www.obsev.com Open in urlscan Pro
2606:4700:3033::ac43:849e Public Scan

133.96.201.35.bc.googleusercontent.com

Software

sffe /

Resource Hash

ca0dd2ce2b414191dd75917f0c710dd1ee040c31b8dc870c24071d6c4ca3b749

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "948 / 702 of 1000 / last-modified: 1627988914"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24730
x-xss-protection: 0
expires: Tue, 03 Aug 2021 18:41:29 GMT

GET
H2 200 dx-rtk-head.js Show response
s29588.pcdn.co/wp-content/plugins/dx-rtk-plugin-v2/assets/dist/scripts/ 9 KB
5 KB 155ms
79ms Script
application/javascript 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/plugins/dx-rtk-plugin-v2/assets/dist/scripts/dx-rtk-head.js?ver=2020-08-15-01
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: faaa0dd551c854746ee514684515ce2b7b9c2ccae64849ba86cbf7c48305cabb

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:17 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 943404
x-cache: Hit from cloudfront
content-type: application/javascript
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: d7657192c93baefe4a47ba7363793b25
last-modified: Thu, 15 Oct 2020 12:06:29 GMT
server: cloudflare
etag: W/"5f883b45-252b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p8Y9YStMwWNaDYzUBMIrIkcbPOFVw1rxkR9oZ512WLYgGzUIlkijKvFPVa4auFGKloSumqedrqZM6FG2px9NeWAyAmhJHu99qkSH%2BMVAAZzbm7qFhk6aFoGW8CwBZI7T"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/plugins/dx-rtk-plugin-v2/assets/dist/scripts/dx-rtk-head.js?ver=2020-08-15-01
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c21bfee3635f-FRA
x-amz-cf-id: voRr-M7dN00jSkkqlcghqGWTPYca3dwQdzw_LJ20J5uOIsqlWGWVhw==
expires: Sun, 22 Aug 2021 20:38:05 GMT

GET
H2 200 jita.js Show response
506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/ 546 KB
172 KB 115ms
33ms Script
application/javascript 151.139.240.1
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.240.1 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 362848ac5b5ac87e90af03c842fd7b75c4d575717f28bf48656c0446854f8451

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:29 GMT
content-encoding: gzip
x-amz-request-id: 03VERZXKF7EVVEJM
x-cache: HIT
content-disposition: inline
x-amz-id-2: FYOOBDUOloL+qqth28gUv9Wxjg5R8axabAgGLlPkLmATT9sXDKQMe3SooTIQHiJOg6jo53yJymc=
last-modified: Mon, 02 Aug 2021 21:03:21 GMT
server: nginx
etag: W/"6f66084a079c7b8220a18e41a2d3cf15"
vary: Accept-Encoding
x-amz-version-id: Um45yRIBOwANL3gA1oUKijtPrpygsXUh
cache-control: max-age=86400
accept-ranges: bytes
content-type: application/javascript
link: <https://s3.amazonaws.com/jita-cdn/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js>; rel="canonical"
expires: Wed, 04 Aug 2021 18:41:29 GMT

GET
H2 200 script.js Show response
d19m55ur8rme4m.cloudfront.net/ 111 KB
37 KB 84ms
34ms Script
application/javascript 2600:9000:2156:6000:e:d90f:180:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:6000:e:d90f:180:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5547d99364d51680781ef7654685fbc4757b34955b28758367365f117dbf5d75

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:29 GMT
content-encoding: gzip
last-modified: Tue, 03 Aug 2021 16:27:42 GMT
server: AmazonS3
x-amz-cf-pop: FRA50-C1
etag: W/"9c1eb043f75581d24e8c277b39d37b8f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
cache-control: max-age=600,public,must-revalidate
x-amz-cf-id: lZ3mZPE4TZPnH5MOWQpRy8PNYea-BZnxLXjxs2_22-HmzBNvTChKgg==

GET
H2 200 vwpt.js Show response
static.vidazoo.com/basev/ 184 KB
46 KB 37ms
7ms Script
application/javascript 2a02:26f0:6c00::210:ba13
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.vidazoo.com/basev/vwpt.js
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00::210:ba13 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 60b56dba681920143487ff766048c03eaff516f53f9c0e33e740e2483a65a047

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:29 GMT
content-encoding: gzip
x-amz-request-id: QCWTTMM29BAP1HQK
content-length: 46207
x-amz-id-2: EWIIrP111sgGzKL3uIYiVCuF0JIeuCDqr8q9v9LZjXmBQENbvDqOWXpdR+EpHU3Xb7fya2FAEJo=
last-modified: Sun, 25 Jul 2021 13:56:50 GMT
server: AmazonS3
etag: "69d0267eb23ab8853a5eb4e792ab3a5a"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
cache-control: max-age=69483
accept-ranges: bytes
access-control-allow-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
expires: Wed, 04 Aug 2021 13:59:32 GMT

GET
H2 200 style.min.css
s29588.pcdn.co/wp-includes/css/dist/block-library/ 52 KB
10 KB 120ms
47ms Stylesheet
text/css 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-includes/css/dist/block-library/style.min.css?ver=5.4.6
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:15 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 943404
x-cache: Hit from cloudfront
content-type: text/css
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: bc65c545758d397988b58b4ddce8f39a
last-modified: Thu, 13 May 2021 05:19:55 GMT
server: cloudflare
etag: W/"609cb6fb-d159"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7YRTMk9WOrm3kFASdCUEDYa7ShAX%2BFTPtxGfyCWBK8bkD67tTzoIMhDrYz2WJui3oKNUbjJ14Uyrvb94q60u0upUD8TQ%2FiVmNzOoBaF2huIcJtuFzwYsbmi2d287DI99"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-includes/css/dist/block-library/style.min.css?ver=5.4.6
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c20c9844074a-FRA
x-amz-cf-id: sDTyCANpcex20kGPJtyoEW3gPfeNwfeZ_LLsY34gUousc1v0s9V0-Q==
expires: Sun, 22 Aug 2021 20:38:05 GMT

GET
H2 200 style.css
s29588.pcdn.co/wp-content/themes/magnetism-pro/ 69 KB
15 KB 151ms
78ms Stylesheet
text/css 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/themes/magnetism-pro/style.css?ver=202107211422
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: cdc87c531aaffeb2d41911312318bf5504bdd26d1a963ab66393e083e1cb599d

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:15 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 450562
cf-polished: origSize=94162
x-cache: Hit from cloudfront
content-type: text/css
cf-bgj: minify
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: 3f477010783da03d77597ec95b6dd93f
last-modified: Thu, 17 Sep 2020 14:26:07 GMT
server: cloudflare
etag: W/"5f6371ff-16fd2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DWTn5eBE52hbb8Tj0ezw7iRKqr%2FwNKuyLSUvJJtjXc2%2Bho%2BmTVz6vl%2FDnYQGSyXfrECXqZSiiCBGSc1226mWUJGKZo4Q3abNjChDihA%2BF4E1b4eTRpQmBfaCxMuF330N"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/themes/magnetism-pro/style.css?ver=202107211422
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c20c98344d89-FRA
x-amz-cf-id: QOifvfptaN8NlSONKUn8-T4POnCBgiiPU73YBiUVn0RJN9wBPpISww==
expires: Sat, 28 Aug 2021 13:32:06 GMT

GET
H2 200 master.css
s29588.pcdn.co/wp-content/themes/obsev-theme/assets/dist/css/ 62 KB
11 KB 107ms
33ms Stylesheet
text/css 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/themes/obsev-theme/assets/dist/css/master.css?ver=202107211422
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: c7b36d4468468febe6be6b4a6e33a0cc2895aa94f74acee573b04112ac93d6e5

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:15 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 943404
cf-polished: origSize=77348
x-cache: Hit from cloudfront
content-type: text/css
cf-bgj: minify
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: 5c4b7141e3795ca6ff2533ef873d3391
last-modified: Wed, 21 Jul 2021 14:22:21 GMT
server: cloudflare
etag: W/"60f82d9d-12e24"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aA4vMv7ebZWmwY%2Bf0sb8xZX0lAO0P3HZZwl%2BAdVW0BBuAW0PnNUZ19AmrHLPGri6FhL7CbmLG1cwrDmnKSb6gfpPe5h%2FZgUjMSmQjynJGuidwlEHSg1HIFu9cmCidpLl"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/themes/obsev-theme/assets/dist/css/master.css?ver=202107211422
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c20c9ebc2be9-FRA
x-amz-cf-id: rVZ0YEiaHGNWNKS47VIohInXaSjaR6dt7tHBvphDII5qm7ckMHB9hA==
expires: Sun, 22 Aug 2021 20:38:05 GMT

GET
H2 200 master.css
s29588.pcdn.co/wp-content/plugins/dx-rtk-plugin-v2/assets/dist/css/ 4 KB
2 KB 107ms
34ms Stylesheet
text/css 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/plugins/dx-rtk-plugin-v2/assets/dist/css/master.css?ver=202101041136
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: 5651eaf9f168cc2291eec10350e0c8b3bd71798fe601418589f80515808069de

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:17 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 450563
cf-polished: origSize=11180
x-cache: Hit from cloudfront
content-type: text/css
cf-bgj: minify
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: 368713f51ee420104466a6d49f941084
last-modified: Thu, 15 Oct 2020 12:06:29 GMT
server: cloudflare
etag: W/"5f883b45-2bac"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AIIKHYDLaz90HsP1eljPeTHKvz8hjCfvAacviqadoICt8iwb01pWmg7OBTrU5EN96eJ2CISvYMHz50tMI6oElSNWdx0IeEglfBS%2Bpox5YomZPLn7tXGyFZdMpnjaZK8G"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/plugins/dx-rtk-plugin-v2/assets/dist/css/master.css?ver=202101041136
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c21c0f272be9-FRA
x-amz-cf-id: FxDtB8Zm2PfxUO7klnaPYdWf3UaMr9ypZCIVFiSSBZMkybCgtyl_vA==
expires: Sat, 28 Aug 2021 13:32:06 GMT

GET
H2 200 style.css
s29588.pcdn.co/wp-content/themes/obsev-theme/ 0
962 B 143ms
70ms Stylesheet
text/css 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/themes/obsev-theme/style.css?ver=5.4.6
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:15 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 943404
cf-polished: origSize=282
x-cache: Hit from cloudfront
content-type: text/css
cf-bgj: minify
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: 7b2cfcd35b91834e3cb0a6f1ab3a2bbb
last-modified: Thu, 02 May 2019 16:52:59 GMT
server: cloudflare
etag: W/"5ccb206b-11a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BHYd5iZaeDgimpfI%2B4lxQl5WCbwaZtMIHlD%2F%2BU0%2BvZiG2cSkr5VJp%2F7HYymLvV4gBSrkrN4V2V0p66IibOYBh831%2F10nEN4AlIE5RyzjE8L14V%2Fun0Q2850dTb1M99jW"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/themes/obsev-theme/style.css?ver=5.4.6
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c20d789ec2f4-FRA
x-amz-cf-id: YG2ZjWz19NFfp1pyAagf5udBaBSh-BEX8TeMRHUlnkT4KaEX50IyoQ==
expires: Sun, 22 Aug 2021 20:38:05 GMT

GET
H2 200 jquery.js Show response
s29588.pcdn.co/wp-includes/js/jquery/ 95 KB
34 KB 131ms
59ms Script
application/javascript 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: 8c7ee0238fa5cd80a02ef9870a7fff498ef52097181cb73edb9219dc022fd919

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:15 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 943404
cf-polished: origSize=96873
x-cache: Hit from cloudfront
content-type: application/javascript
cf-bgj: minify
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: 6b5c7cdc0521ad0009538cb496f4d8cb
last-modified: Thu, 13 May 2021 05:19:55 GMT
server: cloudflare
etag: W/"609cb6fb-17a69"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wXv6sFoT0VNF6dHyGVxk%2BhDTxz9RviebRRvE09O9DzHU7d6rKe4%2FKYqV8GxlW%2FLXHt%2FiCCu9Qo6MtPnQZ9eNNaJI2IoUDWyRcT9Y6Ph16tzYiLlvKZKWkmWJ3Fjs3bx5"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c20c5c65dfe3-FRA
x-amz-cf-id: AH5R52NK-4W5M536vEm8AhQ4-P0JjtzM3L-rtzm-wJXk55pX1O3ivg==
expires: Sun, 22 Aug 2021 20:38:05 GMT

GET
H2 200 jquery-migrate.min.js Show response
s29588.pcdn.co/wp-includes/js/jquery/ 10 KB
5 KB 109ms
37ms Script
application/javascript 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: 48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:15 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 450562
x-cache: Hit from cloudfront
content-type: application/javascript
x-gateway-cache-status: HIT
x-gateway-skip-cache: 0
x-gateway-request-id: 5de4f4f4f8c6a441c07ca19a46f6d881
last-modified: Thu, 13 May 2021 05:19:55 GMT
server: cloudflare
etag: W/"609cb6fb-2748"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hk5hsVBBwcfsDqIR29crykjOzeqnim1qKKBU9JtxrOxYrd1WtFh412ug9hl%2BN6e8EdwRKaLKrE8O3Rtjxvv0bggKKbDzx4sRzL5VC4mqoHA8Q5O%2F34DtJiLsg6QYJgqw"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c20c5c144ac3-FRA
x-amz-cf-id: 0tZaK1Ok5VNLf0x902NSrHvcVFWThGM7sU_36EBTeJkFrVKi5At3Hw==
expires: Sat, 28 Aug 2021 13:32:06 GMT

GET
H2 200 dx-rtk-fullpage.js Show response
s29588.pcdn.co/wp-content/plugins/dx-rtk-plugin-v2/assets/dist/scripts/ 24 KB
10 KB 145ms
73ms Script
application/javascript 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/plugins/dx-rtk-plugin-v2/assets/dist/scripts/dx-rtk-fullpage.js?ver=202101041136
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: 8c9933091ef45f56d56735a3ff93d8327b5fd6db0627089a615194fa7321ef24

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:17 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 943404
x-cache: Hit from cloudfront
content-type: application/javascript
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: 471a0a0db2deea379057749caabd5133
last-modified: Mon, 04 Jan 2021 11:36:18 GMT
server: cloudflare
etag: W/"5ff2fdb2-5e8a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QOUhJ5RoTXLc1UnqPWPsQmc9O198NSknNAbCUtqSf5KbtDeINm4Oye4FrUQqaWpAg%2F4mMd5EdiLYjHvDcNy%2Fv55bz15EkC5vdeAGqwuRfMQeFCQlRF1IF%2F94ntiQ6X0u"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/plugins/dx-rtk-plugin-v2/assets/dist/scripts/dx-rtk-fullpage.js?ver=202101041136
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c21c19382ba1-FRA
x-amz-cf-id: d7xX80KSQ2zwfpT2eimL3teHR3z6rPXSsR67HbhRJuW-fC06Axhgfw==
expires: Sun, 22 Aug 2021 20:38:05 GMT

GET
H2 200 wp-hide-post-public.js Show response
s29588.pcdn.co/wp-content/plugins/wp-hide-post/public/js/ 838 B
1 KB 39ms
34ms Script
application/javascript 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/plugins/wp-hide-post/public/js/wp-hide-post-public.js?ver=9.9.9
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: 57a50c99a31ef4e89e86664e96f6dfbdde163a2eb96e88b3b492c49aa4be2f37

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:15 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 943402
x-cache: Hit from cloudfront
content-type: application/javascript
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: 9bd124fea699bc06ecc7d3e46595ab2f
last-modified: Tue, 16 Apr 2019 15:50:06 GMT
server: cloudflare
etag: W/"5cb5f9ae-346"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JKEfAZcY5RZBMlF0B4Rfy9IkXL8A7bH6v%2FAo42ZwS2VOgnaAKzXT%2FvbJxp3XQ%2FcoqDH1G3AKPG0G20aRu7Y9mEJfzNhFC5q624WjHck4tl2wWypj91NxvsI63%2FAq2iIj"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/plugins/wp-hide-post/public/js/wp-hide-post-public.js?ver=9.9.9
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c20c3baa635f-FRA
x-amz-cf-id: ZagtCXEkJJGhF3_IpQafXinWswRC0JmXPfXidzqpB8usg1YZvkfMDQ==
expires: Sun, 22 Aug 2021 20:38:06 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 100 KB
40 KB 24ms
19ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-67215840-1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c0407d5141f370e397a29d0aa4b34cea2459404d82300acfd179fc3df02676eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:29 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40806
x-xss-protection: 0
last-modified: Tue, 03 Aug 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 03 Aug 2021 18:41:29 GMT

GET
H2 200 optimize.js Show response
www.googleoptimize.com/ 96 KB
38 KB 16ms
15ms Script
application/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleoptimize.com/optimize.js?id=OPT-T4HKTS4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c47a7e03f49b7ce5e5c0ffb9d0f88e3831c69519dd705a221b6983ea98985ca1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:29 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38970
x-xss-protection: 0
last-modified: Tue, 03 Aug 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 03 Aug 2021 18:41:29 GMT

GET
H2

200

oct.js Show response
static.ads-twitter.com/
Redirect Chain

https://platform.twitter.com/oct.js
https://static.ads-twitter.com/oct.js

5 KB
2 KB

90ms
29ms

Script
application/javascript

151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/oct.js
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:29 GMT
via: 1.1 varnish
last-modified: Mon, 12 Jul 2021 21:25:31 GMT
age: 66854
etag: "65cf0c0ceb852397f0d1e6732cd3c533+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding: gzip
cache-control: no-cache
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 1958
x-timer: S1628016090.613559,VS0,VE0
x-served-by: cache-fra19169-FRA

Redirect headers

x-tw-cdn: VZ
Date: Tue, 03 Aug 2021 18:41:29 GMT
Server: ECS (frb/674D)
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Location: https://static.ads-twitter.com/oct.js
Content-Length: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 95 KB
38 KB 22ms
17ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-482106139

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

088b7bb1091248cdc720d9336faf7c04fed64a151c0a3ffbf05fdd4ecb34cf3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:29 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38821
x-xss-protection: 0
last-modified: Tue, 03 Aug 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 03 Aug 2021 18:41:29 GMT

GET
H2 200 logo-main.png.webp
s29588.pcdn.co/wp-content/uploads/sites/2/2020/01/ 2 KB
3 KB 61ms
55ms Image
image/webp 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s29588.pcdn.co/wp-content/uploads/sites/2/2020/01/logo-main.png.webp
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: b10655b58da5b3c76c73c29cd5ce6f73907097cdc01ec4a02e6946dfb49e0adb

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 13:41:32 GMT
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 419882
x-cache: Hit from cloudfront
content-length: 2258
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: c61eb29e1423ee52a59e224f690cf15d
last-modified: Thu, 29 Jul 2021 22:03:27 GMT
server: cloudflare
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/uploads/sites/2/2020/01/logo-main.png.webp
etag: "877e4a56a84a852522f0984c3855f27cbd0fa2d0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RkwZDt4JiLFY9NnUe%2B0l1IDj5U7X365f3SOu22mkSU%2BQRl68lbZHcD0i13jHrxVEQlUF%2BjSehw21UtXM0rcHlNIjvqMsLKPhFxl3HMU0lK99vdbTldzFlaaKwptwB1nL"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=1800
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
cf-ray: 678ff6d08ad1177a-FRA
x-amz-cf-id: 8sAoXDzJ1os4Z0AauxN5bqVUYWoAGnG8BpaKhXWWSMH4YLkNEy1SGA==

GET
H2 200 b1481be1d57a9eab4cebf5b873935bb4
secure.gravatar.com/avatar/ 3 KB
4 KB 23ms
6ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/b1481be1d57a9eab4cebf5b873935bb4?s=75&d=mm&r=g
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 684b46662ac8b47e9912c507381a27a25ae85f1754a131ff10d6c942d74542a6

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 03 Aug 2021 18:41:29 GMT
last-modified: Mon, 22 Aug 2016 01:30:59 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="b1481be1d57a9eab4cebf5b873935bb4.jpeg"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/b1481be1d57a9eab4cebf5b873935bb4?s=75&d=mm&r=g>; rel="canonical"
content-length: 3349
expires: Tue, 03 Aug 2021 18:46:29 GMT

GET
H2 200 savedbythebell.thepitch.jpg.webp
s29588.pcdn.co/wp-content/uploads/sites/2/2021/06/ 72 KB
73 KB 48ms
43ms Image
image/webp 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s29588.pcdn.co/wp-content/uploads/sites/2/2021/06/savedbythebell.thepitch.jpg.webp
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: ebf977455d922f11f8d260feeed314788a753db4cc0961b90440616597617067

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 05:16:37 GMT
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 449611
x-cache: Hit from cloudfront
content-type: image/webp
content-length: 73742
x-gateway-cache-status: HIT
x-gateway-skip-cache: 0
x-gateway-request-id: c620b4e5b9469a3d68e28c796c2a0f9e
last-modified: Thu, 29 Jul 2021 13:47:58 GMT
server: cloudflare
etag: "e9a1380748f9ebe6129051122044edbe58adeb64"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ffn%2BpeDC2XY2ze6ZSR8ERbpO5yoRe36Ly4NTI%2F3FAtj07MD%2Biul%2Bm94kVT8wRj9MM0v0owpepz4LoEgAGDe9hOYHGGKYuLLR9HYwLSgkm%2Bl%2BY%2FgjDwAtV53vDVaTzVb9"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/uploads/sites/2/2021/06/savedbythebell.thepitch.jpg.webp
cache-control: max-age=1800
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
cf-ray: 678d132ddab44e7f-FRA
x-amz-cf-id: gl6xhJDAx3O8wq9De-vlbH_1Mf5yZZcKjkY8AUoN6momYzvd7d3VHA==

GET
H2 200 navigation.js Show response
s29588.pcdn.co/wp-content/themes/magnetism-pro/js/ 2 KB
2 KB 42ms
37ms Script
application/javascript 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/themes/magnetism-pro/js/navigation.js?ver=20161205
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: d79752e33e156b5cb219ab45103fe0ed7d80f111533dd8eec42c57546b4da500

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:15 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 943400
x-cache: Hit from cloudfront
content-type: application/javascript
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: 592f5f52de3ea3a05a7fa6a7e1699b5a
last-modified: Tue, 16 Apr 2019 15:50:06 GMT
server: cloudflare
etag: W/"5cb5f9ae-8e7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SDj4Z2x4CcFHfL0CGkz%2BsCnhXLYv0KoYP1iSW%2BVQ9%2BBififeFeM6pF%2F2%2Bci%2Fzir94ld6b9%2B9FNOag3JCFaCASRRpM14qQDI7iIUGqAgBAIZCUXGHPTWGfYhw%2FI9lxAiB"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/themes/magnetism-pro/js/navigation.js?ver=20161205
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c20c58062ba1-FRA
x-amz-cf-id: gBMsbsNr6_shRtNVgZvvQqAebwprmjfPfB4ErPyJ07GIxRwsDErNEw==
expires: Sun, 22 Aug 2021 20:38:09 GMT

GET
H2 200 main.js Show response
s29588.pcdn.co/wp-content/themes/magnetism-pro/js/ 2 KB
2 KB 39ms
35ms Script
application/javascript 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/themes/magnetism-pro/js/main.js?ver=202107211422
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: eec8a8ed4a551debaf76700713145c8c9b127412de8b5a5212adb2aacc6f87a9

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:15 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 450561
x-cache: Hit from cloudfront
content-type: application/javascript
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: 36bc5d27b6eee53bd6b3aeccb6e14d11
last-modified: Thu, 17 Sep 2020 14:26:07 GMT
server: cloudflare
etag: W/"5f6371ff-8fc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JuxF5BhHVibLqY43JJR5a%2FBbhmFMsYq3larzveaBmOah%2FHvje5V9KBR3NssSb8JUPLg28IjKww%2FYG4x9JTdtGVdG0MRcPLsGLHK1jD7HgBeln9C%2FFOtMupo7TDXKxPtW"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/themes/magnetism-pro/js/main.js?ver=202107211422
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c20c5ae22b4d-FRA
x-amz-cf-id: Wzs6qrAKYMqHncgcWXgr197rD2GINT-aGUNLfYXcuRcu25id0NSLLg==
expires: Sat, 28 Aug 2021 13:32:08 GMT

GET
H2 200 skip-link-focus-fix.js Show response
s29588.pcdn.co/wp-content/themes/magnetism-pro/js/ 751 B
1 KB 41ms
36ms Script
application/javascript 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/themes/magnetism-pro/js/skip-link-focus-fix.js?ver=20130115
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: 5a1a3a3f0ef52a304cde50940ee607a2ebb008b76fa4cf49721b6e5cc07c350a

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:15 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 450561
x-cache: Hit from cloudfront
content-type: application/javascript
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: 28670270ddc0523a0361fd4382ea1a21
last-modified: Tue, 16 Apr 2019 15:50:06 GMT
server: cloudflare
etag: W/"5cb5f9ae-2ef"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xn53JpOckhVb3cHcXelpDsDBupKfXs2Py5Cwn8wLVK6r%2FnIE00a4cMgNcL87H%2BBroCI174o74mNijEH2YPgaGL%2BblcVQjWrQm4iyB6kn2KFcNI3ZUa0NjUbV69xQ3zej"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/themes/magnetism-pro/js/skip-link-focus-fix.js?ver=20130115
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c20c3aaae003-FRA
x-amz-cf-id: dER3Z-OfKOP0iwCVOCi03NShaPmmqmnn5m7F57xUpIDzIT_FDJIJcA==
expires: Sat, 28 Aug 2021 13:32:08 GMT

GET
H2 200 single-post.js Show response
s29588.pcdn.co/wp-content/themes/magnetism-pro/js/ 579 B
1 KB 40ms
35ms Script
application/javascript 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/themes/magnetism-pro/js/single-post.js?ver=20130119
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: 3ff42f6f57602f41ab60068adca26617b68022a930596fdc93095b21d32a2fc0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:17 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 943400
x-cache: Hit from cloudfront
content-type: application/javascript
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: 79cbba01c79c2cccd8c65fe8a1fbfebc
last-modified: Tue, 16 Apr 2019 15:50:06 GMT
server: cloudflare
etag: W/"5cb5f9ae-243"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c0pL0h3Zn5lZgTDDRRpRsuv45tvtMWFK1ihWysIwMvgitZKCb%2BXEoGm8FDcR0zW8geXpC76%2BbKpo%2BBfYPj2jbHKVInOCgMgaVIwV97wXrm0PJSH44H2m6bflVEh6jhfg"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/themes/magnetism-pro/js/single-post.js?ver=20130119
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c21c1f06dfe3-FRA
x-amz-cf-id: mgQR3IYSSjmle2Z1FJM0eRqzl55eyVPZ7z5r8AWPSA4jOuJKuXpu3Q==
expires: Sun, 22 Aug 2021 20:38:09 GMT

GET
H2 200 beacon.min.js Show response
static.cloudflareinsights.com/ 13 KB
5 KB 34ms
16ms Script
text/javascript 2606:4700::6810:5e41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5e41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e567066985125e7974f68b42914dcb134e3c38373a4a3d668bdb38a3e55f299

