if=1&vu=1&app=0&itpl=20&adk=3543907923&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702117493658&rpt=645&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 10:24:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 342C 0
127 B 30ms
30ms Ping
text/plain 178.250.1.25
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.25 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sat, 09 Dec 2023 10:24:54 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 61ms
61ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231206&jk=1199840782855224&bg=!8_Cl8L_NAAY3kmNgF5I7ADQBe5WfOKE0M18h0L6DN7kUwQB63WF5TQ9AteBiG85mMH_rpRGnrP_QOoqbCOrRvLCLqq1CAgAAADNSAAAAAmgBBwoAHBPMpT-v-1uuFp3n0-2kJbCTDVkRa-idlHXu9UyZAw2YunieLNcICV8rlJlNBFk41Jeh8xxLAR1NYa-Nmosxr38LrU5C8MVxliW1GIyl4Uv0DiZSvv4093tLT7qOU94MNPyC4pOhS4KSc4Ux-t_F7rGH0gBjVFYILHcBKkZERgIJdXqtLGP72fDLBnik9P2i40KhiPhDMHGtSkwMjSZUVlGUKLJ16e_pNo2cL8G6eGZPB6K0TZFB8DLvHCCKN8BzbqoYMwQ_gMZN0mMf-5yeSRi9yDUr0vKhKkzwdPj5_GQSlDgiUkhJ0L7AkA_dFR_EVzRO8o_UZ2QvEk-98Yeq6qWnNYVJtCj0ZQBgd308sTRPBrdgKaNFexS3IJL95NcVaTAXP-P4hVZUOwwMu3zlSkc5N3eq8-noN41EfPykG1ZGV3Nkqb2CM-_WNmjiID74XYM-udm5RMZtddchEwasytqKRMsZrnPVyDY3V41EZbDtCaz8DFoUoR22UlOod-x8YlrqR7hEcldUADi2ujjRJFhNFifylj9kdJa-HvrpyEiHeoktOX6AgQL1QE275YCtWSCpFDPr62picGQ6r2xD8zVIPiBo33GjvNYOZl837EvTwFirF_huapraNNawEibX_2Bv1EpryaihF7IeXBT5Mdq74wIR_7wgDzeERPz4lwr4777ovIa7QtKv4QwAkuFeT4dv30OeD9Z77nxRIlr-V_61tFOrGG7qdDkyDY_FLRAqYKkBTTOgevpjMnE2Wg93p_kscVp648gLdvaqGV4n4Q6XvnhUiYQ0N9GXglO6RkmfLL3UHIqGx091BjJoYKQue8lqh0lWNstCaAfOQwg6qSVBrIwCY7DBldoXbxSMrB3XUj3oGUbPUXB-C_7mki40dx1lwvj2tJoKLRLkL5rWD3gApmXrSvnGKVeq9LdEhqORu6tUjkKb3Er5pOBweFNhRIp8gio53Y99aytn_gIbztCmJnnxD6MH1S9Q3QvHXDVPsphjfwSxKw9j3CT7dnMKZEhtm0D2Vj9DTWVOSODVIEqd7GgRkTXOpIGQk06Lip3725mGKSIlMB5aq5wr
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s06-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hairsalon.jingames.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FAEB 42 B
64 B 60ms
60ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsueOIK7U8z99coXSD7FgfqeOEc2jxWtLWGJaeHLMd9cfKgqM_2xDIR9Nf2fctX5uMxXmNN6ekcUDDMN0xTEPqzxV221nZvdCaHlijUJuI1GoyaCt_aI31u9GXGHOKo74LRtkLMZ-lSKZQ0T&sai=AMfl-YSyXseDlQkXD50IXNJnhOAQyg9EWA50Dt05uh12l4wfoK4_z7X2CdOnNnBpd1Q_S7eXrtB8arXhIyIV9daQY4re0ZAFUMpnzmHJBI68qvdSjIAsiCo1QImX0eF3eeaR8pEt5VXdCQOedU15VXIXMJz-