prnt.sc Open in urlscan Pro
172.67.72.27 Public Scan

URL:
https://prnt.sc/12zoygy
Submission: On August 18 via manual (August 18th 2021, 9:04:25 pm UTC) from US

Summary HTTP 182 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 34 IPs in 7 countries across 33 domains to perform 182 HTTP transactions. The main IP is 172.67.72.27, located in United States and belongs to CLOUDFLARENET, US. The main domain is prnt.sc.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 17th 2021. Valid for: a year.

This is the only time prnt.sc was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	172.67.72.27 172.67.72.27	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	104.23.139.12 104.23.139.12	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
2	2600:9000:219... 2600:9000:2190:c400:9:46dc:4700:93a1	16509 (AMAZON-02) (AMAZON-02)
2	151.139.242.3 151.139.242.3	33438 (HIGHWINDS2) (HIGHWINDS2)
2	2620:116:800d... 2620:116:800d:21:8c6e:cf2c:8d6:9fb5	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c08::9c	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
4	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
3	2a00:1450:400... 2a00:1450:4001:812::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
1	2600:9000:219... 2600:9000:2190:d800:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1 5	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	192.207.255.147 192.207.255.147	62821 (AS-MNX) (AS-MNX)
2	104.244.42.72 104.244.42.72	13414 (TWITTER) (TWITTER)
5	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
4	13.224.90.44 13.224.90.44	16509 (AMAZON-02) (AMAZON-02)
1	184.31.84.150 184.31.84.150	16625 (AKAMAI-AS) (AKAMAI-AS)
3	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:82a::2001	15169 (GOOGLE) (GOOGLE)
29	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
17	2a00:1450:400... 2a00:1450:4001:812::2001	15169 (GOOGLE) (GOOGLE)
25	2a00:1450:400... 2a00:1450:4001:803::2006	15169 (GOOGLE) (GOOGLE)
13 39	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
6 12	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
6 9	185.33.221.90 185.33.221.90	29990 (ASN-APPNEX) (ASN-APPNEX)
2	2a02:fa8:8806... 2a02:fa8:8806:12::1400	41041 (VCLK-EU-SE) (VCLK-EU-SE)
1	34.96.105.8 34.96.105.8	15169 (GOOGLE) (GOOGLE)
1 1	35.190.0.66 35.190.0.66	15169 (GOOGLE) (GOOGLE)
6 6	37.157.4.41 37.157.4.41	198622 (ADFORM) (ADFORM)
2 2	216.52.2.19 216.52.2.19	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
3 3	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
1 2	2001:678:cb4:... 2001:678:cb4:bbbb::11	56396 (TURN) (TURN)
4 4	18.158.226.176 18.158.226.176	16509 (AMAZON-02) (AMAZON-02)
1 1	85.114.159.118 85.114.159.118	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
2 2	18.195.239.175 18.195.239.175	16509 (AMAZON-02) (AMAZON-02)
2 2	185.64.190.78 185.64.190.78	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	35.186.193.173 35.186.193.173	15169 (GOOGLE) (GOOGLE)
1	2a05:d018:24:... 2a05:d018:24:b001:197c:8ea4:869f:2648	16509 (AMAZON-02) (AMAZON-02)
1 1	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
2 2	18.197.47.23 18.197.47.23	16509 (AMAZON-02) (AMAZON-02)
3	142.250.186.66 142.250.186.66	15169 (GOOGLE) (GOOGLE)
182	34

2 172.67.72.27 (United States)

ASN13335 (CLOUDFLARENET, US)

prnt.sc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 104.23.139.12 (United States)

ASN13335 (CLOUDFLARENET, US)

st.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2190:c400:9:46dc:4700:93a1 (United States)

ASN16509 (AMAZON-02, US)

quantcast.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.139.242.3 (United States)

ASN33438 (HIGHWINDS2, US)

cdn.ad4game.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2190:d800:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany) 1 redirects

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.207.255.147 (United States)

ASN62821 (AS-MNX, US)
PTR: haproxy2.ad4game.com

ads.ad4game.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.72 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.224.90.44 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-90-44.zrh50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.31.84.150 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-31-84-150.deploy.static.akamaitechnologies.com

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:812::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 2a00:1450:4001:803::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 142.250.186.130 (United States) 13 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2.18.234.21 (Frankfurt am Main, Germany) 6 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 185.33.221.90 (Amsterdam, Netherlands) 6 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:fa8:8806:12::1400 (United States)

ASN41041 (VCLK-EU-SE, US)

dclk-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.105.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.105.96.34.bc.googleusercontent.com

tr.blismedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.0.66 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 66.0.190.35.bc.googleusercontent.com

ads.travelaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 37.157.4.41 (Denmark) 6 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.52.2.19 (United States) 2 redirects

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.126.56.137 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:678:cb4:bbbb::11 (United Kingdom) 1 redirects

ASN56396 (TURN, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.158.226.176 (Frankfurt am Main, Germany) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-226-176.eu-central-1.compute.amazonaws.com

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.114.159.118 (Schopfheim, Germany) 1 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com

dsp.adfarm1.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.195.239.175 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-239-175.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.190.78 (United Kingdom) 2 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.193.173 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com

gcm.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d018:24:b001:197c:8ea4:869f:2648 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

sync.tidaltv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::8000 (Dublin, Ireland) 1 redirects

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.197.47.23 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-47-23.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net

ade.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
53	googlesyndication.com 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com ade.googlesyndication.com	287 KB
49	doubleclick.net 13 redirects stats.g.doubleclick.net securepubads.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net googleads4.g.doubleclick.net	226 KB
25	2mdn.net s0.2mdn.net	565 KB
13	casalemedia.com 6 redirects htlb.casalemedia.com dsum-sec.casalemedia.com	11 KB
11	prntscr.com st.prntscr.com image.prntscr.com Failed
9	adnxs.com 6 redirects ib.adnxs.com	8 KB
6	adform.net 6 redirects c1.adform.net	3 KB
6	twitter.com platform.twitter.com syndication.twitter.com	148 KB
5	googletagservices.com www.googletagservices.com	164 KB
5	facebook.com 1 redirects www.facebook.com	2 KB
4	w55c.net 4 redirects pm.w55c.net	4 KB
4	yahoo.com 4 redirects ups.analytics.yahoo.com pr-bh.ybp.yahoo.com	4 KB
4	amazon-adsystem.com c.amazon-adsystem.com	36 KB
4	google.com www.google.com adservice.google.com	760 B
4	ad4game.com cdn.ad4game.com ads.ad4game.com	105 KB
2	advertising.com 2 redirects pixel.advertising.com	941 B
2	pubmatic.com 2 redirects image6.pubmatic.com	1 KB
2	bidswitch.net 2 redirects x.bidswitch.net	1 KB
2	turn.com 1 redirects ad.turn.com r.turn.com	857 B
2	lijit.com 2 redirects ap.lijit.com	1 KB
2	dotomi.com dclk-match.dotomi.com	207 B
2	quantcount.com rules.quantcount.com pixel.quantcount.com	562 B
2	google.de www.google.de adservice.google.de	229 B
2	facebook.net connect.facebook.net	69 KB
2	consensu.org quantcast.mgr.consensu.org	49 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	prnt.sc prnt.sc	21 KB
1	tidaltv.com sync.tidaltv.com	217 B
1	ctnsnet.com 1 redirects gcm.ctnsnet.com	479 B
1	adition.com 1 redirects dsp.adfarm1.adition.com	584 B
1	travelaudience.com 1 redirects ads.travelaudience.com	609 B
1	blismedia.com tr.blismedia.com	137 B
1	quantserve.com secure.quantserve.com	9 KB
182	33

	Domain	Requested by
33	cm.g.doubleclick.net	13 redirects googleads.g.doubleclick.net 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
29	pagead2.googlesyndication.com	securepubads.g.doubleclick.net prnt.sc 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com s0.2mdn.net www.googletagservices.com
25	s0.2mdn.net	prnt.sc s0.2mdn.net 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
17	tpc.googlesyndication.com	prnt.sc 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com securepubads.g.doubleclick.net tpc.googlesyndication.com s0.2mdn.net
12	dsum-sec.casalemedia.com	6 redirects googleads.g.doubleclick.net
11	st.prntscr.com	prnt.sc
9	ib.adnxs.com	6 redirects googleads.g.doubleclick.net
6	c1.adform.net	6 redirects
6	googleads4.g.doubleclick.net	prnt.sc
6	googleads.g.doubleclick.net	prnt.sc 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
5	www.googletagservices.com	ads.ad4game.com securepubads.g.doubleclick.net prnt.sc 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
5	www.facebook.com	1 redirects connect.facebook.net
4	pm.w55c.net	4 redirects
4	1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
4	c.amazon-adsystem.com	ads.ad4game.com c.amazon-adsystem.com
4	platform.twitter.com	prnt.sc platform.twitter.com
3	ade.googlesyndication.com
3	ups.analytics.yahoo.com	3 redirects
3	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net
3	www.google.com	prnt.sc 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com tpc.googlesyndication.com
2	pixel.advertising.com	2 redirects
2	image6.pubmatic.com	2 redirects
2	x.bidswitch.net	2 redirects
2	ap.lijit.com	2 redirects
2	dclk-match.dotomi.com	1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
2	syndication.twitter.com	platform.twitter.com prnt.sc
2	ads.ad4game.com	cdn.ad4game.com
2	connect.facebook.net	prnt.sc connect.facebook.net
2	cdn.ad4game.com	prnt.sc cdn.ad4game.com
2	quantcast.mgr.consensu.org	prnt.sc quantcast.mgr.consensu.org
2	www.google-analytics.com	prnt.sc www.google-analytics.com
2	prnt.sc	prnt.sc
1	pr-bh.ybp.yahoo.com	1 redirects
1	sync.tidaltv.com	1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
1	gcm.ctnsnet.com	1 redirects
1	dsp.adfarm1.adition.com	1 redirects
1	r.turn.com	1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
1	ad.turn.com	1 redirects
1	ads.travelaudience.com	1 redirects
1	tr.blismedia.com	1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	htlb.casalemedia.com	cdn.ad4game.com
1	pixel.quantcount.com	prnt.sc
1	rules.quantcount.com	secure.quantserve.com
1	www.google.de	prnt.sc
1	stats.g.doubleclick.net	www.google-analytics.com
1	secure.quantserve.com	quantcast.mgr.consensu.org
0	image.prntscr.com Failed	prnt.sc
182	49

This site contains links to these domains. Also see Links.

Domain
app.prntscr.com
prntscr.com
twitter.com
www.facebook.com
www.google.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-17` - `2022-06-16`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
quantcast.mgr.consensu.org Amazon	`2021-04-24` - `2022-05-23`	a year	crt.sh
*.ad4game.com Go Daddy Secure Certificate Authority - G2	`2019-11-17` - `2022-01-16`	2 years	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-07-20` - `2021-10-18`	3 months	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-05` - `2021-11-09`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
syndication.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
c.amazon-adsystem.com Amazon	`2021-07-06` - `2022-06-27`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.google.de GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2021-08-10` - `2022-09-11`	a year	crt.sh
tr.blismedia.com GTS CA 1D4	`2021-06-29` - `2021-09-27`	3 months	crt.sh
*.turn.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2021-03-31` - `2022-03-31`	a year	crt.sh
*.tidaltv.com Sectigo RSA Domain Validation Secure Server CA	`2020-06-04` - `2022-06-04`	2 years	crt.sh

This page contains 29 frames:

Primary Page: https://prnt.sc/12zoygy
Frame ID: 9C1A9CD13957EB989210493F94D53A19
Requests: 49 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html?origin=https%3A%2F%2Fprnt.sc
Frame ID: 61AEDBF618E4CD1A6048A3BBF5DC479B
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?action=like&app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df79a8da0b52e1%26domain%3Dprnt.sc%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff24f7fbd1ab9df8%26relation%3Dparent.parent&container_width=1584&href=https%3A%2F%2Fprnt.sc%2F12zoygy&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&width=100
Frame ID: E3E32129D62E1FD21EB3CCED00E48CE8
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/comments.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df7d75e005d2bbc%26domain%3Dprnt.sc%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff24f7fbd1ab9df8%26relation%3Dparent.parent&container_width=1584&height=100&href=https%3A%2F%2Fprnt.sc%2F12zoygy&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=12zoygy
Frame ID: DD6697AE0C174EB8E31791F1BEBF4F87
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%3D154822244543652%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dfdbbb340c86cfc%2526domain%253Dprnt.sc%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fprnt.sc%25252Ff24f7fbd1ab9df8%2526relation%253Dparent.parent%26container_width%3D0%26header%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpages%252FLightShot%252F242750885760%26locale%3Den_US%26sdk%3Djoey%26show_faces%3Dtrue%26stream%3Dfalse%26width%3D300
Frame ID: 1722D397761402C2824478B079D99BB1
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.f88235f49a156f8b4cab34c7bc1a0acc.en.html
Frame ID: 2DC0BFC90033F523C2E303180232D88B
Requests: 2 HTTP requests in this frame

Frame: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 92A78894F4383E8AE4ECA799016FAAD1
Requests: 1 HTTP requests in this frame

Frame: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: D0CBDA0899575A08BF4FBC03D6203523
Requests: 1 HTTP requests in this frame

Frame: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 781A1F625D8915C6B76EBF75F7AA63BD
Requests: 1 HTTP requests in this frame

Frame: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: E2A5930536EBA8D45F5ED2C6FD83C4DD
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKjs5gIQ8LPQ_AEY64C2rgEwAQ&v=APEucNVk_mwbVQ7Q6EA8oKgBuQ-oU0wGMwAd0g4uCO3EnG7VUQzrkH5PFEJDkp8VKdaoNKUzLLgeEDM_Z8Gn2bvTXkeZY1j30GbNMMonmYc9w5pc9UgJpGYOLPIbmTH93W_M6K1SPtBUvMpDT2TbVb-cYdERjh3tH4a85P0dwbBSBLtPnFZ1H5s
Frame ID: 45547D2E10A17DA99B9D7AC1A9A36EFB
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B4ubndSXYO74QyH0w1Jf8bjvZMX5wBHmpL8a9jNKIqb_paz0EBAblENSS2HlbvVvH237MSrcfDkwlEN8vb4sZNjE53ifJx2ej88E8J1lYyBWl0U1MGOHnpkjNkj7cbGYoT8wYc1z92xAqCjDVNaNuAnUNVEw&dbm_d=AKAmf-AeHT2ytAJqPmdpCxRB-5LGi_J4MRceBNz6HfQc0vhZ_uMbx5eJvyvWxgs17uUggkzX_wlGPGCCUvr8Lr6e2YZOzvCYTNCOjGWNCW9w-NBw1MLTe6g7IG8eTETKXQyKzd6_oOQeyb9a3khdUOl5UOVoMjjAloSkGoTRb6NPPwm47jtVwfNMMXz8gHos2ZScoevs_E_MdSOnZsKkxaIyo3rNSCosWkZF77N4l8_FWjwKbcdqGacK9w9T6SPCw0wQwXaAUWRcw08mcR2JZA0oWQ4QRDYbo9QrYcA8JP0mDsfykj9PPDiNQlA03E0UPEerUsCyyXPfbJk0tIGuopbBRpS22Nq9ABOwkW3KanpUn5BQLUKWjPtyoQMUlgF6HOXZunExue9aawmaJzPbS7wkAAW_MXEsBLMPwmsk062dbdejgaSgIPXFfH56FGGyMlxl-tjaVBFALw3Kma2zx4HLCD_0C33HDXLLK2HnjGMRUYeNdGmUykXgnpEktnpXUoMRNS9RRUyopExxw7O81QHLOPPeVNI7CPi2mxyB_lrubgNGec9HEuGZnfC4b28j8Ns_KTylZMDmTiFYzBJ5ROYRqrp4B9gizE8O5WnrM1O91-bpvDAMinbD1sQDfWXqHtPxkaGcjRB7LFXZw5ycTHqw9IHfmzYWBMB542FHgcwg03zXFYq_h8ex_Ft6PV6C4u8bzTQjAisyJV8YpAe9jE8eoALHQJspDN6XopmLLBatPtajAApLVqcUdeP73nwHt-cOswtpkq6y6ZSXQ-X7P05pX4cVtkknkf66MAMpcUmXT4sCtzcS_aiwr8xMW77FH95CefJ2yGqkj6RDx-0mIcvch6cJq51bAF2tdzVDVASqJW9RhiwAasIJ9h5F-sO18FRz1aJIYEgyIEhV9Puuf6FL2G4QA8wJmSyzniPguxxcaG40IMiDl3_XUX4p8Gj2FFctu5yeJrJTegjoAAofBHuhP1bdpUUKqBemveVkOLPsyiNS_iq2kCY1YZgyQWNsUPgfmvBydhkRCvg8GLwSAm74eT-Ay41OnKn4f55AJBoRG-dz99QmJ1P7RbuxXuNg_OqH1dP-1Gu_smEyQwqs_h9AAaqnYELnWUtWLcQK7Ys99A-JQJCbMxXo18ERV02m0UzQzGrWJfNsnPEYkx-r7V_DWNo_-jnUjmiQI6Ewdlei1EcFUNG7LdkMrDrMe-FYTln9kp5wcsv_GzvoY0TD2nDbb7SU4bdJg6Yzb_vGiys1IG1mxzFr2Lxx2BjHvdmTRAhraja7Z86U1vrx64zCyin7XugEvI41k1o5DX3vc1wLI6Cg56FuDzhTcmk5M-z45iRO6uolVo-KFL0VzAuxZEgFjswAG_fLs_x9cMpDvX5RtE51DsaqKWPPRYX9t60wLIhRSN2MLWvYBz-MBqyMq5TvNpZ_Sytq4eupHa3HgxUtwUyGn3Mk00uOHHcEH038hhQCKn-oQiZaFDmfJyl_Q9xBuF1X6-nZNrRkZLDaBpjfD8ijBeEFX42KaTkkiui2bksZd-w5x5HHE85xH4eHZB9cXRX5328dhDey7PYS_7eV489DsJxqUju9b8qN0yQyiaANBnPas-yVWvEFgYRzbuKRso7pN5POWLMWI4WDHmtZ3C-ZL2VjpGw8phnkqNV3yqnKCgjFwSmhSqNNzEWl_w9lENy79uPmxHIWT43pPJ4-6TR1WyPBoGskbltZJvCqVrEGRJvAsobd9-JQQQ51zc0CJTSSusu1sK3Ed8VHYZnm0szQp4CouRk7oe5T-jgACgJoRoqxkDctju2otZZ9NeoKZ7QJ-caOoAPyCiNTZfKmu1eCzJ6QDV92WaYOmfVh2VHOLr7Ilc0jEpSR0cqmu-jBysD9FLohHTg87rnaexLXthzu4HIp4uxlL26-x1gVQ8PNYoxekwqSZkAg4HttaX3QQSfaveo5N7-c1lD9bsV7QyKjwtkZdAmsNej-PZYxvdj-r3O7GPOy4hTj4_LocEzqg8Jk-LfZxaDr-Y1vkbZvpdmPidHq_oSWb1o528ZRIWQCR09l0ZPjWDQ934cxZSe5wR-UN0Wm1ZNsX_xa_9HgOIWwKXuZwffFIHG5x_hOpny7XlYs8wN7zzM_RmvlHtZ6xC7d14BOQKiXgKIBieQNb84DhqNCPwqGVjyK2JVBfw3_3c-yMSD69gtVuZyzm5BEaUgqYU1sONjXBtZGUUOsC4PC0rWUdSiwqJK3mF6lYSo3C4H7KeDoK6o7tQPyssZNgSq4njvKjxAVooZdicBx_e3-uERMkdGAKf5AgPzA_xtG8QhqkwuS__uELiZ_DqCPD_cULYnqt9OclTH-PYGbO_Wqp-p163g0TSWADK4ry2iUOB5oHMSDNCVlPSwyR7kuXWBCbeKMpC3UireDVPW-3u_iJoj7clkbjALW30AILeNXSl6Dm3KfM0QcGfplqZV8qZyCXKZyZJu9mmFkbNiJLkJxjG6N3qS5iG_kEHiW4qBbB_8GN_A4WbKDrBNS2h4BzAn0C-3FZsEPKBwgGSfmGvfl_CmZnAHiv4EQIf4Ne6a9wK9gHqfJxzVT7gMQzX7i7jF3vRpdDMcnb8QE_OrJlbrBygw2GZhdj2UeupT9kjCfZTdpoU-AxnkcNtDdzGPTDeDN-aWhrW1Zv2fweH5cE4M6DDlIFenFcg7bnf1X1oYgQT8GlhkOLTXbaMYAgamXrzoQ_J1AZuj2Pyt9J8PVH0G3UgY7o5xyMHDWlzB0TKwHjp8tk1adX28UWFRMtSCH0MZPH8gu3lkS0hwxr6uddSQtZdU0_Ev3NPg7fzX6jB65lFef7vkKptsFe4KVPegW2Yil90K4Ucn7xcc6mE0wl4A6lsZCmBvm3NjPfBs2kmgzPQ5zUO88Gumu3FmlXdScSQyEAQHKVjOsAzR0pAMkSlqN87FEUH8&cid=CAASEuRo_lwU7a202w7a5FbEio47eA&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240
Frame ID: 16F541D6AC63FE74C89BD5F92AD42349
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKjs5gIQ8LPQ_AEYnoC2rgEwAQ&v=APEucNUjbMlmaAUbjoaTa9rbP_RtgNgBxxqxUUeKoQ8fEoM8NKvRKsqdLCdEp5CP9C8AQFKPolAH-xQEkHzkYpywSsePB_253SmJG_94M0uljkCzuErcE6Hux5ljHJyf4ZA0KqOvRZdZOY9IkgFJJYIR6AKVO6DlsLLUVDUtwTdsshDqEE4tQcs
Frame ID: BC9565633751DFB7CE371331564F3992
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKjs5gIQ8LPQ_AEY64C2rgEwAQ&v=APEucNWazA_19L_NHZZVF_lArzGfd4VAvWi2ekvBkE_O2RL7A6cq1NoT9YCfVKSIbt9xQmFIp7b9Zwla1HqoFFYe7Ofnd-HynmBiXVDDQIHDJGdlDARCLIiFSEEdCfCKK8xPXR7NVukSu653FBPbt6xRI-CiW1P7fYf736NimD4OZ98prGsN-Do
Frame ID: 9DEB1E3C4F70539C4959963B287AA129
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C61NNBwpKzbZNk7MiSYOB4UmumU_YKOdhlqwZdBW-Ww_dSRy62XlfrFq5mqlFPBeRIuGg3ttnIB6kM3VypIx5PmrP33FUxl0A48J645BOUFpu80J7fOf_TXQv5yQLB8uu9l0Hw0wGcxmRyP02WIjaAKqwLhg&dbm_d=AKAmf-A6MjSyVIY1bmtCsc7mL3CiS8kQfVXYPjF_SE8dC9JrTXPrPsohRIkEjfP942jnxKD3XBmZ4SdpPhnpfv-O0VDukGacffN0X7Zar1i0ahrl9q_gc7WbfeKMB_Mq_M8VCYEuuulN0bF7TuhtWmFooykpd1sKU-znhVhjWvX0vRa3I3Xf9nHeDCN7wKMXmpfGHxAOw1OQ-Vx7gc-lipxSkveN4wvNsWS4rRo9xMmV5c2mw5MNsEg4QxvMiZTCaMPGw_rCYyldDhb2BJYxk4LqATHNQ0jI3BdeocIl4AtPvMyFxNBy4IeXUvvI-drRqlq6Toc8IRjv9wZ7R-ue5_NL_DsKQAHSo6zVdpPNjca7HU2LF0oYhJEMhacwhfK-6VgrALNZjUzToMoY7G3BQYhZhOdD3vEslhDITQRbHXu_MYngtB4SnhTsG1naAAxOZCWpuYH9Wdq0Nbw97nP0COrPn2rTdS4tb4vbBFezaCwR590sEvlkjK7NARGV8vpTGuBUnGwYn8QSvTcIIsvVkwI7uBPc4i7LSg8BDRV_PcSTD_lcuJN5EuSTY0g0i7eGfn9sOdWEvUy-Nr8xWcMcIe4uZCQ4AKHU41T-6FixUPjZL0-3fL_tUZZ8HUlgBL2BZLDt1Pes4yRvwNiE5dvN5QFTCZgFn0gfAWdCo1pY_RlGEr5vaiHm39E8Sawdl6M3ifWrThoqtYzgFFWNkLjUBn9GgUedxXgTICFB4Ii4QiUqkFZ3KDnOTjjfMilVXiQkaU_pF1t4xEoXsnKwjjrCiX1pa8Ehpw8Fuvxae4aTu6W3zIdBgQeZJOtSEUFZ6jMdJk0WZr6AgvHT52tYpt40I18-eRyLUFRS7Oc42y-RL5ReCqyNTAPms1OubMGJvl0C7byvQnlEpOvrolSeeP6IyiZSuC0tKqv097SlHTo5N8hgWoMHsA2MADvNcR4faZfnh4FJ7syIVsA82JTlvhDMA2Fff6OAm7llWK2abGYNPJk936Hb2zEN2O52Abnbgse9L3APTmwTNZINrjHxarNsnqMmUY8SHhjy3mrwXu3KjEXq9iRWchP34mcJfCF39k9JaC7B6hmzEMTL3HOW8Hvxfys07u8R5timhOhhrIkrXtCBDWMCEVep4ZPExQdVEjQmrGXu4nGgiru_B0BQXNMNTLYgaXJPmfdelN5-X49zML5Gzlj6B_GWYFehhQnSN9cYWsqRd-_qK-EcIXW435r9luuptcd2ofnd6iJVkU-XYD1h-4lAa_603mFgvWEkYXIvBEsBiTOhTgz30OrwTuDcu2JQB-uIuu-sbbYYqeZmps8UMkhfjGKh_m2WEIO90aEQufAl0VK3um2Bz4ErIuU4U_6ig6ID_VBtzrszRPPnYZwIjLn77AYil_a5dZkuDCuXpX-blHIgvth6QBd-sIHYYmXc0wNEo47pVDaz48tsv_tF6fKTPtmRltXTh99KZzSu-ZwP_esz09Xj_u_PKMJtFv254dEUyYB5g6sKGjiXMBBfrw79YPWMB3fTQajGU9JvYsbih6QJB-eOsQ4gfVsPEi2kapan1tRT9KrdCgQwV50z42yjc9PEhI4lNPM9St9sWtgFFRVDTi7Ft8jDTAlfzE12VYIY3mBvAj3nF71t43KhGcnxyGiy7QPqind1fF3FoThtcjltQPg9kqxO9HS1SLD1AfWIylDnsPNL9Jk_y51MMmr2rJaxd69f97GH08za7NulESifXQT-ZlTUDT26QvAt2kyNbJqJ9RW2tQO6_hkxKAvUM1NYuxHkplaz5y-YfgqP-BvidTL9QfnA3AQzRB8qaIQxt0bzCXqk8P0r4aXuATcZVQwMoF0wCoFTV0F9ytLdB0wpof4UcyfEY6zf6ewSJuvibOjUP-IZwfP0DVPymU5-xMJ-3VUTr6-598Di_yRm0mDlavEz4IjgF_MtfBjz6O-P4tXcGzX6NQUoE4bFlxPuT8rwC9N9uthjtfs4AHEiNnINSQqDb5VjAQJPUwpa7Q4sELqKnbfLuvErwLU2y_ThUv0MVRW32rh2rzzZyQ-ZoGL3jULFCtbEdFC8LP2_u-gbiUDMM1-ZFlbSMokZYGMXwvq_WFy4JY9fCiYJLpBFHYZPoJBSDN6gjHw9hA06wZn4Z4lHb_8SPMRC_hyqYBdHUlcaptC85YWuZA2Z8j5XYEEs4aWSeHNz2cah4KWIkGk_b4TTRvTbJWANMdV2mp3_HboQ9h-jpV98XdJiFtje13JVztvyJmcp0l-Ndtg3b5RIIUFWdszL6cOlT24zi4TsjOo08rc30ByvwPChMIfLrEIAKKd08YsSoHRJ4l5fa90FSQw2jcRoCSZSBTI-GlkigatSbgPvimdX5JorTR9PHsWdeNVOFh8IAGLcI-hNjfb5CqtgAFo48gh1aIfwg-iQMPnUxNiYhasDnyYZLp8O8UHFsfweKbpkgH1jaM9WZvnYvtLiA4ZtPYw5Mq1igOITCjka9le2NaE31_L2gIES8HapWiXHr1dtLuYPl_yyXoQzxkqC2yGASTfWRPo2sN0kfYv-HnQHd-sE8MXssPwmIzmZqRau1WCuxE9HER_2SxQyqRVOj1AXcwL1yrdbRxcuyQ1pDsl40jABUcT_QBxSzMZDNLj_mOX7L6bxGKtlWznNl2DNyOL6Olwuwo0qCQ7bkAg_tpHqSeZaMy9kHUd-Gcy_u7sRihcckwIff1h-urrjzmIwOMh_x6qiP3RCJhxVtjOL_L8VXkE5iHKkK8H9_RyR0TT3KruUJcLJ5QWkaW7LznvkpD2U5V28rhfDUkif00pRoTfQHlkJiRKhN4XgPVps9-kSZmczofaZ4bOaUBYiUa9TKZj21Tr9LBxpfbWJcwzGAtz5EgxQzbVYPE-k7RHbe-fHJNfLhZutB1yXDy9kuiL_ab6-CgqU6N0AGH6TWo2AGqQ&cid=CAASEuRon7wGfKYAtTl-g2vzjlBDFg&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240
Frame ID: C8F8168234E3FBB4601B0D181FDD47CB
Requests: 14 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 662C8290CCD69CFF93B376129B91996C
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 2CDB5AEBF5C8508DF284D692B10A85B5
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: A3F06F1E467EDC5EDE8CF17E31F0DBCB
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: BD16EB7F06D5AA24E137C28FEFC55B0C
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: BEAC771F824DD50A973F243BF1316389
Requests: 9 HTTP requests in this frame