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:29 GMT
content-encoding: gzip
last-modified: Fri, 28 May 2021 17:24:20 GMT
server: cloudflare
etag: W/"5753bdd2-d310-49fa-bd2b-065a8e512116"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 6791ae30ef754eb0-FRA

POST
H2 200 1a Show response
i.clean.gg/ 0
104 B 106ms
105ms XHR
application/octet-stream 34.95.69.49
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clean.gg/1a
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.69.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 49.69.95.34.bc.googleusercontent.com
Software: nginx/1.17.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 03 Aug 2021 18:41:29 GMT
via: 1.1 google
server: nginx/1.17.4
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
alt-svc: clear
content-length: 0

OPTIONS
H2 204 1a
i.clean.gg/ Frame 0
0 152ms
104ms Preflight
text/plain 34.95.69.49
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clean.gg/1a
Protocol: H2
Server: 34.95.69.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 49.69.95.34.bc.googleusercontent.com
Software: nginx/1.17.4 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.obsev.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: nginx/1.17.4
date: Tue, 03 Aug 2021 18:41:29 GMT
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
access-control-max-age: 1728000
content-type: text/plain; charset=utf-8
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H2 200 dx-rtk-stylesheet-2.css
s29588.pcdn.co/wp-content/plugins/dx-rtk-plugin-v2/assets/dist/css/ 2 KB
2 KB 41ms
38ms Stylesheet
text/css 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/plugins/dx-rtk-plugin-v2/assets/dist/css/dx-rtk-stylesheet-2.css?ver=202101041136
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: 7d2a71f6a1a35e552d1bbc0b52a8f1b20f67f3c5b365dc021d23831934f4a06a

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:17 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 450561
cf-polished: origSize=9022
x-cache: Hit from cloudfront
content-type: text/css
cf-bgj: minify
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: 43b8526f1cea016f3d5094ea79a7c289
last-modified: Thu, 15 Oct 2020 12:06:29 GMT
server: cloudflare
etag: W/"5f883b45-233e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vx1X%2B837r5HKMqMk8KcWFbcaCA9r%2Fbghn9CPEo4M8ldNCxVrx65CkmTETjb9I4O3%2Fn%2BZMcUpjO5zA7CxmBzg6kD9MrQHu4m3FyWH%2By3L9H%2B%2BinCPZ3cSbeK17aobnrvK"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/plugins/dx-rtk-plugin-v2/assets/dist/css/dx-rtk-stylesheet-2.css?ver=202101041136
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c21c0bd54e7a-FRA
x-amz-cf-id: SWNyd_3-xswAGZQ0KmZj-cuAlYLON3KaEBkOmmMBx8HsChvNSQQavw==
expires: Sat, 28 Aug 2021 13:32:08 GMT

GET
H2 200 font-awesome.min.css
s29588.pcdn.co/wp-content/themes/magnetism-pro/css/font-awesome/ 28 KB
8 KB 40ms
37ms Stylesheet
text/css 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/themes/magnetism-pro/css/font-awesome/font-awesome.min.css?ver=5.4.6
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: b2233bd56e2f58aa8135d4ef5dca75a3414522a9f7dd035798dfc268edf6d3b4

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:16 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 943385
x-cache: Hit from cloudfront
content-type: text/css
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: e4530029e144cecee85b39eb4a3e555c
last-modified: Fri, 06 Nov 2020 16:15:24 GMT
server: cloudflare
etag: W/"5fa5769c-7000"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H04nh0rIQLapFspuW9m4NGbbhVU35r8joJ7EUtKBxQFtCmZZr1fnFEt2KwEfNB9NUamUIBnpEnu%2FUuNNR40SRYCNBwtwDcCLu0B%2BRj6bfLLa8x57kL8sUlLANZumdju%2F"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/themes/magnetism-pro/css/font-awesome/font-awesome.min.css?ver=5.4.6
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c2117d424e7a-FRA
x-amz-cf-id: sy6Qu9PYma8_v13xFOgM7Z04NTfmpY6V7tcFHAR6pHtbUt1NmZHb-w==
expires: Sun, 22 Aug 2021 20:38:24 GMT

GET
H2 200 ionicons.css
s29588.pcdn.co/wp-content/themes/magnetism-pro/css/ 50 KB
9 KB 42ms
40ms Stylesheet
text/css 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/themes/magnetism-pro/css/ionicons.css?ver=5.4.6
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: b4c9c3c2bb4b17bff5986d759288ef76a69d3f9bf0ff6e80cf7f278300eb05c7

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:16 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 559585
cf-polished: origSize=57178
x-cache: Hit from cloudfront
content-type: text/css
cf-bgj: minify
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: c819ae5cb357ba5b9a0affab9dd6e4b8
last-modified: Tue, 16 Apr 2019 15:50:06 GMT
server: cloudflare
etag: W/"5cb5f9ae-df5a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xIDev1LBqXU4IVd6gG5wyLOxS6E8OqZ53MZsHMI4YFYS3h0ym47k%2Flh7SP4DjHLgSfBkW5Gzsk8E13lizjtgRvOLxlLJmLbDNjhCU%2BcjFwj3dmUydgFNHd8z3B12lQw7"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/themes/magnetism-pro/css/ionicons.css?ver=5.4.6
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c2117cce635f-FRA
x-amz-cf-id: GvOpt2F8fsVSK5c1-YPgMLFcjb9vost_yFYo6uVUPFj892bMxf-NhA==
expires: Fri, 27 Aug 2021 07:15:04 GMT

GET
H2 200 animate.css
s29588.pcdn.co/wp-content/themes/magnetism-pro/css/ 55 KB
5 KB 43ms
40ms Stylesheet
text/css 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/themes/magnetism-pro/css/animate.css?ver=5.4.6
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: 9141953d9fa60e3d829b5588eb14a2ba746309db1005c36d29ac2a0b659449b0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:17 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 943385
cf-polished: origSize=72257
x-cache: Hit from cloudfront
content-type: text/css
cf-bgj: minify
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: 8eb4427729a31da19bf875b18e426a9e
last-modified: Tue, 16 Apr 2019 15:50:06 GMT
server: cloudflare
etag: W/"5cb5f9ae-11a41"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q5sAxqm2qx2y6J46cFPu0uqbN4m3X41kmjz%2F7Lt4GZIGxwcHQFuhTQHa0Ez%2BQeBEjjU8vkPfbI74P45J6ThrWaJXfPm1WiJQSgWlZEpeUyHx9I0DP%2BKF0%2FIz%2F%2FrHrCdn"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/themes/magnetism-pro/css/animate.css?ver=5.4.6
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c2163e584d89-FRA
x-amz-cf-id: S-G0GObeuxWnmuKseSgnbFmwZnVCherg5F6iA4sHzHkFpg3l04LJ5w==
expires: Sun, 22 Aug 2021 20:38:24 GMT

GET
H2 200 responsive.css
s29588.pcdn.co/wp-content/themes/magnetism-pro/css/ 2 KB
2 KB 44ms
41ms Stylesheet
text/css 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/themes/magnetism-pro/css/responsive.css?ver=5.4.6
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: 2e7448cc3623c60307b28ad956e5b9a3f48acceb721e2a021eb0696135254282

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:17 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 943384
cf-polished: origSize=3286
x-cache: Hit from cloudfront
content-type: text/css
cf-bgj: minify
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: 7de9e1bbbf0462cd0fd9505df3e46b92
last-modified: Tue, 16 Apr 2019 15:50:06 GMT
server: cloudflare
etag: W/"5cb5f9ae-cd6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4pCN9Je4NMjE154wazQM2T4WesjZTpOCZXAGj51kNB56pd9Xc8kma%2FOD9NbfOa1wEkr2JXwqHmZ4LmsRHZsT8cAKGcDBe4NQg3sg17D5fXEdBcJLksPKqxRGrZhFaiZw"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/themes/magnetism-pro/css/responsive.css?ver=5.4.6
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c21639d7e003-FRA
x-amz-cf-id: e-ICxGrN5x0YBOf6DS-HjxMdekMIdPNl1KLppkXh19-183kY4WSL3w==
expires: Sun, 22 Aug 2021 20:38:24 GMT

GET
H2 200 extras.css
s29588.pcdn.co/wp-content/themes/magnetism-pro/css/ 20 KB
5 KB 44ms
42ms Stylesheet
text/css 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/themes/magnetism-pro/css/extras.css?ver=5.4.6
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: 00b8626deb2ef52222d65c6f3039c35c38940cd7458181332381fbd81b76a004

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:17 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 759535
cf-polished: origSize=24487
x-cache: Hit from cloudfront
content-type: text/css
cf-bgj: minify
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: 4c0e524de5042608539b34e45320ec78
last-modified: Tue, 16 Apr 2019 15:50:06 GMT
server: cloudflare
etag: W/"5cb5f9ae-5fa7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2LRyeDR3Y%2B3TOQWjJzcuVphVKGIPrc7p%2ByyccfLfrF75uMNgOQY5dIuCrVykYfC20YCMahSr%2BYLOd5oMWIvmKRO9IFDLEjZnk%2FIApQcNpyWuqk3WM7%2FiqYnQENdBxVTs"}],"group":"cf-nel","max_age":604800}
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/themes/magnetism-pro/css/extras.css?ver=5.4.6
via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
cf-ray: 6766c2163cc02ba1-FRA
x-amz-cf-id: UgwTLWJZxYv97VQxLpvd31fqdZvOKceABhwV4Mf_ubxmYUIH_eJ5ww==
expires: Tue, 24 Aug 2021 23:42:34 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 94 KB
37 KB 24ms
20ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-573NKJ3

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a52a2ec3a934fd44d11004e3770ff5e7a3db7cd7391caabc0f04cbf61724d62d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:29 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37720
x-xss-protection: 0
last-modified: Tue, 03 Aug 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 03 Aug 2021 18:41:29 GMT

GET
H2 200 loader.js Show response
cdn.taboola.com/libtrc/revnewmedia-network/ 499 KB
38 KB 93ms
30ms Script
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/revnewmedia-network/loader.js
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: obaker.93.1.2-11.68.3 /
Resource Hash: d0f6f072d77962a60bfdbb1a4d11c0dc7c16863a90715b2b8c9cdea26170410b

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: tnmvMXpPinQSH8TTh6A7fYq4nwTH.LrZ
content-encoding: gzip
etag: "d1291864f8e7e9ec03c707c4b944b38d9074d4c7"
age: 1664
via: 1.1 varnish
x-cache: HIT
x-from-cache: 1
content-length: 38593
x-amz-id-2: VofGWSVpffRwJQB6HSJKo7T1Vf12wCdoxXU5LHjNi4+f2/aleFbWaFExZXKIoC+iSNJOZI4HXtg=
x-served-by: cache-fra19143-FRA
last-modified: Tue, 03 Aug 2021 18:13:46 UTC
server: obaker.93.1.2-11.68.3
x-timer: S1628016090.799788,VS0,VE1
date: Tue, 03 Aug 2021 18:41:29 GMT
vary: Accept-Encoding, Accept-Encoding
x-amz-request-id: 60Z9KXR3G4FBBY70
access-control-allow-origin: *
cache-control: private,max-age=14400
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 4
x-cache-hits: 1

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
26 KB 52ms
17ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c4243f7f5aa95631ca62fab376c3804859e808b66d373d07270872d23b8b081b

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 25944
x-xss-protection: 0
pragma: public
x-fb-debug: Ff76l4xEpGUgYXKXnrfcs11hlLP3JaPzjpztsFgUPEYRGPVQfcIn+2q9gkBFOChUYEegeusGiEhkMLSd1cNgnQ==
x-fb-trip-id: 720026100
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
date: Tue, 03 Aug 2021 18:41:29 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 sdk.js Show response
analytics.tiktok.com/i18n/pixel/ 114 KB
34 KB 278ms
213ms Script
application/javascript 2.16.186.242
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/sdk.js?sdkid=BTH5J9318114D7H6V62G
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.186.242 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-242.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: d0f522d17605d9aac46180825aaa5d60ba5e365a2f68e03cb5ff6e0b655bfdcd

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-request-id: 50c324fc.35a9dd66
date: Tue, 03 Aug 2021 18:41:29 GMT
content-encoding: gzip
x-cache-remote: TCP_MISS from a23-44-5-44.deploy.akamaitechnologies.com (AkamaiGHost/10.4.4-34529956) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a2-16-186-238.deploy.akamaitechnologies.com (AkamaiGHost/10.4.4-34529956) (-)
x-parent-response-time: 174,2.16.186.238
server-timing: cdn-cache; desc=MISS, edge; dur=173, origin; dur=8, inner; dur=0
pragma: no-cache
server: nginx
x-tt-logid: 202108031841290102450021695CF60BBB
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 8,23.44.5.44
x-tt-trace-host: 0188716309cf3c09bcbe2c234d514c810dc0e35ca0943e7ea50ff04942b296aad4db96ae16cfbef99a119b7592c2eede9b660a4328ef2198dc36a1639adf5ba934e7b8558f75a14e29d7225515f0adb579a85a71788aa684cb67f54fa9fb007977
expires: Tue, 03 Aug 2021 18:41:29 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 32ms
29ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:29 GMT
via: 1.1 varnish
last-modified: Mon, 12 Jul 2021 21:25:31 GMT
age: 66858
etag: "65cf0c0ceb852397f0d1e6732cd3c533+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding: gzip
cache-control: no-cache
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 1958
x-timer: S1628016090.740647,VS0,VE0
x-served-by: cache-fra19169-FRA

GET
H2

200

analytics-1.5.12.min.js Show response
cdn.keywee.co/dist/
Redirect Chain

https://cdn.keywee.co/dist/analytics.min.js
https://cdn.keywee.co/dist/analytics-1.5.12.min.js

22 KB
8 KB

13ms
12ms

Script
application/javascript

2600:9000:2190:c200:e:ec66:e40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.keywee.co/dist/analytics-1.5.12.min.js
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:c200:e:ec66:e40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d29d84e698eb10452f97d8a6f249b73496beb844cef58e920e3832bd321d64a2

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 31 Jul 2021 18:55:02 GMT
content-encoding: gzip
last-modified: Mon, 28 Dec 2020 09:55:56 GMT
server: AmazonS3
age: 258387
etag: W/"13a05c433850fad0455e2ee1a1707eb0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 08c5e904e2f0226b2d9c1417f32b12f2.cloudfront.net (CloudFront)
cache-control: max-age=259200,public
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: bK0ES1Sm47QES5Eku07epZX-yLRq-XPqAMb12ykStZ8ymTw-6AV7JQ==

Redirect headers

date: Tue, 03 Aug 2021 18:41:25 GMT
via: 1.1 08c5e904e2f0226b2d9c1417f32b12f2.cloudfront.net (CloudFront)
server: AmazonS3
age: 5
x-cache: Hit from cloudfront
location: /dist/analytics-1.5.12.min.js
x-amz-cf-pop: ZRH50-C1
content-length: 0
x-amz-cf-id: wJ1zv3YGrVoh26sykHNL92eW7hVEWH6tjtv3vpItrnlGTe_JzxWqhQ==

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 15 KB
6 KB 28ms
6ms Script
application/javascript 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

b9e6c38b3493790e6525ba6715ad839211cab5db3ddc80c7f70f20f92679fee6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Tue, 03 Aug 2021 18:39:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 121
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 5639
x-amz-id-2: r6N06c47MApODmFoB88i9XbLYB+q2KlguKZedL4/R4RXflYpttgGRUyQzBiLM+v1MlYPcTX8wXI=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sat, 02 Jul 2022 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Thu, 27 May 2021 13:00:20 GMT
server: ATS
etag: "6de43f1c725d89777edaa2bc5d679ecb-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: 1RTZHY94S2X4K0N9
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: Bv0RNzsjZsSn6kGrZjdvdggYqc20u__d
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 v2sqmM-r8dC3ZDvsi5fWfBRJFDm4M9gYicwrg7sDFyPlcDmoMdyC1ZSE Show response
overconfidentfood.com/ 103 KB
30 KB 98ms
33ms Script
text/javascript 35.201.96.133
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://overconfidentfood.com/v2sqmM-r8dC3ZDvsi5fWfBRJFDm4M9gYicwrg7sDFyPlcDmoMdyC1ZSE

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.96.133 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

db7ae56daf0307b4b1b28c93c202742bdc50228d2e8931f7d4e53fd99f9cac69

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; preload
content-encoding: br
x-datacenter: gce-europe-west1
etag: "0123243a6ffae0791c51f4c7099093198503d8e56e6c505e72d7b965d84f137f"
vary: Accept-Encoding, Accept-Language
x-hostname: 0f8346e1
content-type: text/javascript; charset=utf-8
cache-control: private, must-revalidate, max-age=21600
date: Tue, 03 Aug 2021 18:41:29 GMT
timing-allow-origin: *

GET
H2 200 choice.js Show response
quantcast.mgr.consensu.org/choice/SLxMaH0S8rqsR/www.obsev.com/ 3 KB
2 KB 45ms
13ms Script
application/javascript 2600:9000:2190:1c00:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/choice/SLxMaH0S8rqsR/www.obsev.com/choice.js
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:1c00:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a74d9a88b145b13af856ba7e17892f66caac51a83e14adafc1e36babd8476b54

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 03 Aug 2021 18:41:20 GMT
content-encoding: gzip
last-modified: Wed, 10 Feb 2021 21:52:50 GMT
server: AmazonS3
age: 58
etag: W/"d5875d1ba0991905b3f69fe3f539d272"
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin,Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 af287426c130b47dba79bf825f91ebbb.cloudfront.net (CloudFront)
cache-control: max-age=900
cross-origin-resource-policy: cross-origin
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: 337y5tdrCeN78Je4DaeBYv1gvDPka3wT3FdsGMw4HSa9HzbJBWK9Rw==

GET

connatix.playspace.dc.js
cds.connatix.com/p/125379/ Frame BB92
Redirect Chain

https://cd.connatix.com/connatix.playspace.js
https://cds.connatix.com/p/125379/connatix.playspace.dc.js

0
0

GET

connatix.player.dc.js
cds.connatix.com/p/125379/ Frame B5DA
Redirect Chain

https://cd.connatix.com/connatix.player.js
https://cds.connatix.com/p/125379/connatix.player.dc.js

0
0

GET
H2 200 DroidSans-webfont.woff2
s29588.pcdn.co/wp-content/themes/obsev-theme/assets/dist/fonts/ 71 KB
72 KB 106ms
40ms Font
font/woff2 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/themes/obsev-theme/assets/dist/fonts/DroidSans-webfont.woff2
Requested by: Host: s29588.pcdn.co
URL: https://s29588.pcdn.co/wp-content/themes/obsev-theme/assets/dist/css/master.css?ver=202107211422
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: ce1d230c6b398c67085e6344ee1c1232c7ce29fc9f2fcc65a3b5674acfdd9ce1

Request headers

Origin: https://www.obsev.com
Referer: https://s29588.pcdn.co/wp-content/themes/obsev-theme/assets/dist/css/master.css?ver=202107211422
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:16 GMT
via: 1.1 d627b75d0c1aedd3691390ac8498d3b0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 450491
x-cache: Hit from cloudfront
content-type: font/woff2
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=irOMgGxmnEcelcRyMdil%2BBuWeqD9TgUZdWqPIrrrp4nUt%2FJFspObEuX7C%2FIpVWmC%2BcZsWSYFeiwYO4rOVUSA8%2FUcBB1Io12MqZxny4s6ArTaurd4rwJ1H8uTem3BmAUC"}],"group":"cf-nel","max_age":604800}
content-length: 72676
x-gateway-cache-status: HIT
x-gateway-skip-cache: 0
x-gateway-request-id: 411fcb308cff14c7067d36defc44a582
last-modified: Fri, 10 May 2019 12:35:31 GMT
server: cloudflare
etag: "5cd57013-11be4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/themes/obsev-theme/assets/dist/fonts/DroidSans-webfont.woff2
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
cf-ray: 6766c212dff3dfe3-FRA
x-amz-cf-id: 9UWnfj3NPq5flFxgZWEmFBCfIS-FzZ6D3NicAblNiojLo_f79N9AYA==
expires: Sat, 28 Aug 2021 13:32:06 GMT

GET
H2 200 DroidSans-Bold-webfont.woff2
s29588.pcdn.co/wp-content/themes/obsev-theme/assets/dist/fonts/ 74 KB
75 KB 102ms
40ms Font
font/woff2 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/themes/obsev-theme/assets/dist/fonts/DroidSans-Bold-webfont.woff2
Requested by: Host: s29588.pcdn.co
URL: https://s29588.pcdn.co/wp-content/themes/obsev-theme/assets/dist/css/master.css?ver=202107211422
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: 6199df887e6da8e621cd94fef4e7dbb8c5e6382b043a5de7143a0ca81bc65db2

Request headers

Origin: https://www.obsev.com
Referer: https://s29588.pcdn.co/wp-content/themes/obsev-theme/assets/dist/css/master.css?ver=202107211422
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:16 GMT
via: 1.1 d627b75d0c1aedd3691390ac8498d3b0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 450561
x-cache: Hit from cloudfront
content-type: font/woff2
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2ncnaWANBqAiadWrNfizkLs99mpmLWzmFt1Is5kjyWIDgDFECD5oFtPRK%2FfWp%2FbUL8kUfoLW1eByIB6bw4n%2BE85B8RW0kJxkI9O798ySNydncOw%2FYUPyjl5ZTSwjIbhR"}],"group":"cf-nel","max_age":604800}
content-length: 75948
x-gateway-cache-status: MISS
x-gateway-skip-cache: 0
x-gateway-request-id: 988b1abc9c45b6abec0599518d2c10d2
last-modified: Fri, 10 May 2019 12:35:31 GMT
server: cloudflare
etag: "5cd57013-128ac"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/themes/obsev-theme/assets/dist/fonts/DroidSans-Bold-webfont.woff2
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
cf-ray: 6766c212dde21f45-FRA
x-amz-cf-id: f7oxoWhfrVqAVsYvddmnv9CBKJismUCWNbyKbcF5cX5E18BCHo1Zhg==
expires: Sat, 28 Aug 2021 13:32:08 GMT

HEAD
H/1.1 200
OK gdpr Show response
jita.rtk.io/ 0
272 B 92ms
23ms XHR
text/html 151.139.240.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://jita.rtk.io/gdpr
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.240.35 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 03 Aug 2021 18:41:29 GMT
Server: nginx
X-Cache: MISS
Content-Type: text/html
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Gdpr,X-Country
X-Country: US
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 0

GET
H2 200 fontawesome-webfont.woff2
s29588.pcdn.co/wp-content/themes/magnetism-pro/css/fonts/ 70 KB
71 KB 42ms
41ms Font
font/woff2 143.204.98.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s29588.pcdn.co/wp-content/themes/magnetism-pro/css/fonts/fontawesome-webfont.woff2?v=4.6.4
Requested by: Host: s29588.pcdn.co
URL: https://s29588.pcdn.co/wp-content/themes/magnetism-pro/css/font-awesome/font-awesome.min.css?ver=5.4.6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-80.fra50.r.cloudfront.net
Software: cloudflare /
Resource Hash: 7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Request headers

Origin: https://www.obsev.com
Referer: https://s29588.pcdn.co/wp-content/themes/magnetism-pro/css/font-awesome/font-awesome.min.css?ver=5.4.6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 29 Jul 2021 13:40:17 GMT
via: 1.1 d627b75d0c1aedd3691390ac8498d3b0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 450561
x-cache: Hit from cloudfront
content-type: font/woff2
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zHD59UKGiabw8pURfJb%2F17a6t6FjORtwHu%2FDbaYEH2zdZtjZtxTZpiRti5AB3kwEuqUp4FXOD5DFTAohpf0MwKbRcvY59UYSaTB38syH91hoS%2Bd8tkU4mj8JWmPs%2BpsZ"}],"group":"cf-nel","max_age":604800}
content-length: 71896
x-gateway-cache-status: HIT
x-gateway-skip-cache: 0
x-gateway-request-id: e95a859ff00150635764feba15129c79
last-modified: Tue, 16 Apr 2019 15:50:06 GMT
server: cloudflare
etag: "5cb5f9ae-118d8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
x-gateway-cache-key: 0||https|fun.obsev.com||/wp-content/themes/magnetism-pro/css/fonts/fontawesome-webfont.woff2?v=4.6.4
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
cf-ray: 6766c21c5bbe4ac3-FRA
x-amz-cf-id: oW1rSRDgD8cq1GRcUMk9xxpcRnHR6RN5lBOawNChQhq75MGFgAqdFQ==
expires: Sat, 28 Aug 2021 13:32:07 GMT

GET
H2

200

connatix.playspace.dc.js Show response
cds.connatix.com/p/125379/ Frame ECA0
Redirect Chain

https://cd.connatix.com/connatix.playspace.js
https://cds.connatix.com/p/125379/connatix.playspace.dc.js

1 MB
232 KB

30ms
29ms

Script
application/javascript

151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/125379/connatix.playspace.dc.js
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 26348d81a6437b1d8e69fcbc704b6b878d6dc4f30ba4193f59c8a455deb36ad7

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: br
last-modified: Tue, 03 Aug 2021 12:01:27 GMT
age: 23925
etag: "859c47ad9263f5d70c58f8dacaad3e4a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
accept-ranges: bytes
content-length: 236990

Redirect headers

location: https://cds.connatix.com/p/125379/connatix.playspace.dc.js
date: Tue, 03 Aug 2021 18:41:29 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
age: 0
accept-ranges: bytes
content-length: 0
retry-after: 0

GET
H2

200

connatix.player.dc.js Show response
cds.connatix.com/p/125379/ Frame 57EC
Redirect Chain

https://cd.connatix.com/connatix.player.js
https://cds.connatix.com/p/125379/connatix.player.dc.js

999 KB
222 KB

35ms
34ms

Script
application/javascript

151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/125379/connatix.player.dc.js
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: f80d2b5bb35d79abb164bf4c62eb6c6be7797660c99bf77aee7a460be868ee4d

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: br
last-modified: Tue, 03 Aug 2021 12:01:26 GMT
age: 23925
etag: "cf7a523966e01fbaa893dad879ab29d8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
accept-ranges: bytes
content-length: 227599

Redirect headers

location: https://cds.connatix.com/p/125379/connatix.player.dc.js
date: Tue, 03 Aug 2021 18:41:29 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
age: 0
accept-ranges: bytes
content-length: 0
retry-after: 0

POST
H/1.1 200
OK extend Show response
bisdr.vidazoo.com/event/ 0
247 B 393ms
97ms XHR
text/plain 68.183.99.11
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://bisdr.vidazoo.com/event/extend
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/vwpt.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 68.183.99.11 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 03 Aug 2021 18:41:30 GMT
Server: nginx
Access-Control-Allow-Headers: *
Content-Length: 0
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