n4a1eScTLH31&sig=Cg0ArKJSzGSX4dOU7jALEAE&cid=CAQSTwDICaaNKpNzl8QNpnx4LPmK7-m47hcQ0irv1Nwe-vmNxceW2dCjjEimPPQttxgQToEV3DKWNKu2XJ9l9xlagu3Uxs7ZQHJ6cJ0BoQ493ywYAQ&id=lidar2&mcvt=1000&p=0,0,600,160&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231206&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271803&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702117494707&rpt=131&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 10:24:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 5815 42 B
64 B 60ms
60ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssGSAD6tRF8lOLitYYf-QDgUAxhny0ONWVWFgQG6nHMfFlJJh9CHWDHa7LiQNYXQxZ1HpSUlchc67Nm3fYnzrY0Zoqq7tf2Yy1S8lfWuh8FmXEXV8NRf5zVOv8MpXkZups95XaHF0dUyz47&sai=AMfl-YQ8xjt9ThZUtIhnK4sHT6DRtLCL0cFW1GcXqJH5hnOFHoBh972kT78qDRObyYqQGPlSsFMTxa0JMr5E_P1KUXS1fjf9b9sXtvntlDacfVYr5cVlzYgNdU2Dbta5_dV98ZqVkMGmiOO5XBR86A-rADLlrraF1kpaIfeT&sig=Cg0ArKJSzEIzLejQzswkEAE&cid=CAQSTwDICaaNKpNzl8QNpnx4LPmK7-m47hcQ0irv1Nwe-vmNxceW2dCjjEimPPQttxgQToEV3DKWNKu2XJ9l9xlagu3Uxs7ZQHJ6cJ0BoQ493ywYAQ&id=lidar2&mcvt=1000&p=0,0,600,160&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231206&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271804&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702117494724&rpt=199&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 10:24:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 76FF 42 B
64 B 64ms
63ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssgm9b0pmTC3bUkpYqC8fUM-KMnfzpmtA2sjqiT6Y2uRxEUoVoz7ikJGyUheayUDfBr76ifUtEda8hZugFDk4WSBj3OVr0-Zr2CSNTKIvKmNhu0oSM6KSAIOUnzpPy4XLcEUWQdECh8GW1f&sai=AMfl-YSvetwRRhWw0q4GRC84Mu4Ww-GlPBlx8hPvKszFe94jlsWDTlEAe2sKSBbNa2Luwqf6CT0_YmwiEAC_jodo1To-V1Gcc7n8LbP_k47QalZQO6K5YBIMW4KCXe12hoPy0AlKZ7BXpbg5nUxIf4pHQxHh40dJFdh5bSU-&sig=Cg0ArKJSzCfTJKrunVu0EAE&cid=CAQSTwDICaaNKpNzl8QNpnx4LPmK7-m47hcQ0irv1Nwe-vmNxceW2dCjjEimPPQttxgQToEV3DKWNKu2XJ9l9xlagu3Uxs7ZQHJ6cJ0BoQ493ywYAQ&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=338,835,1000,1051,1090&tos=338,497,165,51,39&v=20231206&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702117494742&rpt=165&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 10:24:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: main.jingames.net
URL: http://main.jingames.net/wp-content/plugins/login-box/login-box-script.js