Frame: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=a08xP1Y3mD&t=1&renderingType=2
Frame ID: 1A2AE10EED986EF8C609F47F94E01B34
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 60E3E7FC881C5EF61C6DFCAA27583B38
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=HNi5h9qWca&t=1&renderingType=2
Frame ID: B66A9D636B1FD2D3671D70E3E5E8B2FA
Requests: 9 HTTP requests in this frame

Frame: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/index.html?e=69&leftOffset=0&topOffset=0&c=x8gZlaZcXx&t=1&renderingType=2
Frame ID: AF32771E95BC86A244701A7807F5919C
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 39119EDEEE64EA306BB6A128AD031321
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 09D9A10EB324FE61255577CAFF8DF04D
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js
Frame ID: 6F4013C9F2C7086BF8C6C3753A9B4B6E
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js
Frame ID: 1C77C0022EDFC0AF68AED8F295B2BEDD
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js
Frame ID: F7CED5E21CA4E9AD2F54DB32770EBFD6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /\/prebid\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/platform\.twitter\.com\/widgets\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

182
Requests

99 %
HTTPS

48 %
IPv6

33
Domains

49
Subdomains

34
IPs

7
Countries

1710 kB
Transfer

4619 kB
Size

4
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://app.prntscr.com/translate-lightshot.html
Title: Add your language

Search URL Search Domain Scan URL

URL: https://prntscr.com/gallery.html
Title: Sign in

Search URL Search Domain Scan URL

URL: https://twitter.com/Light_shot

Search URL Search Domain Scan URL

URL: http://www.facebook.com/Lighshot

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/
Title: Captured with Lightshot

Search URL Search Domain Scan URL

URL: http://www.google.com/searchbyimage?image_url=https://image.prntscr.com/image/wlgiIuLMQh6vDb1oLzWJXg.png
Title: find similar

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/download.html
Title: Download

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/tutorials.html
Title: Tutorials

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/privacy.html
Title: Privacy

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/faq.html
Title: FAQ

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/help.html
Title: Help

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/advertise.html
Title: Advertise

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 32

https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfdbbb340c86cfc%26domain%3Dprnt.sc%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff24f7fbd1ab9df8%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300 HTTP 302
https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%3D154822244543652%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dfdbbb340c86cfc%2526domain%253Dprnt.sc%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fprnt.sc%25252Ff24f7fbd1ab9df8%2526relation%253Dparent.parent%26container_width%3D0%26header%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpages%252FLightShot%252F242750885760%26locale%3Den_US%26sdk%3Djoey%26show_faces%3Dtrue%26stream%3Dfalse%26width%3D300

Request Chain 88

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1

Request Chain 89

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YR11yQCSENnTX2N5G6a3RQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1

Request Chain 90

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEGIxramnKgnTRcQ7FUs37qY&google_cver=1

Request Chain 91

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTcxNDkyMjEzNjI1OTk3NzcyMQ%3D%3D

Request Chain 92

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1

Request Chain 93

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YR11yQCSENnTX2N5G6a3RQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1

Request Chain 94

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEGIxramnKgnTRcQ7FUs37qY&google_cver=1

Request Chain 95

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTcxNDkyMjEzNjI1OTk3NzcyMQ%3D%3D

Request Chain 96

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1

Request Chain 97

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YR11yQCSENnTX2N5G6a3RQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1

Request Chain 98

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEGIxramnKgnTRcQ7FUs37qY&google_cver=1

Request Chain 99

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTcxNDkyMjEzNjI1OTk3NzcyMQ%3D%3D

Request Chain 120

https://ads.travelaudience.com/google_pixel?google_gid=CAESEAqr77fXe4fP6heV0QR16Eo&google_cver=1&google_push=AYg5qPKZEBRBKPOmOlsK1qcrOQ-9jVkeV104RzPsKa6vmq_2T50AcfIp0gasnJJVcq4ry92eZUPHkpjU5pI0mvxNYr7Bd94n5PM HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=VZ4Lp6WDRgW1-olS4_ViRQ2&google_push=AYg5qPKZEBRBKPOmOlsK1qcrOQ-9jVkeV104RzPsKa6vmq_2T50AcfIp0gasnJJVcq4ry92eZUPHkpjU5pI0mvxNYr7Bd94n5PM

Request Chain 121

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEKMR5yVOb2fWHTYQpj9eFmY&google_cver=1&google_push=AYg5qPJePSus5F8fpSp76cKkYrsMOfg4iOsRHoJ_9GjG9ZzeWb_TYXZg5BcDd1dz6Go12YL6-Ut3dasp7D3i5r8PgXPPBQSY3g HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEKMR5yVOb2fWHTYQpj9eFmY&google_cver=1&google_push=AYg5qPJePSus5F8fpSp76cKkYrsMOfg4iOsRHoJ_9GjG9ZzeWb_TYXZg5BcDd1dz6Go12YL6-Ut3dasp7D3i5r8PgXPPBQSY3g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTMzMTM1Mzk3MjU1MDI1Njk2MQ&google_push=AYg5qPJePSus5F8fpSp76cKkYrsMOfg4iOsRHoJ_9GjG9ZzeWb_TYXZg5BcDd1dz6Go12YL6-Ut3dasp7D3i5r8PgXPPBQSY3g

Request Chain 122

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI&google_cver=1&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI

Request Chain 123

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEMfhap0ebKSN5wnBfl6FT0Y&google_cver=1&google_push=AYg5qPLx1j7NIA5aTj0Z22d8cPJq6M0k1kAIrB0wxgzIW5gBgTnxPqgJZCYYiACP8USaq6tbZj4hIiR8hOXdausJHTPTJOPhkA HTTP 307
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEMfhap0ebKSN5wnBfl6FT0Y&google_cver=1&google_push=AYg5qPLx1j7NIA5aTj0Z22d8cPJq6M0k1kAIrB0wxgzIW5gBgTnxPqgJZCYYiACP8USaq6tbZj4hIiR8hOXdausJHTPTJOPhkA&sovrn_retry=true HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPLx1j7NIA5aTj0Z22d8cPJq6M0k1kAIrB0wxgzIW5gBgTnxPqgJZCYYiACP8USaq6tbZj4hIiR8hOXdausJHTPTJOPhkA&google_hm=6631b450101c1381fcb393bc

Request Chain 124

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEEVM4qUYM87KstToWpOI2aU&google_cver=1&google_push=AYg5qPK_ESyMYfYEmrCwyZbDZDHSkZd1MBcV6kjcR6kssL1EMeotRMD9kMitzaxTdELZsHyInh5a8wdzvFdzp42yXspM05J7zPlE HTTP 302
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEEVM4qUYM87KstToWpOI2aU&google_cver=1&google_push=AYg5qPK_ESyMYfYEmrCwyZbDZDHSkZd1MBcV6kjcR6kssL1EMeotRMD9kMitzaxTdELZsHyInh5a8wdzvFdzp42yXspM05J7zPlE&verify=true HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1DMFpPMVFORTJ1SGlyRTBicWo4LnhZUmtxdExPSDBoSn5B&google_push=AYg5qPK_ESyMYfYEmrCwyZbDZDHSkZd1MBcV6kjcR6kssL1EMeotRMD9kMitzaxTdELZsHyInh5a8wdzvFdzp42yXspM05J7zPlE

Request Chain 126

https://ad.turn.com/r/cs?pid=3&google_gid=CAESENryUbrFCL083UdK5XCci-4&google_cver=1&google_push=AYg5qPJ1HQVPsrbW3c7_xzc2Tw28xHciyG6aimDPoNQi-2lwbsrkzReRxGAfdb_0s_Fa5wqZsbbMzVjSRL2XAv5SC0Gm2TOtln1_ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDU3MzgwMzg5MTU5ODY2MTAzNw== HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESENryUbrFCL083UdK5XCci-4&google_cver=1

Request Chain 128

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cver=1&google_push=AYg5qPLkXuU6CD0kIWzrR-HULo_4e2DEvfxAWomEkVGE1X1nf_vlPzXzxS2pQbZLgUUXiwtZhgaX1O4OTvKYyKh3Gt5pX3dnyzte HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cver=1&google_push=AYg5qPLkXuU6CD0kIWzrR-HULo_4e2DEvfxAWomEkVGE1X1nf_vlPzXzxS2pQbZLgUUXiwtZhgaX1O4OTvKYyKh3Gt5pX3dnyzte HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=cEJKa09qUUwxTWdzSmo1&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cver=1&google_push=AYg5qPLkXuU6CD0kIWzrR-HULo_4e2DEvfxAWomEkVGE1X1nf_vlPzXzxS2pQbZLgUUXiwtZhgaX1O4OTvKYyKh3Gt5pX3dnyzte HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=cEJKa09qUUwxTWdzSmo1&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cver=1&google_push=AYg5qPLkXuU6CD0kIWzrR-HULo_4e2DEvfxAWomEkVGE1X1nf_vlPzXzxS2pQbZLgUUXiwtZhgaX1O4OTvKYyKh3Gt5pX3dnyzte&google_tc=

Request Chain 129

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEFfgEI2mdZRtzc1fjVgNoIs&google_cver=1&google_push=AYg5qPL4u3sEOoRAlPvw23UvtEweYT5juQ1DtBcD27Sp3PCcpGb3hTFD4qIfhzzhBCie8QvEYtQJuW3kONw1zGJmZQf6gPG6JEn3 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk5Nzg3ODkwMjE2NDc0ODQzOA%3D%3D&google_push=AYg5qPL4u3sEOoRAlPvw23UvtEweYT5juQ1DtBcD27Sp3PCcpGb3hTFD4qIfhzzhBCie8QvEYtQJuW3kONw1zGJmZQf6gPG6JEn3

Request Chain 130

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESENYyapL_gqCW6y3kEpZ2uDg&google_cver=1&google_push=AYg5qPLU6j3SdvOBoo2y9OgQ6EGtZppDeVDI3T4CUvrqeuD1X4AbfXtFd9j0718di7lzcQWJx_cr-uPypgdThJo0p1pmACsVJ2rXIg HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESENYyapL_gqCW6y3kEpZ2uDg&google_cver=1&google_push=AYg5qPLU6j3SdvOBoo2y9OgQ6EGtZppDeVDI3T4CUvrqeuD1X4AbfXtFd9j0718di7lzcQWJx_cr-uPypgdThJo0p1pmACsVJ2rXIg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPLU6j3SdvOBoo2y9OgQ6EGtZppDeVDI3T4CUvrqeuD1X4AbfXtFd9j0718di7lzcQWJx_cr-uPypgdThJo0p1pmACsVJ2rXIg&google_hm=AQU9mgC4Q76UBb2XNWbDTw==

Request Chain 131

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEKMR5yVOb2fWHTYQpj9eFmY&google_cver=1&google_push=AYg5qPJlaTdTe1JgsX-1-fbxGxiI1VfViPMz36gN-CYdJJ4IZGe79C2zI41vQWcZeNvy4hl1sdlJq8cQYYRaURGE3DVBfcO5d7CJkQ HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEKMR5yVOb2fWHTYQpj9eFmY&google_cver=1&google_push=AYg5qPJlaTdTe1JgsX-1-fbxGxiI1VfViPMz36gN-CYdJJ4IZGe79C2zI41vQWcZeNvy4hl1sdlJq8cQYYRaURGE3DVBfcO5d7CJkQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTA2MzkyMjgwNzg1NTkwNTk2NQ&google_push=AYg5qPJlaTdTe1JgsX-1-fbxGxiI1VfViPMz36gN-CYdJJ4IZGe79C2zI41vQWcZeNvy4hl1sdlJq8cQYYRaURGE3DVBfcO5d7CJkQ

Request Chain 132

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEP7Z8iD4k2kE-a8283B4TWA&google_cver=1&google_push=AYg5qPJpnnXMtig0rktUXffjhfENqZODCwGJ345LY-uigos0R-qsEty4FFSMTW7pkqaUluGaqxt_ml6JCq5WI2z74igBahgv8kbBCA HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEP7Z8iD4k2kE-a8283B4TWA&google_cver=1&google_push=AYg5qPJpnnXMtig0rktUXffjhfENqZODCwGJ345LY-uigos0R-qsEty4FFSMTW7pkqaUluGaqxt_ml6JCq5WI2z74igBahgv8kbBCA&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=lmsIvgWvQIytlmP5GffTJA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJpnnXMtig0rktUXffjhfENqZODCwGJ345LY-uigos0R-qsEty4FFSMTW7pkqaUluGaqxt_ml6JCq5WI2z74igBahgv8kbBCA

Request Chain 138

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cver=1&google_push=AYg5qPLzwXCiIcdxLUSPrddYe7jxTlKWjP3CF337ISz55icU3-X4lMcwKDOo8nf0NHWqI_bkLQ4Pne_sFmoQiU8thSzHtR8MtKeE3g HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cver=1&google_push=AYg5qPLzwXCiIcdxLUSPrddYe7jxTlKWjP3CF337ISz55icU3-X4lMcwKDOo8nf0NHWqI_bkLQ4Pne_sFmoQiU8thSzHtR8MtKeE3g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=cEJKa09qUUwxTWdzSmo1&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cver=1&google_push=AYg5qPLzwXCiIcdxLUSPrddYe7jxTlKWjP3CF337ISz55icU3-X4lMcwKDOo8nf0NHWqI_bkLQ4Pne_sFmoQiU8thSzHtR8MtKeE3g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=cEJKa09qUUwxTWdzSmo1&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cver=1&google_push=AYg5qPLzwXCiIcdxLUSPrddYe7jxTlKWjP3CF337ISz55icU3-X4lMcwKDOo8nf0NHWqI_bkLQ4Pne_sFmoQiU8thSzHtR8MtKeE3g&google_tc=

Request Chain 139

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEHxVWL6QF6oGet_pkVCqeXw&google_cver=1&google_push=AYg5qPL-aNlxIkfDhyp07el_IC72BDpSI7csYZOecjoCAgQpDrcC4Tl7hQln29Coz36zfutIKweclbs_mu4A_nUXJvWgQyb3hvhNtA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPL-aNlxIkfDhyp07el_IC72BDpSI7csYZOecjoCAgQpDrcC4Tl7hQln29Coz36zfutIKweclbs_mu4A_nUXJvWgQyb3hvhNtA&google_hm=y-rQz2-SQaCypHeQkopngzU

Request Chain 141

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESENg3GiCqz2yLP1T5U0S8kCI&google_cver=1&google_push=AYg5qPJPolXR6i0d0RB3MpagWJXoYY4jRA4PfT4irtSMq3K8Zx6G1H0Rajlfvxnfknex-24rFI_6RuLbhD8Ioa6N6M7T9qA-GxfrgA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJPolXR6i0d0RB3MpagWJXoYY4jRA4PfT4irtSMq3K8Zx6G1H0Rajlfvxnfknex-24rFI_6RuLbhD8Ioa6N6M7T9qA-GxfrgA&google_hm=NDg2MjcyNzM0NzkyOTc3NDk0NQ%3D%3D

Request Chain 142

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEKMR5yVOb2fWHTYQpj9eFmY&google_cver=1&google_push=AYg5qPLzD2AwlNpOs1-PdD2iwTCMbsKFv-afi8ShYzMEQzhUABQ7ofh_BRAwKPcNmiCYvz8l9p0Ygx1tIDZIxp_IJWLv4Yy75EqSwA HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEKMR5yVOb2fWHTYQpj9eFmY&google_cver=1&google_push=AYg5qPLzD2AwlNpOs1-PdD2iwTCMbsKFv-afi8ShYzMEQzhUABQ7ofh_BRAwKPcNmiCYvz8l9p0Ygx1tIDZIxp_IJWLv4Yy75EqSwA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDAzNDg0OTE5Nzg5MTA1MDkwOA&google_push=AYg5qPLzD2AwlNpOs1-PdD2iwTCMbsKFv-afi8ShYzMEQzhUABQ7ofh_BRAwKPcNmiCYvz8l9p0Ygx1tIDZIxp_IJWLv4Yy75EqSwA

Request Chain 143

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEGPDuD2BbIrPTZmNuK_aPLs&google_cver=1&google_push=AYg5qPKtPYfTTYTCOpOe3AHNWD5AGXo4Wj37NwVQcgDwcwKpgxId-S2lcyhgxnynltnd2BJcOA8YJKkNVBM3ut2kEpJHiwvAtKHOyMw HTTP 302
https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEGPDuD2BbIrPTZmNuK_aPLs&google_cver=1&google_push=AYg5qPKtPYfTTYTCOpOe3AHNWD5AGXo4Wj37NwVQcgDwcwKpgxId-S2lcyhgxnynltnd2BJcOA8YJKkNVBM3ut2kEpJHiwvAtKHOyMw&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEGPDuD2BbIrPTZmNuK_aPLs&google_cver=1&google_push=AYg5qPKtPYfTTYTCOpOe3AHNWD5AGXo4Wj37NwVQcgDwcwKpgxId-S2lcyhgxnynltnd2BJcOA8YJKkNVBM3ut2kEpJHiwvAtKHOyMw&apid=UPd4ed373b-0067-11ec-a66e-02ca75180a64 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBkNGVkMzczYi0wMDY3LTExZWMtYTY2ZS0wMmNhNzUxODBhNjQ%3D&google_push=AYg5qPKtPYfTTYTCOpOe3AHNWD5AGXo4Wj37NwVQcgDwcwKpgxId-S2lcyhgxnynltnd2BJcOA8YJKkNVBM3ut2kEpJHiwvAtKHOyMw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBkNGVkMzczYi0wMDY3LTExZWMtYTY2ZS0wMmNhNzUxODBhNjQ%3D&google_push=AYg5qPKtPYfTTYTCOpOe3AHNWD5AGXo4Wj37NwVQcgDwcwKpgxId-S2lcyhgxnynltnd2BJcOA8YJKkNVBM3ut2kEpJHiwvAtKHOyMw&google_tc=

182 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 12zoygy Show response
prnt.sc/ 16 KB
5 KB 304ms
203ms Document
text/html 172.67.72.27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://prnt.sc/12zoygy

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.72.27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67282d6d885c8609168726ce9e9b211bbaa220a668b4ebd798b935d457804564

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: prnt.sc
:scheme: https
:path: /12zoygy
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:06 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8HKY6xplcVdPuCvXA1CTEzdwCYQlLtVoj1gJqGrYKc0%2F9M1gI7Igy3oZ21xqt%2FALRpnu0a5O%2BgzqnYSneB6cip%2BAE4hgVXGsXE4NlA%2BEr1kkTKGrY00Rvpo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 680e17ba4d7bc76d-AMS
content-encoding: br

GET
H2 403 main.css
st.prntscr.com/2021/04/08/1538/css/ 0
0 91ms
36ms Stylesheet
text/html 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Requested by: Host: prnt.sc
URL: https://prnt.sc/12zoygy
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 jquery.1.8.2.min.js
st.prntscr.com/2021/04/08/1538/js/ 0
0 114ms
60ms Script
text/html 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/jquery.1.8.2.min.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/12zoygy
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 script.mix.js
st.prntscr.com/2021/04/08/1538/js/ 0
0 93ms
39ms Script
text/html 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/script.mix.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/12zoygy
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET wlgiIuLMQh6vDb1oLzWJXg.png
image.prntscr.com/image/ 0
0

GET
H2 200 12zoygy
prnt.sc/ 16 KB
16 KB 139ms
139ms Image
text/html 172.67.72.27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://prnt.sc/12zoygy

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.72.27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /12zoygy
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: prnt.sc
referer: https://prnt.sc/12zoygy
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://prnt.sc/12zoygy
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:07 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wjhITmDRH7zQtNiX%2FKkNxhR91fytVZhDJv3Lk%2BFdw0Ro0sheonSz5Rm19JgMAzYm0ZMvrloL%2Bro5u3cHjIJTd8YTLQt70tIqhXXsTi1lcVRLCxInukuXiyc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
cf-ray: 680e17bcdfbcc76d-AMS

GET
H3-29 403 image-helper.js
st.prntscr.com/2021/04/08/1538/js/ 0
0 72ms
35ms Script
text/html 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/image-helper.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/12zoygy
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 403 footer-logo.png
st.prntscr.com/2021/04/08/1538/img/ 0
0 34ms
34ms Image
text/html 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/footer-logo.png
Requested by: Host: prnt.sc
URL: https://prnt.sc/12zoygy
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 403 jquery.smartbanner.css
st.prntscr.com/2021/04/08/1538/css/ 0
0 51ms
36ms Stylesheet
text/html 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/css/jquery.smartbanner.css
Requested by: Host: prnt.sc
URL: https://prnt.sc/12zoygy
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 403 jquery.smartbanner.js
st.prntscr.com/2021/04/08/1538/js/ 0
0 34ms
34ms Script
text/html 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/jquery.smartbanner.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/12zoygy
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 403 script.mix.js
st.prntscr.com/2021/04/08/1538/js/ 0
0 74ms
60ms Script
text/html 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/script.mix.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/12zoygy
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 13 Jul 2021 18:24:06 GMT
server: Golfe2
age: 6626
date: Wed, 18 Aug 2021 19:13:41 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19672
expires: Wed, 18 Aug 2021 21:13:41 GMT

GET
H2 200 choice.js Show response
quantcast.mgr.consensu.org/choice/n-ZGqfdsg5894/prnt.sc/ 3 KB
2 KB 47ms
20ms Script
application/javascript 2600:9000:2190:c400:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/choice/n-ZGqfdsg5894/prnt.sc/choice.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/12zoygy
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:c400:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9bd7952daefc70291b0a0bc163e80b8654b7600d1c590f24fa57a5cb8a218964

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Wed, 18 Aug 2021 21:04:07 GMT
content-encoding: gzip
last-modified: Wed, 10 Feb 2021 21:13:06 GMT
server: AmazonS3
x-amz-cf-pop: ZRH50-C1
etag: W/"9074c1a966aada274b63c92859c4a3ec"
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin,Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 871dedfc10f4428aa2412b6f788b791a.cloudfront.net (CloudFront)
cache-control: max-age=900
cross-origin-resource-policy: cross-origin
x-amz-cf-id: DLuqbRALaLr7tyey8tLrpvj0ogrDsOtNbIyjJcpv2X1HRMPgnwZ7NQ==

GET
H2 200 async-ajs.min.js Show response
cdn.ad4game.com/ 3 KB
2 KB 78ms
25ms Script
application/javascript 151.139.242.3
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ad4game.com/async-ajs.min.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/12zoygy
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.3 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: dc9f7cdaabb3201fd2ead8c0cfd974710305362d0ea77c96069cb189796d6238

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-servername: ads.ad4game.com\ 80\ 81
date: Wed, 18 Aug 2021 21:04:07 GMT
content-encoding: gzip
referrer-policy: no-referrer
last-modified: Wed, 04 Aug 2021 03:32:43 GMT
server: nginx
x-serveraddr: 10.100.0.151
etag: W/"610a0a5b-ca8"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
x-host: ads.ad4game.com
accept-ranges: bytes

GET
H3-29 403 image-helper.js
st.prntscr.com/2021/04/08/1538/js/ 0
0 36ms
36ms Script
text/html 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/image-helper.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/12zoygy
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 13ms
13ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j92&a=1634501236&t=pageview&_s=1&dl=https%3A%2F%2Fprnt.sc%2F12zoygy&ul=en-us&de=UTF-8&dt=Screenshot%20by%20Lightshot&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=981871801&gjid=944869063&cid=1346374503.1629320647&tid=UA-12353127-1&_gid=189544869.1629320647&_r=1&_slc=1&z=268880407