GET
H2 200 10098065.json Show response
s.yimg.com/wi/config/ 2 B
458 B 22ms
9ms XHR
application/json 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10098065.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:23:35 GMT
x-content-type-options: nosniff
age: 1075
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: PF8RDDX1H62R6KAR
x-amz-id-2: I/aewmzKBB1OxHh0OC4ssJTDMELBzJZptsb4iZcWjFGd7UNz8qtGD1K5mJBN4pRQ6OhSigw0PgI=
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 2

GET
H3-29 200 584208432482914 Show response
connect.facebook.net/signals/config/ 253 KB
72 KB 71ms
70ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/584208432482914?v=2.9.44&r=stable

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a4d5b48bacdc12097469d1ed112dea6669a6e27e04befdad591902d296f82f7e

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: ZSAVQa7SvhKtYpW4PdUX4N/qRqFaicXgDVZ/wszPNMcC3Qm9CQi+GX6568gtPEdHrZFB3KOdQ12fNNltOLT7Dg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 03 Aug 2021 18:41:30 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK rates.json Show response
jita.rtk.io/assets/ 3 KB
2 KB 36ms
34ms XHR
application/json 151.139.240.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://jita.rtk.io/assets/rates.json
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.240.35 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: c3e5fa836ea80f448ca4dd16c4d4addfd3bba23226b3f16566282a9b139e07c3

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 03 Aug 2021 18:41:30 GMT
Content-Encoding: gzip
Last-Modified: Tue, 03 Aug 2021 18:00:02 GMT
Server: nginx
x-amz-request-id: 486KRTDPF3N5WE8F
ETag: "b8f9df0de98432e071a48c4cc757dff7"
Vary: Accept-Encoding
X-Cache: HIT
Content-Type: application/json
Access-Control-Allow-Origin: *
Content-Length: 1517
Connection: keep-alive
Accept-Ranges: bytes
x-amz-version-id: UqaHvofVj8K88deZEY59J0j5FUl_ziAk
x-amz-id-2: D7t+rt+RYwXvg2TvgEi/+e6ILZYe5eibLxMi9vWSg+2TXCULUl7YGvO7OUFwYQWQ/aUpDB/ja4M=

GET
H2 200 adsct
t.co/i/ 43 B
454 B 200ms
136ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=o5egv&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Tue, 03 Aug 2021 18:41:30 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 43fa1b0946506b49c47a76caba208a0fe53a0963402be87984dae442cd942840
x-transaction: 2045063b3b46b475
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK 5f1f56e15ca092000440e366 Show response
wserver.vidazoo.com/api/ 4 KB
3 KB 445ms
131ms XHR
application/json 157.230.220.65
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wserver.vidazoo.com/api/5f1f56e15ca092000440e366?userId=551424a21b1b1f08006fb6f9&loadFrequentlyTime=60000&parallel=false&unique=false&allowFrame=false&vdzwLocalCache=true&gdprEnforcement=false&parse=true&utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&cdn=static.vidazoo.com&url=https%253A%252F%252Fwww.obsev.com%252Fentertainment%252Fformer-child-stars-and-what-they-look-like-now%252F%253Futm_source%253Dlit_456%2526amp%253Butm_medium%253Dpaid%2526amp%253Butm_campaign%253D04rc_nitido26_336_all_bc_sc_7_29%2526amp%253Butm_content%253D23849078729880628%2526amp%253Butm_term%253D04rc_nitido26_336_all_bc_sc_7_29%252520-%252520Copy%2526amp%253Bfbclid%253DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&screenSize=1600x1200&innerSize=0x0&outerSize=1600x900&layout=infinity&referrer=lit_456&scrollHeight=67733&maxTouchPoints=0&encodeCms=true&vwptVersion=1.0.1&timezone=Europe%2FBerlin&timezoneOffset=-120
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/vwpt.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 157.230.220.65 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 2de029d32784fbd5a2aba68263e93396a433db24c20751fcc2b6ed4ce982ae57

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 03 Aug 2021 18:41:30 GMT
Content-Encoding: gzip
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.obsev.com
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate
Access-Control-Allow-Credentials: true
Connection: close
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
Content-Length: 3047

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 13 Jul 2021 18:24:06 GMT
server: Golfe2
age: 5269
date: Tue, 03 Aug 2021 17:13:41 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19672
expires: Tue, 03 Aug 2021 19:13:41 GMT

GET
H3-29 200 js Show response
www.googletagmanager.com/gtag/ 100 KB
40 KB 32ms
29ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-67215840-2&l=dataLayer&cx=c

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

581ec608950864a45091cb87bd65a2bad945b1c40e2eee36bc958ad23b5ae8fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40788
x-xss-protection: 0
last-modified: Tue, 03 Aug 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 03 Aug 2021 18:41:30 GMT

GET
H3-29 200 js Show response
www.googletagmanager.com/gtag/ 95 KB
38 KB 24ms
22ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-482106139&l=dataLayer&cx=c

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5ab1d227d7e954c9237ab578346c5252ec28a326d35e8f38fbfd2c3a1bb4f39f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38822
x-xss-protection: 0
last-modified: Tue, 03 Aug 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 03 Aug 2021 18:41:30 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
9 KB 13ms
11ms Script
application/javascript 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: gzip
etag: "WhyxmPkT7L77qVDcrjxwGw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Tue, 10 Aug 2021 18:41:30 GMT

GET
H2 200 cmp2.js Show response
quantcast.mgr.consensu.org/tcfv2/ 178 KB
44 KB 14ms
13ms Script
text/javascript 2600:9000:2190:1c00:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js?referer=www.obsev.com
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:1c00:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 50620886c101862d378bb6aafe054417e7b0b8a0892b55e15fbf0f745936a797

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:40:42 GMT
content-encoding: br
age: 48
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-max-age: 86400
access-control-allow-origin: *
last-modified: Thu, 29 Jul 2021 15:24:18 GMT
server: AmazonS3
etag: W/"b1b5d6c1aaffca164d90c41bda6397b2"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/javascript;charset=UTF-8
via: 1.1 af287426c130b47dba79bf825f91ebbb.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-meta-qc-ineu: True
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: tNqUu9bkzHPaFy0gQtUeGGJ6jZXCzdtmB5LbTS6mpDZLU4yjuAi82Q==

GET
H2 200 impl.20210729-8_b3-PR-38064-DEV-80778-rbox-sends-incorrect-uiv-publisher-version-param-in-request-for-p-b5680aa1a3e-SNAPSHOT.js Show response
cdn.taboola.com/libtrc/ 530 KB
118 KB 29ms
29ms Script
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/impl.20210729-8_b3-PR-38064-DEV-80778-rbox-sends-incorrect-uiv-publisher-version-param-in-request-for-p-b5680aa1a3e-SNAPSHOT.js
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3-br /
Resource Hash: 814252af31d5bbed72c2c968a3580f3b21f2ac1722c091352e14fbbc6dd1d53d

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: Lig8EeaqVgoaLKz4MpqVbOW7wQWgrRe8
content-encoding: br
etag: "5b355bae835eab12b407d8f0e06dac74"
age: 23194
x-cache: HIT
content-length: 120412
x-amz-id-2: nTrFhvPkhbmnrmlbeYFcHgFSij52+TvjOosMLS6HcxGh6GBI4tkqo8TUos+mY9mmK4JqqFmbzVI=
x-served-by: cache-fra19143-FRA
last-modified: Mon, 02 Aug 2021 12:10:53 GMT
server: AmazonS3-br
x-timer: S1628016090.085865,VS0,VE0
date: Tue, 03 Aug 2021 18:41:30 GMT
vary: Accept-Encoding
x-amz-request-id: JZQEC9R2ARAM17DY
via: 1.1 varnish
cache-control: private,max-age=14400
accept-ranges: bytes
content-type: application/javascript
abp: 74
x-cache-hits: 2284

GET
H2 200 beacon.js Show response
sb.scorecardresearch.com/ 1 KB
2 KB 120ms
38ms Script
application/javascript 13.224.96.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.96.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-96-37.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:23:48 GMT
via: 1.1 c76347c8ef1f3a2b6fb69cd7d1c6f749.cloudfront.net (CloudFront)
etag: "1827f116c73f319409b97f10b8a58ade"
last-modified: Fri, 26 Feb 2021 14:35:05 GMT
server: AmazonS3
age: 1063
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-length: 1469
x-amz-cf-id: 79ly5Tx5-3DWU2x4Nm8YuS38OxcpRRUlos_O_xfPz8K5yCQA-G8NEw==

GET
H2 200 tr5
cdn.taboola.com/libtrc/ 3 B
78 B 67ms
67ms Image
text/html 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.taboola.com/libtrc/tr5?abgroup=rbox-sends-incorrect-uiv-publisher-version_var
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1628016090.086555,VS0,VE0
x-served-by: cache-fra19143-FRA
x-cache: HIT
content-type: text/html
cache-control: private,max-age=14400
accept-ranges: bytes
content-length: 3
retry-after: 0
x-cache-hits: 0

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
480 B 61ms
15ms Image
image/gif 2600:9000:2156:8200:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:8200:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
via: 1.1 58bcd6f2e1bc29fb83f080f1743cfeca.cloudfront.net (CloudFront)
etag: "45cf913e5d9d3c9b2058033056d3dd23"
age: 539744
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 43
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: AmazonS3
date: Wed, 28 Jul 2021 12:45:46 GMT
content-type: image/gif
cache-control: max-age=315360000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: EuihXjC0cwBD5S2cout65EygukTm4h36JYt18CS51Jr7_5dX5131qA==

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 123 KB
33 KB 122ms
45ms Script
application/javascript 13.224.90.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.90.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-90-44.zrh50.r.cloudfront.net
Software: Server /
Resource Hash: e7a1375f883984026b922acfbe7cbc0bd02effdbfbfdde9354922a6055502624

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:38:04 GMT
content-encoding: gzip
server: Server
age: 205
etag: f8520ea4ebd91256d6b4f461d472242a
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e96895e7fdc48b58a3d95d2e8e23a8b0.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-version-id: cdBhoWYDE8U.miXtMaq72_QdUztpgDZw
x-amz-cf-id: AhLKrLDEWLwRRlmWEEvaDbcO6YVoylXOs--JCtYThZV-9UzXQ66iTw==

GET
H2 200 974.js Show response
cdn.keywee.co/config/ 223 B
563 B 13ms
13ms Script
application/javascript 2600:9000:2190:c200:e:ec66:e40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.keywee.co/config/974.js
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:c200:e:ec66:e40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7b75dbbf9300d478ba6eb2972e0173411076d71b90bfe1448c7bbbf64e13af37

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 04:01:17 GMT
via: 1.1 08c5e904e2f0226b2d9c1417f32b12f2.cloudfront.net (CloudFront)
last-modified: Tue, 17 Nov 2020 15:50:42 GMT
server: AmazonS3
age: 52814
etag: "36798066f748e2e09fa9fa744da22c54"
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400
x-amz-cf-pop: ZRH50-C1
content-length: 223
x-amz-cf-id: 3ty6oJ2__sbjLAFOUdI2BDQdvU2DcHTnVRvET05kACumVwu45eUj0g==

GET
H3-29 200 pubads_impl_2021072901.js Show response
securepubads.g.doubleclick.net/gpt/ 325 KB
113 KB 36ms
36ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072901.js

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

93a5aff7973bd2b1639e0499d27018a88782692ddb340169b27fac0d37dc6a66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 29 Jul 2021 08:44:06 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 116135
x-xss-protection: 0
expires: Tue, 03 Aug 2021 18:41:30 GMT

GET
H3-29 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 146 B
130 B 37ms
36ms XHR
application/json 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.obsev.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-18-210-181-188.compute-1.amazonaws.com

Software

cafe /

Resource Hash

838c218b2a39403e3dc629309173ac4cc5bae2408c0956c5abe9fd2604966ff3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 105
x-xss-protection: 0
expires: Tue, 03 Aug 2021 18:41:30 GMT

GET
H2 200 identify.js Show response
analytics.tiktok.com/i18n/pixel/ 114 KB
31 KB 203ms
203ms Script
application/javascript 2.16.186.242
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/identify.js
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.186.242 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-242.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: da556df4dc2e8a01fc001ae2a2446328a6615e19a40e9113a8718f0ac018d2c4

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-request-id: 39f57571.35a9e0ac
date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: gzip
x-cache-remote: TCP_MISS from a23-44-5-55.deploy.akamaitechnologies.com (AkamaiGHost/10.4.4-34529956) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a2-16-186-238.deploy.akamaitechnologies.com (AkamaiGHost/10.4.4-34529956) (-)
x-parent-response-time: 163,2.16.186.238
server-timing: cdn-cache; desc=MISS, edge; dur=166, origin; dur=5, inner; dur=0
pragma: no-cache
server: nginx
x-tt-logid: 202108031841300102450021191BFA1074
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 5,23.44.5.55
x-tt-trace-host: 0188716309cf3c09bcbe2c234d514c810dc0e35ca0943e7ea50ff04942b296aad4c2d3aa729281c4b4dc7cfe64d82f644a2bf44dc51d84186f3108760e6facc5b2f76af9b283472c4f27fac4116a5f24a3829577d108e5611254debd5347b5612b
expires: Tue, 03 Aug 2021 18:41:30 GMT

GET
H2 200 config.js Show response
analytics.tiktok.com/i18n/pixel/ 661 B
1 KB 208ms
208ms Script
application/javascript 2.16.186.242
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/config.js?sdkid=BTH5J9318114D7H6V62G&hostname=www.obsev.com
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.186.242 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-242.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: ab7184fc7f60cf264db6d36bce9915b3ae8b42c349a3d531fb20944ed9932b6a

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-request-id: 214004b9.35a9e0da
date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: gzip
x-cache-remote: TCP_MISS from a23-44-5-61.deploy.akamaitechnologies.com (AkamaiGHost/10.4.4-34529956) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a2-16-186-238.deploy.akamaitechnologies.com (AkamaiGHost/10.4.4-34529956) (-)
x-parent-response-time: 166,2.16.186.238
server-timing: cdn-cache; desc=MISS, edge; dur=162, origin; dur=8, inner; dur=0
content-length: 289
pragma: no-cache
server: nginx
x-tt-logid: 2021080318413001024502410716F0B5DE
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 8,23.44.5.61
x-tt-trace-host: 0188716309cf3c09bcbe2c234d514c810dc0e35ca0943e7ea50ff04942b296aad46baf3941c26093d303146d7e7d6891d976a716751545c7fa660173ae143c29d4de56bf8d57d35f614a30a71ee39ff87d3f535a8590ced5d6822deb5f68f702c8aab31359fe996005ee5d8ae3c89273f3
expires: Tue, 03 Aug 2021 18:41:30 GMT

GET
H2 200 rules-p-SLxMaH0S8rqsR.js Show response
rules.quantcount.com/ 2 B
351 B 41ms
12ms Script
application/javascript 2600:9000:2190:8c00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-SLxMaH0S8rqsR.js
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:8c00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:29:47 GMT
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
server: AmazonS3
age: 702
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
cross-origin-resource-policy: cross-origin
x-cache: Hit from cloudfront
x-amz-cf-pop: ZRH50-C1
content-length: 2
x-amz-cf-id: RXt1SpTt6So21NitBmc1FloD2EVe8WbdA_N4mfpEcpH-RwriBFfiAw==

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 14ms
13ms XHR
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j92&a=760268171&t=pageview&_s=1&dl=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&ul=en-us&de=UTF-8&dt=Former%20Child%20Stars%20Who%20Look%20Totally%20Different%20Today%20-%20Obsev&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAUABAAAAAC~&jid=1343331243&gjid=1620548175&cid=182200572.1628016090&tid=UA-67215840-2&_gid=1644577854.1628016090&_r=1&gtm=2ou820&z=855362187

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:30 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.obsev.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 36 KB
14 KB 104ms
39ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

8069956acb4c566506ff71f7a23c8e23f75ce9443384fe3393ed5c846924026e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13910
x-xss-protection: 0
server: cafe
etag: 8154934153164151798
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 18:41:30 GMT

GET
H3-29 200 1216874878695665 Show response
connect.facebook.net/signals/config/ 253 KB
72 KB 78ms
69ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1216874878695665?v=2.9.44&r=stable

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

24694286d6b13d38289d5a3be6f46ec5062b12aad7c3dfefa57593d1e5d293cd

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: /oW50mc11NsMqatrW6TsHwe+BRuSBw3kmVAastXY57u9fGroNVu+UBDaQnBQrSXwWD525CXH0jovldi2C6FNMw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 03 Aug 2021 18:41:30 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 sp-2.9.1.js Show response
cdn.keywee.co/dist/ 75 KB
26 KB 14ms
13ms Script
application/x-javascript 2600:9000:2190:c200:e:ec66:e40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.keywee.co/dist/sp-2.9.1.js
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:c200:e:ec66:e40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8ae5b95f24ba3bf0fa5b9b21ffca4ef8a683558ae0a4985abf835f7b71ad0579

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 02:25:59 GMT
content-encoding: gzip
last-modified: Sun, 14 Oct 2018 12:37:03 GMT
server: AmazonS3
age: 15696931
etag: W/"e0e6c30dc2f18c8cee12448a4cbb07eb"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
via: 1.1 08c5e904e2f0226b2d9c1417f32b12f2.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: rwD0eZbM5bokr3eDjFBN0d8X0xI0zaj7yu_Tp1KLo4xofZx5BiKgOA==

GET
H2

200

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=7&c2=34354936&c3=1&ns__t=1628016090291&ns_c=UTF-8&cv=3.5&c8=Former%20Child%20Stars%20Who%20Look%20Totally%20Different%20Today%20-%20Obsev&c7=https%3A%2F%2Fwww....
https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1628016090291&ns_c=UTF-8&cv=3.5&c8=Former%20Child%20Stars%20Who%20Look%20Totally%20Different%20Today%20-%20Obsev&c7=https%3A%2F%2Fwww...

64 B
330 B

46ms
45ms

Image
image/gif

13.224.96.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1628016090291&ns_c=UTF-8&cv=3.5&c8=Former%20Child%20Stars%20Who%20Look%20Totally%20Different%20Today%20-%20Obsev&c7=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&c9=
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.96.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-96-37.zrh50.r.cloudfront.net
Software: /
Resource Hash: 831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
via: 1.1 c76347c8ef1f3a2b6fb69cd7d1c6f749.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
etag: W/"40-jHLN3x5dWpBzaQm4lkBmDWvrjrg"
x-cache: Miss from cloudfront
content-type: image/gif; charset=utf-8
content-length: 64
x-amz-cf-id: -u3QAQsPNMMX2VFvJhrcLVZzIcbtNctrwqQH-vpt0mfPF8jmzgzrXQ==

Redirect headers

date: Tue, 03 Aug 2021 18:41:30 GMT
via: 1.1 c76347c8ef1f3a2b6fb69cd7d1c6f749.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
vary: Accept
x-cache: Miss from cloudfront
content-type: text/plain; charset=utf-8
location: https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1628016090291&ns_c=UTF-8&cv=3.5&c8=Former%20Child%20Stars%20Who%20Look%20Totally%20Different%20Today%20-%20Obsev&c7=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&c9=
content-length: 591
x-amz-cf-id: EnHMcSjTqoOVUAdSO571pfN8ssKIOxOIOWWHCPbr6jL3j7WMqYd9AA==

GET
H2 200 player.css
cds.connatix.com/p/125379/ 53 KB
8 KB 29ms
29ms Stylesheet
text/css 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/125379/player.css
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: b8b19af75b77e8d96706f9c314513e0a15cd1093c3c59a0bb99c8ba2839ffebf

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: br
last-modified: Tue, 03 Aug 2021 12:01:27 GMT
age: 23925
etag: "c6e2d0f7624aab499fbb112163409456"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
accept-ranges: bytes
content-length: 8234

GET
H2 200 show_companion_ad.js Show response
pagead2.googlesyndication.com/pagead/ 14 KB
6 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_companion_ad.js

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7313b1057f6543d7eb7acaa080be92b436473884cc71a5b0bdf5ece0d5e0aa4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:03:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2256
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5950
x-xss-protection: 0
server: cafe
etag: 3337145904970783249
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 03 Aug 2021 19:03:54 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 114ms
38ms XHR
application/javascript 13.224.90.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.90.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-90-44.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: UwMoja_wiYmXZ_L.v58hX8_8XzeYFzV9
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 74443
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Thu, 01 Jul 2021 22:05:10 GMT
server: AmazonS3
date: Mon, 02 Aug 2021 22:01:45 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 5e318b3ea3fa81a8c20898c2f8c40e7c.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: F29Txa_gvju0xDLjqonNR-ed5YTFEvO1spv501aFF7c1F5dC0tdgrw==

GET
H2 200 i
pixel.keywee.co/ 43 B
294 B 341ms
108ms Image
image/gif 18.210.181.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.keywee.co/i?stm=1628016090476&e=pv&url=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&page=Former%20Child%20Stars%20Who%20Look%20Totally%20Different%20Today%20-%20Obsev&tv=js-2.9.1&tna=cf&aid=974&p=web&tz=Europe%2FBerlin&lang=en-US&cs=UTF-8&res=1600x1200&cd=24&cookie=1&f_passive=1&f_wheel=wheel&eid=54ecd91d-1db9-4342-830c-8f8aa7773d46&dtm=1628016090474&vp=1600x1200&ds=1600x67733&vid=1&sid=5fbe2247-d5b4-499c-bef5-3b5deb84aa4b&duid=bea92a75-5477-4ea2-90ac-a47dc163212f&fp=1072425006

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

18.210.181.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx/1.17.6 /

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

status: 200 OK
date: Tue, 03 Aug 2021 18:41:30 GMT
x-content-type-options: nosniff
server: nginx/1.17.6
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/482106139/ 3 KB
1 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/482106139/?random=1628016090478&cv=9&fst=1628016090478&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa820&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&tiba=Former%20Child%20Stars%20Who%20Look%20Totally%20Different%20Today%20-%20Obsev&hn=www.googleadservices.com&us_privacy=error&async=1&rfmt=3&fmt=4

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0167f592a2053554c40a0530280d77669eec3bc31fd4884d1893a331f37b65f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1264
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
683 B 191ms
191ms Ping
application/octet-stream 2.16.186.242
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/sdk.js?sdkid=BTH5J9318114D7H6V62G
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.186.242 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-242.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 4c793f67.35a9e352
date: Tue, 03 Aug 2021 18:41:30 GMT
x-cache-remote: TCP_MISS from a23-44-5-76.deploy.akamaitechnologies.com (AkamaiGHost/10.4.4-34529956) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a2-16-186-238.deploy.akamaitechnologies.com (AkamaiGHost/10.4.4-34529956) (-)
x-parent-response-time: 159,2.16.186.238
server-timing: cdn-cache; desc=MISS, edge; dur=153, origin; dur=7, inner; dur=0
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 202108031841300102450021692CF7EA1B
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 7,23.44.5.76
x-tt-trace-host: 0188716309cf3c09bcbe2c234d514c810dc0e35ca0943e7ea50ff04942b296aad496dc6e7efa45ef00ef971a7c96f18d70842a59cc3f0881634dc8ab795776c9a59df8deb49c4ad1c7592d2624a5ac413136853bde5157017bd35106541c1ed002
expires: Tue, 03 Aug 2021 18:41:30 GMT

POST
H/1.1 200
OK pls Show response
capi.connatix.com/core/ Frame 57EC 5 KB
3 KB 499ms
145ms XHR
multipart/form-data 18.221.6.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/pls?v=125379
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.186 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-186.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: 146bc98a1713c125255aea8f679917a1a24da98e1df664a8e93bfb8cd1b8931c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 03 Aug 2021 18:41:30 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.obsev.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 2333

GET
H3-29 200 601808327226561 Show response
connect.facebook.net/signals/config/ 253 KB
72 KB 155ms
154ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/601808327226561?v=2.9.44&r=stable

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

536b7d3e4615d511e8734ba07602efc9fe569178827b9c402eec4ac68abf03c3

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: bis0PMJS6dWMwqM92P/D3ZFVIwoLg6vDxqb217MkdQeNM1WGWQ+ZMUeoukMT3P0B53nn0N34Uw1CGN3dG7fGoA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 03 Aug 2021 18:41:30 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
147 B 21ms
20ms Image
image/gif 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=584208432482914&ev=PageView&dl=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&rl=&if=false&ts=1628016090497&sw=1600&sh=1200&v=2.9.44&r=stable&ec=0&o=30&fbp=fb.1.1628016090496.1828513219&it=1628016089990&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 03 Aug 2021 18:41:30 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 21ms
21ms Image
image/gif 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1216874878695665&ev=PageView&dl=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&rl=&if=false&ts=1628016090500&sw=1600&sh=1200&v=2.9.44&r=stable&ec=0&o=30&fbp=fb.1.1628016090496.1828513219&it=1628016089990&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 03 Aug 2021 18:41:30 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/482106139/ 42 B
148 B 20ms
20ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/482106139/?random=1628016090478&cv=9&fst=1628013600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa820&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&tiba=Former%20Child%20Stars%20Who%20Look%20Totally%20Different%20Today%20-%20Obsev&async=1&fmt=3&is_vtc=1&random=1476520810&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/482106139/ 42 B
154 B 18ms
17ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/482106139/?random=1628016090478&cv=9&fst=1628013600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa820&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&tiba=Former%20Child%20Stars%20Who%20Look%20Totally%20Different%20Today%20-%20Obsev&async=1&fmt=3&is_vtc=1&random=1476520810&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vptm.js Show response
static.vidazoo.com/basev/ 40 KB
11 KB 6ms
6ms Script
application/javascript 2a02:26f0:6c00::210:ba13
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.vidazoo.com/basev/vptm.js
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00::210:ba13 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c3cc00dba6427450ca398d496b6d4d5ae385c893d1470754f1fba733c2a54d04

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: gzip
x-amz-request-id: JWM4DX0A5GB8JZA0
content-length: 10371
x-amz-id-2: uX61AqmlLNDNZwnExDtJPj7SiuIa8yWe/cRfXg3lhVZFgjyGojQAATun8f77QH6WgBH0FAXP0JE=
last-modified: Wed, 21 Apr 2021 09:37:00 GMT
server: AmazonS3
etag: "21a2c9567e39057710d15b53f8cc270a"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
cache-control: max-age=13265
accept-ranges: bytes
access-control-allow-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
expires: Tue, 03 Aug 2021 22:22:35 GMT

GET
H2 200 sbt.js Show response
static.vidazoo.com/basev/1.0.577/ 573 KB
121 KB 8ms
7ms Script
application/javascript 2a02:26f0:6c00::210:ba13
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.vidazoo.com/basev/1.0.577/sbt.js
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00::210:ba13 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ebb85ce5ff435e44613b58ed600234676d12e3ed2d7d1aa6ef853f22b390bf94

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: gzip
x-amz-request-id: 4TCC4YD0Y46NEWES
content-length: 122514
x-amz-id-2: T6MK6FzSnZfcRE87MNevGpEVzQctrf+hi50nYYbSqMR9ybsSdx9JOJgPxyPQAxsGY153bVJrwU4=
last-modified: Tue, 27 Jul 2021 08:40:44 GMT
server: AmazonS3
etag: "da4bd2f1e9b48c04c2ffbd46a1a46f5d"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
cache-control: max-age=18362
accept-ranges: bytes
access-control-allow-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
expires: Tue, 03 Aug 2021 23:47:32 GMT