Domain: main.jingames.net
URL: http://main.jingames.net/wp-content/plugins/login-box/wpclassic/scripts.js

Domain: main.jingames.net
URL: http://main.jingames.net/wp-content/plugins/login-box/wpclassic/style.css

Verdicts & Comments Add Verdict or Comment

52 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
hairsalon.jingames.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: k0s2rlgi60ens16q73bct8dku2
hairsalon.jingames.net/	1970-01-21 01:34:13	Name: gdpr[consent_types] Value: %5B%5D
hairsalon.jingames.net/	1970-01-21 01:34:13	Name: gdpr[allowed_cookies] Value: %5B%22%22%2C%22id%22%2C%22IDE%22%2C%22FLC%22%2C%22DSID%22%2C%22SNID%22%2C%22NID%22%2C%22_ga%22%2C%22_gat%22%5D
.jingames.net/	1970-01-21 02:10:13	Name: __gads Value: ID=577f7fd4a31b353d:T=1702117493:RT=1702117493:S=ALNI_MaTjQPDxwUfEiFyx0gJ23LxJrhHtQ
.jingames.net/	1970-01-21 02:10:13	Name: __gpi Value: UID=00000ce490b0d3c3:T=1702117493:RT=1702117493:S=ALNI_MZgOzvQxEW2wSw9iqmTDyeMX50ATw
.doubleclick.net/	1970-01-21 02:10:13	Name: IDE Value: AHWqTUnXkyMuP9oaZdkVmzzqqfxGC6_fDObzSSksY9uPy1MjvJZ3X3BSG0odapdw2y4
.googleadservices.com/	1970-01-20 18:58:13	Name: ar_debug Value: 1