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://prnt.sc
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
9 KB 22ms
8ms Script
application/javascript 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/n-ZGqfdsg5894/prnt.sc/choice.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 95b17ad661699c049d42195b8ccd1d855045a1fcfbd20d8609a6d87fa5703810

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:07 GMT
content-encoding: gzip
etag: "lp772EpWKwf8Kq7YKMhbuw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Wed, 25 Aug 2021 21:04:07 GMT

GET
H2 200 cmp2.js Show response
quantcast.mgr.consensu.org/tcfv2/ 178 KB
47 KB 13ms
13ms Script
text/javascript 2600:9000:2190:c400:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js?referer=prnt.sc
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/n-ZGqfdsg5894/prnt.sc/choice.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:c400:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 50620886c101862d378bb6aafe054417e7b0b8a0892b55e15fbf0f745936a797

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:03:29 GMT
content-encoding: gzip
age: 38
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-max-age: 86400
access-control-allow-origin: *
last-modified: Thu, 29 Jul 2021 15:24:18 GMT
server: AmazonS3
etag: W/"b1b5d6c1aaffca164d90c41bda6397b2"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/javascript;charset=UTF-8
via: 1.1 871dedfc10f4428aa2412b6f788b791a.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-meta-qc-ineu: True
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: ty5QZ9j1MO8mrA3wU243bUpwPuTPWXHcHIol0BDe4hHliIXSixPr7g==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
82 B 15ms
14ms XHR
text/plain 2a00:1450:400c:c08::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j92&tid=UA-12353127-1&cid=1346374503.1629320647&jid=981871801&gjid=944869063&_gid=189544869.1629320647&_u=IEBAAEAAAAAAAC~&z=45310209

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 18 Aug 2021 21:04:07 GMT
content-type: text/plain
access-control-allow-origin: https://prnt.sc
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 19ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

fad77babd0798ad575e1460f0722174f29890ababf95b0f9dc3eb75eeafdb271

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: i+T0jic7hUFqvhc97yfBew==
cross-origin-resource-policy: cross-origin
expires: Wed, 18 Aug 2021 21:16:28 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1686
x-fb-rlafr: 0
x-fb-debug: pYM99XvXb4WnoNsNzUafe8CDRUUu3uYWrdVBrw2Avas2KSVH6MDpei9WvRqCN3gKMPGgEqX2ICmt/OXNwc5bJg==
x-fb-trip-id: 2050670934
x-fb-content-md5: 46b63b45ae4e99af08cf9d5647a824b2
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
date: Wed, 18 Aug 2021 21:04:07 GMT
x-frame-options: DENY
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "5a428ada6108170049cfd3cfeadaaed2"
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 96 KB
29 KB 26ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/12zoygy
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6712) /
Resource Hash: 8db61f95a8f3554830efc6c3942b7322efef09b9d7f0cbfe32135e0fac106d18

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 18 Aug 2021 21:04:07 GMT
Content-Encoding: gzip
Last-Modified: Mon, 02 Aug 2021 20:34:57 GMT
Server: ECS (frb/6712)
Age: 629
Etag: "d405b816322f9770c70cbd10cfa87be4+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 28872

GET
H3-29 403 jquery.smartbanner.css
st.prntscr.com/2021/04/08/1538/css/ 0
0 38ms
37ms Stylesheet
text/html 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/css/jquery.smartbanner.css
Requested by: Host: prnt.sc
URL: https://prnt.sc/12zoygy
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 20ms
19ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-12353127-1&cid=1346374503.1629320647&jid=981871801&_u=IEBAAEAAAAAAAC~&z=1234066662

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 18ms
17ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-12353127-1&cid=1346374503.1629320647&jid=981871801&_u=IEBAAEAAAAAAAC~&z=1234066662

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-n-ZGqfdsg5894.js Show response
rules.quantcount.com/ 2 B
352 B 49ms
22ms Script
application/javascript 2600:9000:2190:d800:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-n-ZGqfdsg5894.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:d800:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:03:53 GMT
via: 1.1 eb7b239aed47669f8a7b6ac95bc8aff1.cloudfront.net (CloudFront)
server: AmazonS3
age: 13
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
cross-origin-resource-policy: cross-origin
x-cache: Hit from cloudfront
x-amz-cf-pop: ZRH50-C1
content-length: 2
x-amz-cf-id: NoSaIkbVbz_cHKQTjQfpnOpssaZlhhHW7mnYC8slgph2uKbda9lftQ==

GET
H3-29 200 all.js Show response
connect.facebook.net/en_US/ 230 KB
67 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=ee152a99fb565ea97327c3305fb10fd2

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f101b87891ad459e38f57487c6aebee9f700c01cab59d3d38a11add8b6738d1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://prnt.sc
Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: DRbRXdFb1v80j+Ivty6fuA==
cross-origin-resource-policy: cross-origin
expires: Thu, 18 Aug 2022 20:08:21 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 68328
x-fb-rlafr: 0
x-fb-debug: C1C6Z5VhGkdzG+4tVT2xGRVbtCTRtAABoKUoVn5MqBUCBd1ljqbmGgsL9zJUFDUlj0fwjw1kP1lX64zIeIwhdg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
x-fb-content-md5: 0aba15a0de96b7fe22b2b3e636c5294e
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 18 Aug 2021 21:04:07 GMT
x-frame-options: DENY
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "a174073c5919d620526a39e01381b84a"
timing-allow-origin: *
priority: u=3,i
access-control-expose-headers: X-FB-Content-MD5

GET
H3-29 403 jquery.smartbanner.js
st.prntscr.com/2021/04/08/1538/js/ 0
0 34ms
33ms Script
text/html 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/jquery.smartbanner.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/12zoygy
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 prebid.js Show response
cdn.ad4game.com/ 261 KB
98 KB 37ms
36ms Script
application/javascript 151.139.242.3
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ad4game.com/prebid.js
Requested by: Host: cdn.ad4game.com
URL: https://cdn.ad4game.com/async-ajs.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.3 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 733f44e4d42f00e0a8c267d516e9f6939d36f65ceb3bf851998475b9f6650d3f

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-servername: ads.ad4game.com\ 80\ 81
date: Wed, 18 Aug 2021 21:04:07 GMT
content-encoding: gzip
referrer-policy: no-referrer
last-modified: Tue, 20 Jul 2021 06:05:57 GMT
server: nginx
x-serveraddr: 10.100.0.151
etag: W/"60f667c5-412ac"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
x-host: ads.ad4game.com
accept-ranges: bytes

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 128ms
115ms Fetch
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=154822244543652&input_token&origin=1&redirect_uri=https%3A%2F%2Fprnt.sc%2F12zoygy&sdk=joey&wants_cookie_data=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=ee152a99fb565ea97327c3305fb10fd2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/;
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: WI3r1p4xUfHG8jJJj6hjuPwmlesKP8W8UI2U7QHQqNQP90USPe1PKvvReDWa+LiFBoOPTKCW5y9Ixy+S9RJ3Hw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
fb-s: unknown
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 18 Aug 2021 21:04:07 GMT
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://prnt.sc
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html Show response
platform.twitter.com/widgets/ Frame 61AE 319 KB
103 KB 8ms
7ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html?origin=https%3A%2F%2Fprnt.sc
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6724) /
Resource Hash: c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://prnt.sc/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 5133
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Wed, 18 Aug 2021 21:04:07 GMT
Etag: "8321d7cf58d70200c1423dfa0bca40f6+gzip"
Last-Modified: Mon, 02 Aug 2021 20:33:53 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/6724)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 105433

GET
H/1.1 200
OK async-ajs.php Show response
ads.ad4game.com/www/delivery/ 9 KB
3 KB 445ms
154ms Script
text/javascript 192.207.255.147
AS-MNX

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.ad4game.com/www/delivery/async-ajs.php?v=1&cb=a4g984739&h=0&siteurl=https%3A%2F%2Fprnt.sc%2F12zoygy&c=UTF-8&z=60918,70076,60916&b=7&x=7
Requested by: Host: cdn.ad4game.com
URL: https://cdn.ad4game.com/async-ajs.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.207.255.147 , United States, ASN62821 (AS-MNX, US),
Reverse DNS: haproxy2.ad4game.com
Software: nginx /
Resource Hash: 477e3dabcd9e09fb6783381ad16b61e03bf3071910402dfeb03b8b6b8098195e

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

X-servername: ads.ad4game.com\ 80\ 81
Pragma: no-cache
Date: Wed, 18 Aug 2021 21:04:07 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="CUR ADM OUR NOR STA NID"
X-serveraddr: 10.100.0.151
Cache-Control: no-cache, no-store, must-revalidate
X-host: ads.ad4game.com
Connection: close
Content-Type: text/javascript; charset=UTF-8
Expires: 0

GET
H2 200 like.php Show response
www.facebook.com/plugins/ Frame E3E3 0
1 KB 108ms
106ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?action=like&app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df79a8da0b52e1%26domain%3Dprnt.sc%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff24f7fbd1ab9df8%26relation%3Dparent.parent&container_width=1584&href=https%3A%2F%2Fprnt.sc%2F12zoygy&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&width=100

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=ee152a99fb565ea97327c3305fb10fd2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/like.php?action=like&app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df79a8da0b52e1%26domain%3Dprnt.sc%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff24f7fbd1ab9df8%26relation%3Dparent.parent&container_width=1584&href=https%3A%2F%2Fprnt.sc%2F12zoygy&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&width=100
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

content-type: text/html;charset=utf-8
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/;
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-content-type-options: nosniff
x-xss-protection: 0
x-fb-debug: t/0upe3aUjvL6/pswZTzSdoxWvdCEVaNI3cTItXRzBPrem1pR+AmdhXhnaDibpSxep/R+rk9VRFw3U12/RT1/w==
content-length: 0
date: Wed, 18 Aug 2021 21:04:07 GMT
priority: u=3,i
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H2 200 comments.php
www.facebook.com/plugins/ Frame DD66 0
0 114ms
114ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/comments.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df7d75e005d2bbc%26domain%3Dprnt.sc%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff24f7fbd1ab9df8%26relation%3Dparent.parent&container_width=1584&height=100&href=https%3A%2F%2Fprnt.sc%2F12zoygy&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=12zoygy

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=ee152a99fb565ea97327c3305fb10fd2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/comments.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df7d75e005d2bbc%26domain%3Dprnt.sc%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff24f7fbd1ab9df8%26relation%3Dparent.parent&container_width=1584&height=100&href=https%3A%2F%2Fprnt.sc%2F12zoygy&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=12zoygy
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

content-type: text/html;charset=utf-8
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/;
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 0
x-fb-debug: 9R7qtrJolQh2MFwUJ80PtEdEvrzL2Op2CcLW4i4vzFuhaJ+h8rya71gQ2SpXmqpO8ScYDtkEl7ByAVhDx88QSg==
content-length: 0
date: Wed, 18 Aug 2021 21:04:07 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H3-29

200

/
www.facebook.com/login/ Frame 1722
Redirect Chain

https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfdbbb340c86cfc%26domain%3Dprnt.s...
https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%3D154822244543652%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fx...

0
0

190ms
188ms

Document
text/html

2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%3D154822244543652%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dfdbbb340c86cfc%2526domain%253Dprnt.sc%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fprnt.sc%25252Ff24f7fbd1ab9df8%2526relation%253Dparent.parent%26container_width%3D0%26header%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpages%252FLightShot%252F242750885760%26locale%3Den_US%26sdk%3Djoey%26show_faces%3Dtrue%26stream%3Dfalse%26width%3D300

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=ee152a99fb565ea97327c3305fb10fd2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com data: blob: 'self';script-src .facebook.com .fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com: attachment.fbsbx.com blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%3D154822244543652%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dfdbbb340c86cfc%2526domain%253Dprnt.sc%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fprnt.sc%25252Ff24f7fbd1ab9df8%2526relation%253Dparent.parent%26container_width%3D0%26header%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpages%252FLightShot%252F242750885760%26locale%3Den_US%26sdk%3Djoey%26show_faces%3Dtrue%26stream%3Dfalse%26width%3D300
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: about:blank

Response headers

vary: Accept-Encoding
content-encoding: br
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
x-fb-rlafr: 0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;frame-src *.facebook.com fbsbx.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-security-policy: default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: 0Mf7o3ajz7NQ8QWdtbHU8pcxvjqxZzbOBs6v0pbK4Q5pq6344slXDaZcyJleqpxMuSlsph5GMrQgOy+edeQfTw==
date: Wed, 18 Aug 2021 21:04:07 GMT
priority: u=3,i
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

Redirect headers

location: https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%3D154822244543652%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dfdbbb340c86cfc%2526domain%253Dprnt.sc%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fprnt.sc%25252Ff24f7fbd1ab9df8%2526relation%253Dparent.parent%26container_width%3D0%26header%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpages%252FLightShot%252F242750885760%26locale%3Den_US%26sdk%3Djoey%26show_faces%3Dtrue%26stream%3Dfalse%26width%3D300
x-fb-rlafr: 0
cross-origin-opener-policy: unsafe-none
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/;
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: fvw5jUxxT8iiXtA/U/jDBfQs818NuamlE9rek5AbFQI0y9Xfocurxce5hKhBLZNNUeZKhFNTISMCUmFDndK/2A==
content-length: 0
date: Wed, 18 Aug 2021 21:04:07 GMT
priority: u=3,i
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H2 200 pixel;r=944441284;source=choice;rf=0;a=p-n-ZGqfdsg5894;url=https%3A%2F%2Fprnt.sc%2F12zoygy;uh=u;uht=u;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=1;gdpr_consent=;ref=;d=prnt.sc;je=0;sr=1600...
pixel.quantcount.com/ 35 B
210 B 9ms
8ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantcount.com/pixel;r=944441284;source=choice;rf=0;a=p-n-ZGqfdsg5894;url=https%3A%2F%2Fprnt.sc%2F12zoygy;uh=u;uht=u;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=1;gdpr_consent=;ref=;d=prnt.sc;je=0;sr=1600x1200x24;dst=1;et=1629320647319;tzo=-120;ogl=site_name.Lightshot%2Ctitle.Screenshot%2Cimage.https%3A%2F%2Fimage%252Eprntscr%252Ecom%2Fimage%2FwlgiIuLMQh6vDb1oLzWJXg%252Epng%2Cdescription.Captured%20with%20Lightshot%2Curl.https%3A%2F%2Fprnt%252Esc%2F12zoygy%2Ctype.website

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:07 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 settings Show response
syndication.twitter.com/ Frame 61AE 232 B
432 B 260ms
157ms Fetch
application/json 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=ffba1a45808af7e0ba30e4bd9c61c826279a03eb

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html?origin=https%3A%2F%2Fprnt.sc

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:07 GMT
content-encoding: gzip
last-modified: Wed, 18 Aug 2021 21:04:07 GMT
server: tsa_o
vary: Origin
strict-transport-security: max-age=631138519
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
x-connection-hash: 3680d03239f064ec7182630b4d5fdc45417f4bb9ea2c9544cffb5cd6c90c5f71
content-length: 166

GET
H/1.1 200
OK button.5d16ecc02fbaf599a24dfb57ab239320.js Show response
platform.twitter.com/js/ 7 KB
3 KB 6ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.5d16ecc02fbaf599a24dfb57ab239320.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6712) /
Resource Hash: 3ee8351e156e2e80d99018a585c18c0dbd9098e3bea84a131d8cbad1ec72c81e

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 18 Aug 2021 21:04:07 GMT
Content-Encoding: gzip
Last-Modified: Mon, 02 Aug 2021 20:33:39 GMT
Server: ECS (frb/6712)
Age: 5133
Etag: "6b95f5a9a2ff4b885e2eafdf446d70d0+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 2296

GET
H/1.1 200
OK tweet_button.f88235f49a156f8b4cab34c7bc1a0acc.en.html Show response
platform.twitter.com/widgets/ Frame 2DC0 32 KB
12 KB 6ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.f88235f49a156f8b4cab34c7bc1a0acc.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6712) /
Resource Hash: 06b34901b9ee1d57c9e0a37a7665c7aa77f6ab8b884cda5e8caad1c3f8b8c639

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://prnt.sc/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 5133
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Wed, 18 Aug 2021 21:04:07 GMT
Etag: "909c8b457796b3e08dbae7ea22074354+gzip"
Last-Modified: Mon, 02 Aug 2021 20:33:46 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/6712)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 12257

GET
DATA 200
OK truncated
/ Frame 2DC0 822 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3-29 200 gpt.js Show response
www.googletagservices.com/tag/js/ 72 KB
25 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: ads.ad4game.com
URL: https://ads.ad4game.com/www/delivery/async-ajs.php?v=1&cb=a4g984739&h=0&siteurl=https%3A%2F%2Fprnt.sc%2F12zoygy&c=UTF-8&z=60918,70076,60916&b=7&x=7

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c5b8ac3757b759ea59343d2c1611c964b6e912594193b89775d77ea2375e4da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "963 / 323 of 1000 / last-modified: 1629284998"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25231
x-xss-protection: 0
expires: Wed, 18 Aug 2021 21:04:07 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 123 KB
33 KB 180ms
64ms Script
application/javascript 13.224.90.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: ads.ad4game.com
URL: https://ads.ad4game.com/www/delivery/async-ajs.php?v=1&cb=a4g984739&h=0&siteurl=https%3A%2F%2Fprnt.sc%2F12zoygy&c=UTF-8&z=60918,70076,60916&b=7&x=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.90.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-90-44.zrh50.r.cloudfront.net
Software: Server /
Resource Hash: e7a1375f883984026b922acfbe7cbc0bd02effdbfbfdde9354922a6055502624

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 20:56:50 GMT
content-encoding: gzip
server: Server
age: 436
etag: f8520ea4ebd91256d6b4f461d472242a
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 eb7b239aed47669f8a7b6ac95bc8aff1.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-version-id: cdBhoWYDE8U.miXtMaq72_QdUztpgDZw
x-amz-cf-id: J-B3aX5IlPYjweO1uaFvxDfaVdxAsYSuF9yPLkq4-RUcNRqq3TdI7Q==

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 24 B
365 B 253ms
140ms XHR
application/json 184.31.84.150
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=619471&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%221a0f4e5002f3a8%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fprnt.sc%2F12zoygy%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allU%22%3A3%2C%22ren%22%3Afalse%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22indexexchange.com%22%2C%22sid%22%3A%22193578%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A1%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2221a4cec2ed8881%22%2C%22ext%22%3A%7B%22siteID%22%3A%22619471%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2236f488dabe1b3b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22619471%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2245260d04ec916a%22%2C%22ext%22%3A%7B%22siteID%22%3A%22610018%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%7D
Requested by: Host: cdn.ad4game.com
URL: https://cdn.ad4game.com/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.84.150 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-84-150.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 4d33cc1995a3c201abf2e3d09fb83fa1e91d3d9f732871f24d30d27bfd97c689

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:07 GMT
content-encoding: gzip
x-ak-initial-geo: CC:[SE], RC:[AB], CN:[EU], CIP:[45.12.220.53], XFF:[]
server: Apache
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://prnt.sc
x-cs-client-geo: 10
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 44
x-ak-client-geo: 10
expires: Wed, 18 Aug 2021 21:04:07 GMT

GET
H/1.1 200
OK bid Show response
ads.ad4game.com/v1/ 5 KB
2 KB 647ms
357ms XHR
application/json 192.207.255.147
AS-MNX

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.ad4game.com/v1/bid?if=0&siteurl=https%3A%2F%2Fprnt.sc%2F12zoygy&size=970x90%3B970x90%3B300x250&id=64b16c2cd1cada%3B733dc1e0e65284%3B8e9c54b221f571&zoneId=60918%3B70076%3B60916&gdpr=%5Bobject%20Object%5D
Requested by: Host: cdn.ad4game.com
URL: https://cdn.ad4game.com/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.207.255.147 , United States, ASN62821 (AS-MNX, US),
Reverse DNS: haproxy2.ad4game.com
Software: nginx /
Resource Hash: badf6d331d6a717326272bc6ff2711e3a602530af98c8d870a0a7bd2cf21fceb

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 18 Aug 2021 21:04:08 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://prnt.sc
Transfer-Encoding: chunked
Connection: close
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
X-Application-Context: application:12063

GET
H2 200 pubads_impl_2021081701.js Show response
securepubads.g.doubleclick.net/gpt/ 328 KB
115 KB 187ms
69ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081701.js?31062322

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

416c66b64adf83bfdfcdd37b98c3d88ae15cc77370bd0f7b5edcc3e5b480e641

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 17 Aug 2021 08:38:29 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117161
x-xss-protection: 0
expires: Wed, 18 Aug 2021 21:04:07 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 79 B
737 B 185ms
68ms XHR
application/json 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=prnt.sc

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

a051e0bd948ad4c3b6be0f24b4010b795959be0d8113c92c969fdb5bb0e3ddcd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 18 Aug 2021 21:04:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 80
x-xss-protection: 0
expires: Wed, 18 Aug 2021 21:04:07 GMT

GET
H2 200 jot
syndication.twitter.com/i/ 43 B
329 B 164ms
164ms Image
image/gif 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fprnt.sc%2F12zoygy%22%2C%22widget_frame%22%3Afalse%2C%22widget_site_screen_name%22%3A%22light_shot%22%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1629320647784%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%221890d59c%3A1627936082797%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Wed, 18 Aug 2021 21:04:07 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 3680d03239f064ec7182630b4d5fdc45417f4bb9ea2c9544cffb5cd6c90c5f71
x-transaction: 93b9a7d39d44095b
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
297 B 156ms
156ms XHR
text/plain 13.224.90.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fprnt.sc%2F12zoygy&pubid=852e3ca3-c387-44e4-a5c1-67c46495a8c4
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.90.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-90-44.zrh50.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:07 GMT
via: 1.1 eb7b239aed47669f8a7b6ac95bc8aff1.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: ZRH50-C1
x-cache: Miss from cloudfront
access-control-allow-origin: https://prnt.sc
cache-control: max-age=86087, s-maxage=86400
access-control-allow-credentials: true
x-amz-cf-id: O20C2ECwcLmlJDXwIfeewDAf1mD_hXmPLmEkMfkuJh97nZSl0OlOMA==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
365 B 90ms
90ms XHR
text/javascript 13.224.90.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fprnt.sc%2F12zoygy&pid=o5rEHKAEbYv8M&cb=0&ws=1600x1200&v=7.67.00&t=2000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22970x90%22%5D%2C%22sn%22%3A%22%2F60257202%2F60918%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22970x90%22%5D%2C%22sn%22%3A%22%2F60257202%2F70076%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F60257202%2F60916%22%7D%5D&cfgv=0&pubid=852e3ca3-c387-44e4-a5c1-67c46495a8c4&gdpre=1&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.90.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-90-44.zrh50.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:08 GMT
via: 1.1 eb7b239aed47669f8a7b6ac95bc8aff1.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: ZRH50-C1
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://prnt.sc
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: HMjIS80vT0Y23-hNCXo4LQNLZI8Ough0S-8sfqdA7lNLfUefLwZ-_g==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 155ms
54ms XHR
application/javascript 13.224.90.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.90.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-90-44.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 21:21:02 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
age: 85387
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Thu, 01 Jul 2021 22:05:10 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: UwMoja_wiYmXZ_L.v58hX8_8XzeYFzV9
via: 1.1 f0f5607a03d2ae4c43b553dc2cef0c9e.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript
x-amz-cf-id: FHNLZhs3AA3IENng02wyOkqkk8c7-vS3ZY7onlVzZ3yj7000LOGnrw==

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 24ms
23ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=prnt.sc

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081701.js?31062322

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 18 Aug 2021 21:04:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 24ms
23ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=prnt.sc

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081701.js?31062322

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 18 Aug 2021 21:04:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 50 KB
19 KB 483ms
482ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3397862552733480&correlator=1744337891123464&output=ldjh&impl=fifs&eid=31062322%2C31062220%2C20211866%2C31062297&vrg=2021081701&ptt=17&gdpr=1&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20210818&iu_parts=60257202%2C60918%2C70076%2C60916&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=970x90%2C970x90%2C300x250&prev_scp=amznbid%3D2%26amznp%3D2%26hb_format_a4g%3Dbanner%26hb_source_a4g%3Dclient%26hb_size_a4g%3D970x90%26hb_pb_a4g%3D0.04%26hb_adid_a4g%3D64b16c2cd1cada%26hb_bidder_a4g%3Da4g%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D970x90%26hb_pb%3D0.04%26hb_adid%3D64b16c2cd1cada%26hb_bidder%3Da4g%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%26hb_format_a4g%3Dbanner%26hb_source_a4g%3Dclient%26hb_size_a4g%3D300x250%26hb_pb_a4g%3D0.09%26hb_adid_a4g%3D8e9c54b221f571%26hb_bidder_a4g%3Da4g%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D300x250%26hb_pb%3D0.09%26hb_adid%3D8e9c54b221f571%26hb_bidder%3Da4g&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1629320648&dt=1629320648445&dlt=1629320646953&idt=1126&frm=20&biw=1600&bih=1200&oid=3&adxs=8%2C8%2C8&adys=782%2C988%2C1096&adks=1432691387%2C3120184932%2C4042975291&ucis=1%7C2%7C3&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fprnt.sc%2F12zoygy&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x90%7C1584x90%7C1584x250&msz=970x-1%7C970x-1%7C300x-1&ga_vid=1346374503.1629320647&ga_sid=1629320648&ga_hid=1634501236&ga_fc=false&fws=0%2C0%2C0&ohw=0%2C0%2C0&btvi=0%7C0%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081701.js?31062322

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

08e4f8fd9774eaef8f56eb73607d06ef2b91e24e09c41f1778376a387bc64e4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:08 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19737
x-xss-protection: 0
google-lineitem-id: -1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://prnt.sc
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 92A7 6 KB
3 KB 49ms
14ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081701.js?31062322

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Wed, 18 Aug 2021 21:04:08 GMT
expires: Thu, 18 Aug 2022 21:04:08 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 container.html Show response
1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame D0CB 6 KB
3 KB 22ms
8ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081701.js?31062322

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Wed, 18 Aug 2021 21:04:08 GMT
expires: Thu, 18 Aug 2022 21:04:08 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 container.html Show response
1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 781A 6 KB
3 KB 17ms
6ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081701.js?31062322

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Wed, 18 Aug 2021 21:04:08 GMT
expires: Thu, 18 Aug 2022 21:04:08 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081701.js?31062322

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e1c5b41cc4dec857ca9c9166336dff0dec8f8ba6046aa71927370897143d2784

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:08 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629286089745720"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27752
x-xss-protection: 0
expires: Wed, 18 Aug 2021 21:04:08 GMT

GET
H3-29 200 container.html Show response
1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E2A5 6 KB
3 KB 9ms
8ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081701.js?31062322