GET
H2 200 widget.js Show response
static.vidazoo.com/basev/wgt/outstream-prebid-mobile/2.1.12/ 238 KB
58 KB 13ms
13ms Script
application/javascript 2a02:26f0:6c00::210:ba13
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.vidazoo.com/basev/wgt/outstream-prebid-mobile/2.1.12/widget.js?jsonp=__vdzw_5f1f56e15ca092000440e366_9GYi_jsonp_
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00::210:ba13 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 194922d297ee1d8f67be1d67dce912cebe4dd1fc5b426ac6fe2ee2dbe4cd9968

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: gzip
x-amz-request-id: KYGSQ0AHS2X0CRV1
content-length: 58292
x-amz-id-2: JtngGKh5+dtkZEfyRo7w0h7soDy0paTyXmogjSeFAtEzM9SKedJYa3e+9SygEIpGV6HU267DR30=
last-modified: Thu, 01 Jul 2021 09:13:43 GMT
server: AmazonS3
etag: "9baa945672bbf72a6e7b076c2bf4da2b"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
cache-control: max-age=84034
accept-ranges: bytes
access-control-allow-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
expires: Wed, 04 Aug 2021 18:02:04 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 20ms
17ms Image
image/gif 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=601808327226561&ev=KWCEPV&dl=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&rl=&if=false&ts=1628016090668&cd[noad30]=0&cd[noadcm]=0&cd[nokart]=0&cd[pvps]=1&cd[slensec]=0&cd[ar30d]=0&cd[arcm]=0&cd[kar30d]=0&cd[karcm]=0&cd[ts30d]=0&cd[tscm]=0&cd[kru]=0&sw=1600&sh=1200&v=2.9.44&r=stable&ec=0&o=30&fbp=fb.1.1628016090496.1828513219&it=1628016089990&coo=false&dpo=LDU&dpoco=0&dpost=0&tm=2&rqm=GET

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Tue, 03 Aug 2021 18:41:30 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
91 B 19ms
17ms Image
image/gif 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=601808327226561&ev=PageView&dl=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&rl=&if=false&ts=1628016090669&sw=1600&sh=1200&v=2.9.44&r=stable&ec=1&o=30&fbp=fb.1.1628016090496.1828513219&it=1628016089990&coo=false&dpo=LDU&dpoco=0&dpost=0&tm=1&rqm=GET

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Tue, 03 Aug 2021 18:41:30 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
658 B 197ms
140ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=o5egv&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
pragma: no-cache
last-modified: Tue, 03 Aug 2021 18:41:30 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 42a4c375fdb1d072cb0d3c9bc1979d1675b7d42a68c4c674e797d41da0ad5893
x-transaction: b89fea46c9b38281
expires: Tue, 31 Mar 1981 05:00:00 GMT

POST
H2 200 v2fveFM6Zdz5-LLeOXk0nxslF6g2JsABKUSfOHIMcIdw5LL97AyhwQfI46wjErPFO2AFwQnI Show response
overconfidentfood.com/ 216 B
612 B 86ms
29ms Fetch
application/json 35.201.96.133
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://overconfidentfood.com/v2fveFM6Zdz5-LLeOXk0nxslF6g2JsABKUSfOHIMcIdw5LL97AyhwQfI46wjErPFO2AFwQnI

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.96.133 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

133.96.201.35.bc.googleusercontent.com

Software

Resource Hash

91417432998a399f45d2a9bd262158cf0358998fe844a5cb6a9d296d574bb79f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=15724800; preload
x-datacenter: gce-europe-west1
date: Tue, 03 Aug 2021 18:41:30 GMT
vary: Accept-Encoding, Origin
access-control-allow-methods: POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.obsev.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-hostname: 0f8346e1
timing-allow-origin: *
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
content-length: 216
expires: Tue, 03 Aug 2021 18:41:29 GMT

POST
H3-29 200 rum Show response
www.obsev.com/cdn-cgi/ 0
201 B 29ms
18ms XHR
text/plain 2606:4700:3033::ac43:849e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.obsev.com/cdn-cgi/rum?req_id=6791ae275caa42e1

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:849e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-fetch-mode: cors
origin: https://www.obsev.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
cookie: rtk_session=eyJyZXZlbnVlIjowLCJ0cmlnZ2VyZWRSUFNSdWxlcyI6W10sInNpZCI6ImM5YzI1NGY5LTA3YmUtNGI3NS04OWVkLTc2ZmVkNzZmOThlNiIsInN0YXJ0ZWRBdCI6MTYyODAxNjA5MCwibGFzdFNlZW4iOjE2MjgwMTYwOTB9; _ga=GA1.2.182200572.1628016090; _gid=GA1.2.1644577854.1628016090; _gat_gtag_UA_67215840_2=1; _gcl_au=1.1.21819372.1628016090; kw.session_ts=1628016090290; kw.pv_session=1; _sp_ses.de44=*; _sp_id.de44=bea92a75-5477-4ea2-90ac-a47dc163212f.1628016090.1.1628016090.1628016090.5fbe2247-d5b4-499c-bef5-3b5deb84aa4b; _fbp=fb.1.1628016090496.1828513219
content-length: 1662
:path: /cdn-cgi/rum?req_id=6791ae275caa42e1
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type: application/json
accept: */*
cache-control: no-cache
:authority: www.obsev.com
referer: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
:scheme: https
sec-fetch-site: same-origin
:method: POST
Referer: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type: application/json

Response headers

date: Tue, 03 Aug 2021 18:41:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://www.obsev.com
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 6791ae383ee242d5-FRA
vary: Origin

POST
H2 200 v2knm1IlZqQEtFlD5SVXtHhe-Gbb5YPJotncQLgct6I1J2QJU_dbM-SiGOkg6YaNEwTAgYkU Show response
overconfidentfood.com/ 3 B
59 B 53ms
52ms Fetch
application/json 35.201.96.133
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://overconfidentfood.com/v2knm1IlZqQEtFlD5SVXtHhe-Gbb5YPJotncQLgct6I1J2QJU_dbM-SiGOkg6YaNEwTAgYkU

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.96.133 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

133.96.201.35.bc.googleusercontent.com

Software

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=15724800; preload
x-datacenter: gce-europe-west1
date: Tue, 03 Aug 2021 18:41:31 GMT
vary: Accept-Encoding, Origin
access-control-allow-methods: POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.obsev.com
access-control-allow-credentials: true
x-hostname: 0f8346e1
timing-allow-origin: *
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
content-length: 3

POST
H/1.1 200
OK sr Show response
capi.connatix.com/tr/ Frame 57EC 0
294 B 117ms
117ms XHR
multipart/form-data 18.221.6.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sr?v=125379
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.186 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-186.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 03 Aug 2021 18:41:31 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.obsev.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H3-29 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 70 KB
24 KB 37ms
37ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-18-196-0-40.eu-central-1.compute.amazonaws.com

Software

sffe /

Resource Hash

ca0dd2ce2b414191dd75917f0c710dd1ee040c31b8dc870c24071d6c4ca3b749

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "948 / 712 of 1000 / last-modified: 1627988914"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24730
x-xss-protection: 0
expires: Tue, 03 Aug 2021 18:41:31 GMT

GET
H2 200 2_media.bin Show response
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/ Frame 57EC 291 B
493 B 90ms
29ms XHR
application/octet-stream 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/2_media.bin
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 723318519bbf13a89e6092f0afb088abf00cc214a50f5f6dc221d9d816b6fa0f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:31 GMT
content-encoding: gzip
last-modified: Tue, 27 Jul 2021 23:21:22 GMT
age: 101588
etag: "6ba7d221640dc9edc659794d320b1e54"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
accept-ranges: bytes
content-length: 255

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame 57EC 340 KB
117 KB 33ms
13ms Script
text/javascript 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

691589a940c9030b5397bdbdc082cb8abb2d15671502a6dd66bafafb4de3b599

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119640
x-xss-protection: 0
expires: Tue, 03 Aug 2021 18:41:31 GMT

POST
H3-29 200 /
www.facebook.com/tr/ 0
15 B 17ms
16ms Ping
text/plain 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryEWVquQrfbSrrBVrj

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Tue, 03 Aug 2021 18:41:31 GMT
content-type: text/plain
access-control-allow-origin: https://www.obsev.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-length: 0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i

POST
H3-29 200 /
www.facebook.com/tr/ 0
15 B 16ms
16ms Ping
text/plain 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryu5kqUGn9466p1GW3

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Tue, 03 Aug 2021 18:41:31 GMT
content-type: text/plain
access-control-allow-origin: https://www.obsev.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-length: 0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i

GET
H3-29 200 bridge3.473.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 7F3F 578 KB
190 KB 19ms
6ms Document
text/html 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.473.0_en.html

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f0b81586105c3fc3ba29f2eef900dd2c50b2b26722c6220e961df8bf1d529ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.473.0_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 194074
date: Thu, 29 Jul 2021 08:18:39 GMT
expires: Fri, 29 Jul 2022 08:18:39 GMT
last-modified: Tue, 27 Jul 2021 18:08:21 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 469372
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ Frame 57EC 44 KB
17 KB 37ms
15ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16746
x-xss-protection: 0
expires: Tue, 03 Aug 2021 18:41:31 GMT

GET
H3-29 200 bridge3.473.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 4D6B 578 KB
190 KB 7ms
7ms Document
text/html 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.473.0_en.html

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f0b81586105c3fc3ba29f2eef900dd2c50b2b26722c6220e961df8bf1d529ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.473.0_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 194074
date: Thu, 29 Jul 2021 08:18:39 GMT
expires: Fri, 29 Jul 2022 08:18:39 GMT
last-modified: Tue, 27 Jul 2021 18:08:21 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 469372
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 bridge3.473.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame A936 578 KB
190 KB 8ms
6ms Document
text/html 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.473.0_en.html

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f0b81586105c3fc3ba29f2eef900dd2c50b2b26722c6220e961df8bf1d529ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.473.0_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 194074
date: Thu, 29 Jul 2021 08:18:39 GMT
expires: Fri, 29 Jul 2022 08:18:39 GMT
last-modified: Tue, 27 Jul 2021 18:08:21 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 469372
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H/1.1 200
OK g Show response
capi.connatix.com/rtb/ Frame 57EC 114 B
407 B 492ms
139ms XHR
multipart/form-data 18.221.6.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/rtb/g?v=125379
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.186 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-186.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: 28a6d7bd8f560a1d2766cccec474186e6b25eec9c211925c1dea958d5487fa42

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 03 Aug 2021 18:41:31 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.obsev.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 132

GET
H2 200 auction Show response
tlx.3lift.com/vast/ Frame 57EC 23 B
398 B 91ms
29ms XHR
application/xml 18.196.0.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tlx.3lift.com/vast/auction?inv_code=obsev_prebid_preroll_ROS&format=REPLACE_ME&width=401&height=226&minDuration=REPLACE_ME&maxDuration=REPLACE_ME&contentLanguage=REPLACE_ME
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.196.0.40 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-0-40.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 721f657d81b06f6159e9efdc3f4558def22f165f3b8fcefe81530bb98d6ba0b3

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: https://www.obsev.com
date: Tue, 03 Aug 2021 18:41:31 GMT
access-control-allow-credentials: true
x-auction-status: 3
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
content-length: 23
content-type: application/xml; charset=utf-8

GET
H2 200 1_th.jpg
img.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/ 8 KB
8 KB 38ms
30ms Image
image/jpeg 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/1_th.jpg?crop=401:226,smart&width=401&height=226&format=jpeg&quality=60&fit=crop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 31dbb22eaa518094d380edeb2090a223213bbef63e654b60490b6f065707cda7

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:31 GMT
age: 104002
etag: "67Em5kGIp5K0a6smn+D5JIlyzA4nITM2u8nSqAciBkM"
access-control-max-age: 86400
fastly-io-info: ifsz=81057 idim=2560x1440 ifmt=jpeg ofsz=7700 odim=401x226 ofmt=jpeg
access-control-allow-origin: *
cache-control: max-age=2592000, public
fastly-stats: io=1
accept-ranges: bytes
content-type: image/jpeg
content-length: 7700

POST
H3-29 200 /
www.facebook.com/tr/ 0
15 B 16ms
16ms Ping
text/plain 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary65zjwR9qfIAcJ8ad

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Tue, 03 Aug 2021 18:41:31 GMT
content-type: text/plain
access-control-allow-origin: https://www.obsev.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-length: 0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i

GET
H2 200 prebid4.43.0-1.js Show response
cds.connatix.com/p/plugins/ Frame 8574 369 KB
101 KB 30ms
30ms Script
application/javascript 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/plugins/prebid4.43.0-1.js
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4adaeccb264cbd8319080fd9f61eb769ff6f8aa1a02ab3408430b2b853d9cbe8

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:31 GMT
content-encoding: br
last-modified: Fri, 11 Jun 2021 12:04:10 GMT
age: 4603017
etag: "e4701779c6417de6368034bef638e34b"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
accept-ranges: bytes
content-length: 103396

GET
H3-29 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 8B19 36 KB
12 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a11f37584d425c821f06a42bb6a20546c9ceaf34bbf5d4d776afbaef40148e6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:21:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1192
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12603
x-xss-protection: 0
last-modified: Mon, 14 Dec 2020 16:45:56 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Tue, 03 Aug 2021 19:21:39 GMT

GET
H3-29 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 54B8 36 KB
12 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a11f37584d425c821f06a42bb6a20546c9ceaf34bbf5d4d776afbaef40148e6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:21:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1192
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12603
x-xss-protection: 0
last-modified: Mon, 14 Dec 2020 16:45:56 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Tue, 03 Aug 2021 19:21:39 GMT

GET
H3-29 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 6858 36 KB
12 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a11f37584d425c821f06a42bb6a20546c9ceaf34bbf5d4d776afbaef40148e6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:21:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1192
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12603
x-xss-protection: 0
last-modified: Mon, 14 Dec 2020 16:45:56 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Tue, 03 Aug 2021 19:21:39 GMT

GET
H2 200 playlist.m3u8 Show response
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/ Frame 57EC 309 B
272 B 29ms
29ms XHR
application/x-mpegurl 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/playlist.m3u8
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:31 GMT
content-encoding: gzip
last-modified: Tue, 27 Jul 2021 23:21:18 GMT
age: 105743
etag: "8a966507b13615ecdc1330a4bc9dcfe1"
vary: Accept-Encoding
content-type: application/x-mpegURL
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
accept-ranges: bytes
content-length: 164

GET
H2 200 0.m3u8 Show response
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/ Frame 57EC 550 B
329 B 36ms
36ms XHR
application/x-mpegurl 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/0.m3u8
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1aa3ad4f8616d2660ad04532c7446161d30587fa57bec096975fccbec3e8e222

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:31 GMT
content-encoding: gzip
last-modified: Tue, 27 Jul 2021 23:21:17 GMT
age: 105741
etag: "d2cb1a35c04bfe82dd55ccb90cf4c25b"
vary: Accept-Encoding
content-type: application/x-mpegURL
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
accept-ranges: bytes
content-length: 238

OPTIONS
H2 200 0.mp4
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/ Frame 0
0 35ms
35ms Preflight 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/0.mp4
Protocol: H2
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://www.obsev.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

retry-after: 0
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Tue, 03 Aug 2021 18:41:31 GMT
access-control-max-age: 86400
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
access-control-allow-origin: *
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/ Frame 57EC 1 KB
1 KB 30ms
30ms XHR
video/mp4 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 586599fb08964a820657e649862d7a21fab0f3d9a97b8188eaef4bc7c962336a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=0-1361

Response headers

date: Tue, 03 Aug 2021 18:41:31 GMT
last-modified: Tue, 27 Jul 2021 23:21:17 GMT
age: 105741
etag: "8ca2d7369b9eb9aa6376ae9d5a1c0247"
access-control-max-age: 86400
content-type: video/mp4
Content-Range: bytes 0-1361/3904550
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
accept-ranges: bytes
access-control-allow-origin: *
Content-Length: 1362

GET
DATA 200
OK truncated
/ Frame 7F3F 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7F3F 0
20 B 39ms
39ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?blob=nullPromise&lid=155&sdkv=h.3.473.0&id=ima_html5&c=1948883199823739&domain=www.obsev.com

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 206 0.mp4 Show response
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/ Frame 57EC 564 KB
565 KB 31ms
30ms XHR
video/mp4 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3427f232c5497ef2927878497c6a2879895e479c73864a43a245cf8e6721ada0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=1362-579241

Response headers

date: Tue, 03 Aug 2021 18:41:31 GMT
last-modified: Tue, 27 Jul 2021 23:21:17 GMT
age: 105741
etag: "8ca2d7369b9eb9aa6376ae9d5a1c0247"
access-control-max-age: 86400
content-type: video/mp4
Content-Range: bytes 1362-579241/3904550
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
accept-ranges: bytes
access-control-allow-origin: *
Content-Length: 577880

OPTIONS
H2 200 0.mp4
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/ Frame 0
0 31ms
30ms Preflight 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/0.mp4
Protocol: H2
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://www.obsev.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

retry-after: 0
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Tue, 03 Aug 2021 18:41:31 GMT
access-control-max-age: 86400
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
access-control-allow-origin: *
content-length: 0

POST
H/1.1 200
OK aggregate Show response
bisdr.vidazoo.com/ 0
273 B 99ms
98ms XHR
text/plain 68.183.99.11
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://bisdr.vidazoo.com/aggregate
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/wgt/outstream-prebid-mobile/2.1.12/widget.js?jsonp=__vdzw_5f1f56e15ca092000440e366_9GYi_jsonp_
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 68.183.99.11 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 03 Aug 2021 18:41:31 GMT
Server: nginx
Content-Type: text/plain
Access-Control-Allow-Headers: *
Content-Length: 0
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

OPTIONS
H2 200 0.mp4
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/ Frame 0
0 32ms
32ms Preflight 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/0.mp4
Protocol: H2
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://www.obsev.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

retry-after: 0
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Tue, 03 Aug 2021 18:41:31 GMT
access-control-max-age: 86400
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
access-control-allow-origin: *
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/ Frame 57EC 566 KB
567 KB 30ms
30ms XHR
video/mp4 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 631492da41f486ba1546d69c9918ccb1ca859b935b45a8f9111b61737d106724

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=579242-1159319

Response headers

date: Tue, 03 Aug 2021 18:41:31 GMT
last-modified: Tue, 27 Jul 2021 23:21:17 GMT
age: 105741
etag: "8ca2d7369b9eb9aa6376ae9d5a1c0247"
access-control-max-age: 86400
content-type: video/mp4
Content-Range: bytes 579242-1159319/3904550
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
accept-ranges: bytes
access-control-allow-origin: *
Content-Length: 580078

POST
H/1.1 200
OK mq Show response
capi.connatix.com/tr/ Frame 57EC 0
294 B 117ms
117ms XHR
multipart/form-data 18.221.6.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/mq?v=125379
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.186 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-186.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 03 Aug 2021 18:41:31 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.obsev.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK ps Show response
capi.connatix.com/tr/ Frame 57EC 0
294 B 235ms
118ms XHR
multipart/form-data 18.221.6.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ps?v=125379
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.186 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-186.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 03 Aug 2021 18:41:32 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.obsev.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK ao Show response
capi.connatix.com/tr/ Frame 57EC 0
294 B 118ms
117ms XHR
multipart/form-data 18.221.6.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ao?v=125379
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.186 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-186.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 03 Aug 2021 18:41:32 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.obsev.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK sv Show response
capi.connatix.com/tr/ Frame 57EC 0
294 B 118ms
117ms XHR
multipart/form-data 18.221.6.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sv?v=125379
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.186 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-186.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 03 Aug 2021 18:41:33 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.obsev.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK abt Show response
capi.connatix.com/tr/ Frame 57EC 0
294 B 121ms
121ms XHR
multipart/form-data 18.221.6.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/abt?v=125379
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.186 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-186.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 03 Aug 2021 18:41:36 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.obsev.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7F3F 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?cslots=0&dispcorr=0&streamcorr=0&loc=https%3A%2F%2Fwww.obsev.com%2F&ref=https%3A%2F%2Fwww.obsev.com%2F&gcasclass=1&vpaidadapter=f&ifstate=-1&lid=70&sdkv=h.3.473.0&id=ima_html5&c=1948883199823739&domain=www.obsev.com

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7F3F 0
20 B 40ms
39ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?csrvinit=1&lid=151&sdkv=h.3.473.0&id=ima_html5&c=1948883199823739&domain=www.obsev.com

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 auction Show response
tlx.3lift.com/vast/ Frame 57EC 23 B
397 B 35ms
35ms XHR
application/xml 18.196.0.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tlx.3lift.com/vast/auction?inv_code=obsev_prebid_preroll_ROS&format=REPLACE_ME&width=401&height=226&minDuration=REPLACE_ME&maxDuration=REPLACE_ME&contentLanguage=REPLACE_ME
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.196.0.40 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-0-40.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 721f657d81b06f6159e9efdc3f4558def22f165f3b8fcefe81530bb98d6ba0b3

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: https://www.obsev.com
date: Tue, 03 Aug 2021 18:41:37 GMT
access-control-allow-credentials: true
x-auction-status: 3
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
content-length: 23
content-type: application/xml; charset=utf-8

POST
H/1.1 200
OK st Show response
capi.connatix.com/tr/ Frame 57EC 0
294 B 118ms
117ms XHR
multipart/form-data 18.221.6.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/st?v=125379
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.186 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-186.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 03 Aug 2021 18:41:38 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.obsev.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
301 B 165ms
164ms XHR
text/plain 13.224.90.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&pubid=67d82afd-5c77-4816-97e0-97527d798aa4
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.90.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-90-44.zrh50.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:38 GMT
via: 1.1 e96895e7fdc48b58a3d95d2e8e23a8b0.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: ZRH50-C1
x-cache: Miss from cloudfront
access-control-allow-origin: https://www.obsev.com
cache-control: max-age=86087, s-maxage=86400
access-control-allow-credentials: true
x-amz-cf-id: lC3XbmhFOQMKt7_Qmt9s78t1ADjSJkOJKoCC_LPtunatHA23eI7hrA==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
371 B 74ms
73ms XHR
text/javascript 13.224.90.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&pid=ZvAbmUZmgDmlU&cb=0&ws=1600x1200&v=7.67.00&t=2500&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F101538805%2Fob_desktop_med_middle_standard%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F101538805%2FOB_Desktop_MED_Bottom_Standard_2%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x600%22%2C%22336x280%22%2C%22300x1050%22%5D%2C%22sn%22%3A%22%2F101538805%2Fob_desktop_med_top_ultra%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22160x600%22%5D%2C%22sn%22%3A%22%2F101538805%2FOB_Desktop_SKY_Top_Standard%22%7D%5D&cfgv=0&pubid=67d82afd-5c77-4816-97e0-97527d798aa4&gdpre=1&gdprl=%7B%22status%22%3A%22tcfv2-success%22%2C%22cmpTimeout%22%3A8000%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.90.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-90-44.zrh50.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:38 GMT
via: 1.1 e96895e7fdc48b58a3d95d2e8e23a8b0.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: ZRH50-C1
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.obsev.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: wu-6DqFT5XW5rphNAtuXHLXx5tAAVMO9pO6crGzt8oIxNBfLnEhwwg==

OPTIONS
H2 204 shandymedia
shandymedia.technoratimedia.com/openrtb/bids/ Frame 0
0 316ms
103ms Preflight 150.136.25.38
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://shandymedia.technoratimedia.com/openrtb/bids/shandymedia?src=prebid_prebid_4.29.0
Protocol: H2
Server: 150.136.25.38 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.obsev.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: nginx
date: Tue, 03 Aug 2021 18:41:38 GMT
access-control-allow-headers: content-type
access-control-allow-origin: https://www.obsev.com
access-control-allow-credentials: true
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 816415585
age: 0
via: 1.1 varnish

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 594 B
4 KB 131ms
43ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19228&site_id=216254&zone_id=1066394%3B1066332%3B1066326%3B1066396&size_id=15%3B15%3B10%3B9&alt_size_ids=%3B%3B16%2C54%3B&eid_pubcid.org=ea253e4b-e028-448d-80bd-730dfcb43d36%5E1&rf=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd%3Bhttps%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd%3Bhttps%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd%3Bhttps%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&tk_flint=pbjs_lite_v4.29.0&x_source.tid=b5cd967c-a18d-4e49-9e45-96cfef2343fc%3Ba1a37cf9-e74c-4789-af68-309fa6485094%3Bf218e650-324f-4dc3-9185-56299ee4c206%3B7b9defa3-3aaa-4487-8524-ac8a1053d480&p_screen_res=1600x1200&rp_secure=1&slots=4&rand=0.9553407183869149
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: afd0b18534e0e62bd34bcde652ebca7f56f41ab1f3f8de64fa04ae72a1765ed1

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:38 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.obsev.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 594
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 arj Show response
obsev-d.openx.net/w/1.0/ 175 B
379 B 201ms
184ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://obsev-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=b5cd967c-a18d-4e49-9e45-96cfef2343fc%2Ca1a37cf9-e74c-4789-af68-309fa6485094%2Cf218e650-324f-4dc3-9185-56299ee4c206&nocache=1628016098528&pubcid=ea253e4b-e028-448d-80bd-730dfcb43d36&aus=300x250%7C300x250%7C300x600%2C336x280%2C300x1050&divIds=RTK_jS5l%2CRTK_K67O%2CRTK_GgFd&auid=540167184%2C540167171%2C540167168
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.211.0 /
Resource Hash: 3ff6b9a36da5c7916e0ffa6ef8a30177046da045cd799d57858d2a37d608b84c

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:38 GMT
content-encoding: gzip
server: OXGW/16.211.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.obsev.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 166
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
343 B 356ms
116ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=anEIgw7emr6ykqaKkGJozW
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: e4456492982b6fcc9178edf4b512ff9f9787ab34bd004c58f9ff6d3831654114

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 03 Aug 2021 18:41:38 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.obsev.com
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
352 B 354ms
115ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=c_qS1a7eOr6ykqaKkGJozW
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: 656acbada1419e65fd90b64b7d55f1e79c17258d84a4b5b053a6d3ffeb7ef925

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 03 Aug 2021 18:41:38 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.obsev.com
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
343 B 359ms
119ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=d808Gu7emr6ykqaKkGJozW
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: 2bf0f56d2151072b3cd503879393040d5201f79abab90e74305ced42a1593000

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 03 Aug 2021 18:41:38 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.obsev.com
access-control-allow-credentials: true

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
352 B 357ms
118ms XHR
application/json 67.202.110.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=cN-KiO7e0r6yoPaKlId8sQ
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.24 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-110.static.steadfastdns.net
Software: / 33Across
Resource Hash: 1000948c44243fa7afb9d93a4472aa5df47a5e02ec9c6e7757495b2e3a8a174c

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 03 Aug 2021 18:41:38 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.obsev.com
access-control-allow-credentials: true