63 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://main.jingames.net/wp-content/themes/mantra/images/socials/YouTube.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://main.jingames.net/wp-content/themes/mantra/images/socials/Facebook.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://main.jingames.net/wp-content/themes/mantra/images/socials/Facebook.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/gYgWKaD.png?1'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/v5DA1SP.png?1'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/Dh4n4Qc.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/btkpmDV.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/F7CnMIb.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/VZaWeJV.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/C0w4Rlw.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/DAFF1Dr.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/p8EDQ1b.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/zrjmZhG.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/Xg4YaHE.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/CJ2penH.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/Nl3oCEP.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/DHtHMWq.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/wYr2w7r.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/tv5ytF6.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/UhYUyNH.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/2uUfq06.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/gPnJgTg.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/nxadgkN.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/4GGx1z4.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/eJrM2Tu.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/qjqksvI.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://imgur.com/wYmmLJi][img]'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/wYmmLJi.png[/img][/url]'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure script 'http://main.jingames.net/wp-content/plugins/login-box/login-box-script.js'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure script 'http://main.jingames.net/wp-content/plugins/login-box/wpclassic/scripts.js'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://hairsalon.jingames.net/(Line 27) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure stylesheet 'http://main.jingames.net/wp-content/plugins/login-box/wpclassic/style.css'. This request has been blocked; the content must be served over HTTPS.
security	warning	URL: https://hairsalon.jingames.net/(Line 166) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://main.jingames.net/wp-content/themes/mantra/images/socials/YouTube.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 166) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://main.jingames.net/wp-content/themes/mantra/images/socials/Facebook.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 166) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://main.jingames.net/wp-content/themes/mantra/images/socials/Facebook.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 235) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/gYgWKaD.png?1'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 235) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/v5DA1SP.png?1'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 263) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/Dh4n4Qc.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 291) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/btkpmDV.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 319) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/F7CnMIb.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 344) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/VZaWeJV.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 372) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/C0w4Rlw.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 401) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/DAFF1Dr.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 430) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/p8EDQ1b.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 460) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/zrjmZhG.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 490) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/Xg4YaHE.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 545) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/CJ2penH.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 628) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/Nl3oCEP.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 628) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/DHtHMWq.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 628) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/wYr2w7r.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 628) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/tv5ytF6.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 658) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/UhYUyNH.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 727) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/2uUfq06.