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Wed, 18 Aug 2021 21:04:08 GMT
expires: Thu, 18 Aug 2022 21:04:08 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 20ms
20ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021081701&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081701.js?31062322

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

02766a9f9fe138fb2077707b73cffe8ce8257dcdf8abc06d41389ff33e4effcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 18 Aug 2021 21:04:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8417
x-xss-protection: 0

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4554 624 B
297 B 17ms
17ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKjs5gIQ8LPQ_AEY64C2rgEwAQ&v=APEucNVk_mwbVQ7Q6EA8oKgBuQ-oU0wGMwAd0g4uCO3EnG7VUQzrkH5PFEJDkp8VKdaoNKUzLLgeEDM_Z8Gn2bvTXkeZY1j30GbNMMonmYc9w5pc9UgJpGYOLPIbmTH93W_M6K1SPtBUvMpDT2TbVb-cYdERjh3tH4a85P0dwbBSBLtPnFZ1H5s

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CKjs5gIQ8LPQ_AEY64C2rgEwAQ&v=APEucNVk_mwbVQ7Q6EA8oKgBuQ-oU0wGMwAd0g4uCO3EnG7VUQzrkH5PFEJDkp8VKdaoNKUzLLgeEDM_Z8Gn2bvTXkeZY1j30GbNMMonmYc9w5pc9UgJpGYOLPIbmTH93W_M6K1SPtBUvMpDT2TbVb-cYdERjh3tH4a85P0dwbBSBLtPnFZ1H5s
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnkH0tk_mpWKkXQY427YIOBjUf6ypm_xeNhnGZLpxQ9Xf90DKtZVyH19qxU6lU
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 18 Aug 2021 21:04:09 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 16F5 71 KB
28 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B4ubndSXYO74QyH0w1Jf8bjvZMX5wBHmpL8a9jNKIqb_paz0EBAblENSS2HlbvVvH237MSrcfDkwlEN8vb4sZNjE53ifJx2ej88E8J1lYyBWl0U1MGOHnpkjNkj7cbGYoT8wYc1z92xAqCjDVNaNuAnUNVEw&dbm_d=AKAmf-AeHT2ytAJqPmdpCxRB-5LGi_J4MRceBNz6HfQc0vhZ_uMbx5eJvyvWxgs17uUggkzX_wlGPGCCUvr8Lr6e2YZOzvCYTNCOjGWNCW9w-NBw1MLTe6g7IG8eTETKXQyKzd6_oOQeyb9a3khdUOl5UOVoMjjAloSkGoTRb6NPPwm47jtVwfNMMXz8gHos2ZScoevs_E_MdSOnZsKkxaIyo3rNSCosWkZF77N4l8_FWjwKbcdqGacK9w9T6SPCw0wQwXaAUWRcw08mcR2JZA0oWQ4QRDYbo9QrYcA8JP0mDsfykj9PPDiNQlA03E0UPEerUsCyyXPfbJk0tIGuopbBRpS22Nq9ABOwkW3KanpUn5BQLUKWjPtyoQMUlgF6HOXZunExue9aawmaJzPbS7wkAAW_MXEsBLMPwmsk062dbdejgaSgIPXFfH56FGGyMlxl-tjaVBFALw3Kma2zx4HLCD_0C33HDXLLK2HnjGMRUYeNdGmUykXgnpEktnpXUoMRNS9RRUyopExxw7O81QHLOPPeVNI7CPi2mxyB_lrubgNGec9HEuGZnfC4b28j8Ns_KTylZMDmTiFYzBJ5ROYRqrp4B9gizE8O5WnrM1O91-bpvDAMinbD1sQDfWXqHtPxkaGcjRB7LFXZw5ycTHqw9IHfmzYWBMB542FHgcwg03zXFYq_h8ex_Ft6PV6C4u8bzTQjAisyJV8YpAe9jE8eoALHQJspDN6XopmLLBatPtajAApLVqcUdeP73nwHt-cOswtpkq6y6ZSXQ-X7P05pX4cVtkknkf66MAMpcUmXT4sCtzcS_aiwr8xMW77FH95CefJ2yGqkj6RDx-0mIcvch6cJq51bAF2tdzVDVASqJW9RhiwAasIJ9h5F-sO18FRz1aJIYEgyIEhV9Puuf6FL2G4QA8wJmSyzniPguxxcaG40IMiDl3_XUX4p8Gj2FFctu5yeJrJTegjoAAofBHuhP1bdpUUKqBemveVkOLPsyiNS_iq2kCY1YZgyQWNsUPgfmvBydhkRCvg8GLwSAm74eT-Ay41OnKn4f55AJBoRG-dz99QmJ1P7RbuxXuNg_OqH1dP-1Gu_smEyQwqs_h9AAaqnYELnWUtWLcQK7Ys99A-JQJCbMxXo18ERV02m0UzQzGrWJfNsnPEYkx-r7V_DWNo_-jnUjmiQI6Ewdlei1EcFUNG7LdkMrDrMe-FYTln9kp5wcsv_GzvoY0TD2nDbb7SU4bdJg6Yzb_vGiys1IG1mxzFr2Lxx2BjHvdmTRAhraja7Z86U1vrx64zCyin7XugEvI41k1o5DX3vc1wLI6Cg56FuDzhTcmk5M-z45iRO6uolVo-KFL0VzAuxZEgFjswAG_fLs_x9cMpDvX5RtE51DsaqKWPPRYX9t60wLIhRSN2MLWvYBz-MBqyMq5TvNpZ_Sytq4eupHa3HgxUtwUyGn3Mk00uOHHcEH038hhQCKn-oQiZaFDmfJyl_Q9xBuF1X6-nZNrRkZLDaBpjfD8ijBeEFX42KaTkkiui2bksZd-w5x5HHE85xH4eHZB9cXRX5328dhDey7PYS_7eV489DsJxqUju9b8qN0yQyiaANBnPas-yVWvEFgYRzbuKRso7pN5POWLMWI4WDHmtZ3C-ZL2VjpGw8phnkqNV3yqnKCgjFwSmhSqNNzEWl_w9lENy79uPmxHIWT43pPJ4-6TR1WyPBoGskbltZJvCqVrEGRJvAsobd9-JQQQ51zc0CJTSSusu1sK3Ed8VHYZnm0szQp4CouRk7oe5T-jgACgJoRoqxkDctju2otZZ9NeoKZ7QJ-caOoAPyCiNTZfKmu1eCzJ6QDV92WaYOmfVh2VHOLr7Ilc0jEpSR0cqmu-jBysD9FLohHTg87rnaexLXthzu4HIp4uxlL26-x1gVQ8PNYoxekwqSZkAg4HttaX3QQSfaveo5N7-c1lD9bsV7QyKjwtkZdAmsNej-PZYxvdj-r3O7GPOy4hTj4_LocEzqg8Jk-LfZxaDr-Y1vkbZvpdmPidHq_oSWb1o528ZRIWQCR09l0ZPjWDQ934cxZSe5wR-UN0Wm1ZNsX_xa_9HgOIWwKXuZwffFIHG5x_hOpny7XlYs8wN7zzM_RmvlHtZ6xC7d14BOQKiXgKIBieQNb84DhqNCPwqGVjyK2JVBfw3_3c-yMSD69gtVuZyzm5BEaUgqYU1sONjXBtZGUUOsC4PC0rWUdSiwqJK3mF6lYSo3C4H7KeDoK6o7tQPyssZNgSq4njvKjxAVooZdicBx_e3-uERMkdGAKf5AgPzA_xtG8QhqkwuS__uELiZ_DqCPD_cULYnqt9OclTH-PYGbO_Wqp-p163g0TSWADK4ry2iUOB5oHMSDNCVlPSwyR7kuXWBCbeKMpC3UireDVPW-3u_iJoj7clkbjALW30AILeNXSl6Dm3KfM0QcGfplqZV8qZyCXKZyZJu9mmFkbNiJLkJxjG6N3qS5iG_kEHiW4qBbB_8GN_A4WbKDrBNS2h4BzAn0C-3FZsEPKBwgGSfmGvfl_CmZnAHiv4EQIf4Ne6a9wK9gHqfJxzVT7gMQzX7i7jF3vRpdDMcnb8QE_OrJlbrBygw2GZhdj2UeupT9kjCfZTdpoU-AxnkcNtDdzGPTDeDN-aWhrW1Zv2fweH5cE4M6DDlIFenFcg7bnf1X1oYgQT8GlhkOLTXbaMYAgamXrzoQ_J1AZuj2Pyt9J8PVH0G3UgY7o5xyMHDWlzB0TKwHjp8tk1adX28UWFRMtSCH0MZPH8gu3lkS0hwxr6uddSQtZdU0_Ev3NPg7fzX6jB65lFef7vkKptsFe4KVPegW2Yil90K4Ucn7xcc6mE0wl4A6lsZCmBvm3NjPfBs2kmgzPQ5zUO88Gumu3FmlXdScSQyEAQHKVjOsAzR0pAMkSlqN87FEUH8&cid=CAASEuRo_lwU7a202w7a5FbEio47eA&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f72cd84522248d7a8cb63872362fc34ebabd2b1f1d90172ee16c7c56c2d76be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28814
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 16F5 2 KB
1 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/window_focus_fy2019.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:02:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 101
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 01 Sep 2021 21:02:28 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 16F5 124 KB
37 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4621e2f0cc2662504242c3321a21836621dd99f274ef444418dfbe96c3f1f79f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:09 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629286078051219"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38195
x-xss-protection: 0
expires: Wed, 18 Aug 2021 21:04:09 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 16F5 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 236
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 01 Sep 2021 21:00:13 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 16F5 42 B
63 B 28ms
27ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CvQ-5h3AgKMdUxksQ3lB10kudXFINqRV0_9kL49-Vfn_ZCVUDthkE83QN9Zu9Z62c3K4F0DFegtihMN1m3lmuXlP4QdsLJVjf2VVDOVHz4O-4dgK8

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame BC95 624 B
297 B 17ms
17ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKjs5gIQ8LPQ_AEYnoC2rgEwAQ&v=APEucNUjbMlmaAUbjoaTa9rbP_RtgNgBxxqxUUeKoQ8fEoM8NKvRKsqdLCdEp5CP9C8AQFKPolAH-xQEkHzkYpywSsePB_253SmJG_94M0uljkCzuErcE6Hux5ljHJyf4ZA0KqOvRZdZOY9IkgFJJYIR6AKVO6DlsLLUVDUtwTdsshDqEE4tQcs

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CKjs5gIQ8LPQ_AEYnoC2rgEwAQ&v=APEucNUjbMlmaAUbjoaTa9rbP_RtgNgBxxqxUUeKoQ8fEoM8NKvRKsqdLCdEp5CP9C8AQFKPolAH-xQEkHzkYpywSsePB_253SmJG_94M0uljkCzuErcE6Hux5ljHJyf4ZA0KqOvRZdZOY9IkgFJJYIR6AKVO6DlsLLUVDUtwTdsshDqEE4tQcs
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnkH0tk_mpWKkXQY427YIOBjUf6ypm_xeNhnGZLpxQ9Xf90DKtZVyH19qxU6lU
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 18 Aug 2021 21:04:09 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E2A5 71 KB
28 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bq7xFWpoyvDzdlx8q_pO9pT_edUJn5F-ebrLtdj7EMbY0SRN81yy-XMFoD8c2GqRSHQFmmshdG0NfGYLK6b9gtgo3-b5-fIB574QhTRdRsBy2LjjoTWhGLuDbJgozTP77znI2AbX1PHD0eiOiF_IbfWJZ78A&dbm_d=AKAmf-ABq2Wl0YaZEpdakeSr5SslqUG209oV8ZP4AponnXocMYL4wZaFgze2q91tIwwum7zO8M2DkRQtfQvMTN3CbVcrSbPIWKizW1hXinS-6YRjmvCUoQJh3FwQ1yRtNO1Y8HJydKpVfxTnBevMzt4XdULbdRaQeOj3zepqlS-6NdvHiZ0VXyuH8ICl88OJRbfm8GLT6r-LcT1MmCtVYs_9EO1qRyPs7YVMELjdC9pTuRh8tWuHYIc74jt7x7JtesyJiSXu9VFpoNNf3wxYyEbueUtAf64ndIRJz9-3Ui9-aBfzWTr7g-kUG-oi7YHHx0pEfA5NYQWADVQnPzkvnfsY7RReeX92KiEr51u4Pasj8FFkPl5RE9pJAHTEcKIJ5u8V-lxWyJPXXdbjyngdqtGsgKbYLlmLL8V31VxACAJ5uDpzSya1brD06V2Cu3uUj7s0aAWawHyl5kM9gSpJ3FwggW548Oa60FdfktsygYoOszKmn-ZtmuGI7XM-8C9RvUTEUL_mhQAfpMjx1CI6d60xlN1mmBebL_ucugNGxSkgoGNEm1xcLyNkZG4p1ezqxFUphZH5gixWk7GpfZynmfzt9jMra1XoD8stciuU-TShf8I5-0fV1psLbyhO0ur6OLG3y9NCe_c5wofgbxoppCFzTQEpbkg_aThqn5gvlnNe5Ua8KntuedvVvTthupmeAa-qlT2ydrbvjtkAcXiD9oAgEiYL9fpn6NHXpA0E5BCYJSCnWBlp2uTvC6rWy_FQErwgRpd5RuOemL4X-vJbIyaRb3vd1G23SI0InSZjLP33H5yc5S49628jHrI-RtonLDSp18FBeaP7cSbO29K71R3EkIqXaK4gF77tb1pNIRR1s5L6iRyA_UUif4nX3_2tQ3iKjR1EJrBiT2x-J4T2O7PZI4rZg383n0ziXxHgn2Zy6gZksUH5A3xNlGiOjBR20uKz4R8UGTgI0qgOIunxjjB1WyvMSEompce9jdSeBAr5xLHIll2Qji44AIKIby7UOxpO_uwZiDzEAdVeCwuLA3D87N-yG0CbYzZXVMkEBz3Lwm1EVtMP29OZaK6ZPecC4rEwQlHIoiFZ1tKzOQ0ot09Y_LNMlEiG1BXf-V8klmrXtmlqBqPlgbN9l6e2FSMl-8rrNBTTfltehw5SBWbHxYqkOmve8-s1dm1xEjunyqg95NXzmN6zduq_V8qr_IKHLeThA5kmDZ0LMMweehWoQWvhuj5Lbih5JXJ0Z80Jmt3ylgBI5ZPJzB4jEXXMX1XptzgYFIPUzkLtKf8Mh7s1hWaWeYgl2lJeN4sksVGF7rikoQ-XWe-ya96dyhSQ8OdSyXHHJCM00xZ5mPCQvwB7hzz01T25moGJR4ObfgOiWzQWz5HVZRrU52U84zdXbzRDV97eFObCA6sPn27T_STilQ31XnArDiDgEw9JKYjb1Sosl1wHkT0Ukqx7OLjL5ABWQFc1rlPAX6EfmSnC11SBhH5KjHI0mO68NZaZU0oqXQw0FO2WMS9sKL-ZFTA1OPavC0Hp12X9Kat7snTQ8wIM17Gg75XZiMlpJsndNOXlaVhGuncNrSxDJ1q6FKd17lTSj65IChpLBa2JJ6d21aHXJyDRkKO7zwtR2NtI25crVbRaUo47orrAFhn2-qXrbZOfoX2PgRpC4mSnxstZCtiHe-ovPGLTDUAD97Qfqjd96qw-eeNMQDQ_MnwWBAbbhd7qMTpj7ZA9CfuRlBrXvvs8Cl6--YFGWGSTLPKJK7ywomy6-4LNu29edOtxR_zqT-F9ClqFs6FMiNXRCxbSmr79ZSV2hhxfaJ6l0jkyYrEzkPEj-Hj3rXhng1NbpgcAPdRXVbEzCbvMGXjlAi-YT_SpQtoTOjNBPACyXzHtxg7NoHfM5WyORa0noRK6PCIpkJ7Z8_IDIa2txHknjiY_inzq7tDVS8zhYyYzNcv4nxlSlnPHscJKqXev33PQbfRtgN9rP1UhVepQ3QyXlrC8886JyYnLj1Zq3Odul0_eMaZkJIYWw25iw7N1YpfzXXUHVhhOBaJGRlaewNcde_OZhvn_3XF5o1epNXnaJEygahD2S9RDZ5e1RiJm2ymaQJodFKAwKnpDpiHheO2FfnT7wRXtGr7sXiyPrdAGuEQOSRkZk4G_AOBDVsMUUIdob_3Ag-uy7VVIY_9xvw1hPZYKQEZTYQ9V9pd4JCjY-RE170uOmq3e5eFe5SJWIdfgLgruKpMr3jOlgSMZzezaU-393P130an3_dNwxr72WEC0QaA4IFB6XIJUqbO_M72PYhtS3mp41lYQssRSGfZFEkUuLrm4SU74hP0EIxEya9DF6Kh6ShxdQmqwM0uWva3CB9GYA27936v-CgixvdxBHMYvKSOluyNOQYPTLVkZCU-m6hBB9UYIxXFJPl_iy91_gjGu9fNy2ex2LGPGzLww31nFG0dVUiAoIBupo8CxMRZUu1Jn5SqmzX0Zj67rOpEVw3gXGFON9h-eeho-ij9KV5s-hEK21f4UKhrKAZWDq0gVKiow1jPVkV-hZLtqvCSrusOMzaU-W5qqaBk9Xi-dIBMyVHS6skqVAySFXFyqBayPxTJNbZabAfRkebbQ6qUpXp9iYZE6EMxyGGCcj_21-e4tkbw_28V1FtgrGstkmSGu-KXPKBYHa_iGqzRBXfzmER5R5TG6HhyBwjWfPPkBJUZJd-l-u1uIiGOqP3d2A0rj32K-WA54p5N0HBOrmpSdWOiwUbQuI-XPPKM5PzAlUgzc8SHqbP4NNuTyyGvZIBRiupp1mM98LFOO0x_cN6l7YIMTmkY0s3gGYbvoAnSUvLC1WXQ8FmAsDOBTwPAlzI0d0SxfNVkmr06ALyx5IoZ6yqEH1BZwPYie7qJfynd_sVFWKJ0HzIQ2YG1e7J7sGKeOodyUOfIoIWNVayDew306tGMTdqxAlUyfiEyD8GkX&cid=CAASEuRoF_z9xR-Ozd99ipQ9K3l89g&rfl=1%2Chttps%253A%252F%252Fprnt.sc%252F%240

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a53657ea65c84349910571280cfa6d766ed167bdb964831b916e6ae5d91c4b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28960
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E2A5 42 B
63 B 28ms
27ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AIKlNnr_oWhxXMuZV0xvYnOhOUlWeerAe4qAW4f4x4eT2vIaK1aELd_pvdKYUPS-W5WrSub7F02-4MUAE1HRMk7B6Hv6kKZCRPABjA2K3K8VssrQs

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame E2A5 2 KB
1 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/window_focus_fy2019.js

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:02:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 101
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 01 Sep 2021 21:02:28 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E2A5 124 KB
37 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4621e2f0cc2662504242c3321a21836621dd99f274ef444418dfbe96c3f1f79f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:09 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629286078051219"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38195
x-xss-protection: 0
expires: Wed, 18 Aug 2021 21:04:09 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame E2A5 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 236
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 01 Sep 2021 21:00:13 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame E2A5 0
0 14ms
13ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ0h1yonO1bzEJB1yOZRZ38BhBlP3BfWnXgwaCRTpBTjVyRa-G39mkywznG3spfFtZycQEtOsYGQ09gT5A1VUx71h2SbQ
Requested by: Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9DEB 624 B
297 B 19ms
16ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKjs5gIQ8LPQ_AEY64C2rgEwAQ&v=APEucNWazA_19L_NHZZVF_lArzGfd4VAvWi2ekvBkE_O2RL7A6cq1NoT9YCfVKSIbt9xQmFIp7b9Zwla1HqoFFYe7Ofnd-HynmBiXVDDQIHDJGdlDARCLIiFSEEdCfCKK8xPXR7NVukSu653FBPbt6xRI-CiW1P7fYf736NimD4OZ98prGsN-Do

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CKjs5gIQ8LPQ_AEY64C2rgEwAQ&v=APEucNWazA_19L_NHZZVF_lArzGfd4VAvWi2ekvBkE_O2RL7A6cq1NoT9YCfVKSIbt9xQmFIp7b9Zwla1HqoFFYe7Ofnd-HynmBiXVDDQIHDJGdlDARCLIiFSEEdCfCKK8xPXR7NVukSu653FBPbt6xRI-CiW1P7fYf736NimD4OZ98prGsN-Do
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnkH0tk_mpWKkXQY427YIOBjUf6ypm_xeNhnGZLpxQ9Xf90DKtZVyH19qxU6lU
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 18 Aug 2021 21:04:09 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C8F8 71 KB
28 KB 45ms
42ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C61NNBwpKzbZNk7MiSYOB4UmumU_YKOdhlqwZdBW-Ww_dSRy62XlfrFq5mqlFPBeRIuGg3ttnIB6kM3VypIx5PmrP33FUxl0A48J645BOUFpu80J7fOf_TXQv5yQLB8uu9l0Hw0wGcxmRyP02WIjaAKqwLhg&dbm_d=AKAmf-A6MjSyVIY1bmtCsc7mL3CiS8kQfVXYPjF_SE8dC9JrTXPrPsohRIkEjfP942jnxKD3XBmZ4SdpPhnpfv-O0VDukGacffN0X7Zar1i0ahrl9q_gc7WbfeKMB_Mq_M8VCYEuuulN0bF7TuhtWmFooykpd1sKU-znhVhjWvX0vRa3I3Xf9nHeDCN7wKMXmpfGHxAOw1OQ-Vx7gc-lipxSkveN4wvNsWS4rRo9xMmV5c2mw5MNsEg4QxvMiZTCaMPGw_rCYyldDhb2BJYxk4LqATHNQ0jI3BdeocIl4AtPvMyFxNBy4IeXUvvI-drRqlq6Toc8IRjv9wZ7R-ue5_NL_DsKQAHSo6zVdpPNjca7HU2LF0oYhJEMhacwhfK-6VgrALNZjUzToMoY7G3BQYhZhOdD3vEslhDITQRbHXu_MYngtB4SnhTsG1naAAxOZCWpuYH9Wdq0Nbw97nP0COrPn2rTdS4tb4vbBFezaCwR590sEvlkjK7NARGV8vpTGuBUnGwYn8QSvTcIIsvVkwI7uBPc4i7LSg8BDRV_PcSTD_lcuJN5EuSTY0g0i7eGfn9sOdWEvUy-Nr8xWcMcIe4uZCQ4AKHU41T-6FixUPjZL0-3fL_tUZZ8HUlgBL2BZLDt1Pes4yRvwNiE5dvN5QFTCZgFn0gfAWdCo1pY_RlGEr5vaiHm39E8Sawdl6M3ifWrThoqtYzgFFWNkLjUBn9GgUedxXgTICFB4Ii4QiUqkFZ3KDnOTjjfMilVXiQkaU_pF1t4xEoXsnKwjjrCiX1pa8Ehpw8Fuvxae4aTu6W3zIdBgQeZJOtSEUFZ6jMdJk0WZr6AgvHT52tYpt40I18-eRyLUFRS7Oc42y-RL5ReCqyNTAPms1OubMGJvl0C7byvQnlEpOvrolSeeP6IyiZSuC0tKqv097SlHTo5N8hgWoMHsA2MADvNcR4faZfnh4FJ7syIVsA82JTlvhDMA2Fff6OAm7llWK2abGYNPJk936Hb2zEN2O52Abnbgse9L3APTmwTNZINrjHxarNsnqMmUY8SHhjy3mrwXu3KjEXq9iRWchP34mcJfCF39k9JaC7B6hmzEMTL3HOW8Hvxfys07u8R5timhOhhrIkrXtCBDWMCEVep4ZPExQdVEjQmrGXu4nGgiru_B0BQXNMNTLYgaXJPmfdelN5-X49zML5Gzlj6B_GWYFehhQnSN9cYWsqRd-_qK-EcIXW435r9luuptcd2ofnd6iJVkU-XYD1h-4lAa_603mFgvWEkYXIvBEsBiTOhTgz30OrwTuDcu2JQB-uIuu-sbbYYqeZmps8UMkhfjGKh_m2WEIO90aEQufAl0VK3um2Bz4ErIuU4U_6ig6ID_VBtzrszRPPnYZwIjLn77AYil_a5dZkuDCuXpX-blHIgvth6QBd-sIHYYmXc0wNEo47pVDaz48tsv_tF6fKTPtmRltXTh99KZzSu-ZwP_esz09Xj_u_PKMJtFv254dEUyYB5g6sKGjiXMBBfrw79YPWMB3fTQajGU9JvYsbih6QJB-eOsQ4gfVsPEi2kapan1tRT9KrdCgQwV50z42yjc9PEhI4lNPM9St9sWtgFFRVDTi7Ft8jDTAlfzE12VYIY3mBvAj3nF71t43KhGcnxyGiy7QPqind1fF3FoThtcjltQPg9kqxO9HS1SLD1AfWIylDnsPNL9Jk_y51MMmr2rJaxd69f97GH08za7NulESifXQT-ZlTUDT26QvAt2kyNbJqJ9RW2tQO6_hkxKAvUM1NYuxHkplaz5y-YfgqP-BvidTL9QfnA3AQzRB8qaIQxt0bzCXqk8P0r4aXuATcZVQwMoF0wCoFTV0F9ytLdB0wpof4UcyfEY6zf6ewSJuvibOjUP-IZwfP0DVPymU5-xMJ-3VUTr6-598Di_yRm0mDlavEz4IjgF_MtfBjz6O-P4tXcGzX6NQUoE4bFlxPuT8rwC9N9uthjtfs4AHEiNnINSQqDb5VjAQJPUwpa7Q4sELqKnbfLuvErwLU2y_ThUv0MVRW32rh2rzzZyQ-ZoGL3jULFCtbEdFC8LP2_u-gbiUDMM1-ZFlbSMokZYGMXwvq_WFy4JY9fCiYJLpBFHYZPoJBSDN6gjHw9hA06wZn4Z4lHb_8SPMRC_hyqYBdHUlcaptC85YWuZA2Z8j5XYEEs4aWSeHNz2cah4KWIkGk_b4TTRvTbJWANMdV2mp3_HboQ9h-jpV98XdJiFtje13JVztvyJmcp0l-Ndtg3b5RIIUFWdszL6cOlT24zi4TsjOo08rc30ByvwPChMIfLrEIAKKd08YsSoHRJ4l5fa90FSQw2jcRoCSZSBTI-GlkigatSbgPvimdX5JorTR9PHsWdeNVOFh8IAGLcI-hNjfb5CqtgAFo48gh1aIfwg-iQMPnUxNiYhasDnyYZLp8O8UHFsfweKbpkgH1jaM9WZvnYvtLiA4ZtPYw5Mq1igOITCjka9le2NaE31_L2gIES8HapWiXHr1dtLuYPl_yyXoQzxkqC2yGASTfWRPo2sN0kfYv-HnQHd-sE8MXssPwmIzmZqRau1WCuxE9HER_2SxQyqRVOj1AXcwL1yrdbRxcuyQ1pDsl40jABUcT_QBxSzMZDNLj_mOX7L6bxGKtlWznNl2DNyOL6Olwuwo0qCQ7bkAg_tpHqSeZaMy9kHUd-Gcy_u7sRihcckwIff1h-urrjzmIwOMh_x6qiP3RCJhxVtjOL_L8VXkE5iHKkK8H9_RyR0TT3KruUJcLJ5QWkaW7LznvkpD2U5V28rhfDUkif00pRoTfQHlkJiRKhN4XgPVps9-kSZmczofaZ4bOaUBYiUa9TKZj21Tr9LBxpfbWJcwzGAtz5EgxQzbVYPE-k7RHbe-fHJNfLhZutB1yXDy9kuiL_ab6-CgqU6N0AGH6TWo2AGqQ&cid=CAASEuRon7wGfKYAtTl-g2vzjlBDFg&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7eac9876de8b55341701a45fbef2ec523361bf9b47d9a9fc6a018c6279128dee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28854
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame C8F8 2 KB
1 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/window_focus_fy2019.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:02:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 101
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 01 Sep 2021 21:02:28 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C8F8 124 KB
37 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4621e2f0cc2662504242c3321a21836621dd99f274ef444418dfbe96c3f1f79f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:09 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629286078051219"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38195
x-xss-protection: 0
expires: Wed, 18 Aug 2021 21:04:09 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame C8F8 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 236
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 01 Sep 2021 21:00:13 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C8F8 42 B
63 B 28ms
26ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CAX94HfhmXglWiIEGJLJW8P8nowqLwGXnJbXI7s8Wa8_NckMoCRXcDyesJe98xpgnfPu2y8Fkl1uxmuev5IlIurD4hoZ0RYIH3VIL7N8a70j9_UI8