GET
H2 204 prebid Show response
ads.yieldmo.com/exchange/ 0
224 B 140ms
45ms XHR
text/plain 52.48.144.237
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebid?pbav=4.29.0&p=%5B%7B%22placement_id%22%3A%22RTK_jS5l%22%2C%22callback_id%22%3A%22167920b4613294%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%5D%2C%22ym_placement_id%22%3A%222556582347667349967%22%7D%2C%7B%22placement_id%22%3A%22RTK_K67O%22%2C%22callback_id%22%3A%2217163fc55a444ae%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%5D%2C%22ym_placement_id%22%3A%222556582348799812055%22%7D%2C%7B%22placement_id%22%3A%22RTK_GgFd%22%2C%22callback_id%22%3A%2218f2ee3d3be2f71%22%2C%22sizes%22%3A%5B%5B300%2C600%5D%2C%5B336%2C280%5D%2C%5B300%2C1050%5D%5D%2C%22ym_placement_id%22%3A%222556582348111946194%22%7D%2C%7B%22placement_id%22%3A%22RTK_U2ui%22%2C%22callback_id%22%3A%2219e9485e1b33a85%22%2C%22sizes%22%3A%5B%5B160%2C600%5D%5D%2C%22ym_placement_id%22%3A%222556582350343315938%22%7D%5D&page_url=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&bust=1628016098530&pr=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&scrd=1&dnt=false&description=&title=Former%20Child%20Stars%20Who%20Look%20Totally%20Different%20Today%20-%20Obsev&w=1600&h=1200&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%7D&us_privacy=&pubcid=ea253e4b-e028-448d-80bd-730dfcb43d36
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.48.144.237 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.obsev.com
pragma: no-cache
date: Tue, 03 Aug 2021 18:41:38 GMT
access-control-allow-credentials: true
x-robots-tag: none,NOINDEX,NOFOLLOW
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
59 B 130ms
130ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.obsev.com
date: Tue, 03 Aug 2021 18:41:37 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
539 B 31ms
31ms XHR
application/json 18.196.0.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=4.29.0&referrer=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&tmax=2500

Requested by

Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.196.0.40 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:38 GMT
x-auction-status: 12, 12, 12, 12
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://www.obsev.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 204 hb Show response
brightcombid.marphezis.com/ 0
98 B 339ms
107ms XHR
text/plain 54.224.214.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://brightcombid.marphezis.com/hb
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.224.214.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Tue, 03 Aug 2021 18:41:38 GMT
access-control-allow-credentials: true
server: nginx

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
247 B 190ms
98ms XHR
application/json 2.18.232.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.7 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:38 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.obsev.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Tue, 03 Aug 2021 18:41:38 GMT

GET
H/1.1 200
OK bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
473 B 206ms
142ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96954f01747430358b31ecfff00212&pos=ob_desktop_med_bottom_standard_2&cmd=bid&secure=1
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: ATS/7.1.2.128 /
Resource Hash: 81c7726d40b4626189952583c44a16ea3470bb662cb0c4f19eac4965dd46529b

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 03 Aug 2021 18:41:38 GMT
Server: ATS/7.1.2.128
Age: 0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST,GET,HEAD,OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.obsev.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 62

GET
H/1.1 200
OK bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
473 B 206ms
143ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96954f01747430358b31ecfff00212&pos=ob_desktop_med_middle_standard&cmd=bid&secure=1
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: ATS/7.1.2.128 /
Resource Hash: 686227081dbf428d2926b5eef8adbbfac3d2613b191596cf8519da7e081086d0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 03 Aug 2021 18:41:38 GMT
Server: ATS/7.1.2.128
Age: 0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST,GET,HEAD,OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.obsev.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 62

GET
H/1.1 200
OK bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
473 B 206ms
143ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96954f01747430358b31ecfff00212&pos=ob_desktop_med_top_ultra&cmd=bid&secure=1
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: ATS/7.1.2.128 /
Resource Hash: 356672701d909c8d03ce47bd9f39a186737930d1d671fb9895632033e9c7be4c

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 03 Aug 2021 18:41:38 GMT
Server: ATS/7.1.2.128
Age: 0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST,GET,HEAD,OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.obsev.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 62

GET
H/1.1 200
OK bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
473 B 204ms
142ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96954f01747430358b31ecfff00212&pos=ob_desktop_sky_top_standard&cmd=bid&secure=1
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: ATS/7.1.2.128 /
Resource Hash: 5f67bea4f10105a499cbf1693bdff95625099e2f9b17abf1b6764757f7185beb

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 03 Aug 2021 18:41:38 GMT
Server: ATS/7.1.2.128
Age: 0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST,GET,HEAD,OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.obsev.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 62

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 478 B
1 KB 70ms
69ms XHR
application/json 185.33.221.15
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.15 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

720.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

39a3378e0904a51e03402ce079735df2afb49294eeece4fe9697b4d9eea4fb33

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:38 GMT
X-Proxy-Origin: 159.48.55.4; 159.48.55.4; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 5ae2244b-56b6-49d8-bae5-1dfb853b4afa
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.obsev.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 478
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 470 B
1 KB 68ms
23ms XHR
application/json 185.33.221.15
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.15 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

720.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

eb79988fce180ee63be278d07d2b309282f55eae86f0adcb5292da34ea6cc0cd

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:38 GMT
X-Proxy-Origin: 159.48.55.4; 159.48.55.4; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f420be6c-a1ad-4139-a5ee-730887b7133a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.obsev.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 470
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
754 B 76ms
26ms XHR
application/json 216.52.2.30
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.29.0
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.30 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx /
Resource Hash: 51bd512f1dec02a4385028e075a77728d4042262799b7578c3d530dd61e46bb1

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 03 Aug 2021 18:41:38 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding, Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://www.obsev.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap6ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

POST
H2 200 c Show response
prebid.a-mo.net/a/ 861 B
784 B 386ms
182ms XHR
application/json 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 0ae898534acb1289c4f60fe8e7a408a14ae166b33736323b356c473ae989f772

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 03 Aug 2021 18:41:38 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.obsev.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 75
content-length: 356

GET
H/1.1 200
OK aardvark Show response
bidder.rtk.io/8L6B/jS5l_K67O_GgFd_U2ui/ 548 B
807 B 459ms
139ms XHR
text/html 147.75.107.42
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.rtk.io/8L6B/jS5l_K67O_GgFd_U2ui/aardvark?version=1&jsonp=false&rtkreferer=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&w=1600&h=1200&jS5l=65a3c4675b20a89&K67O=66ad534d98e53b1&GgFd=678571e517cd916&U2ui=685d6cfaea9c8ca
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 147.75.107.42 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS: lbadstorm-pk-nj-102
Software: RTK AdStorm/1.0 /
Resource Hash: 20f9fe2c5eb5ebcd114477538278a243664d8562359c1eee8e0c517f21476470

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:38 GMT
Content-Encoding: gzip
Server: RTK AdStorm/1.0
Etag: "5d4daf2209e19cbb79740480e888fc1f6dd09452"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://www.obsev.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
X-Rtk-Nid: adstorm-pk-nj-102:291
Access-Control-Allow-Headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With, Access-Control-Allow-Origin
Content-Length: 189
Expires: 0

POST
H2 204 hb Show response
hb.undertone.com/ 0
448 B 222ms
133ms XHR
text/plain 13.224.96.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.undertone.com/hb?pid=3822&domain=obsev.com
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.96.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-96-105.zrh50.r.cloudfront.net
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:38 GMT
via: 1.1 6b0e09b8a7d995016df1513b4b11c17e.cloudfront.net (CloudFront)
server: istio-envoy
x-amz-cf-pop: ZRH50-C1
x-cache: Miss from cloudfront
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV"
access-control-allow-origin: https://www.obsev.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
x-envoy-upstream-service-time: 4
x-amz-cf-id: kFtlsc5a9Xin7fWoc6H-djLV8FkAZyRVXh1Vzwq2kHTF8AWPstD-FA==
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
112 B 95ms
32ms XHR
text/plain 3.122.57.214
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.122.57.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.obsev.com
date: Tue, 03 Aug 2021 18:41:38 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
113 B 94ms
32ms XHR
text/plain 3.122.57.214
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.122.57.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.obsev.com
date: Tue, 03 Aug 2021 18:41:38 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
112 B 94ms
32ms XHR
text/plain 3.122.57.214
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.122.57.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.obsev.com
date: Tue, 03 Aug 2021 18:41:38 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
112 B 99ms
37ms XHR
text/plain 3.122.57.214
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.122.57.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.obsev.com
date: Tue, 03 Aug 2021 18:41:38 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 shandymedia Show response
shandymedia.technoratimedia.com/openrtb/bids/ 0
293 B 334ms
114ms XHR
text/plain 150.136.25.38
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://shandymedia.technoratimedia.com/openrtb/bids/shandymedia?src=prebid_prebid_4.29.0
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 150.136.25.38 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 03 Aug 2021 18:41:39 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 693166404
access-control-allow-origin: https://www.obsev.com
access-control-allow-credentials: true

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 25 B
369 B 100ms
40ms XHR
application/json 23.37.38.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=271445&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22833261f3f843e92%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A4%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allU%22%3A4%2C%22ren%22%3Afalse%2C%22version%22%3A%224.29.0%22%2C%22msd%22%3A2%2C%22msi%22%3A2%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%228478ddd3b0dde5%22%2C%22ext%22%3A%7B%22siteID%22%3A%22271445%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2285ebc53b42f27c9%22%2C%22ext%22%3A%7B%22siteID%22%3A%22271450%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%228671c35bc5b7f5%22%2C%22ext%22%3A%7B%22siteID%22%3A%22271447%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22878b8ee42311937%22%2C%22ext%22%3A%7B%22siteID%22%3A%22292743%22%2C%22sid%22%3A%22160x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A160%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%228671c35bc5b7f5%22%2C%22ext%22%3A%7B%22siteID%22%3A%22271447%22%2C%22sid%22%3A%22336x280%22%7D%2C%22banner%22%3A%7B%22w%22%3A336%2C%22h%22%3A280%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%228671c35bc5b7f5%22%2C%22ext%22%3A%7B%22siteID%22%3A%22271447%22%2C%22sid%22%3A%22300x1050%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A1050%2C%22topframe%22%3A1%7D%7D%5D%7D
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.38.181 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-38-181.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 00eaf8fb1ed892357a5722f0f467a007375b14bcdf7a93360963f212d79f9973

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:38 GMT
content-encoding: gzip
x-ak-initial-geo: CC:[NL], RC:[], CN:[EU], CIP:[159.48.55.4], XFF:[]
server: Apache
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.obsev.com
x-cs-client-geo: 12
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 45
x-ak-client-geo: 12
expires: Tue, 03 Aug 2021 18:41:38 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
282 B 89ms
40ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 03 Aug 2021 18:41:38 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://www.obsev.com
access-control-allow-credentials: true
cf-ray: 6791ae684c1a1ea1-AMS
access-control-allow-headers: Content-Type, Origin

GET
H3-29 200 integrator.js Show response
adservice.google.nl/adsid/ 107 B
122 B 31ms
15ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.nl/adsid/integrator.js?domain=www.obsev.com

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 03 Aug 2021 18:41:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
14ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.obsev.com

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 03 Aug 2021 18:41:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 54 KB
22 KB 445ms
445ms XHR
text/plain 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2427807378415322&correlator=4179742949571617&output=ldjh&impl=fifs&eid=31061180%2C20211866&vrg=2021072901&ptt=17&gdpr=1&sc=1&sfv=1-0-38&ecs=20210803&iu_parts=101538805%2Cob_desktop_med_middle_standard%2COB_Desktop_MED_Bottom_Standard_2%2Cob_desktop_med_top_ultra%2COB_Desktop_SKY_Top_Standard&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=300x250%2C300x250%2C300x600%7C336x280%7C300x1050%2C160x600&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=ddg_source%3Dlit_456%26ddg_lay%3D0%26ddg_sourcerep%3Dlit_456-0%26ddg_variant%3Ddefault&cookie_enabled=1&bc=31&abxe=1&lmt=1628016099&dt=1628016099719&dlt=1628016089506&idt=893&frm=20&biw=1600&bih=1200&oid=3&adxs=-12245933%2C-12245933%2C-12245933%2C183&adys=-12245933%2C-12245933%2C-12245933%2C93&adks=2121899528%2C3364728483%2C2764056001%2C1352494781&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.obsev.com%2Fentertainment%2Fformer-child-stars-and-what-they-look-like-now%2F%3Futm_source%3Dlit_456%26amp%3Butm_medium%3Dpaid%26amp%3Butm_campaign%3D04rc_nitido26_336_all_bc_sc_7_29%26amp%3Butm_content%3D23849078729880628%26amp%3Butm_term%3D04rc_nitido26_336_all_bc_sc_7_29%2520-%2520Copy%26amp%3Bfbclid%3DIwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0%7C0x0%7C0x-1%7C162x10&msz=0x0%7C0x0%7C0x-1%7C160x0&ga_vid=182200572.1628016090&ga_sid=1628016100&ga_hid=760268171&ga_fc=false&fws=132%2C132%2C132%2C644&ohw=1600%2C1600%2C1600%2C1600&btvi=-1%7C-1%7C-1%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

720.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

cafe /

Resource Hash

1908d6b9689ad7295bc5549c2f21a7bc23dec1ec27a8546940becfad96ac518e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:40 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22506
x-xss-protection: 0
google-lineitem-id: -1,-1,-2,-1
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,-2,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.obsev.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9A71 6 KB
3 KB 39ms
13ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 03 Aug 2021 18:41:39 GMT
expires: Wed, 03 Aug 2022 18:41:39 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H/1.1 200
OK extend Show response
bisdr.vidazoo.com/event/ 0
247 B 98ms
97ms XHR
text/plain 68.183.99.11
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://bisdr.vidazoo.com/event/extend
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/vwpt.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 68.183.99.11 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 03 Aug 2021 18:41:40 GMT
Server: nginx
Access-Control-Allow-Headers: *
Content-Length: 0
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

POST
H2 204 perf Show response
trc-events.taboola.com/shandymedia-obsev1/log/3/ 0
246 B 78ms
22ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/shandymedia-obsev1/log/3/perf?lti=rbox-sends-incorrect-uiv-publisher-version_var
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20210729-8_b3-PR-38064-DEV-80778-rbox-sends-incorrect-uiv-publisher-version-param-in-request-for-p-b5680aa1a3e-SNAPSHOT.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://www.obsev.com
pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

OPTIONS
H2 200 analytics
bucket.rtk.io/ Frame 0
0 82ms
22ms Preflight
text/html 147.75.80.107
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://bucket.rtk.io/analytics
Protocol: H2
Server: 147.75.80.107 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.obsev.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: nginx/1.10.3 (Ubuntu)
date: Tue, 03 Aug 2021 18:41:40 GMT
content-type: text/html; charset=utf-8
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With, Access-Control-Allow-Origin
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://www.obsev.com
cache-control: no-cache, no-store, must-revalidate
expires: 0
pragma: no-cache

POST
H2 200 analytics Show response
bucket.rtk.io/ 0
344 B 103ms
26ms XHR
text/html 147.75.80.107
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://bucket.rtk.io/analytics
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.80.107 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: POST,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.obsev.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With, Access-Control-Allow-Origin
content-length: 0
expires: 0

GET
H3-29 200 container.html Show response
de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 3E0B 6 KB
3 KB 21ms
7ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 03 Aug 2021 18:41:39 GMT
expires: Wed, 03 Aug 2022 18:41:39 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 container.html Show response
de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6C05 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 03 Aug 2021 18:41:39 GMT
expires: Wed, 03 Aug 2022 18:41:39 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 container.html Show response
de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E309 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 03 Aug 2021 18:41:39 GMT
expires: Wed, 03 Aug 2022 18:41:39 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

OPTIONS
H2 200 analytics
bucket.rtk.io/ Frame 0
0 23ms
23ms Preflight
text/html 147.75.80.107
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://bucket.rtk.io/analytics
Protocol: H2
Server: 147.75.80.107 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.obsev.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: nginx/1.10.3 (Ubuntu)
date: Tue, 03 Aug 2021 18:41:40 GMT
content-type: text/html; charset=utf-8
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With, Access-Control-Allow-Origin
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://www.obsev.com
cache-control: no-cache, no-store, must-revalidate
expires: 0
pragma: no-cache

OPTIONS
H2 200 analytics
bucket.rtk.io/ Frame 0
0 23ms
23ms Preflight
text/html 147.75.80.107
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://bucket.rtk.io/analytics
Protocol: H2
Server: 147.75.80.107 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.obsev.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: nginx/1.10.3 (Ubuntu)
date: Tue, 03 Aug 2021 18:41:40 GMT
content-type: text/html; charset=utf-8
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With, Access-Control-Allow-Origin
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://www.obsev.com
cache-control: no-cache, no-store, must-revalidate
expires: 0
pragma: no-cache

OPTIONS
H2 200 analytics
bucket.rtk.io/ Frame 0
0 23ms
23ms Preflight
text/html 147.75.80.107
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://bucket.rtk.io/analytics
Protocol: H2
Server: 147.75.80.107 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.obsev.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: nginx/1.10.3 (Ubuntu)
date: Tue, 03 Aug 2021 18:41:40 GMT
content-type: text/html; charset=utf-8
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With, Access-Control-Allow-Origin
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://www.obsev.com
cache-control: no-cache, no-store, must-revalidate
expires: 0
pragma: no-cache

POST
H2 200 analytics Show response
bucket.rtk.io/ 0
344 B 95ms
26ms XHR
text/html 147.75.80.107
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://bucket.rtk.io/analytics
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.80.107 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: POST,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.obsev.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With, Access-Control-Allow-Origin
content-length: 0
expires: 0

POST
H2 200 analytics Show response
bucket.rtk.io/ 0
344 B 92ms
26ms XHR
text/html 147.75.80.107
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://bucket.rtk.io/analytics
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.80.107 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: POST,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.obsev.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With, Access-Control-Allow-Origin
content-length: 0
expires: 0

POST
H2 200 analytics Show response
bucket.rtk.io/ 0
344 B 90ms
26ms XHR
text/html 147.75.80.107
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://bucket.rtk.io/analytics
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.80.107 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: POST,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.obsev.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With, Access-Control-Allow-Origin
content-length: 0
expires: 0

GET
H3-29 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
27 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e3da77a5939fbc06cb620cc93ee888978121a1dcd5cdb746deeb936a4cd92f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:40 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627903448373927"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27995
x-xss-protection: 0
expires: Tue, 03 Aug 2021 18:41:40 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 18ms
18ms XHR
application/json 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021072901&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021072901.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

350b80c7fa4582251e9e6ca14fcdb70ad98e0c85069bb1f3e78c4484ab693a90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 03 Aug 2021 18:41:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8538
x-xss-protection: 0

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Tue, 03 Aug 2021 18:41:40 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame FCB3 624 B
343 B 17ms
17ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CIikNxCPxucCGLzD3LABMAE&v=APEucNWfmzwK3Ac_JlOVx7JASeMyA5qsio-NUCmNUg8tslF-dLKRQu1zRhdeL997-4uMwPouCP0dAT667ZlE31cPWqpf0oQuElp_7P6A3oK0hTD8Ym2-2D9jrUv2zmsre4MpWel2G54t58aRw1dNKO7dCJut7O9vU6JoDm1P05T13KTwLbzIhNI

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CIikNxCPxucCGLzD3LABMAE&v=APEucNWfmzwK3Ac_JlOVx7JASeMyA5qsio-NUCmNUg8tslF-dLKRQu1zRhdeL997-4uMwPouCP0dAT667ZlE31cPWqpf0oQuElp_7P6A3oK0hTD8Ym2-2D9jrUv2zmsre4MpWel2G54t58aRw1dNKO7dCJut7O9vU6JoDm1P05T13KTwLbzIhNI
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnlKuXSIR6pgYrcre4g6Q29ezSpdUJn3WUt3ONiZ_TYUjXRxd5m4MKe5TrKxgM
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 03 Aug 2021 18:41:40 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 3E0B 60 KB
24 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A7vtkKQGVlSQ6vpi4Tk7fv4oaWPIaqQ6LYHRaeL8GHNqdfVJh5CwW2DQaga5Fo5-GzGG2-KI4YOPRb3pQhk6lFQHb_X_7NJd1EwSx_DZULCCoNzcQFAMy4yd05ZUVqHA0QYruQcSAaU22tPHKCSxfzhM24Qg&dbm_d=AKAmf-B222dH00StKRTGZUMMkXqLppBJsTvOhrD8b6KyEOtePb7XkXYPj0le-UBMv2z4J5pqMe6N_guPY2LGEMOmVsvN5P4m2DvwRZm5-drGkYbDEv4tuxRyRpmX8rVRJcGEeJrfnCszelppNiDMgVrT64GbGlVK3TfHfWys9hVKtWczrtGsCz2ykkBUkJD39cygBYFH3cj4SAZZCSksRoQneBhugldrt8ML0PNQH6iYyHA5KeljOaxlIbrUAFHCKA0U4DWG4iAj082_jQBiwHmCCug13Aw6gQBHIHKMHwZZHrjaMpHASSF5L5eF8okbcijkvJ1qMLTomncu4kjwi-30y9XujjM6d87V76wya9mAhEGM4Cp-QlrQc4OatiDLLlshFz2hNSM707xEi5qDrE57mbVEiyISB2yLEEPlUJMac7mV_NMwJvgsR_6KhYESJzp3PdzT6yudLyl4bYZQZBcpgeGUGOuoBXSLfmheqjZqThQNumCbEvM_qwgoExlp8rhT-_GcmuorZChdX4MtcT_WwX8zBzxRnSJmL2NsgWH2W4nKKFpe9aGjsPtygLhu4p3mE4iideLAwfpcRZJpPpuV5xwZ37xOKjrXWNNxwYFH5ksHTDeOGfyeC5yLUWOIgunPxYxSWfM4hMtVTp8brvcgkCVv71SpHzJDZKHFxFIum2IkfniasUCkEH_rQFl8c4bRcPsAdIdYMCv32xtUTB8CYINuqeFrtWguxyHlSzJKbvTvMq_2B6LeZG1cZE2kM4mxE5qTkx3USVcpVNzRfkUrlIj3n6ZAye9NMLdC7LUzilAUk6Z9XqvTwn6VFbmlN7yKZNNXWmtIy80URmMTP8C_0-j_fHlnOIZ1_Vhc_Li1fqF1ACLBh9vOYY9x45slpk0XvS2ZAGKqfWwoLXESpnrwLxCEdZuJrfw8IfSO6AXs5jF839dsfhcVkb2HsUjTlI6iYp1esp-JGYRJTyusCrgZPeNHLVD0safslNce6nB32kPiTYW9guOntpFjMws_w5EmJvmn66DSYQbA9PSsy25Mlc7s9J7QsdC_ciKErW_jFkwtdIEldzLICK_mVVBPWQKlelldyFf2nHZUzTCQ6MFYcNK3Hyl6XssaYCbc3CMfYqKh9M2olOMEEaE-QH7E_4MzB-VKn8AcOQNvhGLFeF2ezKKZWnbNX6vJu321_ekVaGfg4HILk9nHysqwcdE1Fmy0_YVWMKVz_Dkxm23zMFYUGDwawFS8VTHRgXWw2IgSWBX1rDSDScC2i-HMoo1a-s6U1WUo2rdQNHjOFo4k21NRsIri0H7_5U-CE-QiFTAwtVUCMUuMC_6iR4qol63Mutf7jfATLBhHswb5Jjy3sl_1HoGpW6np_CZ9rlaK1y4TEmDkbDTUTR9xMacUCMtPc-oU2_UaRQaapdHaFVK7nmzEBAcOsz3GsqpOd2SD2NdzfcmT6yhT1jRPs_3qRX3PLJtby9H-c66ogtWbsm6ob1Zi3mybd9t7hbLa9nbUo0fqik60CRZmwRqZByj2ZCjUQIkmmBVJfK7d92cM0540ufXoqXG6dOZvWu_9NosmoBMDUaC4hxMzZuuiPTZfZ2Or6WIJyhKPjDnl_r5Bn2R2DN8s5ldFnDMUQZdpYVFBS0bBz0vdMIoRW2gWbek18kL8ctGn3X1LI9RIoHc6UcXoV4hshoRk-JN7-4OLYmxZBJw7usCXIm-G9_H_2hsyBsa80qg_ruo28hggicbcbDjxowewjxdOX9hBLFOv-kom2ud4BjVCxxCL14zvt_gL0kULit55_MY3sgg0IvMLZzgtbPEBDc5DOHef1nH17DZzH9dH3u8opDDRboIIiV65hOMW1R8Qa4wvuciVksaSulv80Zo9QMd879bpKbbw-hNQvTVQUIwooOwXNuy0AfBq7U1ll_xefkcRLKuzL4X9zXBO0S0GaPIuxzKYLkBTpxBPWabYvYEYYkyAoLFXVHXsPzbh3HGrim7ZGkxYx1n58_LDzWx6i6JrHskh8uEOVV7cL7_NTb2Fb1ZoGPiRaTn9P4zvrFepdXl3WEvtdmtSXfOxnzI4hfks3_XQywFOLaO3WMHjMp1X4lyKA75WKvkFpb6LNv8cTEwRyS0aaLD1NlwtYfc5wfmIq1I-Titj4hayB5snndyPqMaJawRsRk-E8qYdmgcGyrg34nPEg0DVkRVVkR4mDnUBlSOutw8f3pGddDMdvF67DPPYaSciX9PeM_z6Dl3clEAelCh-HhELNvhHLZEWyHIDJzP5m8iZmB8RMRBG5VDeyrU79UPIMWMZpDPK_cDak4aw7oAvtNhIW5UaD29uHv1jq-X96lnlC_6Apo2SAWRX3g3fLi-L7-TfyfGAMnQP6VhzgIn-FTKugVN3BNMct7tXm_TqP7J_9jJUGp_F_YyFiHuN1zTMd5uGDnpVajkHFb_1XnyviwoYa2JqL79sbcWIDOyOYGtvOk8o-rWgyE4sdRqNdHobbj4xt1DGaU5zfPnLHmKJpovsvhVLPdYOreE0npxVAwRrmWBlCXsWHir2TU6wbbr4GFOVq-7HRzcIaV4671eLK6k1a0_YPC-RmQD_mhLgV0LuyRe0-SnR8nyvPFC5wlAti5gBvkfAwMU6PWf-KN7_HrjZeQ00LaFPf5phoCNtyENvg-pkneU3VEAoih-pTQBk3g5bLJ2qtqHcepbogq4VrXKQj7BwcSewxzyKY1BJ8O9PtUHRNUetrZe5cuoX1QsdNUtK3W6Hf_kFG0GWkgfWId0bSC4W1GD6CF9pFdzVX84iRrIBzGEhqzEzKZkaakXsDJNOWfD-Gp6WK3Xy_zL_NANeAbvfdMOfIQeV427vSYa9FxGvx5_uI5TDnhmkCXsX2fzhPKlE-bTgRx4l3pBMsy5X2ljzlUsRuyIhNZm33rEhhiSmpFnfDnPuWX6LNNBF3tDFxtRF0f__Em8FUTnBum83pBkP5_tNW61p8elrBWrUfOSXjnYlBSdBzXC8egs1jT0algYBb6vbEh_VPos8R1ph5XrPciJqeR31K3EtDb-3Us1v8mEm_67Zu2lJyIH-H9sga95av64qVhSFLl4xTRcPDtuarPE0y9OnCHyTWxuwnOrr_wxAcTEt0iIHJlsl-vIyBq3d-ks8017Aol7kp7f1gqhGiN4Ovxu5X5A5BABjBAsdZ3Wr2EnPiLpYjfQDshI0qpjPNd1ABWAOJifqn_k0eWLHw0hzuiJ_ItC88tJrvmMtf3TUX708mZKapVM&cid=CAASEuRogXUqoI5xUZoI-rOFGFOIRA&rfl=1%2Chttps%253A%252F%252Fwww.obsev.com%252F%240