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 727) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/gPnJgTg.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 727) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/nxadgkN.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 727) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/4GGx1z4.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 757) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/eJrM2Tu.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 813) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/qjqksvI.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 849) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://imgur.com/wYmmLJi][img]'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 849) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://i.imgur.com/wYmmLJi.png[/img][/url]'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hairsalon.jingames.net/(Line 906) Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over a secure connection, but contains a form that targets an insecure endpoint 'http://main.jingames.net/wp-login.php'. This endpoint should be made available over a secure connection.
security	warning	URL: https://hairsalon.jingames.net/ Message: Mixed Content: The page at 'https://hairsalon.jingames.net/' was loaded over HTTPS, but requested an insecure element 'http://main.jingames.net/wp-content/uploads/2015/01/cropped-header1.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
network	error	URL: https://imgur.com/wYmmLJi][img] Message: Failed to load resource: the server responded with a status of 404 ()
other	warning	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3861338687785014&output=html&h=600&slotname=2391061885&adk=3543907923&adf=2961538820&pi=t.ma~as.2391061885&w=300&lmt=1702117493&format=300x600&url=https%3A%2F%2Fhairsalon.jingames.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702117493358&bpp=1&bdt=490&idt=296&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C728x90&correlator=4965530886452&frm=20&pv=1&ga_vid=955479272.1702117494&ga_sid=1702117494&ga_hid=753171646&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1042&ady=813&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079922%2C31079930%2C31079980%2C42531706%2C44809003%2C95320884&oid=2&pvsid=1199840782855224&tmod=833450862&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=299 Message: Origin trial controlled feature not enabled: 'attribution-reporting'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
ads.eu.criteo.com
cat.nl3.eu.criteo.com
csm.eu.criteo.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
hairsalon.jingames.net
i.imgur.com
imageproxy.eu.criteo.net
imgur.com
main.jingames.net
pagead2.googlesyndication.com
rtb.nl3.eu.criteo.com
s0.2mdn.net
static.criteo.net
tpc.googlesyndication.com
www.google.com
www.googleadservices.com
www.googletagservices.com
www.gstatic.com
main.jingames.net
142.250.181.226
142.250.185.226
142.250.185.70
142.250.186.34
142.250.186.35
142.250.186.98
146.75.120.193
172.217.16.134
172.217.16.202
178.250.1.10
178.250.1.15
178.250.1.17
178.250.1.25
178.250.1.3
178.250.1.6
185.80.49.249
199.232.196.193
216.58.206.33
216.58.206.35
216.58.212.164
00ea2571266ff06371d3de9cedcbfc8673e8c8b400be87cf3fe73e81aabf6e84
05bb3e7b6befc00816b63a3c50555832495513e28a0f9c5e605fbb79e0d8d495
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0ae8d2ebd4d24ebebb1d850ddbc48c3394b7fb79ac01ab6dc227e6489aeaa862
0bcc9959e25dea025ee9a70a550c2a127fc3ff29d9b71c3ab81602f5ada5a9c4
0e8ff9e9656cb9622f1bfef0f431dc90c626b24cc914c07d1100480accae63c2
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
15b869b02c6fbaa8c6c26445a2dd2d9bad80fd27b1409f8179e5dd89dc89d90a
1644a837db5cf4f3b0224c2518dc0d29fdbc830ef844a0cbcd3c4f0fcea22c91
1e4aae7472b7c50811747781b8943c51cc23d75f550c37f3d26de8c29b5fed8c
1efbd89776d2711d93abdcbe92ba4680258af85c690358896a3d1a31c0a03f4b
1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea
21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81
2237852527a89a4ec8a6e080d02b93c160abc69a7dd6d66101e14562e81cf2ea
225aa88b6ab02c06222ec9468d62e15fa188e39cdb9431d1f55401ad380753ed
247c3a90c91349a79ad2679f40b5dbaa0a60aa2a353ed21ca57af5aa6e94af45
27d5ba2175dc395614adb2c69fe9f4bff9abddef3a7c6e3e30a68587f428a37b
29cda2ed62ac6a68ee82b7a52fca3b306b467fe15093f3ca755842a186a86257
2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058
2df2335c3e89071d7b931c3b41ca26de3142e2551fbc2fe363ca60cbaa0272f1
2e4f890d949be95fb96ed1655e0fd9685157879afe02efd202455e5fa11de31c
2fda446210f480afd2c2dfb33be25b8943de1e00b741e07bfc1c22369ad2beb1
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
36c6d0b69ddafb6ccca03f163f243340a569493f763da89c8db792f3e192c119
3b4854276d704345a017d873d14e45dceab9ad1aa7cd09f3b5015ec16a249cc7
3bb28b38c9b760b981cc53e24f1d45c3b34a8d8e00c7872741d8cebdab943566
4066df2bffec203ba6a727276b94b7997c435b47f17eb30d6938a1e1f1aa58bb
41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
441e23601fe7525a142857c98cbb2784997579d51a17f736d7964dceee609709
452acd09eda3c896c51d1e583b8a1486ebafd773e55a8985ca23cc918be2f6c0
457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d
4a9936b2900612831eb4bc27bb0c4cdd5adb5d0c135f37d9abe2a9d3d19c2cff