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081701.js?31062322

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Wed, 18 Aug 2021 21:04:09 GMT

GET
H2 200 html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame 16F5 169 KB
59 KB 28ms
8ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 19:02:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7298
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59842
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:49 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Aug 2021 19:02:31 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/elements/html/ Frame 16F5 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B4ubndSXYO74QyH0w1Jf8bjvZMX5wBHmpL8a9jNKIqb_paz0EBAblENSS2HlbvVvH237MSrcfDkwlEN8vb4sZNjE53ifJx2ej88E8J1lYyBWl0U1MGOHnpkjNkj7cbGYoT8wYc1z92xAqCjDVNaNuAnUNVEw&dbm_d=AKAmf-AeHT2ytAJqPmdpCxRB-5LGi_J4MRceBNz6HfQc0vhZ_uMbx5eJvyvWxgs17uUggkzX_wlGPGCCUvr8Lr6e2YZOzvCYTNCOjGWNCW9w-NBw1MLTe6g7IG8eTETKXQyKzd6_oOQeyb9a3khdUOl5UOVoMjjAloSkGoTRb6NPPwm47jtVwfNMMXz8gHos2ZScoevs_E_MdSOnZsKkxaIyo3rNSCosWkZF77N4l8_FWjwKbcdqGacK9w9T6SPCw0wQwXaAUWRcw08mcR2JZA0oWQ4QRDYbo9QrYcA8JP0mDsfykj9PPDiNQlA03E0UPEerUsCyyXPfbJk0tIGuopbBRpS22Nq9ABOwkW3KanpUn5BQLUKWjPtyoQMUlgF6HOXZunExue9aawmaJzPbS7wkAAW_MXEsBLMPwmsk062dbdejgaSgIPXFfH56FGGyMlxl-tjaVBFALw3Kma2zx4HLCD_0C33HDXLLK2HnjGMRUYeNdGmUykXgnpEktnpXUoMRNS9RRUyopExxw7O81QHLOPPeVNI7CPi2mxyB_lrubgNGec9HEuGZnfC4b28j8Ns_KTylZMDmTiFYzBJ5ROYRqrp4B9gizE8O5WnrM1O91-bpvDAMinbD1sQDfWXqHtPxkaGcjRB7LFXZw5ycTHqw9IHfmzYWBMB542FHgcwg03zXFYq_h8ex_Ft6PV6C4u8bzTQjAisyJV8YpAe9jE8eoALHQJspDN6XopmLLBatPtajAApLVqcUdeP73nwHt-cOswtpkq6y6ZSXQ-X7P05pX4cVtkknkf66MAMpcUmXT4sCtzcS_aiwr8xMW77FH95CefJ2yGqkj6RDx-0mIcvch6cJq51bAF2tdzVDVASqJW9RhiwAasIJ9h5F-sO18FRz1aJIYEgyIEhV9Puuf6FL2G4QA8wJmSyzniPguxxcaG40IMiDl3_XUX4p8Gj2FFctu5yeJrJTegjoAAofBHuhP1bdpUUKqBemveVkOLPsyiNS_iq2kCY1YZgyQWNsUPgfmvBydhkRCvg8GLwSAm74eT-Ay41OnKn4f55AJBoRG-dz99QmJ1P7RbuxXuNg_OqH1dP-1Gu_smEyQwqs_h9AAaqnYELnWUtWLcQK7Ys99A-JQJCbMxXo18ERV02m0UzQzGrWJfNsnPEYkx-r7V_DWNo_-jnUjmiQI6Ewdlei1EcFUNG7LdkMrDrMe-FYTln9kp5wcsv_GzvoY0TD2nDbb7SU4bdJg6Yzb_vGiys1IG1mxzFr2Lxx2BjHvdmTRAhraja7Z86U1vrx64zCyin7XugEvI41k1o5DX3vc1wLI6Cg56FuDzhTcmk5M-z45iRO6uolVo-KFL0VzAuxZEgFjswAG_fLs_x9cMpDvX5RtE51DsaqKWPPRYX9t60wLIhRSN2MLWvYBz-MBqyMq5TvNpZ_Sytq4eupHa3HgxUtwUyGn3Mk00uOHHcEH038hhQCKn-oQiZaFDmfJyl_Q9xBuF1X6-nZNrRkZLDaBpjfD8ijBeEFX42KaTkkiui2bksZd-w5x5HHE85xH4eHZB9cXRX5328dhDey7PYS_7eV489DsJxqUju9b8qN0yQyiaANBnPas-yVWvEFgYRzbuKRso7pN5POWLMWI4WDHmtZ3C-ZL2VjpGw8phnkqNV3yqnKCgjFwSmhSqNNzEWl_w9lENy79uPmxHIWT43pPJ4-6TR1WyPBoGskbltZJvCqVrEGRJvAsobd9-JQQQ51zc0CJTSSusu1sK3Ed8VHYZnm0szQp4CouRk7oe5T-jgACgJoRoqxkDctju2otZZ9NeoKZ7QJ-caOoAPyCiNTZfKmu1eCzJ6QDV92WaYOmfVh2VHOLr7Ilc0jEpSR0cqmu-jBysD9FLohHTg87rnaexLXthzu4HIp4uxlL26-x1gVQ8PNYoxekwqSZkAg4HttaX3QQSfaveo5N7-c1lD9bsV7QyKjwtkZdAmsNej-PZYxvdj-r3O7GPOy4hTj4_LocEzqg8Jk-LfZxaDr-Y1vkbZvpdmPidHq_oSWb1o528ZRIWQCR09l0ZPjWDQ934cxZSe5wR-UN0Wm1ZNsX_xa_9HgOIWwKXuZwffFIHG5x_hOpny7XlYs8wN7zzM_RmvlHtZ6xC7d14BOQKiXgKIBieQNb84DhqNCPwqGVjyK2JVBfw3_3c-yMSD69gtVuZyzm5BEaUgqYU1sONjXBtZGUUOsC4PC0rWUdSiwqJK3mF6lYSo3C4H7KeDoK6o7tQPyssZNgSq4njvKjxAVooZdicBx_e3-uERMkdGAKf5AgPzA_xtG8QhqkwuS__uELiZ_DqCPD_cULYnqt9OclTH-PYGbO_Wqp-p163g0TSWADK4ry2iUOB5oHMSDNCVlPSwyR7kuXWBCbeKMpC3UireDVPW-3u_iJoj7clkbjALW30AILeNXSl6Dm3KfM0QcGfplqZV8qZyCXKZyZJu9mmFkbNiJLkJxjG6N3qS5iG_kEHiW4qBbB_8GN_A4WbKDrBNS2h4BzAn0C-3FZsEPKBwgGSfmGvfl_CmZnAHiv4EQIf4Ne6a9wK9gHqfJxzVT7gMQzX7i7jF3vRpdDMcnb8QE_OrJlbrBygw2GZhdj2UeupT9kjCfZTdpoU-AxnkcNtDdzGPTDeDN-aWhrW1Zv2fweH5cE4M6DDlIFenFcg7bnf1X1oYgQT8GlhkOLTXbaMYAgamXrzoQ_J1AZuj2Pyt9J8PVH0G3UgY7o5xyMHDWlzB0TKwHjp8tk1adX28UWFRMtSCH0MZPH8gu3lkS0hwxr6uddSQtZdU0_Ev3NPg7fzX6jB65lFef7vkKptsFe4KVPegW2Yil90K4Ucn7xcc6mE0wl4A6lsZCmBvm3NjPfBs2kmgzPQ5zUO88Gumu3FmlXdScSQyEAQHKVjOsAzR0pAMkSlqN87FEUH8&cid=CAASEuRo_lwU7a202w7a5FbEio47eA&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 20:50:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 798
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 01 Sep 2021 20:50:51 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/ Frame 16F5 24 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63ed4c66bf3ba06512f7028be62a4bd53295e1ba68a919a7591f5fd392e72b90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 20:53:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 647
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9341
x-xss-protection: 0
server: cafe
etag: 177112232901409761
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 01 Sep 2021 20:53:22 GMT

GET
H2 200 html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame E2A5 169 KB
59 KB 35ms
21ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 19:02:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7298
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59842
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:49 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Aug 2021 19:02:31 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/elements/html/ Frame E2A5 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bq7xFWpoyvDzdlx8q_pO9pT_edUJn5F-ebrLtdj7EMbY0SRN81yy-XMFoD8c2GqRSHQFmmshdG0NfGYLK6b9gtgo3-b5-fIB574QhTRdRsBy2LjjoTWhGLuDbJgozTP77znI2AbX1PHD0eiOiF_IbfWJZ78A&dbm_d=AKAmf-ABq2Wl0YaZEpdakeSr5SslqUG209oV8ZP4AponnXocMYL4wZaFgze2q91tIwwum7zO8M2DkRQtfQvMTN3CbVcrSbPIWKizW1hXinS-6YRjmvCUoQJh3FwQ1yRtNO1Y8HJydKpVfxTnBevMzt4XdULbdRaQeOj3zepqlS-6NdvHiZ0VXyuH8ICl88OJRbfm8GLT6r-LcT1MmCtVYs_9EO1qRyPs7YVMELjdC9pTuRh8tWuHYIc74jt7x7JtesyJiSXu9VFpoNNf3wxYyEbueUtAf64ndIRJz9-3Ui9-aBfzWTr7g-kUG-oi7YHHx0pEfA5NYQWADVQnPzkvnfsY7RReeX92KiEr51u4Pasj8FFkPl5RE9pJAHTEcKIJ5u8V-lxWyJPXXdbjyngdqtGsgKbYLlmLL8V31VxACAJ5uDpzSya1brD06V2Cu3uUj7s0aAWawHyl5kM9gSpJ3FwggW548Oa60FdfktsygYoOszKmn-ZtmuGI7XM-8C9RvUTEUL_mhQAfpMjx1CI6d60xlN1mmBebL_ucugNGxSkgoGNEm1xcLyNkZG4p1ezqxFUphZH5gixWk7GpfZynmfzt9jMra1XoD8stciuU-TShf8I5-0fV1psLbyhO0ur6OLG3y9NCe_c5wofgbxoppCFzTQEpbkg_aThqn5gvlnNe5Ua8KntuedvVvTthupmeAa-qlT2ydrbvjtkAcXiD9oAgEiYL9fpn6NHXpA0E5BCYJSCnWBlp2uTvC6rWy_FQErwgRpd5RuOemL4X-vJbIyaRb3vd1G23SI0InSZjLP33H5yc5S49628jHrI-RtonLDSp18FBeaP7cSbO29K71R3EkIqXaK4gF77tb1pNIRR1s5L6iRyA_UUif4nX3_2tQ3iKjR1EJrBiT2x-J4T2O7PZI4rZg383n0ziXxHgn2Zy6gZksUH5A3xNlGiOjBR20uKz4R8UGTgI0qgOIunxjjB1WyvMSEompce9jdSeBAr5xLHIll2Qji44AIKIby7UOxpO_uwZiDzEAdVeCwuLA3D87N-yG0CbYzZXVMkEBz3Lwm1EVtMP29OZaK6ZPecC4rEwQlHIoiFZ1tKzOQ0ot09Y_LNMlEiG1BXf-V8klmrXtmlqBqPlgbN9l6e2FSMl-8rrNBTTfltehw5SBWbHxYqkOmve8-s1dm1xEjunyqg95NXzmN6zduq_V8qr_IKHLeThA5kmDZ0LMMweehWoQWvhuj5Lbih5JXJ0Z80Jmt3ylgBI5ZPJzB4jEXXMX1XptzgYFIPUzkLtKf8Mh7s1hWaWeYgl2lJeN4sksVGF7rikoQ-XWe-ya96dyhSQ8OdSyXHHJCM00xZ5mPCQvwB7hzz01T25moGJR4ObfgOiWzQWz5HVZRrU52U84zdXbzRDV97eFObCA6sPn27T_STilQ31XnArDiDgEw9JKYjb1Sosl1wHkT0Ukqx7OLjL5ABWQFc1rlPAX6EfmSnC11SBhH5KjHI0mO68NZaZU0oqXQw0FO2WMS9sKL-ZFTA1OPavC0Hp12X9Kat7snTQ8wIM17Gg75XZiMlpJsndNOXlaVhGuncNrSxDJ1q6FKd17lTSj65IChpLBa2JJ6d21aHXJyDRkKO7zwtR2NtI25crVbRaUo47orrAFhn2-qXrbZOfoX2PgRpC4mSnxstZCtiHe-ovPGLTDUAD97Qfqjd96qw-eeNMQDQ_MnwWBAbbhd7qMTpj7ZA9CfuRlBrXvvs8Cl6--YFGWGSTLPKJK7ywomy6-4LNu29edOtxR_zqT-F9ClqFs6FMiNXRCxbSmr79ZSV2hhxfaJ6l0jkyYrEzkPEj-Hj3rXhng1NbpgcAPdRXVbEzCbvMGXjlAi-YT_SpQtoTOjNBPACyXzHtxg7NoHfM5WyORa0noRK6PCIpkJ7Z8_IDIa2txHknjiY_inzq7tDVS8zhYyYzNcv4nxlSlnPHscJKqXev33PQbfRtgN9rP1UhVepQ3QyXlrC8886JyYnLj1Zq3Odul0_eMaZkJIYWw25iw7N1YpfzXXUHVhhOBaJGRlaewNcde_OZhvn_3XF5o1epNXnaJEygahD2S9RDZ5e1RiJm2ymaQJodFKAwKnpDpiHheO2FfnT7wRXtGr7sXiyPrdAGuEQOSRkZk4G_AOBDVsMUUIdob_3Ag-uy7VVIY_9xvw1hPZYKQEZTYQ9V9pd4JCjY-RE170uOmq3e5eFe5SJWIdfgLgruKpMr3jOlgSMZzezaU-393P130an3_dNwxr72WEC0QaA4IFB6XIJUqbO_M72PYhtS3mp41lYQssRSGfZFEkUuLrm4SU74hP0EIxEya9DF6Kh6ShxdQmqwM0uWva3CB9GYA27936v-CgixvdxBHMYvKSOluyNOQYPTLVkZCU-m6hBB9UYIxXFJPl_iy91_gjGu9fNy2ex2LGPGzLww31nFG0dVUiAoIBupo8CxMRZUu1Jn5SqmzX0Zj67rOpEVw3gXGFON9h-eeho-ij9KV5s-hEK21f4UKhrKAZWDq0gVKiow1jPVkV-hZLtqvCSrusOMzaU-W5qqaBk9Xi-dIBMyVHS6skqVAySFXFyqBayPxTJNbZabAfRkebbQ6qUpXp9iYZE6EMxyGGCcj_21-e4tkbw_28V1FtgrGstkmSGu-KXPKBYHa_iGqzRBXfzmER5R5TG6HhyBwjWfPPkBJUZJd-l-u1uIiGOqP3d2A0rj32K-WA54p5N0HBOrmpSdWOiwUbQuI-XPPKM5PzAlUgzc8SHqbP4NNuTyyGvZIBRiupp1mM98LFOO0x_cN6l7YIMTmkY0s3gGYbvoAnSUvLC1WXQ8FmAsDOBTwPAlzI0d0SxfNVkmr06ALyx5IoZ6yqEH1BZwPYie7qJfynd_sVFWKJ0HzIQ2YG1e7J7sGKeOodyUOfIoIWNVayDew306tGMTdqxAlUyfiEyD8GkX&cid=CAASEuRoF_z9xR-Ozd99ipQ9K3l89g&rfl=1%2Chttps%253A%252F%252Fprnt.sc%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 20:50:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 798
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 01 Sep 2021 20:50:51 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/ Frame E2A5 24 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63ed4c66bf3ba06512f7028be62a4bd53295e1ba68a919a7591f5fd392e72b90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 20:53:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 647
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9341
x-xss-protection: 0
server: cafe
etag: 177112232901409761
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 01 Sep 2021 20:53:22 GMT

GET
H2 200 html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame C8F8 169 KB
59 KB 23ms
15ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 19:02:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7298
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59842
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:49 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Aug 2021 19:02:31 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/elements/html/ Frame C8F8 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C61NNBwpKzbZNk7MiSYOB4UmumU_YKOdhlqwZdBW-Ww_dSRy62XlfrFq5mqlFPBeRIuGg3ttnIB6kM3VypIx5PmrP33FUxl0A48J645BOUFpu80J7fOf_TXQv5yQLB8uu9l0Hw0wGcxmRyP02WIjaAKqwLhg&dbm_d=AKAmf-A6MjSyVIY1bmtCsc7mL3CiS8kQfVXYPjF_SE8dC9JrTXPrPsohRIkEjfP942jnxKD3XBmZ4SdpPhnpfv-O0VDukGacffN0X7Zar1i0ahrl9q_gc7WbfeKMB_Mq_M8VCYEuuulN0bF7TuhtWmFooykpd1sKU-znhVhjWvX0vRa3I3Xf9nHeDCN7wKMXmpfGHxAOw1OQ-Vx7gc-lipxSkveN4wvNsWS4rRo9xMmV5c2mw5MNsEg4QxvMiZTCaMPGw_rCYyldDhb2BJYxk4LqATHNQ0jI3BdeocIl4AtPvMyFxNBy4IeXUvvI-drRqlq6Toc8IRjv9wZ7R-ue5_NL_DsKQAHSo6zVdpPNjca7HU2LF0oYhJEMhacwhfK-6VgrALNZjUzToMoY7G3BQYhZhOdD3vEslhDITQRbHXu_MYngtB4SnhTsG1naAAxOZCWpuYH9Wdq0Nbw97nP0COrPn2rTdS4tb4vbBFezaCwR590sEvlkjK7NARGV8vpTGuBUnGwYn8QSvTcIIsvVkwI7uBPc4i7LSg8BDRV_PcSTD_lcuJN5EuSTY0g0i7eGfn9sOdWEvUy-Nr8xWcMcIe4uZCQ4AKHU41T-6FixUPjZL0-3fL_tUZZ8HUlgBL2BZLDt1Pes4yRvwNiE5dvN5QFTCZgFn0gfAWdCo1pY_RlGEr5vaiHm39E8Sawdl6M3ifWrThoqtYzgFFWNkLjUBn9GgUedxXgTICFB4Ii4QiUqkFZ3KDnOTjjfMilVXiQkaU_pF1t4xEoXsnKwjjrCiX1pa8Ehpw8Fuvxae4aTu6W3zIdBgQeZJOtSEUFZ6jMdJk0WZr6AgvHT52tYpt40I18-eRyLUFRS7Oc42y-RL5ReCqyNTAPms1OubMGJvl0C7byvQnlEpOvrolSeeP6IyiZSuC0tKqv097SlHTo5N8hgWoMHsA2MADvNcR4faZfnh4FJ7syIVsA82JTlvhDMA2Fff6OAm7llWK2abGYNPJk936Hb2zEN2O52Abnbgse9L3APTmwTNZINrjHxarNsnqMmUY8SHhjy3mrwXu3KjEXq9iRWchP34mcJfCF39k9JaC7B6hmzEMTL3HOW8Hvxfys07u8R5timhOhhrIkrXtCBDWMCEVep4ZPExQdVEjQmrGXu4nGgiru_B0BQXNMNTLYgaXJPmfdelN5-X49zML5Gzlj6B_GWYFehhQnSN9cYWsqRd-_qK-EcIXW435r9luuptcd2ofnd6iJVkU-XYD1h-4lAa_603mFgvWEkYXIvBEsBiTOhTgz30OrwTuDcu2JQB-uIuu-sbbYYqeZmps8UMkhfjGKh_m2WEIO90aEQufAl0VK3um2Bz4ErIuU4U_6ig6ID_VBtzrszRPPnYZwIjLn77AYil_a5dZkuDCuXpX-blHIgvth6QBd-sIHYYmXc0wNEo47pVDaz48tsv_tF6fKTPtmRltXTh99KZzSu-ZwP_esz09Xj_u_PKMJtFv254dEUyYB5g6sKGjiXMBBfrw79YPWMB3fTQajGU9JvYsbih6QJB-eOsQ4gfVsPEi2kapan1tRT9KrdCgQwV50z42yjc9PEhI4lNPM9St9sWtgFFRVDTi7Ft8jDTAlfzE12VYIY3mBvAj3nF71t43KhGcnxyGiy7QPqind1fF3FoThtcjltQPg9kqxO9HS1SLD1AfWIylDnsPNL9Jk_y51MMmr2rJaxd69f97GH08za7NulESifXQT-ZlTUDT26QvAt2kyNbJqJ9RW2tQO6_hkxKAvUM1NYuxHkplaz5y-YfgqP-BvidTL9QfnA3AQzRB8qaIQxt0bzCXqk8P0r4aXuATcZVQwMoF0wCoFTV0F9ytLdB0wpof4UcyfEY6zf6ewSJuvibOjUP-IZwfP0DVPymU5-xMJ-3VUTr6-598Di_yRm0mDlavEz4IjgF_MtfBjz6O-P4tXcGzX6NQUoE4bFlxPuT8rwC9N9uthjtfs4AHEiNnINSQqDb5VjAQJPUwpa7Q4sELqKnbfLuvErwLU2y_ThUv0MVRW32rh2rzzZyQ-ZoGL3jULFCtbEdFC8LP2_u-gbiUDMM1-ZFlbSMokZYGMXwvq_WFy4JY9fCiYJLpBFHYZPoJBSDN6gjHw9hA06wZn4Z4lHb_8SPMRC_hyqYBdHUlcaptC85YWuZA2Z8j5XYEEs4aWSeHNz2cah4KWIkGk_b4TTRvTbJWANMdV2mp3_HboQ9h-jpV98XdJiFtje13JVztvyJmcp0l-Ndtg3b5RIIUFWdszL6cOlT24zi4TsjOo08rc30ByvwPChMIfLrEIAKKd08YsSoHRJ4l5fa90FSQw2jcRoCSZSBTI-GlkigatSbgPvimdX5JorTR9PHsWdeNVOFh8IAGLcI-hNjfb5CqtgAFo48gh1aIfwg-iQMPnUxNiYhasDnyYZLp8O8UHFsfweKbpkgH1jaM9WZvnYvtLiA4ZtPYw5Mq1igOITCjka9le2NaE31_L2gIES8HapWiXHr1dtLuYPl_yyXoQzxkqC2yGASTfWRPo2sN0kfYv-HnQHd-sE8MXssPwmIzmZqRau1WCuxE9HER_2SxQyqRVOj1AXcwL1yrdbRxcuyQ1pDsl40jABUcT_QBxSzMZDNLj_mOX7L6bxGKtlWznNl2DNyOL6Olwuwo0qCQ7bkAg_tpHqSeZaMy9kHUd-Gcy_u7sRihcckwIff1h-urrjzmIwOMh_x6qiP3RCJhxVtjOL_L8VXkE5iHKkK8H9_RyR0TT3KruUJcLJ5QWkaW7LznvkpD2U5V28rhfDUkif00pRoTfQHlkJiRKhN4XgPVps9-kSZmczofaZ4bOaUBYiUa9TKZj21Tr9LBxpfbWJcwzGAtz5EgxQzbVYPE-k7RHbe-fHJNfLhZutB1yXDy9kuiL_ab6-CgqU6N0AGH6TWo2AGqQ&cid=CAASEuRon7wGfKYAtTl-g2vzjlBDFg&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 20:50:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 798
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 01 Sep 2021 20:50:51 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/ Frame C8F8 24 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63ed4c66bf3ba06512f7028be62a4bd53295e1ba68a919a7591f5fd392e72b90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 20:53:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 647
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9341
x-xss-protection: 0
server: cafe
etag: 177112232901409761
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 01 Sep 2021 20:53:22 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 662C 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Wed, 18 Aug 2021 18:58:00 GMT
expires: Thu, 18 Aug 2022 18:58:00 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 7569
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 2CDB 783 B
531 B 17ms
16ms Document
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

95eb000be2e5f9731d5aace0dd3a7367fa28ccd592d9882afc0705988add7185

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-h6ZM5hfFaOueUfie0UArfQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

expires: Wed, 18 Aug 2021 21:04:09 GMT
date: Wed, 18 Aug 2021 21:04:09 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-h6ZM5hfFaOueUfie0UArfQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4554
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1

43 B
1012 B

98ms
88ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKjs5gIQ8LPQ_AEY64C2rgEwAQ&v=APEucNVk_mwbVQ7Q6EA8oKgBuQ-oU0wGMwAd0g4uCO3EnG7VUQzrkH5PFEJDkp8VKdaoNKUzLLgeEDM_Z8Gn2bvTXkeZY1j30GbNMMonmYc9w5pc9UgJpGYOLPIbmTH93W_M6K1SPtBUvMpDT2TbVb-cYdERjh3tH4a85P0dwbBSBLtPnFZ1H5s
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 18 Aug 2021 21:04:09 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 18 Aug 2021 21:04:09 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4554
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YR11yQCSENnTX2N5G6a3RQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1