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1a8fb5132ef121109e2d42148fecb317790aad87594095d320d764578234b2be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24896
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3E0B 42 B
63 B 40ms
39ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B_q2lhjcEQYUUY5vypQmIbC_9VFceE7Go-QbbgqF8HzrZOXCI2dwZcac0mY4SIIiSI0iHLP3PeoTehSWEsgdlyYGvFY88LGxYWHsKYPThURsqGmOM

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210729/r20110914/client/ Frame 3E0B 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210729/r20110914/client/window_focus_fy2019.js

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:38:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 164
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 17 Aug 2021 18:38:56 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3E0B 124 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c430c267231b0171372bc7daa045e7293403f2744255796e9121c320760f191a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:40 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627903459924584"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38134
x-xss-protection: 0
expires: Tue, 03 Aug 2021 18:41:40 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210729/r20110914/client/ Frame 3E0B 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210729/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:38:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6204
x-xss-protection: 0
server: cafe
etag: 11055049251678278959
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 17 Aug 2021 18:38:35 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 70FB 640 B
366 B 17ms
16ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjs5s6jATAB&v=APEucNVPrWFdtGkDUVF8pT4JQBbPpjY4NQ4wNWgL5vSxql0lYWOaoZb7VVTRblQ3YrtXgDR2mj7RL8Yv6C3bqPenepvCp3Cy5Pk62wrXV53e-aenlr0BWPgWsRKjLgGfx4vJeYjpnWlxm8cx8u6gPpWZTmqdOgbDg5hEh3UEGALSJXiH3aSTyfs

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJfnugEQw7j0ARjs5s6jATAB&v=APEucNVPrWFdtGkDUVF8pT4JQBbPpjY4NQ4wNWgL5vSxql0lYWOaoZb7VVTRblQ3YrtXgDR2mj7RL8Yv6C3bqPenepvCp3Cy5Pk62wrXV53e-aenlr0BWPgWsRKjLgGfx4vJeYjpnWlxm8cx8u6gPpWZTmqdOgbDg5hEh3UEGALSJXiH3aSTyfs
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnlKuXSIR6pgYrcre4g6Q29ezSpdUJn3WUt3ONiZ_TYUjXRxd5m4MKe5TrKxgM
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 03 Aug 2021 18:41:40 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6C05 25 KB
13 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D2T6-eF4lqVgXx7TgxF3xtGVnX0OiX6WPwu8WG9xcGXastvYKdHQHsd7Gu81nDzFBWspYtXfvX4plI3QDJb2Zrquy_2bkmI0HRMoNIJNKvHbghkuuVd0dBMbszM5kHUSBlsDLcu-8e-YPxSN2EzhGSlViFhQ&cry=1&dbm_d=AKAmf-Cp-MywIPph17hztYe-GikRSI3ujLYTEXjBSAc9ZDibYQIL65oz6XhwqST3L-dQQWYqOYRIKMqWshtXhSsqlofepIWOA_USKLegfWME6O9hSucIvNTrppiyQW-qsBv1PJMZ61GgS0yvgTocjAT6GMdl8sFkQmRQJa8gGeRbuFXLEnzWoUZhmyC64gcqgc2f3ZORcXRpmytBFvLHjHBIrV7v5Luo_VEWl5D5tI5Gr8C14s45sPVapDWFBGBe1PZjEQawIiKO9xWYJCCpcPV7CAn49-7bmsoBWEztoP3X-jII_75u0oNhoYDWYwaGnR_o30RgC0EOSDIigMmJ4qSnTjSge06IYaD1ESWJaia0sTZIm31k81tU8_d2T3UpZ7sHYLP39TA0bUGfCYMIf88h3jjol1CcYIYILX3Ut6QwV8Utwnj6snlRZVIhCTGu9TZbFJkWZWaR-sxTuBcCgWkzPHtrX913xKISjQtQaC2lYb_d-4bjPS6XQWwX95wyK7uMjdTCVgOTAW5xWAQWdTr6P15cOukbKp_kB618YV-neOQ8b7svzqr6O60hchOne_k3Ew6nLZMsKTaySGLBcUYPwvxny1AvIVLpkz1SWA81kxi04JhJtZr1-y_jzZF14i44mQP-BQK5nhs18pY8K6gZRtg3wB6jQq8M_dWM3VrTRL2c0d1Rr5cRrQrkrQH-182lJ8eUbTPuONVAmJ_o8nIQQ6Im80iH3l4eaPMFURmbkDv9g9aHdP7vpqsDmMb5QwSJfih5ywc7LwH2z7g7SRjEYkATZ7L6AQ08qkK91ne-MmgD_2u6C-8d4wtJWJqe-xOLltr_s4OVwr4-h_NgOJouxwYqbyhfye5i6M6AcW-JqETdyvAUWddACJ5IJawmorCp1a8VZYWvs0No_2teXt8lIQIAjwc5vUKvZfNufBvbvV6Qc7A5wvGKk4kwsucOTrSIuDTHlZh4L_2PKOgM0eyeciW5mqj6YjsiLnu-HNqlBat1gEd47B4xUTq5qa3AepJ0Ton_vBpOp0SpIl0NtHQnUH18qu6dp5L-IQiji1ykFhbENfnYSt_sTD4a3uJ0ActWqU2Pku0k3wJtwj0sDFUhPnsPMP4cOIRaI4FTzvQ999gqXbQs01W_eBaeWKbERdHI7rlmqe-gE14w1Icsv4ldzWcoRj8iPhwnM7cyCGgjDCqfo8Cg5PG1bmMz2pPYel_EgkG2NAhfnJIibVEn2dYW-Xrnlr6asdcJwo2Uy3K8YVtKebB6099O0eMfzD3zJTWXmFXH4gu4cNEmdoNzxVUVY8k8GUaaxZ8_ZN0zCa7_nFDp_YYM96D2G9AKB29fTFcDLaVxC6A9yOUc_BfQb8VW2JQbaLnmSx5urti2IoS1WNMqyc1JZ-VROKXQyCby73s9Bsr6Ll4XbtNxKLzn742IEyHnHdIlU-Bl3VrjwKUc9LTzTkPK40YIeb9NAkfOqkH3RQXwUEOF3Y9NWkK8w4JwkjIj920CBwoXn-dcdq9scTLZ5l5nTNpQ0PJVfC_bVbGDFFlrrCCOFRv5pg8mF2M8thY6mPhdr0_yUrU1J1EkTXTLWJjPi8bZ_q1LCn48CqRUNsQywEmT6d_3xq_hko159Tu4W38fgsDQ2GD4BAfFp9MmYoDyPyMjiIU7JIihD-Q_U-1ADpLVzh8thT3OcfWmMw_PZmFarpf1WMeEcbC5mPMJTwDHmdQxXUUdogswAnG1_7p3-ygWbcGT-zyvnMLaqXuZgPR8xx93j6JwMBBeOWTly4EHA8i0DUu2gP11vvrMpaw7IcUTxeL8C1ZUnevNpsqqnpg2QG_RgnkYH_KY8IlHbc8kzNSwGMOJxlc2ASPeCF2MYFHjGUqsLj2H4V7cvUcqfvHvYtSEvDRK_VN7Cn3cRfGQHbhVp5he6bXwIQJdjD_IfHJz2gAIWCwbzz9RmziEob7-WR4GbSVlwj0tJwwEbuUxNEtkjAnPkeAxsCPsJZcLo-ypqfvqEKiYQB7gXVbzN0ItVsQcyiMi4k2Wh93XpwefzLuTeQdbOxgSsOuk2W32CSBK5HnhVZgeVPSpZJgs1SqvV_jnm8j5KBFtjC6SwYO_XeQQK4Wzq5tC2N55lgwuyi5EXfvvdS9wd1P5KGpf-6NytJMHKaAmMa-W5G0vgyS4sd180jOymYmnhFpqwQvfMZDtRMFarZDPu1047NKTxWH57k5ZWNKruEEAvpcORwhtdoiUyNSzSbyJRgkPNOW66jfHVWtNHXbaihKf4hgJ_hvZfmCzH_kUIRkbn3L6o_klY1OwlsjBh8OBsKq_vNMy_0Mrr1J4xjDwOqsLf44wZPebN7rbeAmONTAx-EUhNBpPT8kCSc3U269Ofe1RIQkitPaUk5IXpF0cl1-WGvj8ZuoXjZ7oprbMm5zDz5uvs5Od1UeCZvNmUL7thUekxKoizHrHCpEHXE9wZyagGB_rBHFkwEP27x1GzbyDQkLi8GRCKvSzOK4sH0tfhkazwViHrvZFyrl-G7jF3SAElXPSg9ekrogVh1vKso7KPXY4SwCOdJeXMXICIBF1ItqzJLiISMLS-9N9AFBEJud2t0axQyZtf6gOuwNog6mvYOR4PQ_F8d6_ihlBwbGBb_z78lG9IgBqSq_zeUaFacpHNZ8xii1tHp5iEhKx--3O7UNXWyrb2Jvz3Sc3MoZS1Yq7qfMTJwnmdR1Multi6CAap7HUa-lxgOVeQSyRvvTbt0BCV1-zLEqdLGPePVqP7uBtEQV7ChNuCJC9DCkPIzYtD1pJRycGioQtNc3c_W8QPOKTjf-LaV_8Q-aZrdfDm5CDISsewPf2vx6zQgdUH0caPByL5yDyGVdPfLbk_ieaek5Dbc0xaaBxSmZiL6QsqhxmZy-oRrMqU4EVDab-bpBVZ9y4e6sF7zGGD67vSXteMW7C-F3qXWyEIoGNpEz45NFrbQNxpfB3XOt_ZF21N1e1SL_0nE9V8GfoBBqPA5fPvTZ6L5eV87etbWyb3ytZhAqGuzznOCKBnArZJHAVF2TtHkh_7hNXknyO0RDQTl58VpFUcYApKtn3HlYH4NcaDGpTKqrxi-s7eWaTDbuOPx2dZzpTU3eciU1fSckdnRU7PMkyYxSGwiffWjafSQtBT6xAqThag_2jNwiZevUK-vp64YjCgni94R0eSRHGq-QGYN90YcIHYk_O4YIDmXs1gyWY-wTVlzEmng0ATE7AaSrqBI2w3sDniwRR8_PS3ZUgAhJZMYJqIJX2cn1Jo0D8bf9Vsjq_feBf&cid=CAASEuRoDUSEjgwLBZCUaJKz58TpHA&rfl=1%2Chttps%253A%252F%252Fwww.obsev.com%252F%240

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36501a9fdcb0d5ba80dee41f384b2516d5a0441fde248c3c27028ba94ea3cf61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13204
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6C05 42 B
63 B 41ms
40ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CT_IcIOOPzEZghRaHYcR_YcGzIFhuY3AOWWpLw84y2QRc_RWPIso_GdQWP4ZpabJEYHN9jlCvcjeMtoVBCwko9zstcN-yrtu9HzCGO3f8o0k9ilpA

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame 6C05 2 KB
2 KB 23ms
7ms Script
application/javascript 2a02:26f0:6c00:2b2::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=115750&plc=4891039&sid=18330&dvregion=0&unit=300x250&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&prr=1&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0j6AFk9eCQMllMj-guEsdkb&DVP_DBM_1=3060631&DVP_DBM_2=15755259&DVP_DBM_3=42380503&DVP_DBM_4=343126892&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=123477524927&turl=https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/&DVP_PP_BUNDLE_ID=
Requested by: Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2b2::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 4c5e0f59ec7c19362841c9028d45df75db9bb27854aff4cb0e780169fc24b8ae

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 03 Aug 2021 18:41:40 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Jul 2021 12:01:56 GMT
Server: Microsoft-IIS/10.0
ETag: "795741877184d71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 1338

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 6C05 7 KB
4 KB 23ms
7ms Script
application/javascript 2a02:26f0:6c00:2b2::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&advid=3398311&adsrv=0&btreg=&btadsrv=&tagtype=&dvtagver=6.1.src&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVPX_PP_IMP_ID=ABAjH0j6AFk9eCQMllMj-guEsdkb&DVP_DBM_1=3060631&DVP_DBM_2=15755259&DVP_DBM_3=42380503&DVP_DBM_4=343126892&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=123477524927&turl=https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/&DVP_PP_BUNDLE_ID=
Requested by: Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2b2::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 1151aff3999cb1d2a772cbcea84542dabf406babb47c1f7377a5c0ecde94264f

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 03 Aug 2021 18:41:40 GMT
Content-Encoding: gzip
Last-Modified: Tue, 03 Aug 2021 09:39:25 GMT
Server: Microsoft-IIS/10.0
ETag: "53a472724b88d71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3757

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210729/r20110914/client/ Frame 6C05 2 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210729/r20110914/client/window_focus_fy2019.js

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:38:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 164
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 17 Aug 2021 18:38:56 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6C05 124 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c430c267231b0171372bc7daa045e7293403f2744255796e9121c320760f191a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:40 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627903459924584"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38134
x-xss-protection: 0
expires: Tue, 03 Aug 2021 18:41:40 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210729/r20110914/client/ Frame 6C05 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210729/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:38:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6204
x-xss-protection: 0
server: cafe
etag: 11055049251678278959
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 17 Aug 2021 18:38:35 GMT

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9898 640 B
316 B 26ms
24ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLWwChCYzpoBGJmMjqwBMAE&v=APEucNW2OuuaLDOHZhf5SYkIcrGM28n7PDH2idHFoZaH314lTdDrdbAC-sarYD1tOFfbmXbyUDYP3duFqQQ0PzovnzmHJo5KjLH6Y7SrmjjCy5qxc_Xs3rNZhG9srnikH3WT5qJSjLdN9RVITPO70uz3XZ7EluMeyX1UeYPHnHYL79X9izdOBDU

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CLWwChCYzpoBGJmMjqwBMAE&v=APEucNW2OuuaLDOHZhf5SYkIcrGM28n7PDH2idHFoZaH314lTdDrdbAC-sarYD1tOFfbmXbyUDYP3duFqQQ0PzovnzmHJo5KjLH6Y7SrmjjCy5qxc_Xs3rNZhG9srnikH3WT5qJSjLdN9RVITPO70uz3XZ7EluMeyX1UeYPHnHYL79X9izdOBDU
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnlKuXSIR6pgYrcre4g6Q29ezSpdUJn3WUt3ONiZ_TYUjXRxd5m4MKe5TrKxgM
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 03 Aug 2021 18:41:40 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E309 59 KB
24 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DiFk8sfr_kKlobyfZpWIzYL3FOq3C73b6MsvkTWk7wd0vKUh75goD9Rxl7lzif6H5JEHs0sU8kpxrbXrXKnp8C9CELFnVnLiYLUaW51saTRBTKP6ln-qkEEX3JoIrN4etaS7jMmrtWOZLpUVY0zyc9XN88IQ&dbm_d=AKAmf-DLJKHf5lZ84DSWzxWMSPsmVHCklrWwbbo8wLjVGwdVGubPYblwxuaiH_ljvjsarEjmIs3Hcgnu53iBnAgkOvnmJdgxzbjjKO26WOaWvofEjbMHppZdB6Tn7YSWZuIPEVyNS2rCFMJ209Jlt87jleoF_RhCn2Nmub3Y-mie6yx-MYcI6XXU6BCjJ3NlcGMuk0zfqoFvcvbaygOzzgLBrctmmvaSJNV0kQy-bjhjWmFWuEL7o8VL10m6_mR7R0ziQLn1yygTwH_YlgkOwIJHjlJVON50yqqzPGD4-Tpy6DYGxiJFkCYgvRPHhQUXSdGV3_DDf-Z3WjCW7OcWU1n5STjI1Ue9_QTW1c4njmT3-lESuz7QfV43LDrKGCW9vRaMpnDG5heYMwdBlLelQdgve3d14vGMiSSI8QBXQddCSKPl8HhHxMhAyHapspjhkslUzsGX3lFtrB0AQw54CYSgma64_XknRN8W-Pb_oUKzX50yf__zqc9k7CUyDwzEqfdfUu9serFe9EyZjFQ8vbs8g6hH7N_hQzx9gXAqL0bevkC_xIS-1OmtmVcW2FxALPSi4FfNDII7oJRq9KltCgTzmc7AMpbPEiFkmKRmgGOT0A4YmO_CP6itmhjjVuuKyaHxgwbBkxg_diWWXmEUG5f9cnU2pFsHj1IdLpwpdMaSSnZIqY8B-dPaRS-BhQlajPmfBmU3A-tBwOYhWJ9M566DqRbgrm_KloTx5qKEO5Vqyprsy2rw3tmrws3bxdwGaccP1TLojYMLyA7fO45xCdlPCLemKd9BvkUfBb-Yt1RpwbKiXcbLUExnBqyv6dQdLSF4X0e2OiyQkLZgAQ3jypboGeAHEOhTCZaQVFrwKfhT6muFNYr0J_XcDGhq0Xc37H2hsvIFo3FGxv-GDwrRAME_RO8UmloHPOd-HQnRtu_bv7DYz0wsMMX4oeOMhFrbhg-uZPD2ETpKJ-ugYfVH3VE9jkQc5GM1IM1c7M_5I5LVhZXDfELwr_37oHlFRzw7KwBOhpQTATw_OcV1SHO0Yw_whDcrth-mUuSupVEUoyVymfesgTr-Wzdw6kbPpKNT0c6qvweINWguxfbMp47t4DPVYQEAKYr_FKeiMs89xPpvIjdqop_vVVDDiXBAezM5SUUY-uGe_p7ttqQU9RNK9pN7HoOSKET49To-gIuAOegl_dDU2TIYcsjPsS0N1nalyteBHxWcG37zc3eqowAVdImWMat8ZiJ3ES7PYxBZvnIzPcPjwFPzSMNvpdeYCk4Plj6Xb033GcauGjHyxEsaJeZ8LPyLaiCnL03k-Fo_N99SqPrREiazzN7pcqHBKLlSXvBJUNeAoUYcD_DlGiqpESaSOAtlkwZQtsOTotT8oeEvNCAipuQPbfIiYYIFhwBL9-ASCavMhaNAACJaK1twYqVTDmqSmaIIDwBpSSRK2q1C0tB0D49qWfTgnRBpsDEj0EKYtp5qCJsY7N0Wf4XKcm7RGReHgrKrf7Ksrfazj5YkZPGGdK0JIkB3FAoBeWIhS-gAgoZehRkOfNQC1H1xoRm2kVejwc452PVX0Se0XDlYrYV0aVlU8pk0WfFfTCigXYnad4UaeANqfck5lFe6g3Dtk5GkgY2KCXHo38rvZHWth-fGKlwezpg0NQViozHDyoHXh5wta0AOoSmcjFmw6ylo8KdPJgFBkuzVUb-CvCFJtF4dkJeUx4tOt205NJOMyPTRT9CgMX6I98ZA1JTeG1JxK7wskv84VIF_7gCfZGrzfurJmbW62V2-pSdp2jVcisQMK_qoAKR2q9XkcNebfo-r3_Ru7EknREpeRxz5X7Mj4dKSXvt9ToLDndSHihNOdgz2b3S3EH0j7Gt8c0s5fz5pOmY2Lqa1mgMCEwdBplMgObJcXBtxEZT2HQn3W0wjBH5ILq7goNeEzxhydv1UZPNHal4F1ssbCMd5qTGAW3go_1OXu9nOJIeXrmzqanUVcEPFJ_YdZkA9SVT1r__WbNtPZ3MnfLBqoHytyZEtEelKZHf6djPM2bODwtVQQAzwzTXlaD-9ER7JsCJRGYUSxdj3B5iC2weMHAH5w5hVz5vbhWKR8bU3Pr9mU-Z1410r2QYPkSYyvjfcAtWMRnFVeaIXxyTaaCZ59GwGDsk9E8a1bXOBZRYJFp7FYlxZ5bR6JqgmAZF0fcjKpR7hDFdEbexwi0XeJxJeRCyTZ0qyK3NNbv_LTEIgoG5ie_KQzrfxU20NSZVbTo6CQHMhtDaGIWe1gPPEHdilHOppYlg3jslVeuk-8spl1r3k4-pq7pM-rzcS4TlIWtAkbrhyYaRBiVG4dZjhks7gtRqW3xGOyqf1VWXgRv96_ud_aEahIO4NpXTgTWOHgU8ns1n7HLWnpwRtoCePg0O5r1K3VM4WLtMu3gzueeeaa1ID8Q4_XZRUlaTEne02p1gAnNA_TCuUbmc2ep0Tdg-tHizALuROYoUWNsktJwPmNtRz8bROt18JFuOEiG5ODRIuK0-TBOk2MpjrVtg5WbKG_ekpshtyf_4-gALdlFnz_xCHAFuolIpcG_YjaFsiuKmP6C2XW9r-HqrBEghj5EBs9liBhihx3ffLeuywFpeLFky3J9c43HwHixEk8IZVpcUrOQA7-xTmxA5r5lAoSXQhps_689q7Z3SU2HNqwUyYLkH1BW1f5dpbx2ZseXqkLEH8i6RCD2cZsgAkXaFIBT_L9Uy3tRTabsQ6aqApmTt5Wo-YwoUqZRioAK0kiyOXr48SxWyi7cmYM_3UXyOg-8OgS9z2hpoSEYYz4oz-0HpIFZEPrUgHQHXD1KIJG6KJdMIlKokCgnE4fB-ihzxxrU3u_wJkxjOsLc-RzeY3jMeP9IlMFQGyb331nZxZD_rVOGuA5Us0ZS9GBGBfmIqRypmn0ZTzAFtF7AKJQlPrKM_aFXGo6zBvcWxiOge_gVnUbfdDXvpjk0zUs-cwk5dZJvIDdNd5zT86xA4sbrO1xpuDoAZd3_zOdfJWsn2QDE0kIOg6bOhjCJeDm6DuC7dK114yNFNVEBTk_6ECK_Dqb54cslCWY9pEHlmx2tS8T5lzhbLJtBoQU8Hpxi23AD-A3Pq9eMIyydu0TdYqKhwKjmdCJbmRJ-wXpS9dHLZgBn61ioAryojruNGgvNualI0QyuA6JcKuCD7X89dVhCy_3jvx6fTtPakMmSb3Bf6NYzMyWPdcdWz4jsRmB_xiQDsBibKKFJ9P3KySlGPmPnlRQRzGZaLvMQ3LyZIgpswjAtb94SPynx1WbjTtvwKkCEp35BYK5BtJ8g9ApICkJsjLwihPilFdHEb5U3Cd7cUKLolTPsaPXENTfrAky_T3AxM0cajNRXKfcfDnpSyNlz9k8bDyWt3anlDJLjtDX5hXVDHTjAjv9HuETlsyw12bJABRnhHkk4peS41pRTXCy_MBBBwYywA&cid=CAASEuRoHOcpiQSs1Bh2E55jdewiBg&rfl=1%2Chttps%253A%252F%252Fwww.obsev.com%252F%240

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3bd1f7cae5f5155e3438fe19bb03fd4324ee440cea00b7039721bc162c32831

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24886
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E309 42 B
63 B 39ms
39ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AWC7y5UeMrM8oQ2boyJr3cuJs2pTclSwk-n6d__vblnIat4TRw3cVn_4zj-0UZ6ZZpHItQ9fnrfkGHtGTgRvsQZCFyJWmG7sexR8btKY4SFLA6IgQ

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210729/r20110914/client/ Frame E309 2 KB
1 KB 11ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210729/r20110914/client/window_focus_fy2019.js

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:38:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 164
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 17 Aug 2021 18:38:56 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E309 124 KB
37 KB 17ms
14ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c430c267231b0171372bc7daa045e7293403f2744255796e9121c320760f191a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:40 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627903459924584"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38134
x-xss-protection: 0
expires: Tue, 03 Aug 2021 18:41:40 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210729/r20110914/client/ Frame E309 14 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210729/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:38:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6204
x-xss-protection: 0
server: cafe
etag: 11055049251678278959
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 17 Aug 2021 18:38:35 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame E309 0
0 15ms
13ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQG5auPvQBDwWbnx5hq-gC3qOMZYSFu-5QR6z2jcSZBKvE4e8jdmOvgoupdwEIEgj_0mas1de96jyMZbeOQx9ZwzNAXVw
Requested by: Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 5FAD 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Tue, 03 Aug 2021 17:25:58 GMT
expires: Wed, 03 Aug 2022 17:25:58 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 4542
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 6389 783 B
534 B 16ms
16ms Document
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