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4ddf6973fa3421cc10d8946187a761c0317632b66442c3d20c736024fba1029f
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e1d7d234c7a5927859f10908ad09106aef746b68e34370ca4fc695e64f89957
4fb39048b8810113fcf3acfe101ba586a97ae9481fc02804712e2f4cf96706f8
505022d86f149fc0ca5e56db8f7def31acbd780372ae4e72b05aeaa67e751094
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
56261242a0778635a10082c1e3cbf96b7e94d01af6fbbe9d8c6b23a469b80611
59985a0310265813b1340d9106b57fe51516b6b9303ac8ad84ab94c3a1bfaf46
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5c9bca654e3b4508bbfb85cf1b871ad4ecb67554664c4203a927e1df12bb8296
5d62e6c90005bfb71f6abb440f9e4753681cb23bbd5e60477ab6f442d2f0e69c
60dc0148688852de8c26cba837c86045099c4f40cb5f763da74d9a62b2b62eff
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6647fea76ad0ed167fd4fc0b54086de7e609c148f3a8a26be643601bd7ea31ac
6a87fdfa3fe7951f4d71c11f58f5ccee7bf291e8d8f227306cfda9e9d970ec61
6d9ed1d11bf10386253e7b950a51fcb1ea0cb8b4079e7147c7917132df636ac3
6f4813e4fe6dd891838e421479bf603f6d3f0d2a55b90517b875a77050471d4b
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
73e415f6a1a6f888f5b9f1c304635503f558ade72057d1a796edade47f739956
7612ff33976166c9617f119403de9d0eae9e553ce8e06a265f5a02039cb05fc3
7733da1c0eb31d41390cfa1922b2be1d48d2afe4301b7a2e574e283fe9144bf1
7d275f5e00a33273cf0464ed50034e22943e11a65941ed30eb7a8e86817c3e6d
7fd9273f20fdb1229c224341271a119020a5eee74ccf6b4605730917c864caf2
82794c3c5fea4628f4e2155d7d2749e56e2d3bd8c9b8d9a9def1fa8d9f2cdf3f
83b348246d8b17459fbb72c53547b83a27bb25a95b1398f7af301eb15b3dd8b1
83dbaa0bc2d7e537bb62d602123d3d667b37448d448b59045d504d93ee9553c1
859fbca443befc30e88c800971f32a91d0928d9a708fb9cb01e28447320e2345
88d3342019cb40e7abd7e305bf58270653db34eaca0cd8f631dfbfdbd5772302
89fdc3682ba7b435d92947f318c9a8a1c4544ee02922f6012fe2e450799f59f1
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
93bb199d3abd68c438e4e11b1169223fbb7a123329a7d46a5a1a34617441acb3
9404536a8f4d78d41cdbb47bc7bdc5402e81653b6afe022f621aed516a4b7c26
951af233b9948bf5f4b5a6baea6256641df11a61aacaa0e179bbcd45dbd98d9a
988688356dc54a7ac123416df30c77f104bf518103d18df67129da00b9de121c
9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1
9caffafcdae7b42e3d074103c18a33640d4edf81401c216e99dbb77a15dfa511
9ef54ce221fe81933db2f8713dba333bebea4585a77cb4ba52498e5f3f083ada
a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a558dc731872adb52490cf8550eb796d0d0b448df332e38f815228576dd0cd5a
a67f7c40e1f2acac9e9d5623dabb39188083317341d23eb085997779a5f347a5
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
aed37d23a522a77ad4e3568eafcc17e69f780286608f3b70c2e16b193cd26ccc
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b23a9ff408dba1959c07f65527e8cdcb3aa53676c2d439a2813ee09667c03004
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
b6516367a4082d9ff4d26b2e592acb604cbc4006c682bfdaa249ee1d3591c480
b7b8dd44f5d03fd5e7ff6b3400535d6e2bb22185437b6e1b681f4602836e1384
b8d99191997f9c3e6794142cba8b2959a673c7cd044871697b0e969620a584ab
ba1a686b053caeabf630e5eb0f5585b0559c2c1014a37624b51045763fd5c78c
bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27
bf1a25ff21e2c773fb34e5dd83207ae099855307fde72b76b8d200a92b3960f3
c14ade80fd908bfa3fbd8d1d6f93d18ef515507fad06db09aaca1dc400695d2d
c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146
c57164a49ea8b39cfe0b4ff1913e11e974c9f0713cacc6026b0a4e87698cb975
c5854934ec7208509825a4e86bbbcb60c69b8e31e25b7db15c9a4c9b96b11d49
c5bcc597ce8a3ec0c0ef52ee8ece8f284ca9739c1bd1bbac380a3deb672d5446
c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1
ca536442d5dad77c7bb6b667002549970998676544998c49f3c2c32b6528f7b6
d1a9fd0bd6b1014d1ad42f71f7e1d0cb7823df0fc0337e21ad05567523309852
d3a17df2fd4d04f89533a05d640b202a026f37f06654904f9b746024c948c813
dc9a623e55aedb7563d96a2bd367237c17bc7d9493bae1300cae0e4e3af8af52
dd3426e528a9a8b6a8edc8a7f3836ef6b445f488dd807fb4daf1f3549d802ae9
e13de906ee74cc523ab3cdf0869c4ab3d5632c75119673a1f7be2b475eb7b53e
e308aef7270562fbba067db0695f5744ac0834621b18d8c1d6796ffd46b1f7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e61a5274401d098ca96cd8b36e4030f75bcb644047b18cf0deb1f916c863f126
e9367e651d2644c8bb8e2ea0e295a13999a8505a5eecc5acdd09414751ea3f32
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef5bbf104b13a29fd500a221f3a81babce750e791dd462fde66d9f90865ad8f0
f35d00f93992bcab90d7f4199080bfaa98bc1e78f24be03431b46d8f88d089db
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
fc1df364182447bd46fcabde5331fc0a9ad256fc26e54a56274423fa2fffda5f
fe0c7255c105a9be331b462dc5a759e1d38850e51884100331506b1308d62977
fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

hairsalon.jingames.net Open in urlscan Pro 185.80.49.249 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

172 Requests

98 %HTTPS

0 %IPv6

12 Domains

21 Subdomains

21 IPs

4 Countries

6536 kBTransfer

10533 kBSize

7 Cookies

82 Outgoing links

Page URL History

Redirected requests

172 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

hairsalon.jingames.net Open in urlscan Pro
185.80.49.249 Public Scan

Screenshot
Live screenshot

Full Image

172
Requests

98 %
HTTPS

0 %
IPv6

12
Domains

21
Subdomains

21
IPs

4
Countries

6536 kB
Transfer

10533 kB
Size

7
Cookies

172 HTTP transactions
6 data transactions