43 B
892 B

74ms
73ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKjs5gIQ8LPQ_AEY64C2rgEwAQ&v=APEucNVk_mwbVQ7Q6EA8oKgBuQ-oU0wGMwAd0g4uCO3EnG7VUQzrkH5PFEJDkp8VKdaoNKUzLLgeEDM_Z8Gn2bvTXkeZY1j30GbNMMonmYc9w5pc9UgJpGYOLPIbmTH93W_M6K1SPtBUvMpDT2TbVb-cYdERjh3tH4a85P0dwbBSBLtPnFZ1H5s
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 18 Aug 2021 21:04:09 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 18 Aug 2021 21:04:09 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 4554
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGIxramnKgnTRcQ7FUs37qY&google_cver=1

43 B
1002 B

106ms
50ms

Image
image/gif

185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGIxramnKgnTRcQ7FUs37qY&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKjs5gIQ8LPQ_AEY64C2rgEwAQ&v=APEucNVk_mwbVQ7Q6EA8oKgBuQ-oU0wGMwAd0g4uCO3EnG7VUQzrkH5PFEJDkp8VKdaoNKUzLLgeEDM_Z8Gn2bvTXkeZY1j30GbNMMonmYc9w5pc9UgJpGYOLPIbmTH93W_M6K1SPtBUvMpDT2TbVb-cYdERjh3tH4a85P0dwbBSBLtPnFZ1H5s

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 18 Aug 2021 21:04:09 GMT
X-Proxy-Origin: 45.12.220.53; 45.12.220.53; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 9cb41416-1282-4f43-8fa5-d423294ebbcb
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGIxramnKgnTRcQ7FUs37qY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 4554
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTcxNDkyMjEzNjI1OTk3NzcyMQ%3D%3D

170 B
188 B

70ms
64ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTcxNDkyMjEzNjI1OTk3NzcyMQ%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 18 Aug 2021 21:04:09 GMT
X-Proxy-Origin: 45.12.220.53; 45.12.220.53; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 4174ff27-c3e6-4f0f-a7e5-d48a1ad43e88
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTcxNDkyMjEzNjI1OTk3NzcyMQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame BC95
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1

43 B
1012 B

90ms
85ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKjs5gIQ8LPQ_AEYnoC2rgEwAQ&v=APEucNUjbMlmaAUbjoaTa9rbP_RtgNgBxxqxUUeKoQ8fEoM8NKvRKsqdLCdEp5CP9C8AQFKPolAH-xQEkHzkYpywSsePB_253SmJG_94M0uljkCzuErcE6Hux5ljHJyf4ZA0KqOvRZdZOY9IkgFJJYIR6AKVO6DlsLLUVDUtwTdsshDqEE4tQcs
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 18 Aug 2021 21:04:09 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 18 Aug 2021 21:04:09 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame BC95
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YR11yQCSENnTX2N5G6a3RQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1

43 B
892 B

70ms
69ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKjs5gIQ8LPQ_AEYnoC2rgEwAQ&v=APEucNUjbMlmaAUbjoaTa9rbP_RtgNgBxxqxUUeKoQ8fEoM8NKvRKsqdLCdEp5CP9C8AQFKPolAH-xQEkHzkYpywSsePB_253SmJG_94M0uljkCzuErcE6Hux5ljHJyf4ZA0KqOvRZdZOY9IkgFJJYIR6AKVO6DlsLLUVDUtwTdsshDqEE4tQcs
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 18 Aug 2021 21:04:09 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 18 Aug 2021 21:04:09 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame BC95
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGIxramnKgnTRcQ7FUs37qY&google_cver=1

43 B
1002 B

97ms
50ms

Image
image/gif

185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGIxramnKgnTRcQ7FUs37qY&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKjs5gIQ8LPQ_AEYnoC2rgEwAQ&v=APEucNUjbMlmaAUbjoaTa9rbP_RtgNgBxxqxUUeKoQ8fEoM8NKvRKsqdLCdEp5CP9C8AQFKPolAH-xQEkHzkYpywSsePB_253SmJG_94M0uljkCzuErcE6Hux5ljHJyf4ZA0KqOvRZdZOY9IkgFJJYIR6AKVO6DlsLLUVDUtwTdsshDqEE4tQcs

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 18 Aug 2021 21:04:09 GMT
X-Proxy-Origin: 45.12.220.53; 45.12.220.53; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: cfa20135-db82-4fb0-b2c9-acdf9bc66b59
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGIxramnKgnTRcQ7FUs37qY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame BC95
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTcxNDkyMjEzNjI1OTk3NzcyMQ%3D%3D

170 B
188 B

66ms
66ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTcxNDkyMjEzNjI1OTk3NzcyMQ%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 18 Aug 2021 21:04:09 GMT
X-Proxy-Origin: 45.12.220.53; 45.12.220.53; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 25e71730-0f11-474f-ba81-8f71539f5ebb
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTcxNDkyMjEzNjI1OTk3NzcyMQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9DEB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1

43 B
1012 B

97ms
87ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKjs5gIQ8LPQ_AEY64C2rgEwAQ&v=APEucNWazA_19L_NHZZVF_lArzGfd4VAvWi2ekvBkE_O2RL7A6cq1NoT9YCfVKSIbt9xQmFIp7b9Zwla1HqoFFYe7Ofnd-HynmBiXVDDQIHDJGdlDARCLIiFSEEdCfCKK8xPXR7NVukSu653FBPbt6xRI-CiW1P7fYf736NimD4OZ98prGsN-Do
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 18 Aug 2021 21:04:09 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 18 Aug 2021 21:04:09 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9DEB
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YR11yQCSENnTX2N5G6a3RQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1

43 B
892 B

69ms
68ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKjs5gIQ8LPQ_AEY64C2rgEwAQ&v=APEucNWazA_19L_NHZZVF_lArzGfd4VAvWi2ekvBkE_O2RL7A6cq1NoT9YCfVKSIbt9xQmFIp7b9Zwla1HqoFFYe7Ofnd-HynmBiXVDDQIHDJGdlDARCLIiFSEEdCfCKK8xPXR7NVukSu653FBPbt6xRI-CiW1P7fYf736NimD4OZ98prGsN-Do
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 18 Aug 2021 21:04:09 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 18 Aug 2021 21:04:09 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJBuBE7hhsYy2ATD15ngrIY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 9DEB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGIxramnKgnTRcQ7FUs37qY&google_cver=1

43 B
1002 B

64ms
48ms

Image
image/gif

185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGIxramnKgnTRcQ7FUs37qY&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKjs5gIQ8LPQ_AEY64C2rgEwAQ&v=APEucNWazA_19L_NHZZVF_lArzGfd4VAvWi2ekvBkE_O2RL7A6cq1NoT9YCfVKSIbt9xQmFIp7b9Zwla1HqoFFYe7Ofnd-HynmBiXVDDQIHDJGdlDARCLIiFSEEdCfCKK8xPXR7NVukSu653FBPbt6xRI-CiW1P7fYf736NimD4OZ98prGsN-Do

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 18 Aug 2021 21:04:09 GMT
X-Proxy-Origin: 45.12.220.53; 45.12.220.53; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 0d8a448e-3539-43b5-a04c-b4d881d5584e
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGIxramnKgnTRcQ7FUs37qY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 9DEB
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTcxNDkyMjEzNjI1OTk3NzcyMQ%3D%3D

170 B
188 B

65ms
64ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTcxNDkyMjEzNjI1OTk3NzcyMQ%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 18 Aug 2021 21:04:09 GMT
X-Proxy-Origin: 45.12.220.53; 45.12.220.53; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 5ad68dec-0f66-46d2-8349-47e1ba44c906
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTcxNDkyMjEzNjI1OTk3NzcyMQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 16F5 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 13 Aug 2021 17:07:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 446178
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 13 Aug 2022 17:07:51 GMT

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame A3F0 1 KB
749 B 9ms
8ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 18 Aug 2021 03:09:05 GMT
expires: Thu, 19 Aug 2021 03:09:05 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 64504
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 16F5 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8e193098549a42c5609f47940e991d29ff85eb5b7a9ad6c0339d0f9a41975351

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C8F8 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 13 Aug 2021 17:07:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 446178
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 13 Aug 2022 17:07:51 GMT

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame BD16 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 18 Aug 2021 03:09:05 GMT
expires: Thu, 19 Aug 2021 03:09:05 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 64504
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame C8F8 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0e8bbe951dd4239876be3e38704329f90dfe16df2e14e4d168624c27536bf8f0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E2A5 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 13 Aug 2021 17:07:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 446178
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 13 Aug 2022 17:07:51 GMT

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame BEAC 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 18 Aug 2021 03:09:05 GMT
expires: Thu, 19 Aug 2021 03:09:05 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 64504
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame E2A5 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e33139bde3704b1cc7ee5d82aee60f7962e295301a1cba0a37e670f168cdfaa

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/ Frame 1A2A 133 KB
34 KB 23ms
22ms Document
text/html 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=a08xP1Y3mD&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

09e7825013295f1d736a25a46d478267a65189a5a31f01c5ab681eaece702b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=a08xP1Y3mD&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 34707
date: Wed, 18 Aug 2021 21:04:09 GMT
expires: Thu, 19 Aug 2021 21:04:09 GMT
cache-control: public, max-age=86400
last-modified: Thu, 19 Nov 2020 15:00:23 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C8F8 0
255 B 84ms
82ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvOEygqKKwlBDHl1KCPlh3I3Xt9yn5pnksOtUOJqNPAdD7emIR6qDcNXz0-xS6VfLskMuUzfjVAszD6JxqkUL38s1cvWclAo4s2DnDF1HPMHRyyMriXe8cxAnj6dGrFAiFWT5KC-3kqvG-gjt4c4kCr0xyodnZsteaPOL-I5KiaOqcUyd736oY6wKyikOAHw9_4ixYECx_zCupxOD5yQeVRfxY_GmnCVljLHHgS7C1AGUVsD0jRixNOnJbWdQ4boIP0_zemT71eb8Nsv6UI-A5z97yclbFbDMVug_klL3ahmTTeCs9cqGGh8TlhLSnm5GxBU9eGzxuus9xrg0CWd7NiJQ9e3cQAVTC8COyDeidQlBlTLRLA9AOEmCTFLMeS0JZaGpb2-vQ-FWsnzPU7p8VetbhQyzlRtIpaNRVuDSem5fYHHTihn5OH2h2ORkKn0bFbzaoC6T2yc1bcQsB21lAYuyOitrZvhX4FGxyRZ58lOxsOI-jlkXYi6RmxQ8kuEpPQFnRu2208HCdcn-lFlQuijR85iu3l6_aCsGz0T14nS-7dCV3xwSm5d0bvSuedEOMgsxI59nQrFliuVOCeS9ybm3AqtIaNb-fXslqUjA09H2MLYLBYVFjjQCS6qf07pyAkkJpBqiyKz6KlSIauNf6BUVIiOXwqLy3njTkPDROKYeurvZ821z5_OCG4p-9dGX-IJu77TRvr3oVfOK7xzP8R4CRM6f789JNkcaYKhNgRkrLuW1ONu3IUhXuft_f6bDjpYgTMIifctNYYyrGUZ1JlhaqdDoZ_i1opFvto_tjoe6ISBSYJtuwDjyQyoDLfoiN3nNTZPHNL_rwQRqtWqpSnDgtdJ2wWS-j1W2zT5yehPk4vtkyStQxmcTckMKVjN9TMn2i1QjnretlQEngCgE75L88_0opDoCQNPcCXJBFrnfUW3EIFd7y7s3K0bBcPLRwvlzX7kgqtAcj7GgKPjauth0cGLPdlYS6pHLjY0ZK_xUOKniGx3Fyov0-Hj6sTRdAWp96_V5bC5QaR4_UoGB19kYTntJEe0W-gjKXjfKG4XTPfqfEhSsMbr-E2g5EjlMsNuYC_jKRJOfIif3Bn_yHr1SOcExHGm1ZafUPyrILIAL0uIbqXRxLJr5C49WI6Q7SKEF_X1brCKNCkwKwMbGA8kSmrbnI5OAPaQmcCbPSqKajdhmQ&sai=AMfl-YQe0KQcnjD65cT6HH5BDYEkTkfg5jzHRIVVUsn5O2IcjhG9Xy8mawUV9GCg46AKr4SB1xdLUlCqQ2u5OjgpbJkqwDyQk8TmCYaGBJLgAwG4QHSMtezW0wvSY4mgA0IsnGQoVh0CWQW2oWwB3wVCyUeaA92BXA&sig=Cg0ArKJSzMLhHp98oqbwEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=195&cbvp=1&cstd=189&cisv=r20210812.55387&adurl=

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 18 Aug 2021 21:04:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 60E3 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 16 Aug 2021 00:46:47 GMT
expires: Tue, 16 Aug 2022 00:46:47 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 245842
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/ Frame B66A 133 KB
34 KB 18ms
15ms Document
text/html 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=HNi5h9qWca&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

09e7825013295f1d736a25a46d478267a65189a5a31f01c5ab681eaece702b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=HNi5h9qWca&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 34707
date: Wed, 18 Aug 2021 21:04:09 GMT
expires: Thu, 19 Aug 2021 21:04:09 GMT
cache-control: public, max-age=86400
last-modified: Thu, 19 Nov 2020 15:00:23 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 16F5 0
61 B 84ms
83ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstPE6yxQrQD8GJFzIgKtpIZ-KBTnqyQV_pPIXSZ8g7N-LgcgqtMFd45__vmWx4zh6Z6JpuUcrEqmgAOeGGasovdD9qVm3PO8M1xFsjM64O3fp3HsJsfsdnJKh_C_QiXbpzqr5TGCCsiejxXVuFXVitoTfbdsqN94jXPjckyuysEu5rNdnFsvHt_YJIEdnPJwCn9XeDgLcPnBe0q-RjRDn41NN0-wzZnd75x9B48krNK4wJU1OtWeadryuh2V5dY6fJoa4QAjOmSZ-MH3RyjLTOyTwDvUDcmjYB3R_v5-MDPSEFzILlOhfRn3wPr-S7n1CeFyEq4HUbT3PrQm5zVhbQJaCOHDpsxwir7Wg6VZEVrqanWcGexPHXWapVKNg_Q4vZcQe-KBNVgFRG0Hp0m6zuYtbdK3KaXfvEDMor8kXlhkWAol6fDdUIzxxmqdtrUtO6aMYRgeJqP9Go9rXuPBF2cKTKvo-tcITQvokLDNXbvQkkXwLUgfEPOqLyzmlNPYJniG1DuuBcl8Qs85ZMfp_8fYequ1icW4HeFA3HJaxsncCHGnKHNgkPnC7XUYEw30u8gb1wnqawTd4e7Jr1pcHbYiHQye1wBwuuKghliLo2u_QlCw5mZwifcndSGWMhLnfobWpTfFhM2LPXV4jNRBevr9UT80R1fkhkCAoboZIQA5dCx5V0STEFgx_7PgI6r9HT8Ipd9IX6fAxwBxf8Q0c535pV1PQBmxe5kGxxBOU4kjAoON1CTgF0hzfRjdsq6myQk1LUi42DYVEymTGf7dlTRffBzFohyD-XV7VGBe02fzC61Qo5FxO9GhC-WddSeDUl8kALvoj_OZyyanJtXxIIRiw9WOuYpVUFYaqR_y7bh2OiK9QXgwPg47pCt98cgcihrj9BUYnOA-QnhAP_bhcaE0cgQY0EosT-Ei2Efx-sYGqjh7wPqsFhADKfmdbuNutNYdFoqT96RytHxG0665fx9pmVPalcdH2FQlOQ6NIUpYBTXABAkgk7BHzUvOTMKKbb3O-JlkTNnzqY3iYx3voWdZ3I7l2Z8FtqMdslFyrk37xG9EaLyiV3krWUS9aiOcvaOTzkrmbldls0TT85sf55LLfVGZNcIwcVZHXFGD3kzGwqRga3pPObvpoAxEJVjG59nSqAjWUkdcAdGV5t7wjfZgXHBNehXt8qV1FPIJYplbQ0GpBpAZzM&sai=AMfl-YTBLjxmQWv_DYsuYJyiu7gEtUsCksrActwaHHxp3X6bBR2rse4BJ1eYk0PA4PJCu0nehxCuWMf9hQ4TxGJFhLXKnDg3-Ptw-VR8R0jowuXIEPn3YJVscv_Tl2uxmjTliuKwu8HTwZaHnPCwjTD_01gTdLfuVQ&sig=Cg0ArKJSzBQc5fVKJcp9EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=226&cbvp=1&cstd=222&cisv=r20210812.82151&adurl=

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 18 Aug 2021 21:04:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/ Frame AF32 135 KB
34 KB 14ms
14ms Document
text/html 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/index.html?e=69&leftOffset=0&topOffset=0&c=x8gZlaZcXx&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e97a3b0f6188419765a14090c4a8c88209cf7f4c154023e65adbc8747475122

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61554580/20201119070120951/index.html?e=69&leftOffset=0&topOffset=0&c=x8gZlaZcXx&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 34719
date: Wed, 18 Aug 2021 21:04:09 GMT
expires: Thu, 19 Aug 2021 21:04:09 GMT
cache-control: public, max-age=86400
last-modified: Thu, 19 Nov 2020 15:01:21 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame E2A5 0
61 B 97ms
97ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss1gD3rZ-W0Cdv_f9N58ZwDm0ME9RXKGTRnuYrYsJ9kJpA_fQy6wQjZeWhfKIzmMV2HCplCaKTU0sCrZYY13FjHNUkTr604XkpmzHXhGueNNvPyKzXOXqFEu3g-avssk6CySPAxglThCCDh-0yPs5SDv0AoZFk18i0CRgx7oQsy04S-SrW8wwR5BGBRUpO-4oOSD_09OyeYS0ToieSlChQt4QyHuFwLpDnGlj-9WUExgvKv0nGpDiPlFCdvczrmXvYZj226rBYh8lx6affjoZEll9PvsX6ltLyz9SUvNdTieaBHwY07H2-oBJB_dvrRCvT8TaiGsDvJ1aCWcgGa-oKRc_Xl_AYCumy1QuQgOKBFnWLcrk76WbdK2mzPaUQEHVoW6CC1hhyVHNHivgHX-kIwg3ffZCDkl4UpZvjNm9383wa89z6_kbO_EDVUqgsU6KmDG_HTCQj3d9GAl0NDb3Hd0xdxwDGNOqQTSugc3bYn8o_fdHmWI58Wm_QyRnkcD3Us3U0NXxl0svYAxZ_jvBEoHGQytE3hVtpgc2x-MbifOKGy1FAxVHRAyXuM-AX8m2eQ-qn6NYEjgpmJlLDkmseZFMO-DTmKMm7mEBJdA6SpaIkQ2EBXtJDIq1qNSfXpcqrfhrPB8MDjyCUDK1OlkTQRy0GJnJLjTm_86WXywbVjKk9RZ0wABhDR7N9jV9VprqroVxVa4DnDwwmOR4n34hOmW2SSJ6iXVoYqZF2mkQnI4u_8V1cJ9i59_BZK5VhPia8AoURcndhosxsfb7kfaly-UMKobO8UG5Lf1RVgXQx-cMrVZ2E3Nt29G0xJaCzbgqxzo_i8VH3G3q9WM0ndfZtajI_Vunm9YJw17fvJzPPwVy4V9P-AP8Zn35k0-RBPdUwLtt5YC9dKvpgCNPAHSsmFEVmteiB4NfCaBTaRb_N9HtzsHsNmA0Wao-uM0KspGp0dJujs4J5vqB9LvwzUj2ON8UGlMBy3e407VzjDA_pHg0BEEuQ04LCKGJqdirqst5_O5vR7glo6GcofGpyge5tVH8FWgCrdFbuoeuzUZFSqoUNtQA5JsmXPwceTiSy8OWnzrYdm6OJ30pG2xscX116vJ5tpAdYG-O31g_kiSeHp6REIP4GFONy9ykNghHLaNmkTc6QTZx7wey7YZj9LvJEQFkoAaHRGUTLSnpBnMiFhs_t_658-YwCcZw7UiQ&sai=AMfl-YRwFb0jOWYgA1zc0U-h-PI5deoQjW_IdY8gZW6jmWMYo6VSOOE3H0YBSd4hJqkHfWxTom0s4Wf_wNK3Ggp5-oTnTF6frbQbZisbuYLkCmmsn6BLhb6wCIrEHlzdQarC15sUolLR4T7iI-wp8ZHkjqXJ_vTxEw&sig=Cg0ArKJSzEWw1e2DpDiiEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=233&cbvp=1&cstd=230&cisv=r20210812.51157&adurl=

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 18 Aug 2021 21:04:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3911 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 16 Aug 2021 00:46:47 GMT
expires: Tue, 16 Aug 2022 00:46:47 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 245842
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 09D9 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 16 Aug 2021 00:46:47 GMT
expires: Tue, 16 Aug 2022 00:46:47 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 245842
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame A3F0 0
104 B 92ms
59ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESELNoAe_r5fVP7jWAKXyoAdU&google_cver=1&google_push=AYg5qPJag-UiIhkiUnBy5P-efI60M0SNAqaqCiDAYoVS_C9R0rwiaz1H85VD33ndEUMnhakA-HUnPnLdpxe9zm4FGgmKMh82n98
Requested by: Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame A3F0 0
137 B 113ms
48ms Image
text/plain 34.96.105.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEJbsrFgHmkX4Z3Dn_0wOBdM&google_cver=1&google_push=AYg5qPLGt3rM4PfU5w728ZD1s7ZybuZDFOpYxiDK4VYB_HDv5aSA-sofnDTs7oUvnC_FJ4i4lZGRJDo9L6VJcssltY3kU8RXWiY
Requested by: Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:09 GMT
via: 1.1 google
alt-svc: clear

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame A3F0
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEAqr77fXe4fP6heV0QR16Eo&google_cver=1&google_push=AYg5qPKZEBRBKPOmOlsK1qcrOQ-9jVkeV104RzPsKa6vmq_2T50AcfIp0gasnJJVcq4ry92eZUPHkpjU5pI0mvxN...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=VZ4Lp6WDRgW1-olS4_ViRQ2&google_push=AYg5qPKZEBRBKPOmOlsK1qcrOQ-9jVkeV104RzPsKa6vmq_2T50AcfIp0gasnJJVcq4ry92eZUPHkpjU5pI0mvxNYr7Bd94n5PM

170 B
188 B

67ms
67ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=VZ4Lp6WDRgW1-olS4_ViRQ2&google_push=AYg5qPKZEBRBKPOmOlsK1qcrOQ-9jVkeV104RzPsKa6vmq_2T50AcfIp0gasnJJVcq4ry92eZUPHkpjU5pI0mvxNYr7Bd94n5PM

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 18 Aug 2021 21:04:09 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.15.12
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=VZ4Lp6WDRgW1-olS4_ViRQ2&google_push=AYg5qPKZEBRBKPOmOlsK1qcrOQ-9jVkeV104RzPsKa6vmq_2T50AcfIp0gasnJJVcq4ry92eZUPHkpjU5pI0mvxNYr7Bd94n5PM
x-host: tde-deliveryengine-production-75454cbd8f-vzs5f
alt-svc: clear
content-length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame A3F0
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEKMR5yVOb2fWHTYQpj9eFmY&google_cver=1&google_push=AYg5qPJePSus5F8fpSp76cKkYrsMOfg4iOsRHoJ_9GjG9ZzeWb_TYXZg5BcDd1dz6Go12YL6-Ut3dasp...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEKMR5yVOb2fWHTYQpj9eFmY&google_cver=1&google_push=AYg5qPJePSus5F8fpSp76cKkYrsMOfg4iOsRHoJ_9GjG9ZzeWb_TYXZg5BcDd1dz6Go12YL6-Ut...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTMzMTM1Mzk3MjU1MDI1Njk2MQ&google_push=AYg5qPJePSus5F8fpSp76cKkYrsMOfg4iOsRHoJ_9GjG9ZzeWb_TYXZg5BcDd1dz6Go12YL6-Ut3da...

170 B
188 B

67ms
66ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTMzMTM1Mzk3MjU1MDI1Njk2MQ&google_push=AYg5qPJePSus5F8fpSp76cKkYrsMOfg4iOsRHoJ_9GjG9ZzeWb_TYXZg5BcDd1dz6Go12YL6-Ut3dasp7D3i5r8PgXPPBQSY3g

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTMzMTM1Mzk3MjU1MDI1Njk2MQ&google_push=AYg5qPJePSus5F8fpSp76cKkYrsMOfg4iOsRHoJ_9GjG9ZzeWb_TYXZg5BcDd1dz6Go12YL6-Ut3dasp7D3i5r8PgXPPBQSY3g
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET

pixel
cm.g.doubleclick.net/ Frame A3F0
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYR...

0
0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame A3F0
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEMfhap0ebKSN5wnBfl6FT0Y&google_cver=1&google_push=AYg5qPLx1j7NIA5aTj0Z22d8cPJq6M0k1kAIrB0wxgzIW5gBgTnxPqgJZCYYiACP8USaq6tbZj4hIiR8hOXdausJH...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEMfhap0ebKSN5wnBfl6FT0Y&google_cver=1&google_push=AYg5qPLx1j7NIA5aTj0Z22d8cPJq6M0k1kAIrB0wxgzIW5gBgTnxPqgJZCYYiACP8USaq6tbZj4hIiR8hOXdausJH...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPLx1j7NIA5aTj0Z22d8cPJq6M0k1kAIrB0wxgzIW5gBgTnxPqgJZCYYiACP8USaq6tbZj4hIiR8hOXdausJHTPTJOPhkA&google_hm=6631b450101c1381fcb393bc

170 B
188 B

66ms
65ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPLx1j7NIA5aTj0Z22d8cPJq6M0k1kAIrB0wxgzIW5gBgTnxPqgJZCYYiACP8USaq6tbZj4hIiR8hOXdausJHTPTJOPhkA&google_hm=6631b450101c1381fcb393bc

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 18 Aug 2021 21:04:09 GMT
Server: nginx
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPLx1j7NIA5aTj0Z22d8cPJq6M0k1kAIrB0wxgzIW5gBgTnxPqgJZCYYiACP8USaq6tbZj4hIiR8hOXdausJHTPTJOPhkA&google_hm=6631b450101c1381fcb393bc
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap4ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame A3F0
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEEVM4qUYM87KstToWpOI2aU&google_cver=1&google_push=AYg5qPK_ESyMYfYEmrCwyZbDZDHSkZd1MBcV6kjcR6kssL1EMeotRMD9kMitzaxTdELZsHyInh...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEEVM4qUYM87KstToWpOI2aU&google_cver=1&google_push=AYg5qPK_ESyMYfYEmrCwyZbDZDHSkZd1MBcV6kjcR6kssL1EMeotRMD9kMitzaxTdELZsHyInh...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1DMFpPMVFORTJ1SGlyRTBicWo4LnhZUmtxdExPSDBoSn5B&google_push=AYg5qPK_ESyMYfYEmrCwyZbDZDHSkZd1MBcV6kjcR6kssL1EMeotRMD9k...