2180d646ca46b184ba0254276f4d19153ed0a6573c0894247ecce6335d741341

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-2s2KrRm0xsCmpNva0TKM3A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: _GRECAPTCHA=09ADKZGYqVqFAkbKCa6BMyIAk-uxcthDvwEKRo4ujSaRZuZ9cMz0XplzE0pkYE0u30SuawHP_142PQa0IlTWq0s1k
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

expires: Tue, 03 Aug 2021 18:41:40 GMT
date: Tue, 03 Aug 2021 18:41:40 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-2s2KrRm0xsCmpNva0TKM3A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame 3E0B 169 KB
59 KB 25ms
6ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 14:30:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15094
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59842
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:49 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 04 Aug 2021 14:30:06 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210729/r20110914/elements/html/ Frame 3E0B 8 KB
3 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210729/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:32:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 547
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 17 Aug 2021 18:32:33 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210729/r20110914/ Frame 3E0B 24 KB
9 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210729/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1e2ce44b575d26f6d5dcf0c354810831f84415656813f7e0a9d4112904635c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9340
x-xss-protection: 0
server: cafe
etag: 2602534973733678128
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 17 Aug 2021 18:41:33 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210729/r20110914/ Frame 6C05 24 KB
9 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210729/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D2T6-eF4lqVgXx7TgxF3xtGVnX0OiX6WPwu8WG9xcGXastvYKdHQHsd7Gu81nDzFBWspYtXfvX4plI3QDJb2Zrquy_2bkmI0HRMoNIJNKvHbghkuuVd0dBMbszM5kHUSBlsDLcu-8e-YPxSN2EzhGSlViFhQ&cry=1&dbm_d=AKAmf-Cp-MywIPph17hztYe-GikRSI3ujLYTEXjBSAc9ZDibYQIL65oz6XhwqST3L-dQQWYqOYRIKMqWshtXhSsqlofepIWOA_USKLegfWME6O9hSucIvNTrppiyQW-qsBv1PJMZ61GgS0yvgTocjAT6GMdl8sFkQmRQJa8gGeRbuFXLEnzWoUZhmyC64gcqgc2f3ZORcXRpmytBFvLHjHBIrV7v5Luo_VEWl5D5tI5Gr8C14s45sPVapDWFBGBe1PZjEQawIiKO9xWYJCCpcPV7CAn49-7bmsoBWEztoP3X-jII_75u0oNhoYDWYwaGnR_o30RgC0EOSDIigMmJ4qSnTjSge06IYaD1ESWJaia0sTZIm31k81tU8_d2T3UpZ7sHYLP39TA0bUGfCYMIf88h3jjol1CcYIYILX3Ut6QwV8Utwnj6snlRZVIhCTGu9TZbFJkWZWaR-sxTuBcCgWkzPHtrX913xKISjQtQaC2lYb_d-4bjPS6XQWwX95wyK7uMjdTCVgOTAW5xWAQWdTr6P15cOukbKp_kB618YV-neOQ8b7svzqr6O60hchOne_k3Ew6nLZMsKTaySGLBcUYPwvxny1AvIVLpkz1SWA81kxi04JhJtZr1-y_jzZF14i44mQP-BQK5nhs18pY8K6gZRtg3wB6jQq8M_dWM3VrTRL2c0d1Rr5cRrQrkrQH-182lJ8eUbTPuONVAmJ_o8nIQQ6Im80iH3l4eaPMFURmbkDv9g9aHdP7vpqsDmMb5QwSJfih5ywc7LwH2z7g7SRjEYkATZ7L6AQ08qkK91ne-MmgD_2u6C-8d4wtJWJqe-xOLltr_s4OVwr4-h_NgOJouxwYqbyhfye5i6M6AcW-JqETdyvAUWddACJ5IJawmorCp1a8VZYWvs0No_2teXt8lIQIAjwc5vUKvZfNufBvbvV6Qc7A5wvGKk4kwsucOTrSIuDTHlZh4L_2PKOgM0eyeciW5mqj6YjsiLnu-HNqlBat1gEd47B4xUTq5qa3AepJ0Ton_vBpOp0SpIl0NtHQnUH18qu6dp5L-IQiji1ykFhbENfnYSt_sTD4a3uJ0ActWqU2Pku0k3wJtwj0sDFUhPnsPMP4cOIRaI4FTzvQ999gqXbQs01W_eBaeWKbERdHI7rlmqe-gE14w1Icsv4ldzWcoRj8iPhwnM7cyCGgjDCqfo8Cg5PG1bmMz2pPYel_EgkG2NAhfnJIibVEn2dYW-Xrnlr6asdcJwo2Uy3K8YVtKebB6099O0eMfzD3zJTWXmFXH4gu4cNEmdoNzxVUVY8k8GUaaxZ8_ZN0zCa7_nFDp_YYM96D2G9AKB29fTFcDLaVxC6A9yOUc_BfQb8VW2JQbaLnmSx5urti2IoS1WNMqyc1JZ-VROKXQyCby73s9Bsr6Ll4XbtNxKLzn742IEyHnHdIlU-Bl3VrjwKUc9LTzTkPK40YIeb9NAkfOqkH3RQXwUEOF3Y9NWkK8w4JwkjIj920CBwoXn-dcdq9scTLZ5l5nTNpQ0PJVfC_bVbGDFFlrrCCOFRv5pg8mF2M8thY6mPhdr0_yUrU1J1EkTXTLWJjPi8bZ_q1LCn48CqRUNsQywEmT6d_3xq_hko159Tu4W38fgsDQ2GD4BAfFp9MmYoDyPyMjiIU7JIihD-Q_U-1ADpLVzh8thT3OcfWmMw_PZmFarpf1WMeEcbC5mPMJTwDHmdQxXUUdogswAnG1_7p3-ygWbcGT-zyvnMLaqXuZgPR8xx93j6JwMBBeOWTly4EHA8i0DUu2gP11vvrMpaw7IcUTxeL8C1ZUnevNpsqqnpg2QG_RgnkYH_KY8IlHbc8kzNSwGMOJxlc2ASPeCF2MYFHjGUqsLj2H4V7cvUcqfvHvYtSEvDRK_VN7Cn3cRfGQHbhVp5he6bXwIQJdjD_IfHJz2gAIWCwbzz9RmziEob7-WR4GbSVlwj0tJwwEbuUxNEtkjAnPkeAxsCPsJZcLo-ypqfvqEKiYQB7gXVbzN0ItVsQcyiMi4k2Wh93XpwefzLuTeQdbOxgSsOuk2W32CSBK5HnhVZgeVPSpZJgs1SqvV_jnm8j5KBFtjC6SwYO_XeQQK4Wzq5tC2N55lgwuyi5EXfvvdS9wd1P5KGpf-6NytJMHKaAmMa-W5G0vgyS4sd180jOymYmnhFpqwQvfMZDtRMFarZDPu1047NKTxWH57k5ZWNKruEEAvpcORwhtdoiUyNSzSbyJRgkPNOW66jfHVWtNHXbaihKf4hgJ_hvZfmCzH_kUIRkbn3L6o_klY1OwlsjBh8OBsKq_vNMy_0Mrr1J4xjDwOqsLf44wZPebN7rbeAmONTAx-EUhNBpPT8kCSc3U269Ofe1RIQkitPaUk5IXpF0cl1-WGvj8ZuoXjZ7oprbMm5zDz5uvs5Od1UeCZvNmUL7thUekxKoizHrHCpEHXE9wZyagGB_rBHFkwEP27x1GzbyDQkLi8GRCKvSzOK4sH0tfhkazwViHrvZFyrl-G7jF3SAElXPSg9ekrogVh1vKso7KPXY4SwCOdJeXMXICIBF1ItqzJLiISMLS-9N9AFBEJud2t0axQyZtf6gOuwNog6mvYOR4PQ_F8d6_ihlBwbGBb_z78lG9IgBqSq_zeUaFacpHNZ8xii1tHp5iEhKx--3O7UNXWyrb2Jvz3Sc3MoZS1Yq7qfMTJwnmdR1Multi6CAap7HUa-lxgOVeQSyRvvTbt0BCV1-zLEqdLGPePVqP7uBtEQV7ChNuCJC9DCkPIzYtD1pJRycGioQtNc3c_W8QPOKTjf-LaV_8Q-aZrdfDm5CDISsewPf2vx6zQgdUH0caPByL5yDyGVdPfLbk_ieaek5Dbc0xaaBxSmZiL6QsqhxmZy-oRrMqU4EVDab-bpBVZ9y4e6sF7zGGD67vSXteMW7C-F3qXWyEIoGNpEz45NFrbQNxpfB3XOt_ZF21N1e1SL_0nE9V8GfoBBqPA5fPvTZ6L5eV87etbWyb3ytZhAqGuzznOCKBnArZJHAVF2TtHkh_7hNXknyO0RDQTl58VpFUcYApKtn3HlYH4NcaDGpTKqrxi-s7eWaTDbuOPx2dZzpTU3eciU1fSckdnRU7PMkyYxSGwiffWjafSQtBT6xAqThag_2jNwiZevUK-vp64YjCgni94R0eSRHGq-QGYN90YcIHYk_O4YIDmXs1gyWY-wTVlzEmng0ATE7AaSrqBI2w3sDniwRR8_PS3ZUgAhJZMYJqIJX2cn1Jo0D8bf9Vsjq_feBf&cid=CAASEuRoDUSEjgwLBZCUaJKz58TpHA&rfl=1%2Chttps%253A%252F%252Fwww.obsev.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1e2ce44b575d26f6d5dcf0c354810831f84415656813f7e0a9d4112904635c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9340
x-xss-protection: 0
server: cafe
etag: 2602534973733678128
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 17 Aug 2021 18:41:33 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 6C05 41 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 02 Aug 2021 06:32:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 130178
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 02 Aug 2022 06:32:02 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame FCB3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED1AyjAZ8D7M37W69NATYHc&google_cver=1

43 B
1014 B

43ms
43ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED1AyjAZ8D7M37W69NATYHc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIikNxCPxucCGLzD3LABMAE&v=APEucNWfmzwK3Ac_JlOVx7JASeMyA5qsio-NUCmNUg8tslF-dLKRQu1zRhdeL997-4uMwPouCP0dAT667ZlE31cPWqpf0oQuElp_7P6A3oK0hTD8Ym2-2D9jrUv2zmsre4MpWel2G54t58aRw1dNKO7dCJut7O9vU6JoDm1P05T13KTwLbzIhNI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:40 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 03 Aug 2021 18:41:40 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED1AyjAZ8D7M37W69NATYHc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame FCB3
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YQmN5Gle5E.WnHYopbgYgwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED1AyjAZ8D7M37W69NATYHc&google_cver=1&google_hm=2

43 B
894 B

70ms
69ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED1AyjAZ8D7M37W69NATYHc&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIikNxCPxucCGLzD3LABMAE&v=APEucNWfmzwK3Ac_JlOVx7JASeMyA5qsio-NUCmNUg8tslF-dLKRQu1zRhdeL997-4uMwPouCP0dAT667ZlE31cPWqpf0oQuElp_7P6A3oK0hTD8Ym2-2D9jrUv2zmsre4MpWel2G54t58aRw1dNKO7dCJut7O9vU6JoDm1P05T13KTwLbzIhNI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:40 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 03 Aug 2021 18:41:40 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED1AyjAZ8D7M37W69NATYHc&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame FCB3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESED58pxoqd-lWyzQkqZFJXxM&google_cver=1

43 B
1000 B

28ms
27ms

Image
image/gif

185.33.221.15
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESED58pxoqd-lWyzQkqZFJXxM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIikNxCPxucCGLzD3LABMAE&v=APEucNWfmzwK3Ac_JlOVx7JASeMyA5qsio-NUCmNUg8tslF-dLKRQu1zRhdeL997-4uMwPouCP0dAT667ZlE31cPWqpf0oQuElp_7P6A3oK0hTD8Ym2-2D9jrUv2zmsre4MpWel2G54t58aRw1dNKO7dCJut7O9vU6JoDm1P05T13KTwLbzIhNI

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.15 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:40 GMT
X-Proxy-Origin: 159.48.55.4; 159.48.55.4; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 8cda487d-afb6-4a92-a55f-3ff5af626d85
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESED58pxoqd-lWyzQkqZFJXxM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame FCB3
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDQ3MzQwMjU0Mjk4NTAxODA2OA%3D%3D

170 B
188 B

39ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDQ3MzQwMjU0Mjk4NTAxODA2OA%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:40 GMT
X-Proxy-Origin: 159.48.55.4; 159.48.55.4; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 8f4131de-240d-493c-a4d2-178027498c8c
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDQ3MzQwMjU0Mjk4NTAxODA2OA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 70FB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJ-XBOxXZO1FDcvOgo50ihY&google_cver=1

43 B
106 B

29ms
29ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJ-XBOxXZO1FDcvOgo50ihY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjs5s6jATAB&v=APEucNVPrWFdtGkDUVF8pT4JQBbPpjY4NQ4wNWgL5vSxql0lYWOaoZb7VVTRblQ3YrtXgDR2mj7RL8Yv6C3bqPenepvCp3Cy5Pk62wrXV53e-aenlr0BWPgWsRKjLgGfx4vJeYjpnWlxm8cx8u6gPpWZTmqdOgbDg5hEh3UEGALSJXiH3aSTyfs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.211.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
via: 1.1 google
server: OXGW/16.211.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJ-XBOxXZO1FDcvOgo50ihY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 70FB
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Y2VmMGUwZmQtZDJjZS02OTFiLTRjNzgtMjA4YTc0M2RkOGJj

170 B
188 B

39ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Y2VmMGUwZmQtZDJjZS02OTFiLTRjNzgtMjA4YTc0M2RkOGJj

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjs5s6jATAB&v=APEucNVPrWFdtGkDUVF8pT4JQBbPpjY4NQ4wNWgL5vSxql0lYWOaoZb7VVTRblQ3YrtXgDR2mj7RL8Yv6C3bqPenepvCp3Cy5Pk62wrXV53e-aenlr0BWPgWsRKjLgGfx4vJeYjpnWlxm8cx8u6gPpWZTmqdOgbDg5hEh3UEGALSJXiH3aSTyfs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 03 Aug 2021 18:41:40 GMT
content-encoding: gzip
server: OXGW/16.211.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Y2VmMGUwZmQtZDJjZS02OTFiLTRjNzgtMjA4YTc0M2RkOGJj
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame 70FB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESENEJBuVVPWdRfBvLDMPjISo&google_cver=1

23 B
172 B

59ms
59ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESENEJBuVVPWdRfBvLDMPjISo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjs5s6jATAB&v=APEucNVPrWFdtGkDUVF8pT4JQBbPpjY4NQ4wNWgL5vSxql0lYWOaoZb7VVTRblQ3YrtXgDR2mj7RL8Yv6C3bqPenepvCp3Cy5Pk62wrXV53e-aenlr0BWPgWsRKjLgGfx4vJeYjpnWlxm8cx8u6gPpWZTmqdOgbDg5hEh3UEGALSJXiH3aSTyfs
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
cache-control: max-age=0, no-cache, no-store
expires: Tue, 03 Aug 2021 18:41:40 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESENEJBuVVPWdRfBvLDMPjISo&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 70FB 23 B
172 B 125ms
56ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjs5s6jATAB&v=APEucNVPrWFdtGkDUVF8pT4JQBbPpjY4NQ4wNWgL5vSxql0lYWOaoZb7VVTRblQ3YrtXgDR2mj7RL8Yv6C3bqPenepvCp3Cy5Pk62wrXV53e-aenlr0BWPgWsRKjLgGfx4vJeYjpnWlxm8cx8u6gPpWZTmqdOgbDg5hEh3UEGALSJXiH3aSTyfs
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
cache-control: max-age=0, no-cache, no-store
expires: Tue, 03 Aug 2021 18:41:40 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

GET
H2 200 express_html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame E309 114 KB
39 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 10:46:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28535
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40185
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 04 Aug 2021 10:46:05 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210729/r20110914/elements/html/ Frame E309 8 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210729/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:32:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 547
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 17 Aug 2021 18:32:33 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210729/r20110914/ Frame E309 24 KB
9 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210729/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1e2ce44b575d26f6d5dcf0c354810831f84415656813f7e0a9d4112904635c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9340
x-xss-protection: 0
server: cafe
etag: 2602534973733678128
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 17 Aug 2021 18:41:33 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 9898
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJ-XBOxXZO1FDcvOgo50ihY&google_cver=1

43 B
106 B

28ms
28ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJ-XBOxXZO1FDcvOgo50ihY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLWwChCYzpoBGJmMjqwBMAE&v=APEucNW2OuuaLDOHZhf5SYkIcrGM28n7PDH2idHFoZaH314lTdDrdbAC-sarYD1tOFfbmXbyUDYP3duFqQQ0PzovnzmHJo5KjLH6Y7SrmjjCy5qxc_Xs3rNZhG9srnikH3WT5qJSjLdN9RVITPO70uz3XZ7EluMeyX1UeYPHnHYL79X9izdOBDU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.211.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
via: 1.1 google
server: OXGW/16.211.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJ-XBOxXZO1FDcvOgo50ihY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 9898
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Y2VmMGUwZmQtZDJjZS02OTFiLTRjNzgtMjA4YTc0M2RkOGJj

170 B
188 B

39ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Y2VmMGUwZmQtZDJjZS02OTFiLTRjNzgtMjA4YTc0M2RkOGJj

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLWwChCYzpoBGJmMjqwBMAE&v=APEucNW2OuuaLDOHZhf5SYkIcrGM28n7PDH2idHFoZaH314lTdDrdbAC-sarYD1tOFfbmXbyUDYP3duFqQQ0PzovnzmHJo5KjLH6Y7SrmjjCy5qxc_Xs3rNZhG9srnikH3WT5qJSjLdN9RVITPO70uz3XZ7EluMeyX1UeYPHnHYL79X9izdOBDU

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 03 Aug 2021 18:41:40 GMT
content-encoding: gzip
server: OXGW/16.211.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Y2VmMGUwZmQtZDJjZS02OTFiLTRjNzgtMjA4YTc0M2RkOGJj
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame 9898
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESENEJBuVVPWdRfBvLDMPjISo&google_cver=1

23 B
172 B

57ms
57ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESENEJBuVVPWdRfBvLDMPjISo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLWwChCYzpoBGJmMjqwBMAE&v=APEucNW2OuuaLDOHZhf5SYkIcrGM28n7PDH2idHFoZaH314lTdDrdbAC-sarYD1tOFfbmXbyUDYP3duFqQQ0PzovnzmHJo5KjLH6Y7SrmjjCy5qxc_Xs3rNZhG9srnikH3WT5qJSjLdN9RVITPO70uz3XZ7EluMeyX1UeYPHnHYL79X9izdOBDU
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
cache-control: max-age=0, no-cache, no-store
expires: Tue, 03 Aug 2021 18:41:40 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESENEJBuVVPWdRfBvLDMPjISo&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 9898 23 B
172 B 111ms
57ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLWwChCYzpoBGJmMjqwBMAE&v=APEucNW2OuuaLDOHZhf5SYkIcrGM28n7PDH2idHFoZaH314lTdDrdbAC-sarYD1tOFfbmXbyUDYP3duFqQQ0PzovnzmHJo5KjLH6Y7SrmjjCy5qxc_Xs3rNZhG9srnikH3WT5qJSjLdN9RVITPO70uz3XZ7EluMeyX1UeYPHnHYL79X9izdOBDU
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
cache-control: max-age=0, no-cache, no-store
expires: Tue, 03 Aug 2021 18:41:40 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 2CB8 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 02 Aug 2021 06:32:03 GMT
expires: Tue, 02 Aug 2022 06:32:03 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 130177
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 3E0B 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 02 Aug 2021 06:32:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 130178
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 02 Aug 2022 06:32:02 GMT

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6B04 1 KB
749 B 7ms
6ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 03 Aug 2021 11:56:19 GMT
expires: Wed, 04 Aug 2021 11:56:19 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 24321
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 3E0B 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 564c10795890e86c10dc8b272b33ca11ccca5763770f2429580875ad8e6fe920

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK dvbs_src_internal98.js Show response
cdn.doubleverify.com/ Frame 6C05 61 KB
19 KB 7ms
7ms Script
application/javascript 2a02:26f0:6c00:2b2::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal98.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=115750&plc=4891039&sid=18330&dvregion=0&unit=300x250&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&prr=1&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0j6AFk9eCQMllMj-guEsdkb&DVP_DBM_1=3060631&DVP_DBM_2=15755259&DVP_DBM_3=42380503&DVP_DBM_4=343126892&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=123477524927&turl=https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/&DVP_PP_BUNDLE_ID=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2b2::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: d1f01effb3a1e20c0b51bb304bcf9db1778e4e814832d5fb21032e808a39f5fd

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 03 Aug 2021 18:41:40 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Jul 2021 12:02:15 GMT
Server: Microsoft-IIS/10.0
ETag: "807d37927184d71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19242

GET
H3-29 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/ Frame 62F5 3 KB
914 B 29ms
15ms Document
text/html 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b1d09718613cb4ee4c55f71f96cab9ba08c3735eff37ecc7bb1b894929972e5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 889
date: Tue, 03 Aug 2021 18:41:40 GMT
expires: Wed, 04 Aug 2021 18:41:40 GMT
cache-control: public, max-age=86400
last-modified: Mon, 26 Jul 2021 09:58:42 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3E0B 0
592 B 140ms
75ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstRlQCDyacDYiSIXBnW3-qcspPPW4ICrucL0_hVVhrEP4nOmsttbqOq35wzXBYzjgJYlRw_RzSuYCyysUye-DYME4-baflWmY_I-ww-Uj0v8R4Ni5YUQfs887UN7ThnC2yx2tKISyk3ECYR5QcJ2pVHZNymbfG0V9JX4sCsC37gj6Bo-5UetWATr2og1KlrHPT6kGEtXQf5NwPwc_xFwBkmljja607pZ44pH5fBKkVLfwNGrzOmvjx_3HPI_MaoGCL2BSUXQxYixZYIUmGtYvr8KUFz2O0OjJhExz-WzpqDTNYRZVYPSnIacdnqm084wspqmon_96GFOsbz58HlhtX2aDdTW3uku7ZzS7Ic-35-ZWOs6efF9HeErpBFIRiHX2xDK5MZQ7tWlu3uI5hp7MIK6Hl27RPDstIMrmam4Ry1DgdQCgkTQVpdyH0FYvMMF7h7sGy5aNIfn-sIgTRAmhqDESPfFrBsZoGG7gZ68HfTSrmjIcD5pRs3H3l4zG5OQEzyNLw5g64-DRCUyYiz87ZSTKZjwtio-XJVT2Z3p0nFzzrc3mcvejNFTDV-Snhu5Vk_7aFCNTGwVgUwV3YeN5FVlsPTCsZ0zI_-K0evodFOOHmAuWnqEmhNjX0Y4M1ak9vcC4s3NvaY8wX9K2QTT1xT4NTz0VFamKtVphcISXOxs584AA5L8a7Yw1KTwTfnhZizhBWoDkY0YTsQU1hQ4OQr4IFN86JnyGCmphhTgO41xnlII42RdqMsyy3wgZbfjVY0vN8X-4hTF1lCO3OpFR6wE4W5hsFTYJ_j33BsrxtQ5geHe-7K_OVCYMvpr-joXi_K1r6hFKSZUvEl_GZfcCb50b5fPHF-Tek2dXo1sGnF_49kgBdIwi11hl3oV6fO8K8foRH6ES6kcRJWPh6PYoBUF8ZTa21dBeJ0n61AH294aElPNh3mMXgtY7W0c8zDzefbls5UrKwVHs_89fAU4vWgxY7rQmc1w06mMc8QTbSx9KQ2QmxrNcCLCYNWTSRIxU9IYtLoFRsl7zaSGNEcdiyOaTF-jbXoZC6QOd-wM9NCGb2FUGZ0SFa6qpcBbzgMxjgcOmzs5alk3o5yIJMXcOzPGz84Nyxx8ePhMnY--aJZzwX86LE7SDvdFR_7ZODkiyXW0SrKzroNxVm1juz7&sai=AMfl-YTmS04NhY5gGkmp8KJ_kcA8cn3MlIRQc19CP1Ox9hcrHEYJkepMDJM4qyNPPMXEsP7Zo3anItp2fLotRR_KFtT6Wjh0sOXXsj2p7XKot6QK54GWkcgPqKx_8xJDA1wOB-kYal8s0ip3YPald33l3AsjQ8xnGA&sig=Cg0ArKJSzJz_YOmmSphHEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=123&cbvp=1&cstd=107&cisv=r20210729.29605&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 03 Aug 2021 18:41:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E309 41 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 02 Aug 2021 06:32:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 130178
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 02 Aug 2022 06:32:02 GMT

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame F7EB 1 KB
749 B 7ms
6ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 03 Aug 2021 11:56:19 GMT
expires: Wed, 04 Aug 2021 11:56:19 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 24321
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame E309 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6013f01600bc63a56351dcaffaa9ddadf32a24ad28f962c8ee80420e25974e81

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame BC3F 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 02 Aug 2021 06:32:03 GMT
expires: Tue, 02 Aug 2022 06:32:03 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 130177
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK bst2tv3.html Show response
cdn3.doubleverify.com/ Frame 4609 1 KB
1 KB 25ms
11ms Document
text/html 2a02:26f0:6c00:286::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn3.doubleverify.com/bst2tv3.html
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal98.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:286::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 86be5d6a3d661fd3d5d72f254a347dec5c66cad569117f51dad297acba02f558

Request headers

Host: cdn3.doubleverify.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/

Response headers

Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Tue, 02 Sep 2014 17:01:36 GMT
Accept-Ranges: bytes
ETag: "01818ecfc6cf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
Content-Length: 806
Cache-Control: max-age=47416
Date: Tue, 03 Aug 2021 18:41:40 GMT
Connection: keep-alive

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 6C05 3 KB
2 KB 95ms
34ms Script
text/javascript 213.254.244.16
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_666144667016&jsTagObjCallback=__tagObject_callback_666144667016&num=6&ctx=1828362&cmp=115750&plc=4891039&sid=18330&advid=&adsrv=&unit=300x250&isdvvid=&uid=666144667016&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&dvp_strhd=0.20&dvpx_strhd=0.20&brid=0&brver=&bridua=3&dup=null&turl=https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/&srcurlD=0&ssl=1&refD=1&htmlmsging=1&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0j6AFk9eCQMllMj-guEsdkb&DVP_DBM_1=3060631&DVP_DBM_2=15755259&DVP_DBM_3=42380503&DVP_DBM_4=343126892&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=123477524927&DVP_PP_BUNDLE_ID=&prr=1&aUrlD=-1&m1=13&noc=12&fcifrms=21&brh=2&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=146&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D%403D6G%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D%403D6G%5D4%40%3ETar9EEADTbpTauTau56bbe%60g57dchh%606_76fc6d5hbagdb62b%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTauHHH%5D%403D6G%5D4%40%3ETau6%3FE6CE2%3A%3F%3E6%3FETau7%40C%3E6C%5C49%3A%3D5%5CDE2CD%5C2%3F5%5CH92E%5CE96J%5C%3D%40%40%3C%5C%3D%3A%3C6%5C%3F%40HTau&dvp_exetime=21.90&callbackName=__verify_callback_666144667016
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal98.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.16 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: b036d37a5c30f99fc59a637375bc12eb9f4b06da46ee091ec0f82645af195d61

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
X-DV-Response: 1
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
Date: Tue, 03 Aug 2021 18:41:39 GMT
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=0
Transfer-Encoding: chunked
Expires: 8/2/2021 6:41:40 PM

GET
H/1.1 200
OK dv-match6.js Show response
cdn.doubleverify.com/ Frame 4A7E 4 KB
2 KB 6ms
6ms Script
application/javascript 2a02:26f0:6c00:2b2::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-match6.js
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2b2::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: d03755898b05a3d69377bf7da16ccb307e789a0f569b4dbbcb7b29bdecf967c5

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 03 Aug 2021 18:41:40 GMT
Content-Encoding: gzip
Last-Modified: Sun, 11 Mar 2018 04:45:12 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "03c84bdf3b8d31:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=61679
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1935