170 B
188 B

66ms
66ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1DMFpPMVFORTJ1SGlyRTBicWo4LnhZUmtxdExPSDBoSn5B&google_push=AYg5qPK_ESyMYfYEmrCwyZbDZDHSkZd1MBcV6kjcR6kssL1EMeotRMD9kMitzaxTdELZsHyInh5a8wdzvFdzp42yXspM05J7zPlE

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 18 Aug 2021 21:04:09 GMT
Server: ATS/7.1.2.138
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1DMFpPMVFORTJ1SGlyRTBicWo4LnhZUmtxdExPSDBoSn5B&google_push=AYg5qPK_ESyMYfYEmrCwyZbDZDHSkZd1MBcV6kjcR6kssL1EMeotRMD9kMitzaxTdELZsHyInh5a8wdzvFdzp42yXspM05J7zPlE
Connection: keep-alive
Content-Length: 0

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame A3F0 0
12 B 77ms
74ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JOzwHAVKXzaxBNX0zkXDKlLSzjQ602999JqVfCKCbHDjUtt_Fj0Ask5k3p-779KP3i5jeQ9A

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame BD16
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESENryUbrFCL083UdK5XCci-4&google_cver=1&google_push=AYg5qPJ1HQVPsrbW3c7_xzc2Tw28xHciyG6aimDPoNQi-2lwbsrkzReRxGAfdb_0s_Fa5wqZsbbMzVjSRL2XAv5SC0Gm2TOtln1_
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDU3MzgwMzg5MTU5ODY2MTAzNw==
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESENryUbrFCL083UdK5XCci-4&google_cver=1

43 B
407 B

36ms
13ms

Image
image/gif

2001:678:cb4:bbbb::11
TURN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESENryUbrFCL083UdK5XCci-4&google_cver=1
Requested by: Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (TURN, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESENryUbrFCL083UdK5XCci-4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame BD16 0
103 B 83ms
60ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESELNoAe_r5fVP7jWAKXyoAdU&google_cver=1&google_push=AYg5qPKEODvW7AKLF8aOUh5EVnWTQTmBnsx13MOqX0cQoNrznthJjYVV2B67qO7OgNKc2EQT_zD5uWHy7EVaO_VKYjDQ3pZy5P3rkg
Requested by: Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame BD16
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=cEJKa09qUUwxTWdzSmo1&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cver=1&google_push=AYg5qPLkXuU6CD0kIWzrR-HULo_4e2DEvfxAWomEkVGE1X1...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=cEJKa09qUUwxTWdzSmo1&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cver=1&google_push=AYg5qPLkXuU6CD0kIWzrR-HULo_4e2DEvfxAWomEkVGE1X1...

170 B
188 B

64ms
64ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=cEJKa09qUUwxTWdzSmo1&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cver=1&google_push=AYg5qPLkXuU6CD0kIWzrR-HULo_4e2DEvfxAWomEkVGE1X1nf_vlPzXzxS2pQbZLgUUXiwtZhgaX1O4OTvKYyKh3Gt5pX3dnyzte&google_tc=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=cEJKa09qUUwxTWdzSmo1&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cver=1&google_push=AYg5qPLkXuU6CD0kIWzrR-HULo_4e2DEvfxAWomEkVGE1X1nf_vlPzXzxS2pQbZLgUUXiwtZhgaX1O4OTvKYyKh3Gt5pX3dnyzte&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 478
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame BD16
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEFfgEI2mdZRtzc1fjVgNoIs&google_cver=1&google_push=AYg5qPL4u3sEOoRAlPvw23UvtEweYT5juQ1DtBcD27Sp3PCcpGb3hTFD4qIfhzzhBCie8QvEYtQJuW3kONw1zG...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk5Nzg3ODkwMjE2NDc0ODQzOA%3D%3D&google_push=AYg5qPL4u3sEOoRAlPvw23UvtEweYT5juQ1DtBcD27Sp3PCcpGb3hTFD4qIfhzzhBCie8QvEYtQJuW3kONw1zGJmZQ...

170 B
188 B

66ms
65ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk5Nzg3ODkwMjE2NDc0ODQzOA%3D%3D&google_push=AYg5qPL4u3sEOoRAlPvw23UvtEweYT5juQ1DtBcD27Sp3PCcpGb3hTFD4qIfhzzhBCie8QvEYtQJuW3kONw1zGJmZQf6gPG6JEn3

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk5Nzg3ODkwMjE2NDc0ODQzOA%3D%3D&google_push=AYg5qPL4u3sEOoRAlPvw23UvtEweYT5juQ1DtBcD27Sp3PCcpGb3hTFD4qIfhzzhBCie8QvEYtQJuW3kONw1zGJmZQf6gPG6JEn3
Date: Wed, 18 Aug 2021 21:04:09 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame BD16
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESENYyapL_gqCW6y3kEpZ2uDg&google_cver=1&google_push=AYg5qPLU6j3SdvOBoo2y9OgQ6EGtZppDeVDI3T4CUvrqeuD1X4AbfXtFd9j0718di7lzcQWJx_cr-uPypgdThJo0p1pm...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESENYyapL_gqCW6y3kEpZ2uDg&google_cver=1&google_push=AYg5qPLU6j3SdvOBoo2y9OgQ6EGtZppDeVDI3T4CUvrqeuD1X4AbfXtFd9j0718di7lzcQWJx_cr-uPypgdThJ...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPLU6j3SdvOBoo2y9OgQ6EGtZppDeVDI3T4CUvrqeuD1X4AbfXtFd9j0718di7lzcQWJx_cr-uPypgdThJo0p1pmACsVJ2rXIg&google_hm=AQU9mgC4Q76UBb2XNWbDTw==

170 B
188 B

65ms
65ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPLU6j3SdvOBoo2y9OgQ6EGtZppDeVDI3T4CUvrqeuD1X4AbfXtFd9j0718di7lzcQWJx_cr-uPypgdThJo0p1pmACsVJ2rXIg&google_hm=AQU9mgC4Q76UBb2XNWbDTw==

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPLU6j3SdvOBoo2y9OgQ6EGtZppDeVDI3T4CUvrqeuD1X4AbfXtFd9j0718di7lzcQWJx_cr-uPypgdThJo0p1pmACsVJ2rXIg&google_hm=AQU9mgC4Q76UBb2XNWbDTw==
date: Wed, 18 Aug 2021 21:04:09 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame BD16
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEKMR5yVOb2fWHTYQpj9eFmY&google_cver=1&google_push=AYg5qPJlaTdTe1JgsX-1-fbxGxiI1VfViPMz36gN-CYdJJ4IZGe79C2zI41vQWcZeNvy4hl1sdlJq8cQ...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEKMR5yVOb2fWHTYQpj9eFmY&google_cver=1&google_push=AYg5qPJlaTdTe1JgsX-1-fbxGxiI1VfViPMz36gN-CYdJJ4IZGe79C2zI41vQWcZeNvy4hl1sdl...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTA2MzkyMjgwNzg1NTkwNTk2NQ&google_push=AYg5qPJlaTdTe1JgsX-1-fbxGxiI1VfViPMz36gN-CYdJJ4IZGe79C2zI41vQWcZeNvy4hl1sdlJq8...

170 B
188 B

67ms
67ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTA2MzkyMjgwNzg1NTkwNTk2NQ&google_push=AYg5qPJlaTdTe1JgsX-1-fbxGxiI1VfViPMz36gN-CYdJJ4IZGe79C2zI41vQWcZeNvy4hl1sdlJq8cQYYRaURGE3DVBfcO5d7CJkQ

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTA2MzkyMjgwNzg1NTkwNTk2NQ&google_push=AYg5qPJlaTdTe1JgsX-1-fbxGxiI1VfViPMz36gN-CYdJJ4IZGe79C2zI41vQWcZeNvy4hl1sdlJq8cQYYRaURGE3DVBfcO5d7CJkQ
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame BD16
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=lmsIvgWvQIytlmP5GffTJA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

65ms
65ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=lmsIvgWvQIytlmP5GffTJA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJpnnXMtig0rktUXffjhfENqZODCwGJ345LY-uigos0R-qsEty4FFSMTW7pkqaUluGaqxt_ml6JCq5WI2z74igBahgv8kbBCA

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=lmsIvgWvQIytlmP5GffTJA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJpnnXMtig0rktUXffjhfENqZODCwGJ345LY-uigos0R-qsEty4FFSMTW7pkqaUluGaqxt_ml6JCq5WI2z74igBahgv8kbBCA
date: Wed, 18 Aug 2021 21:04:07 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame BD16 0
12 B 69ms
69ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IHRMekeklleMTbRpwWd3aEMLrWmhOiiWuqo5IZR-3Leji38HKFdxX_xgiFm2Bz8_U00lxG

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame 1A2A 110 KB
38 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=a08xP1Y3mD&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=a08xP1Y3mD&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 19:02:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7297
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Aug 2021 19:02:32 GMT

GET
H3-29 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame B66A 110 KB
38 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=HNi5h9qWca&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=HNi5h9qWca&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 19:02:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7297
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Aug 2021 19:02:32 GMT

GET
H3-29 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame AF32 110 KB
38 KB 11ms
6ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/index.html?e=69&leftOffset=0&topOffset=0&c=x8gZlaZcXx&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/index.html?e=69&leftOffset=0&topOffset=0&c=x8gZlaZcXx&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 19:02:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7297
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Aug 2021 19:02:32 GMT

GET
H3-29 200 2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js Show response
pagead2.googlesyndication.com/bg/ Frame 662C 35 KB
13 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8c6a6cb581cb56e57e64928574e9e10da0e29a6732926f4f271217c2c38de86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:40:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 105813
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13268
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 15:40:36 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame BEAC
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=cEJKa09qUUwxTWdzSmo1&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cver=1&google_push=AYg5qPLzwXCiIcdxLUSPrddYe7jxTlKWjP3CF337ISz55ic...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=cEJKa09qUUwxTWdzSmo1&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cver=1&google_push=AYg5qPLzwXCiIcdxLUSPrddYe7jxTlKWjP3CF337ISz55ic...

170 B
188 B

66ms
65ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=cEJKa09qUUwxTWdzSmo1&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cver=1&google_push=AYg5qPLzwXCiIcdxLUSPrddYe7jxTlKWjP3CF337ISz55icU3-X4lMcwKDOo8nf0NHWqI_bkLQ4Pne_sFmoQiU8thSzHtR8MtKeE3g&google_tc=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=cEJKa09qUUwxTWdzSmo1&google_gid=CAESEKlbkajdY-oW9xgaHX26LFU&google_cver=1&google_push=AYg5qPLzwXCiIcdxLUSPrddYe7jxTlKWjP3CF337ISz55icU3-X4lMcwKDOo8nf0NHWqI_bkLQ4Pne_sFmoQiU8thSzHtR8MtKeE3g&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 480
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame BEAC
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEHxVWL6QF6oGet_pkVCqeXw&google_cver=1&google_push=AYg5qPL-aNlxIkfDhyp07el_IC72BDpSI7csYZOecjoCAgQpDrcC4Tl7hQln29Coz36zfutIKweclbs_mu4...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPL-aNlxIkfDhyp07el_IC72BDpSI7csYZOecjoCAgQpDrcC4Tl7hQln29Coz36zfutIKweclbs_mu4A_nUXJvWgQyb3hvhNtA&google_hm=y-rQz2-SQaCypHeQko...

170 B
188 B

67ms
67ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPL-aNlxIkfDhyp07el_IC72BDpSI7csYZOecjoCAgQpDrcC4Tl7hQln29Coz36zfutIKweclbs_mu4A_nUXJvWgQyb3hvhNtA&google_hm=y-rQz2-SQaCypHeQkopngzU

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:08 GMT
via: 1.1 google
server: Apache-Coyote/1.1
status: 302
p3p: CP="NOI DSP COR NID CUR OUR NOR"
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPL-aNlxIkfDhyp07el_IC72BDpSI7csYZOecjoCAgQpDrcC4Tl7hQln29Coz36zfutIKweclbs_mu4A_nUXJvWgQyb3hvhNtA&google_hm=y-rQz2-SQaCypHeQkopngzU
cache-control: no-cache, must-revalidate
content-type: text/html;charset=UTF-8
alt-svc: clear
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 genericusersync.ashx
sync.tidaltv.com/ Frame BEAC 42 B
217 B 121ms
33ms Image
image/gif 2a05:d018:24:b001:197c:8ea4:869f:2648
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.tidaltv.com/genericusersync.ashx?dpid=glrdr&google_gid=CAESEF9hokixWsLDBus3KLH7_es&google_cver=1&google_push=AYg5qPJ5rW-iQjATt0Q65900TD7MP9M79iw9LijWb8QzvD6WP4AvSpsiHH7Xr_Msg8BChUY_2TwJSq_H4Q-cwZEXDnIKs3lLsj2tYg

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:24:b001:197c:8ea4:869f:2648 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache-Coyote/1.1 /

Resource Hash

99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
server: Apache-Coyote/1.1
content-type: image/gif
x-xss-protection: 1; mode=block
expires: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame BEAC
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESENg3GiCqz2yLP1T5U0S8kCI&google_cver=1&google_push=AYg5qPJPolXR6i0d0RB3MpagWJXoYY4jRA4PfT4irtSMq3K8Zx6G1H0Rajlfvxnfknex-24rFI_6RuLbhD8Ioa6N6M7T9qA...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJPolXR6i0d0RB3MpagWJXoYY4jRA4PfT4irtSMq3K8Zx6G1H0Rajlfvxnfknex-24rFI_6RuLbhD8Ioa6N6M7T9qA-GxfrgA&google_hm=NDg2MjcyNzM0NzkyOTc3...

170 B
188 B

65ms
65ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJPolXR6i0d0RB3MpagWJXoYY4jRA4PfT4irtSMq3K8Zx6G1H0Rajlfvxnfknex-24rFI_6RuLbhD8Ioa6N6M7T9qA-GxfrgA&google_hm=NDg2MjcyNzM0NzkyOTc3NDk0NQ%3D%3D

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 18 Aug 2021 21:04:09 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJPolXR6i0d0RB3MpagWJXoYY4jRA4PfT4irtSMq3K8Zx6G1H0Rajlfvxnfknex-24rFI_6RuLbhD8Ioa6N6M7T9qA-GxfrgA&google_hm=NDg2MjcyNzM0NzkyOTc3NDk0NQ%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame BEAC
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEKMR5yVOb2fWHTYQpj9eFmY&google_cver=1&google_push=AYg5qPLzD2AwlNpOs1-PdD2iwTCMbsKFv-afi8ShYzMEQzhUABQ7ofh_BRAwKPcNmiCYvz8l9p0Ygx1t...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEKMR5yVOb2fWHTYQpj9eFmY&google_cver=1&google_push=AYg5qPLzD2AwlNpOs1-PdD2iwTCMbsKFv-afi8ShYzMEQzhUABQ7ofh_BRAwKPcNmiCYvz8l9p0...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDAzNDg0OTE5Nzg5MTA1MDkwOA&google_push=AYg5qPLzD2AwlNpOs1-PdD2iwTCMbsKFv-afi8ShYzMEQzhUABQ7ofh_BRAwKPcNmiCYvz8l9p0Ygx...

170 B
188 B

65ms
65ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDAzNDg0OTE5Nzg5MTA1MDkwOA&google_push=AYg5qPLzD2AwlNpOs1-PdD2iwTCMbsKFv-afi8ShYzMEQzhUABQ7ofh_BRAwKPcNmiCYvz8l9p0Ygx1tIDZIxp_IJWLv4Yy75EqSwA

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDAzNDg0OTE5Nzg5MTA1MDkwOA&google_push=AYg5qPLzD2AwlNpOs1-PdD2iwTCMbsKFv-afi8ShYzMEQzhUABQ7ofh_BRAwKPcNmiCYvz8l9p0Ygx1tIDZIxp_IJWLv4Yy75EqSwA
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame BEAC
Redirect Chain

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEGPDuD2BbIrPTZmNuK_aPLs&google_cver=1&google_push=AYg5qPKtPYfTTYTCOpOe3AHNWD5AGXo4Wj37NwVQcgDwcwKpgxId-S2l...
https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEGPDuD2BbIrPTZmNuK_aPLs&google_cver=1&google_push=AYg5qPKtPYfTTYTCOpOe3AHNWD5AGXo4Wj37NwVQcgDwcwKpgxId-S2l...
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEGPDuD2BbIrPTZmNuK_aPLs&google_cver=1&google_push=AYg5qPKtPYfTTYTCOpOe3AHNWD5AGXo4Wj37NwVQcgDwcwKpgxId-S...
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBkNGVkMzczYi0wMDY3LTExZWMtYTY2ZS0wMmNhNzUxODBhNjQ%3D&google_push=AYg5qPKtPYfTTYTCOpOe3AHNWD5AGXo4Wj37NwVQcgDwcwKpgxId-S2lcyhgxnynlt...
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBkNGVkMzczYi0wMDY3LTExZWMtYTY2ZS0wMmNhNzUxODBhNjQ%3D&google_push=AYg5qPKtPYfTTYTCOpOe3AHNWD5AGXo4Wj37NwVQcgDwcwKpgxId-S2lcyhgxnynlt...

170 B
188 B

68ms
67ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBkNGVkMzczYi0wMDY3LTExZWMtYTY2ZS0wMmNhNzUxODBhNjQ%3D&google_push=AYg5qPKtPYfTTYTCOpOe3AHNWD5AGXo4Wj37NwVQcgDwcwKpgxId-S2lcyhgxnynltnd2BJcOA8YJKkNVBM3ut2kEpJHiwvAtKHOyMw&google_tc=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBkNGVkMzczYi0wMDY3LTExZWMtYTY2ZS0wMmNhNzUxODBhNjQ%3D&google_push=AYg5qPKtPYfTTYTCOpOe3AHNWD5AGXo4Wj37NwVQcgDwcwKpgxId-S2lcyhgxnynltnd2BJcOA8YJKkNVBM3ut2kEpJHiwvAtKHOyMw&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 454
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 dot.gif
s0.2mdn.net/ Frame BEAC 43 B
63 B 21ms
19ms Image
image/gif 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESELB71p4vvbwB4SY1ZQidLXI&google_cver=1&google_push=AYg5qPJHwyrUvkBE1mFHXc5EuOOn-NW8r0TIXnm7no3qpUQF-0Kpau1DZ6jsUiRTM9X3Zccb9wGRquKEdwFMZJ93Kqjv4wMfrK5Y4g

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:09 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
expires: Thu, 19 Aug 2021 21:04:09 GMT

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame BEAC 0
12 B 65ms
63ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I_amek4C6JYNEMhff6tdnruPmDa3G4omwYrPrE-DmMdLhxFnht8Be-pNJN3UoJORXKelbqtKE

Requested by

Host: 1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
URL: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:09 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 fedexsans_rg-webfont.woff
s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/ Frame 1A2A 26 KB
26 KB 9ms
8ms Font
font/woff 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/fedexsans_rg-webfont.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=a08xP1Y3mD&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ceac48a7a84f3eac7045ca4f9cc69662c848c30d76942cf9d33108407ea71cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=a08xP1Y3mD&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 10:07:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Nov 2020 15:00:23 GMT
server: sffe
age: 39377
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27080
x-xss-protection: 0
expires: Thu, 19 Aug 2021 10:07:52 GMT

GET
H3-29 200 2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js Show response
pagead2.googlesyndication.com/bg/ Frame 60E3 35 KB
13 KB 12ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8c6a6cb581cb56e57e64928574e9e10da0e29a6732926f4f271217c2c38de86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:40:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 105813
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13268
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 15:40:36 GMT

GET
H3-29 200 2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js Show response
pagead2.googlesyndication.com/bg/ Frame 3911 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8c6a6cb581cb56e57e64928574e9e10da0e29a6732926f4f271217c2c38de86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:40:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 105813
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13268
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 15:40:36 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame C8F8 0
23 B 79ms
79ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 18 Aug 2021 21:04:09 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 fedexsans_rg-webfont.woff
s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/ Frame B66A 26 KB
26 KB 6ms
6ms Font
font/woff 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/fedexsans_rg-webfont.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=HNi5h9qWca&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ceac48a7a84f3eac7045ca4f9cc69662c848c30d76942cf9d33108407ea71cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=HNi5h9qWca&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 10:07:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Nov 2020 15:00:23 GMT
server: sffe
age: 39377
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27080
x-xss-protection: 0
expires: Thu, 19 Aug 2021 10:07:52 GMT

GET
H3-29 200 fedexsans_rg-webfont.woff
s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/ Frame AF32 26 KB
26 KB 7ms
7ms Font
font/woff 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/fedexsans_rg-webfont.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/index.html?e=69&leftOffset=0&topOffset=0&c=x8gZlaZcXx&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ceac48a7a84f3eac7045ca4f9cc69662c848c30d76942cf9d33108407ea71cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/index.html?e=69&leftOffset=0&topOffset=0&c=x8gZlaZcXx&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 10:04:35 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Nov 2020 15:01:21 GMT
server: sffe
age: 39574
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27080
x-xss-protection: 0
expires: Thu, 19 Aug 2021 10:04:35 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame E2A5 0
23 B 81ms
80ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 18 Aug 2021 21:04:09 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 16F5 0
23 B 80ms
80ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: prnt.sc
URL: https://prnt.sc/12zoygy

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 18 Aug 2021 21:04:09 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js Show response
pagead2.googlesyndication.com/bg/ Frame 09D9 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8c6a6cb581cb56e57e64928574e9e10da0e29a6732926f4f271217c2c38de86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:40:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 105813
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13268
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 15:40:36 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame AF32 6 KB
4 KB 17ms
17ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6210dbe9b964f36573eec31ac30bc560cea477e751d5e1759952d4c95799f903

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 18 Aug 2021 21:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4384
x-xss-protection: 0

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 1A2A 6 KB
4 KB 24ms
23ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dc8eca03a82e90174f9165a76f2c8107eade58f5500bc9569cc2a8ade69615a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 18 Aug 2021 21:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4373
x-xss-protection: 0

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame B66A 6 KB
4 KB 17ms
17ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fc5868d5535d8b9dec270bc3385c2191d0797b49d8bc1e206d9e108bcf9512df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 18 Aug 2021 21:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4493
x-xss-protection: 0

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame AF32 17 KB
6 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Wed, 18 Aug 2021 21:04:09 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 1A2A 17 KB
6 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Wed, 18 Aug 2021 21:04:09 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame B66A 17 KB
6 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 21:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Wed, 18 Aug 2021 21:04:09 GMT

GET
H2 200 2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js Show response
pagead2.googlesyndication.com/bg/ Frame 6F40 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8c6a6cb581cb56e57e64928574e9e10da0e29a6732926f4f271217c2c38de86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:40:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 105813
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13268
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 15:40:36 GMT

GET
H2 200 2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js Show response
pagead2.googlesyndication.com/bg/ Frame 1C77 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8c6a6cb581cb56e57e64928574e9e10da0e29a6732926f4f271217c2c38de86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:40:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 105813
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13268
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 15:40:36 GMT

GET
H2 200 logo.png
s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/ Frame AF32 2 KB
2 KB 43ms
20ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/logo.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

092bf2a0145d7c672d97fc343e2fd2dd20be09728104d3e28c67670b0e38bb60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/index.html?e=69&leftOffset=0&topOffset=0&c=x8gZlaZcXx&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 10:04:23 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Nov 2020 15:01:21 GMT
server: sffe
age: 39586
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2043
x-xss-protection: 0
expires: Thu, 19 Aug 2021 10:04:23 GMT

GET
H2 200 img1.jpg
s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/ Frame AF32 12 KB
12 KB 38ms
15ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/img1.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0fc719084a17edd624f83817795dc042bfe09c539a04bf794c2051ba6eb656fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/index.html?e=69&leftOffset=0&topOffset=0&c=x8gZlaZcXx&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 10:04:23 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Nov 2020 15:01:21 GMT
server: sffe
age: 39586
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11820
x-xss-protection: 0
expires: Thu, 19 Aug 2021 10:04:23 GMT

GET
H2 200 img2.jpg
s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/ Frame AF32 8 KB
8 KB 41ms
19ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/img2.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

574aca11e55d3f6e95d8697b69d9bded72a143e4c9abc3c10b6f1cdaa8d74b38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/index.html?e=69&leftOffset=0&topOffset=0&c=x8gZlaZcXx&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 10:04:19 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Nov 2020 15:01:21 GMT
server: sffe
age: 39590
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8586
x-xss-protection: 0
expires: Thu, 19 Aug 2021 10:04:19 GMT

GET
H2 200 img3.jpg
s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/ Frame AF32 10 KB
10 KB 39ms
17ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/img3.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9463e1fe6c1add55c69ff4ecd823f9f020435483650dd1ec37bc770dd6cd12cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554580/20201119070120951/index.html?e=69&leftOffset=0&topOffset=0&c=x8gZlaZcXx&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 10:04:23 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Nov 2020 15:01:21 GMT
server: sffe
age: 39586
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10468
x-xss-protection: 0
expires: Thu, 19 Aug 2021 10:04:23 GMT

GET
H2 200 logo.png
s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/ Frame 1A2A 2 KB
2 KB 30ms
8ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/logo.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ccec5161fbbfaab1c2f8e430352adf69459880d45d56d8ed1373708ad6944f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=a08xP1Y3mD&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 10:07:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Nov 2020 15:00:23 GMT
server: sffe
age: 39377
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1980
x-xss-protection: 0
expires: Thu, 19 Aug 2021 10:07:52 GMT

GET
H2 200 img1.jpg
s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/ Frame 1A2A 12 KB
13 KB 31ms
10ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/img1.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d0ef4b3129b4ead75cf32611fa78a7ac6051472becac18e3a7de6bc1e4cfa50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=a08xP1Y3mD&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 10:07:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Nov 2020 15:00:23 GMT
server: sffe
age: 39377
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12742
x-xss-protection: 0
expires: Thu, 19 Aug 2021 10:07:52 GMT

GET
H2 200 img2.jpg
s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/ Frame 1A2A 8 KB
8 KB 42ms
21ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/img2.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ffce6e7fe38d9eaa59d2d80b36fd14d080a4c7f3513ee331cac376b4f982e9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=a08xP1Y3mD&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 10:07:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Nov 2020 15:00:23 GMT
server: sffe
age: 39377
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7881
x-xss-protection: 0
expires: Thu, 19 Aug 2021 10:07:52 GMT

GET
H2 200 img3.jpg
s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/ Frame 1A2A 9 KB
9 KB 34ms
14ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/img3.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b069be0e4b3a3cf7547ab7c25a4c6ff752610b53d6f6e49a2fb0a6dc15f314fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=a08xP1Y3mD&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 10:07:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Nov 2020 15:00:23 GMT
server: sffe
age: 39377
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9051
x-xss-protection: 0
expires: Thu, 19 Aug 2021 10:07:52 GMT

GET
H2 200 logo.png
s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/ Frame B66A 2 KB
2 KB 21ms
9ms Image
image/png 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=HNi5h9qWca&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ccec5161fbbfaab1c2f8e430352adf69459880d45d56d8ed1373708ad6944f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=HNi5h9qWca&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 10:07:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Nov 2020 15:00:23 GMT
server: sffe
age: 39377
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1980
x-xss-protection: 0
expires: Thu, 19 Aug 2021 10:07:52 GMT

GET
H2 200 img1.jpg
s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/ Frame B66A 12 KB
13 KB 31ms
20ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/img1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=HNi5h9qWca&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d0ef4b3129b4ead75cf32611fa78a7ac6051472becac18e3a7de6bc1e4cfa50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=HNi5h9qWca&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 10:07:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Nov 2020 15:00:23 GMT
server: sffe
age: 39377
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12742
x-xss-protection: 0
expires: Thu, 19 Aug 2021 10:07:52 GMT

GET
H2 200 img2.jpg
s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/ Frame B66A 8 KB
8 KB 33ms
22ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/img2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=HNi5h9qWca&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ffce6e7fe38d9eaa59d2d80b36fd14d080a4c7f3513ee331cac376b4f982e9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=HNi5h9qWca&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 10:07:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Nov 2020 15:00:23 GMT
server: sffe
age: 39377
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7881
x-xss-protection: 0
expires: Thu, 19 Aug 2021 10:07:52 GMT

GET
H2 200 img3.jpg
s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/ Frame B66A 9 KB
9 KB 31ms
20ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/img3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=HNi5h9qWca&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b069be0e4b3a3cf7547ab7c25a4c6ff752610b53d6f6e49a2fb0a6dc15f314fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61554679/20201119070023690/index.html?e=69&leftOffset=0&topOffset=0&c=HNi5h9qWca&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 18 Aug 2021 10:07:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Nov 2020 15:00:23 GMT
server: sffe
age: 39377
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9051
x-xss-protection: 0
expires: Thu, 19 Aug 2021 10:07:52 GMT

GET
H3-29 200 2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js Show response
pagead2.googlesyndication.com/bg/ Frame F7CE 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/2Mamy1gctW5X5kkoV06eENoOKaZzKSb08nEhfCw43oY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8c6a6cb581cb56e57e64928574e9e10da0e29a6732926f4f271217c2c38de86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:40:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 105813
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13268
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 15:40:36 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 30ms
29ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021081701&jk=3397862552733480&bg=!ysmlyY3NAAZvV8FTb1c7ACkAdvg8WjG3QjZ0WSOgN-Za9I-5H5KEa3xyV2PhMQoVLYw7pHhJgZhsTAIAAAGDUgAAAHtoAQcKAR9l1_bK_GGSCTlVQay9rbnzhelQRmRR8-KZx-tw0YIlCr3kzfenoJI8jo8S5u7UlDsTjJsuekSczsjyXJF7T8UsNqGu4HysrE3xhGvUamyoYy7FmmdGGf5y1BuQOpfzey5FPOGTKzsLYk-PXNg93IIc4hofY9BIztrwUCvX8aDD4mPNDmZKSMrkOM4xWVvjSVuUE3cyUgrmmlodFqQ2yVRk8in5j6aJo2-pOU4-Q97dITBXC1nEdegfxGDTVj4L8qAC1oc7RIoYP6D4vX7wiA4Wb54AvbeeyBwJIaDiwywf7ZkbMI9W0RFFqd1h7XVijASppwGZPjkLA9YtwyOmJHQkTSTNUey3Io4Zzyot9LXXpcY6X7pu3hl5DFuI7m7-DpkCZSs1L72bjsvxDSArSrb_RuuaTh_ONKHdpAGRJ5dkHXJsJ1BUhJfOdu-mJduaPgl-In019LsD9IbAeNGMIrwUffCjhYrZ7lDbbRrb7kGOKb5Tjw1G_Lg1TqZMy7sAb3kQ5g6hb7CJxYG6TU8sWHCW4R_h6tKDQjZVW0WoyixCBVb73H-5RyviHODGFce8GpbvtdD0LsLIY1ix7e2uGmO0hbYAlIgRO6bjPAAdfn5WXtmFBBcZBVlZfqCYKyHBpB8sLkxLPPekjeSsRD42YHE1ydgJZr1UXEZ_5zmtzI-iCWpydKyLhx60ibnis1_BZ4ecCw4V80CcprmOC3j_hJpkUaCQeL0FuE2EL0-dwMLMMTC-h698mdoX4MWhKkEyBkw6p3QydIeTvdAWhhA0s3NRlbFh-Kf0UwHaAwDNvN3YEl22OQmBfripPzalhGYnqz0FWz4U1TIMlKKii2OW-PkepOM3otHoxjhJW3lZMW6HRKhfCnDHkDhiei9K907YVXXUKTOIlgGRkMThrKht4fCM905GxNRDavRzpSjUV0NtCVStrdy6KxQJD7EBaUSKW360tIHCZC89gTUuAeIeVTnxWXIzbG0md1peUc9pi093XsJoRFrnhoUBYb8aOmcKDUdwhmm2Vl5kTzer9v6VJ1jNiTuDrrp7ayAHyx8BnX5ajw9gFeoTwlz67F1oAaFYil2kY2NSsLPjGh0DOSbya6HIIlWqHM4X_KZBgspYN2CCubYKQmpt9PSXCF7xMjPoBVdj5I9m8V6H1hxjDdjsOm0g0XQtzoA1lkWwJySvccWbiwjK_OVdg5Q

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 60E3 0
20 B 30ms
30ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B1G14yXUdYa5i39zv9Q-fkpy4BQAAAAA4AeAEAg&bg=!5Oel56PNAAZvV8FTb1c7ACkAdvg8WmTzpKjGuFTFtuvaLh0anVqFvjss-v4CB02CuPYulGLrx1qTgQIAAAGRUgAAAFVoAQeZAwFPZYjwX9CsB2RWG12Vw6Wtfguc68sdwu84BpEfjrImas1xmoO3wd3ve2-Bw75cmRWZwZ-C27fFYy9lrqruC-tSHSLwqUNFnXk9lSbIggq6qZXMPmgvOyLr5Qm18dFrZu47yMYMdhjCbXq1fgVOOW2oBxcVPdbo4VJIj_SI6CPE-8dtJYu8UeTwmYsLzJ8JZnS35EspKYgvyAmq71wW9BdGzgfOFpD997F5OHbEI9BrLR8PLs7_qaWQVkXbb2GFQwfu_sFzidDHJIFV5zKbfTrC-uSaky3uXc8OsRYp4EA9HBlRuXVqQE5CparKii5_SA3o6CP698AFQ-0u5qQgT2htg5GBOO8dw5ROo83UyYfAFYRPyiWVxh9uPu5YIaywRB2ep-pbnS0RC27UnNGCtRM0_xuuq38IDHUlEQ2bdNsr_IUHyk4qVjsNH4zA-MwG8MWq4Wi-uUPIvSpYIvbTvq3Whe9OmxOGH84H7qWCnm8AdkjNJzeOadFjIVpbuWwWccr5CthYNR9QdCSLETAl6aHaDOFqMQyNRVyYyoMd2INCnX8-MxxwWLEBcxU7pPnntqbnPePlUjXH6U3HnmpOLr5vSy6yPTreBN7WHRkn9G27DjD4FMP6qrmDS9SmwNSvbgOiH9pFe4K4BOgSStFoJN-A14g2TJXNQjv2-0ZNuymdR-9SPMmG4U8rn5IqBg5ChahDwGVxXYVm8-IEDN1GUntT0LCoFeHq3rS3NG0gDVtZdFYX6tacXkVHCGyAeqJ4DVqslSmOugrFXp_VnWdqB7pClwIoMLjkO6mLL3S0iRjHvcfdS9kf3SS7iAm_-rE_nQj_oYpKMsxyo4Rkmst94CETxGjxvMmRBL4x0SHLcjEQ_EejleK84-j8PAC-LayQVcAEBYPpW7vFiCT3za2j5666M-qIgMP9BZCrC5x2yXhP9klQoIppXr9jkt4DgSvg_DciqVVRQ_i8AYMXC-BfT2EeFhL0z3fpzSV3-TwnUdUwM5zEpATWMioexOZvPDgxNh7Q

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3911 0
20 B 29ms
28ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BNukqyXUdYerBAdDG7_UPuPmxiAQAAAAAOAHgBAI&bg=!e3ileDzNAAZvV8FTb1c7ACkAdvg8WtuaRXK--GBKbLCu7MUKBKFFOPwNuJ4Z7tkTJ5Jp7Y5zF845_AIAAAGuUgAAAEhoAQcKABv9KD7u1yXwOFIWMUfcZ8DerOHdFG89HLBLNTSZAw-UNR2BaaxjEa_KPR3inN9VEag8_jNEK6qkKCdtRxHdL_rnCm-nS8VimlIgsbSMGzyQQh8EXZPDGYIK-Fwpe4EohX0mdT7wxPyhy1Lzp9hKX_jGhQBagOmSPCyPB0RtvZRF_HvjjAEDkZLjd2weaGTngtL8oiEFshBc_KsBRJBjAcR01XLs6A4_ouPtS6lF0IJlRpyCxrPEDGdLYZ6lUkMQcPiPfk_GTXZ6YNMxyjUFlCioLzAK26iZraiagdBdyX567wWU8XYbP3KwEno73wzTQw1pXeWVPbRN_8Ke2lJfg_rtwlfXNlLu-X_DbPwdX_L9H-aGN9OGKet5An609cYoHeCXClYTwhJA3oPxUXRzKDAEEzcaRupif0OZo7ayVx0O59mEI8H6InmjxuA1rvd6ZipJjSTq-EjPevG0ZChM9tTQ-zlQUcrfT3UPGzdIJKQepSDp5tS6hhQqKFcJMgjzgnCK7EOu6I4F0KFs9Suoz9AFP02D2ovYmv4IHmGxxRHITZDlPAYaEeP11RVxwDcirZZ-de-bbst00jS1vI41F7qFgki5zpZaMea53C1mzLb5o877SEqh-I2N2Ber4t5Z8b4d59KMoQ7vHRZJW0bVuQbeT-n5of_aVcC9jUJ-r0EH4jChXiYRMw5XufCBAdK5nGzXRBx0sItn7ZOdEokx--ydwmJks_uADC6ZkfVJV8ObijvtusUanTJjcyyM_HZz21657j9-7sTLTqoGJW9wUtImPri8Rl90XLH4ArZgbHK3sM-_ml7OVgMXkDma-Aqk0IBoTgD43cLsPPokzp6I_Job-1WJBvbL2MxKMvL_ldT0i5oRJdP27ENX0IPUkcAQwgh0MphryXDETzZGBrZFgOmn3OsRkb5JR35S2d_IPs-M3zlHBun-o_-M9VIqUBv2MTCz6vgv-z3nXpX1aiNv7cja3Cdmv-kPtCucjKfedM3xbQ-5AUX19Z-7IsqPHEGMJdr1YbnkMW3IIOiIQYF7bnvAjRZMZPnbWEU7E7AwrFjNxXqbLXYR5KqR9qsvr7A

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 09D9 0
20 B 29ms
29ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B6WgHyXUdYeZ2g9Xv9Q_h55ToDwAAAAA4AeAEAg&bg=!8_Cl8LTNAAZvV8FTb1c7ACkAdvg8Wku386RSzl63x7c_H0zLjrKtKsD4fCwT5KmPa2Gutr4t26QjAQIAAAGpUgAAADloAQeZArLr96G7RSY05U7eyVnAbpktzbZZZfBTOHiIYlZUP3FA9NoGG7aGnq1Ujicgh6v1-0AxWerLAQgktZD4-5wZT4YBRmFchLQpSA-FEP-eWYtcxW1Q0dPuI88rNp87xTYpd0NkkOH2UQlGMgMhDbK129NO0YnTcEfPC7IvqLVou0lougbEiDAfVmtEAadHHmi5ZGXS3JNUxGI9eIY3i92ZAURyEx1TTzuYjLf4K3Kwseap6ZQTdRTgMxHH3NbpF4MPo1t3fpTj356byfscZNsmqPvmao6r0ABczc5alGUtbXLAfJSU4585dKYQYXHQZt5iPGaM8Nu6v3qdhK8TwO73sExRwGUfh8CTde3LbEZr7gIwaQfxUnGQ17MVDEwtVfZMXwo5HcMpvoYVwt8jjuDnrhkZUrykhZlOliAtrVJyPPhRKTdWoqxLEo28eMc82ZLghWQNNlv8kNBma6U-L0QmPm019GQnoS6VKem9-dmXpr3Hnk7najSIcz_V4CGdYsGq8Lkd1B1I4F4F49BxPrViturYD28crl5fBAY8wNtMAZChdvZCenkfbbuqJuIk_x2ndeHzvZf5vay4MaC3sAUOkkZQkyF542E54QxaitWFD-pNldtKz00U1T2XqvzgMS-BRS7HZWa-JdHpSGyaROzCTyu3M9BYS-zGMETYPkM97Hid756QMwAkBaW7hHnAS3U5LfBm57JVph_JRAXg5_ObAmZwlBr8WPUWeLJJQDNGF_45MHLRZrq1tn3XNbIMVQZ3NPFBrAVA-Ce_cgzoAo9aPBA9F52qb6Q0UrxaqN8NPyyNNrXTij-NWEluX41RsxXoYj_yg01MVWfGu0SAIofJfHXbjskoC8kZYKa9pgO9wODtxIcQBCKdWsLPu0XRmMv7HVnU1j9tAY1WcfRWRtZkO78o1ac

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C8F8 42 B
64 B 34ms
34ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu5tz9lZhc6SM3Cc80YtobkLTZykPvUiMwX8dt2F8dKXTiVHc4GNASz05ELiGIIzgQz-m-xYWOWlaRz7QTYXFpRmzLL_ZNOx-kAvL9hiP4miYgJbTQrXWX0ACEJAQ&sai=AMfl-YSgLx53uNriIj6WuggRH_n8C71Pmtrw4wGw0ehS2IwkW0RgGEgVpj16YJz0XhEFDM28v7iTszTwMnpvNri1StLLO0mJ-2bmjMl0oHoZhZNsL3fHf7bhPckopEc&sig=Cg0ArKJSzAdkF9Vji7SnEAE&cid=CAASEuRon7wGfKYAtTl-g2vzjlBDFg&id=lidar2&mcvt=1005&p=782,8,872,736&asp=782,8,872,736&mtos=1005,1005,1005,1005,1005&tos=1005,0,0,0,0&v=20210818&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1432691387&rs=4&met=ce&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1629320649007&dlt=42&rpt=221&isd=0&lsd=0&msd=0&r=v&speed=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 16F5 42 B
64 B 33ms
33ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssvZglqzkfmrz-ONcqwD2syR2vHlq-aTdSZWw7Bj4uo9l5URnujJzAK-Dtk75YActFNP43fO_BgUQP39Kk6KNjBUVexv907nwbVq1zpMN8tCLajBS93tX8dN2bqew&sai=AMfl-YTlAY-VnhIGC9X9G4wxM7aoS3bYf4YOjr-7v746LaiBXkTuDIADBXHkuURpQdKGVuL5E_FVEXvGfwA2rTRK1PvdZTmZvBKMrckd00kaJa3OqUIJxDvTdVSqQvY&sig=Cg0ArKJSzNz3bxWYsd9_EAE&cid=CAASEuRo_lwU7a202w7a5FbEio47eA&id=lidar2&mcvt=1006&p=988,8,1078,736&asp=988,8,1078,736&mtos=1006,1006,1006,1006,1006&tos=1006,0,0,0,0&v=20210818&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3120184932&rs=4&met=ce&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1629320648995&dlt=29&rpt=194&isd=0&lsd=0&msd=0&r=v&speed=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMIpv-JtLy78gIVg-q7CB3hMwX9EAAYACCFmK5CQhMI9-rrs7y78gIVOeO7CB3lmwCv;met=1;&timestamp=1629320659668;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame E2A5 42 B
515 B 197ms
77ms Image
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIpv-JtLy78gIVg-q7CB3hMwX9EAAYACCFmK5CQhMI9-rrs7y78gIVOeO7CB3lmwCv;met=1;&timestamp=1629320659668;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMIqsqKtLy78gIVUOO7CB24fAxBEAAYACCCmK5CQhMI9errs7y78gIVOeO7CB3lmwCv;met=1;&timestamp=1629320659676;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame C8F8 42 B
107 B 190ms
78ms Image
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIqsqKtLy78gIVUOO7CB24fAxBEAAYACCCmK5CQhMI9errs7y78gIVOeO7CB3lmwCv;met=1;&timestamp=1629320659676;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMI7uqJtLy78gIVX-67CB0fCQdXEAAYACCCmK5CQhMI9urrs7y78gIVOeO7CB3lmwCv;met=1;&timestamp=1629320659702;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 16F5 42 B
107 B 164ms
78ms Image
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI7uqJtLy78gIVX-67CB0fCQdXEAAYACCCmK5CQhMI9urrs7y78gIVOeO7CB3lmwCv;met=1;&timestamp=1629320659702;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 18 Aug 2021 21:04:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: image.prntscr.com
URL: https://image.prntscr.com/image/wlgiIuLMQh6vDb1oLzWJXg.png

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YR11yQCSENnTX2N5G6a3RQAAApAAAAAB&google_push=AYg5qPI6zwjaqIKbxrF3vhoOckVpjPcQjn2-CQzwkonRVfI_lBOpLmeyT3rQlBZDCexFDJvmPo_5MpCk44xOTlYbYRej-iEAhwo&google_cver=1&google_gid=CAESEKAy1w7mTjoFwgTYN1lyHHI

Verdicts & Comments Add Verdict or Comment

84 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.prnt.sc/	1969-12-31 23:59:59	Name: _dlt Value: 1
.prnt.sc/	1970-01-19 20:35:20	Name: _gat Value: 1
.prnt.sc/	1970-01-19 20:36:47	Name: _gid Value: GA1.2.189544869.1629320647
.prnt.sc/	1970-01-20 14:06:32	Name: _ga Value: GA1.2.1346374503.1629320647

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js?referer=prnt.sc(Line 1) Message: TypeError: Cannot read property 'getItem' of null

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1339f56d23849c8c9691a3fdea0164f1.safeframe.googlesyndication.com
ad.turn.com
ade.googlesyndication.com
ads.ad4game.com
ads.travelaudience.com
adservice.google.com
adservice.google.de
ap.lijit.com
c.amazon-adsystem.com
c1.adform.net
cdn.ad4game.com
cm.g.doubleclick.net
connect.facebook.net
dclk-match.dotomi.com
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
gcm.ctnsnet.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
htlb.casalemedia.com
ib.adnxs.com
image.prntscr.com
image6.pubmatic.com
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantcount.com
platform.twitter.com
pm.w55c.net
pr-bh.ybp.yahoo.com
prnt.sc
quantcast.mgr.consensu.org
r.turn.com
rules.quantcount.com
s0.2mdn.net
secure.quantserve.com
securepubads.g.doubleclick.net
st.prntscr.com
stats.g.doubleclick.net
sync.tidaltv.com
syndication.twitter.com
tpc.googlesyndication.com
tr.blismedia.com
ups.analytics.yahoo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagservices.com
x.bidswitch.net
cm.g.doubleclick.net
image.prntscr.com
104.23.139.12
104.244.42.72
13.224.90.44
142.250.184.226
142.250.186.130
142.250.186.66
151.139.242.3
172.67.72.27
18.158.226.176
18.195.239.175
18.197.47.23
184.31.84.150
185.33.221.90
185.64.190.78
192.207.255.147
2.18.234.21
2001:678:cb4:bbbb::11
216.52.2.19
2600:9000:2190:c400:9:46dc:4700:93a1
2600:9000:2190:d800:6:44e3:f8c0:93a1
2606:2800:234:59:254c:406:2366:268c
2620:116:800d:21:8c6e:cf2c:8d6:9fb5
2a00:1288:110:c305::8000
2a00:1450:4001:803::2006
2a00:1450:4001:809::2002
2a00:1450:4001:812::2001
2a00:1450:4001:812::2003
2a00:1450:4001:812::2004
2a00:1450:4001:827::2002
2a00:1450:4001:827::200e
2a00:1450:4001:82a::2001
2a00:1450:4001:82a::2002
2a00:1450:4001:82f::2002
2a00:1450:400c:c08::9c
2a02:fa8:8806:12::1400
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:d018:24:b001:197c:8ea4:869f:2648
3.126.56.137
34.96.105.8
35.186.193.173
35.190.0.66
37.157.4.41
85.114.159.118
02766a9f9fe138fb2077707b73cffe8ce8257dcdf8abc06d41389ff33e4effcf
03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0
06b34901b9ee1d57c9e0a37a7665c7aa77f6ab8b884cda5e8caad1c3f8b8c639
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
08e4f8fd9774eaef8f56eb73607d06ef2b91e24e09c41f1778376a387bc64e4f
092bf2a0145d7c672d97fc343e2fd2dd20be09728104d3e28c67670b0e38bb60
09e7825013295f1d736a25a46d478267a65189a5a31f01c5ab681eaece702b4b
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0e8bbe951dd4239876be3e38704329f90dfe16df2e14e4d168624c27536bf8f0
0fc719084a17edd624f83817795dc042bfe09c539a04bf794c2051ba6eb656fa
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77
3a53657ea65c84349910571280cfa6d766ed167bdb964831b916e6ae5d91c4b6
3ee8351e156e2e80d99018a585c18c0dbd9098e3bea84a131d8cbad1ec72c81e
416c66b64adf83bfdfcdd37b98c3d88ae15cc77370bd0f7b5edcc3e5b480e641
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4621e2f0cc2662504242c3321a21836621dd99f274ef444418dfbe96c3f1f79f
4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b
477e3dabcd9e09fb6783381ad16b61e03bf3071910402dfeb03b8b6b8098195e
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d33cc1995a3c201abf2e3d09fb83fa1e91d3d9f732871f24d30d27bfd97c689
4f72cd84522248d7a8cb63872362fc34ebabd2b1f1d90172ee16c7c56c2d76be
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50620886c101862d378bb6aafe054417e7b0b8a0892b55e15fbf0f745936a797
574aca11e55d3f6e95d8697b69d9bded72a143e4c9abc3c10b6f1cdaa8d74b38
5e33139bde3704b1cc7ee5d82aee60f7962e295301a1cba0a37e670f168cdfaa
6210dbe9b964f36573eec31ac30bc560cea477e751d5e1759952d4c95799f903
63ed4c66bf3ba06512f7028be62a4bd53295e1ba68a919a7591f5fd392e72b90
67282d6d885c8609168726ce9e9b211bbaa220a668b4ebd798b935d457804564
726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3
733f44e4d42f00e0a8c267d516e9f6939d36f65ceb3bf851998475b9f6650d3f
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
7eac9876de8b55341701a45fbef2ec523361bf9b47d9a9fc6a018c6279128dee
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8db61f95a8f3554830efc6c3942b7322efef09b9d7f0cbfe32135e0fac106d18
8e193098549a42c5609f47940e991d29ff85eb5b7a9ad6c0339d0f9a41975351
9463e1fe6c1add55c69ff4ecd823f9f020435483650dd1ec37bc770dd6cd12cc
95b17ad661699c049d42195b8ccd1d855045a1fcfbd20d8609a6d87fa5703810
95eb000be2e5f9731d5aace0dd3a7367fa28ccd592d9882afc0705988add7185
966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9bd7952daefc70291b0a0bc163e80b8654b7600d1c590f24fa57a5cb8a218964
9c5b8ac3757b759ea59343d2c1611c964b6e912594193b89775d77ea2375e4da
9d0ef4b3129b4ead75cf32611fa78a7ac6051472becac18e3a7de6bc1e4cfa50
9e97a3b0f6188419765a14090c4a8c88209cf7f4c154023e65adbc8747475122
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
9ffce6e7fe38d9eaa59d2d80b36fd14d080a4c7f3513ee331cac376b4f982e9d
a051e0bd948ad4c3b6be0f24b4010b795959be0d8113c92c969fdb5bb0e3ddcd
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b069be0e4b3a3cf7547ab7c25a4c6ff752610b53d6f6e49a2fb0a6dc15f314fe
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
badf6d331d6a717326272bc6ff2711e3a602530af98c8d870a0a7bd2cf21fceb
bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e
ccec5161fbbfaab1c2f8e430352adf69459880d45d56d8ed1373708ad6944f4f
ceac48a7a84f3eac7045ca4f9cc69662c848c30d76942cf9d33108407ea71cee
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d8c6a6cb581cb56e57e64928574e9e10da0e29a6732926f4f271217c2c38de86
dc8eca03a82e90174f9165a76f2c8107eade58f5500bc9569cc2a8ade69615a7
dc9f7cdaabb3201fd2ead8c0cfd974710305362d0ea77c96069cb189796d6238
e1c5b41cc4dec857ca9c9166336dff0dec8f8ba6046aa71927370897143d2784
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd
e7a1375f883984026b922acfbe7cbc0bd02effdbfbfdde9354922a6055502624
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f101b87891ad459e38f57487c6aebee9f700c01cab59d3d38a11add8b6738d1e
fad77babd0798ad575e1460f0722174f29890ababf95b0f9dc3eb75eeafdb271
fc5868d5535d8b9dec270bc3385c2191d0797b49d8bc1e206d9e108bcf9512df

prnt.sc Open in urlscan Pro 172.67.72.27 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

182 Requests

99 %HTTPS

48 %IPv6

33 Domains

49 Subdomains

34 IPs

7 Countries

1710 kBTransfer

4619 kBSize

4 Cookies

12 Outgoing links

Redirected requests

182 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

prnt.sc Open in urlscan Pro
172.67.72.27 Public Scan

Screenshot
Live screenshot

Full Image

182
Requests

99 %
HTTPS

48 %
IPv6

33
Domains

49
Subdomains

34
IPs

7
Countries

1710 kB
Transfer

4619 kB
Size

4
Cookies

182 HTTP transactions
4 data transactions