GET
H3-29 200 index-160x600.html Show response
s0.2mdn.net/8506465/1626943591117/ Frame E24F 5 KB
2 KB 8ms
7ms Document
text/html 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8506465/1626943591117/index-160x600.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e712d41731bc8e63542fdb271cd2260d79b797312b1356040282f4df9ddef1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /8506465/1626943591117/index-160x600.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 1753
date: Tue, 03 Aug 2021 15:12:52 GMT
expires: Wed, 04 Aug 2021 15:12:52 GMT
last-modified: Thu, 22 Jul 2021 08:46:31 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 12528
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame E309 0
61 B 78ms
77ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu8oL5kWjFuy6Kd6pe04wAYuxCd1Qo49Wlb7OjqXKzhapv7umHVYOyJ1zwON3VRDkF5JIHE8jDv-NA8hUSHwKFhFF5SU_8ON81EKfdLr1mjLFE9q_AWJzrk-Ig-HD4N9ZT8Pp-p2gbISUdGmUWI-hMmdO8qG1gGZXNJiuAnd0CMZ3YhEVKILDF-V5fwVxTVwReUQVGnEyQel2ZbywJvxaNuInNCax0dW8XBY-FuQgo8JgYYInGOzfCNQ0bfRCzr9w6DRF45QYx-2wayaVP3extj8_nDe-78xzVmhAn97UFjuH3w6BjGyRG6LbtKeG1Ial4xfoG0mpp0LbasqX2YDPBRatY5mKXpN9-_plJKBBURtI_RZaiISXegB3D7lFG2tqUofHYexdJm4CAYS5gbHKmAowxkEgNCqtIPVfgW00y39pvOI0159ARWhD3qhakF3sxZKeuuaZVl1pARn_OyZ5XYFg1DMF_sAi0i-1vVz6CL7-3R8WE_rnFguvr8jZe5oU3qwJ5I-FunqA5_bzdMJ7zpVdnYD17itH58JYIPsIt2F7lt4hh3_EJePG0MinTV_V3B0zsFqjQK3hKKxFM8jhW8Rp418DMA1O6T1y4LTeAsyLhywhf3cQmqiyuKs_fAIjxL0DB0eb4ezYZ6wDOQGdfaXNHxKVq0aNuBrGAozPYblkg3Gn-8ywLG6SFTFG5NDVHS_pWL03cJcsc4tjodc9vUdWCTqAmE-QYRMU8I0WGVsIWsKHOGlZZQIS3LAu4Vbi4TEqCs7vJLtIwYrVhrpki2WYfghS8FgIn3qdIJwh3xI4qhg2XPUlCZ8H66Yo71C_ud0wmzp733ivNVthftPhlkiVM0J6b1qkU0o3ehVmslo-fZ9pbQNDNaWnDk7ck4tJYxZX7iarRrU4eGtFoBUUmQ5Smq-cXTGCQgYsF-cP_uuTb6ub9xJuqau2l7sUPNUj8hAaMLq7O5mMVRSw9YtVq0qf6d0WaWcXbTv_UBJv0apkT65dIu0c3n6pMRCRp70dmyWWyT7dQtjxAz8AX6t1xaQHDbxwBtVIBKHRLAwYvfJ-jV4zzbjF5uRkDiLPhVw4mGWok3xrLrmcc4AdqBru-o-1-WR5bABaBe6Joz9E9kiqJ_41DDb0y6JgrF_Fr3NFqJSCU&sai=AMfl-YTD7icYM_FsmOa7NSSydvcUYJZ6ccSxjg6oAeliR_2hckuJtc3yW96ic8hGzXT8gI9TgknYWaygX70wtJX4mn-SyoVytfo7yptQsLPwZrmMAmCfuEYoRUEvCaiSbcMFTnq86RKvFhlhk4wDJ-1EfHyNsizOkg&sig=Cg0ArKJSzJOkVMfteC1mEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=183&cbvp=1&cstd=177&cisv=r20210729.28449&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 03 Aug 2021 18:41:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js Show response
pagead2.googlesyndication.com/bg/ Frame 5FAD 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb87103f40756d26814cb4495c3fcd634c42b6994e19b8b27ce080a39e739b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 06:38:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 43377
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13261
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 03 Aug 2022 06:38:43 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame ADC3 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 02 Aug 2021 06:32:03 GMT
expires: Tue, 02 Aug 2022 06:32:03 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 130177
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 dpixel
cms.quantserve.com/ Frame 6B04 35 B
462 B 11ms
7ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEOlM-GejY2a7quvv-Yw79w8&google_cver=1&google_push=AYg5qPJzlIJcRVT8vDP9pIUKy1inVA3M5mcMAEz9WPWkwfX-3L9dKvMz3Cfp3K0WVKh_iSzAjt347F5GHXNogz_04rXkQGQLayxqJg

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 6B04 0
104 B 127ms
68ms Image
text/plain 2a02:fa8:8806:16::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESED2QCavGAEpvEc0ep7KO4Uc&google_cver=1&google_push=AYg5qPKdyU49Cg3qsxaJlSC4LyjQarlUwOs8lNq-I7PKesgnav83UP6ABBNK4y-bfkfeyl3-00vTbKMUTKJSYtXqXB5MlbP-jClGpw
Requested by: Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:16::1400 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6B04
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESENfK_a4X0aRHyx_OviQjsow&google_push=AYg5qPIlWqzsXq5nNlPi9xLXikdPMS6dSDjvkgi7XBRaKPNH9kJ0TGF81V...

170 B
188 B

40ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESENfK_a4X0aRHyx_OviQjsow&google_push=AYg5qPIlWqzsXq5nNlPi9xLXikdPMS6dSDjvkgi7XBRaKPNH9kJ0TGF81VizTtviDXK8oqxcMh6Xl_mywn8a295-YsoerEqIUmSiZA

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1628016101.801186,VS0,VE89
x-served-by: cache-fra19166-FRA
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESENfK_a4X0aRHyx_OviQjsow&google_push=AYg5qPIlWqzsXq5nNlPi9xLXikdPMS6dSDjvkgi7XBRaKPNH9kJ0TGF81VizTtviDXK8oqxcMh6Xl_mywn8a295-YsoerEqIUmSiZA
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6B04
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEPIFIScDlHgyARsjX9seajE&google_cver=1&google_push=AYg5qPIH0_eoqeyG4GpFTHib89nb4ZXH1-ZTrK_klJU7vr3FodNcMelFjEBRR-gBIVtl10aH5RhePmZ_msN5kgzW...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=hQRe5j-SStqhj2mVpvRAIw2&google_push=AYg5qPIH0_eoqeyG4GpFTHib89nb4ZXH1-ZTrK_klJU7vr3FodNcMelFjEBRR-gBIVtl10aH5RhePmZ_msN5kgzWM8Y_MtbXb4i3tQ

170 B
188 B

38ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=hQRe5j-SStqhj2mVpvRAIw2&google_push=AYg5qPIH0_eoqeyG4GpFTHib89nb4ZXH1-ZTrK_klJU7vr3FodNcMelFjEBRR-gBIVtl10aH5RhePmZ_msN5kgzWM8Y_MtbXb4i3tQ

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 03 Aug 2021 18:41:40 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.15.12
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=hQRe5j-SStqhj2mVpvRAIw2&google_push=AYg5qPIH0_eoqeyG4GpFTHib89nb4ZXH1-ZTrK_klJU7vr3FodNcMelFjEBRR-gBIVtl10aH5RhePmZ_msN5kgzWM8Y_MtbXb4i3tQ
x-host: tde-deliveryengine-production-d875b88dc-s72v6
alt-svc: clear
content-length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6B04
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YVOehgeeSVyFFZRWI55lWQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

40ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YVOehgeeSVyFFZRWI55lWQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLTglnUU4oxO5prEgtgJKZp7W12Gq9BlCBHT_YCJhdS-Y4PDakCsuYLVPPXO72R00DnQL9GR3UDFDCU5GeN8yHLp3JbrEZ78A

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YVOehgeeSVyFFZRWI55lWQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLTglnUU4oxO5prEgtgJKZp7W12Gq9BlCBHT_YCJhdS-Y4PDakCsuYLVPPXO72R00DnQL9GR3UDFDCU5GeN8yHLp3JbrEZ78A
date: Tue, 03 Aug 2021 18:41:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET

pixel
cm.g.doubleclick.net/ Frame 6B04
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESELdJGCamhabgxjTmg7wahlI&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YQmN5Gle5E-WnHYopbgYgwAABFUAAAIB&google_cver=1&google_push=AYg5qPKy_nyYFLPNI2IS7B_EwDh6sjYpLuLwBHZzhLszWJWqcCxc2AZW6a5U0HaCGaoc2SIpvyy8...

0
0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6B04
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEAxxmXrWT4mryhZ7Navmjj0&google_cver=1&google_push=AYg5qPLvwEsGnW67el18saogiL6TBRFS59ANDb-LiSpzQNAkWp2BIiqnsJApR6J856cdHefaNn...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEAxxmXrWT4mryhZ7Navmjj0&google_cver=1&google_push=AYg5qPLvwEsGnW67el18saogiL6TBRFS59ANDb-LiSpzQNAkWp2BIiqnsJApR6J856cdHefaNn...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1NUnBoa1BCRTJ1RjZvczFpU0Vvc3dRamx4UTFnMS5ZOH5B&google_push=AYg5qPLvwEsGnW67el18saogiL6TBRFS59ANDb-LiSpzQNAkWp2BIiqns...

170 B
188 B

41ms
41ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1NUnBoa1BCRTJ1RjZvczFpU0Vvc3dRamx4UTFnMS5ZOH5B&google_push=AYg5qPLvwEsGnW67el18saogiL6TBRFS59ANDb-LiSpzQNAkWp2BIiqnsJApR6J856cdHefaNn5Z5SvwHvd2lbLO7loTksaAXPTpa1M

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 03 Aug 2021 18:41:40 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1NUnBoa1BCRTJ1RjZvczFpU0Vvc3dRamx4UTFnMS5ZOH5B&google_push=AYg5qPLvwEsGnW67el18saogiL6TBRFS59ANDb-LiSpzQNAkWp2BIiqnsJApR6J856cdHefaNn5Z5SvwHvd2lbLO7loTksaAXPTpa1M
Connection: keep-alive
Content-Length: 0

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 6B04 0
12 B 37ms
36ms Image
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J5j2GsrYhm3qYY1xtkstMo7mK_xRhpRcyJzaMZ7RWkSLC6SkCY_ZoXgRFnB0hnnLMZH0jxEw

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 style.css
s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/css/ Frame 62F5 1 KB
388 B 7ms
6ms Stylesheet
text/css 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/css/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b60b41e9b08ff124963d6805d601821bd0151a89420b52c30f5e6dec737a7f96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 02 Aug 2021 23:37:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 68655
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 362
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 09:58:42 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 03 Aug 2021 23:37:25 GMT

GET
H3-29 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 62F5 60 KB
24 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 03 Aug 2021 18:41:40 GMT

GET
H3-29 200 f8_img.png
s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/ Frame 62F5 49 KB
49 KB 9ms
9ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/f8_img.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97b521030ab84ea7134f40ee22262263ed21acd40b2e8b3c5c39e8f5289ba2d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 02 Aug 2021 22:47:20 GMT
x-content-type-options: nosniff
last-modified: Mon, 26 Jul 2021 09:58:42 GMT
server: sffe
age: 71660
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50620
x-xss-protection: 0
expires: Tue, 03 Aug 2021 22:47:20 GMT

GET
H3-29 200 f7_img.png
s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/ Frame 62F5 11 KB
11 KB 12ms
7ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/f7_img.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a1e2e0a5bdc0c47d220717d172890bdfdf6da133f37d67cae41cdf3001f77491

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 02 Aug 2021 22:47:20 GMT
x-content-type-options: nosniff
last-modified: Mon, 26 Jul 2021 09:58:42 GMT
server: sffe
age: 71660
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11670
x-xss-protection: 0
expires: Tue, 03 Aug 2021 22:47:20 GMT

GET
H3-29 200 f6_img.png
s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/ Frame 62F5 8 KB
8 KB 17ms
12ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/f6_img.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566cadb582650e5e9a04824b0933a6ff89d45e981e63b376e39ab1c425a8e4f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 02 Aug 2021 22:47:20 GMT
x-content-type-options: nosniff
last-modified: Mon, 26 Jul 2021 09:58:42 GMT
server: sffe
age: 71660
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7951
x-xss-protection: 0
expires: Tue, 03 Aug 2021 22:47:20 GMT

GET
H3-29 200 f5_img.png
s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/ Frame 62F5 4 KB
4 KB 18ms
12ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/f5_img.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

086af40f7f7a0997319e600824c4b71ca1174957debe844655c84e50a7f5a9a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 02 Aug 2021 22:47:20 GMT
x-content-type-options: nosniff
last-modified: Mon, 26 Jul 2021 09:58:42 GMT
server: sffe
age: 71660
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4133
x-xss-protection: 0
expires: Tue, 03 Aug 2021 22:47:20 GMT

GET
H3-29 200 f4_img.png
s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/ Frame 62F5 22 KB
22 KB 16ms
11ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/f4_img.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f04ad12ed1bbf1b101da192ab4cb4403daa1fa2a20433a42bbb34720bcdedf1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 02 Aug 2021 22:47:20 GMT
x-content-type-options: nosniff
last-modified: Mon, 26 Jul 2021 09:58:42 GMT
server: sffe
age: 71660
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22376
x-xss-protection: 0
expires: Tue, 03 Aug 2021 22:47:20 GMT

GET
H3-29 200 f3_img.png
s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/ Frame 62F5 23 KB
23 KB 14ms
8ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/f3_img.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

43eac1f59dac6aa67a68961219e298eaee62dfa835919583bfdf9e6dcd7c005f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 02 Aug 2021 22:47:20 GMT
x-content-type-options: nosniff
last-modified: Mon, 26 Jul 2021 09:58:42 GMT
server: sffe
age: 71660
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24008
x-xss-protection: 0
expires: Tue, 03 Aug 2021 22:47:20 GMT

GET
H3-29 200 f2_img.png
s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/ Frame 62F5 20 KB
20 KB 14ms
9ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/f2_img.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee6332d205bf20bd60367c60baa7a393abc0af42fadbcb45bc412ea033ec6111

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 02 Aug 2021 22:47:20 GMT
x-content-type-options: nosniff
last-modified: Mon, 26 Jul 2021 09:58:42 GMT
server: sffe
age: 71660
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20019
x-xss-protection: 0
expires: Tue, 03 Aug 2021 22:47:20 GMT

GET
H3-29 200 f1_img.png
s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/ Frame 62F5 25 KB
25 KB 18ms
13ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/f1_img.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a0864a65c686ee3589ae4d6a2f6ff070e7812be2821a549c979b1d19f6d003e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 02 Aug 2021 22:47:21 GMT
x-content-type-options: nosniff
last-modified: Mon, 26 Jul 2021 09:58:42 GMT
server: sffe
age: 71659
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26051
x-xss-protection: 0
expires: Tue, 03 Aug 2021 22:47:21 GMT

GET
H3-29 200 text_one.png
s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/ Frame 62F5 5 KB
5 KB 18ms
13ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/text_one.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7978bbd745503190109accbb0f138a47bfe01397b126295630c6b22486cf1136

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 02 Aug 2021 22:47:21 GMT
x-content-type-options: nosniff
last-modified: Mon, 26 Jul 2021 09:58:42 GMT
server: sffe
age: 71659
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4968
x-xss-protection: 0
expires: Tue, 03 Aug 2021 22:47:21 GMT

GET
H3-29 200 text_two.png
s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/ Frame 62F5 4 KB
4 KB 19ms
13ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/assets/text_two.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8336f2d92daecb3e5a5ee788d1e8277744f83e8b768035230a4a9ff18744734b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 02 Aug 2021 22:47:21 GMT
x-content-type-options: nosniff
last-modified: Mon, 26 Jul 2021 09:58:42 GMT
server: sffe
age: 71659
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3591
x-xss-protection: 0
expires: Tue, 03 Aug 2021 22:47:21 GMT

GET
H3-29 200 Enabler_01_246.js Show response
s0.2mdn.net/879366/ Frame 62F5 116 KB
39 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_246.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b64291fc91dc77833930ffcead244193c5cfd9e882af312ecc89b580160c22a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61862280/20210726025842353/index.html?e=69&leftOffset=0&topOffset=0&c=OWvZYVjDpo&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 15:17:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12245
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40237
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:51 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 04 Aug 2021 15:17:35 GMT

GET
H3-29 200 z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js Show response
pagead2.googlesyndication.com/bg/ Frame 2CB8 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb87103f40756d26814cb4495c3fcd634c42b6994e19b8b27ce080a39e739b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 06:38:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 43377
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13261
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 03 Aug 2022 06:38:43 GMT

GET
H3-29 200 css2
fonts.googleapis.com/ Frame E24F 2 KB
522 B 33ms
21ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:wght@800&display=swap

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0cb1764dfbf11d9e34ed7ab23e7ee8bef9324ff583c885b2c914f9599b93e19b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 03 Aug 2021 17:05:51 GMT
server: ESF
date: Tue, 03 Aug 2021 18:41:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 03 Aug 2021 18:41:40 GMT

GET
H3-29 200 css2
fonts.googleapis.com/ Frame E24F 2 KB
614 B 24ms
20ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Noto+Sans&display=swap

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

553d7063c929d535b3806b00ca23c6fdba4aa1965a8fec006686a7fe0802ac53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 03 Aug 2021 17:21:52 GMT
server: ESF
date: Tue, 03 Aug 2021 18:41:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 03 Aug 2021 18:41:40 GMT

GET
H3-29 200 main.css
s0.2mdn.net/8506465/1626943591117/css/ Frame E24F 2 KB
759 B 7ms
7ms Stylesheet
text/css 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8506465/1626943591117/css/main.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2dcec491a4e45204ae6a245bb6588c2289d15bad019b8a609b6f865726774806

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 15:12:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12528
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 735
x-xss-protection: 0
last-modified: Thu, 22 Jul 2021 08:46:31 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 04 Aug 2021 15:12:52 GMT

GET
H3-29 200 alion-preloader.gif
s0.2mdn.net/8506465/1626943591117/img/ Frame E24F 7 KB
7 KB 11ms
8ms Image
image/gif 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8506465/1626943591117/img/alion-preloader.gif

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

516d6780a5be3b53e77a73a6b125d734b403f5625251f6dbb1475eabb2a15489

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 15:12:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 22 Jul 2021 08:46:31 GMT
server: sffe
age: 12528
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7554
x-xss-protection: 0
expires: Wed, 04 Aug 2021 15:12:52 GMT

GET
H3-29 200 img.jpg
s0.2mdn.net/8506465/1626943591117/img/ Frame E24F 78 KB
78 KB 11ms
9ms Image
image/jpeg 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8506465/1626943591117/img/img.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14e4c6bcbade4c14b0347d4035bd24ada2799054b6143be02a785a9cdaf1efcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 15:12:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 22 Jul 2021 08:46:31 GMT
server: sffe
age: 12528
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 79984
x-xss-protection: 0
expires: Wed, 04 Aug 2021 15:12:52 GMT

GET
H3-29 200 blackGradient.png
s0.2mdn.net/8506465/1626943591117/img/ Frame E24F 2 KB
2 KB 13ms
11ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8506465/1626943591117/img/blackGradient.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33509684fc63e68dec5ee70decc98bd1e0f70209cc0d59e87fa86ff14df84ea5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 15:12:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 22 Jul 2021 08:46:32 GMT
server: sffe
age: 12528
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-doubleclick-media
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1566
x-xss-protection: 0
expires: Wed, 04 Aug 2021 15:12:52 GMT

GET
H3-29 200 logo-pink.svg
s0.2mdn.net/8506465/1626943591117/img/ Frame E24F 2 KB
1006 B 11ms
9ms Image
image/svg+xml 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8506465/1626943591117/img/logo-pink.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

033d083615725ec14a6a2e313029c31a403cdf7ef95567f62de6100cda369e36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 15:12:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12528
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 982
x-xss-protection: 0
last-modified: Thu, 22 Jul 2021 08:46:32 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 04 Aug 2021 15:12:52 GMT

GET
H3-29 200 arrow.svg
s0.2mdn.net/8506465/1626943591117/img/ Frame E24F 557 B
368 B 10ms
8ms Image
image/svg+xml 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8506465/1626943591117/img/arrow.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b00810e20d1934543a88970254356cf2d6f387f611a578dc940b96e7dd4eaa8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 15:12:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12528
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 344
x-xss-protection: 0
last-modified: Thu, 22 Jul 2021 08:46:31 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 04 Aug 2021 15:12:52 GMT

GET
H3-29 200 gsap_3.2.4_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame E24F 57 KB
23 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.2.4_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8403779d45a9590b43c0ecf984ebe11e75fd2982630d658390a6001a6768770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23276
x-xss-protection: 0
last-modified: Thu, 05 Mar 2020 03:53:22 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 03 Aug 2021 18:41:40 GMT

GET
H3-29 200 main.js Show response
s0.2mdn.net/8506465/1626943591117/script/ Frame E24F 2 KB
629 B 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8506465/1626943591117/script/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

790f4981438444ea83d00b36f408972866619ab7d29f30460a39be65273dde56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8506465/1626943591117/index-160x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 15:12:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12528
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 605
x-xss-protection: 0
last-modified: Thu, 22 Jul 2021 08:46:31 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 04 Aug 2021 15:12:52 GMT

GET /
google2waycm.netmng.com/cm/ Frame F7EB 0
0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame F7EB
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEOlM-GejY2a7quvv-Yw79w8&google_cver=1&google_push=AYg5qPK680vsSD-OqBGneZZwMho78NpGSFX3ZpCiDLkqKIJiZK-xWNGWly...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPK680vsSD-OqBGneZZwMho78NpGSFX3ZpCiDLkqKIJiZK-xWNGWlyV607JkkQCWnzfGjpvAt_3PlFeQtk1RWx5oUYw3bsE&google_hm=EZ9Q7Ry...

170 B
188 B

39ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPK680vsSD-OqBGneZZwMho78NpGSFX3ZpCiDLkqKIJiZK-xWNGWlyV607JkkQCWnzfGjpvAt_3PlFeQtk1RWx5oUYw3bsE&google_hm=EZ9Q7RyCU3Gs6VZZXqhBJw

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPK680vsSD-OqBGneZZwMho78NpGSFX3ZpCiDLkqKIJiZK-xWNGWlyV607JkkQCWnzfGjpvAt_3PlFeQtk1RWx5oUYw3bsE&google_hm=EZ9Q7RyCU3Gs6VZZXqhBJw
pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame F7EB
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEOY_8AWbBH3Ki5vA4dV8Y7M&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEOY_8AWbBH3Ki5vA4dV8Y7M&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=QUZoVFlNR24xTWFabWM1&google_gid=CAESEOY_8AWbBH3Ki5vA4dV8Y7M&google_cver=1&google_push=AYg5qPLTYAGMx1ytS_l9MGNSXLIL3UNspMtSUf8E7VkNJ-_...

170 B
188 B

40ms
40ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=QUZoVFlNR24xTWFabWM1&google_gid=CAESEOY_8AWbBH3Ki5vA4dV8Y7M&google_cver=1&google_push=AYg5qPLTYAGMx1ytS_l9MGNSXLIL3UNspMtSUf8E7VkNJ-_a_pXUOWQ5J6O94ne83R-T39DCYMVX-oVgOLsr6DXLTjMzhBr-qw

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:40 GMT
Server: PingMatch/v2.0.30-661-ga8ef792#rel-ec2-master i-0b5388877fe362141@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security: max-age=604800; includeSubDomains
P3P: policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=QUZoVFlNR24xTWFabWM1&google_gid=CAESEOY_8AWbBH3Ki5vA4dV8Y7M&google_cver=1&google_push=AYg5qPLTYAGMx1ytS_l9MGNSXLIL3UNspMtSUf8E7VkNJ-_a_pXUOWQ5J6O94ne83R-T39DCYMVX-oVgOLsr6DXLTjMzhBr-qw
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame F7EB
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEF2EHuEx-SzsvmGk7SM_SFI&google_cver=1&google_push=AYg5qPJYb9J-p8ClGl_GEeG3SdiQHOyeNQC-7hbaFIGrS__JOqA8b92its_5n9H8RnnivTXkdO704wbyOv6n66hE...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPJYb9J-p8ClGl_GEeG3SdiQHOyeNQC-7hbaFIGrS__JOqA8b92its_5n9H8RnnivTXkdO704wbyOv6n66hEaVqjdDdNV9w

170 B
188 B

39ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPJYb9J-p8ClGl_GEeG3SdiQHOyeNQC-7hbaFIGrS__JOqA8b92its_5n9H8RnnivTXkdO704wbyOv6n66hEaVqjdDdNV9w

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 03 Aug 2021 18:41:44 GMT
Server: MT3 3820 7698daf master zrh-pixel-x25
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPJYb9J-p8ClGl_GEeG3SdiQHOyeNQC-7hbaFIGrS__JOqA8b92its_5n9H8RnnivTXkdO704wbyOv6n66hEaVqjdDdNV9w
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 03 Aug 2021 18:41:43 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame F7EB
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEHim2txxF58x38aIQk4fxnE&google_cver=1&google_push=AYg5qPIh27NCR_AtYcRdSdywTktjg6pM2ld7v-51oo3bM8gyU5U67rQPaNplUIABvLhSiotHi0qlj7hIb-HBLY6zvcreOWP4KIY
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=A5917B71F469414D9FCAB5B66E5425D2&google_push=AYg5qPIh27NCR_AtYcRdSdywTktjg6pM2ld7v-51oo3bM8gyU5U67rQPaNplUIABvLhSiotHi0qlj7hIb-HBLY6...

170 B
188 B

40ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=A5917B71F469414D9FCAB5B66E5425D2&google_push=AYg5qPIh27NCR_AtYcRdSdywTktjg6pM2ld7v-51oo3bM8gyU5U67rQPaNplUIABvLhSiotHi0qlj7hIb-HBLY6zvcreOWP4KIY

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 03 Aug 2021 18:41:40 GMT
x-content-type-options: nosniff
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=A5917B71F469414D9FCAB5B66E5425D2&google_push=AYg5qPIh27NCR_AtYcRdSdywTktjg6pM2ld7v-51oo3bM8gyU5U67rQPaNplUIABvLhSiotHi0qlj7hIb-HBLY6zvcreOWP4KIY
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 154
expires: Mon, 02 Aug 2021 18:41:40 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame F7EB
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WkanioH7TYuD5a7CmMIeNQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

39ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WkanioH7TYuD5a7CmMIeNQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLjYLeEMXBqZVvE4rOqmGzBApzeVUIztwXCcAXi9ZfAv358lq-pRTegv-V55ufnFUdR06VbfAJ0QB8kSBrt1afSkJ8_E-g

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WkanioH7TYuD5a7CmMIeNQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLjYLeEMXBqZVvE4rOqmGzBApzeVUIztwXCcAXi9ZfAv358lq-pRTegv-V55ufnFUdR06VbfAJ0QB8kSBrt1afSkJ8_E-g
date: Tue, 03 Aug 2021 18:41:38 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame F7EB
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEPqAO0qIVwKaIzaITQMZO94&google_cver=1&google_push=AYg5qPJeR0pmE5TlbLhg_qjRCaGh9Cpn0sF-NBy7As_0ql_GxfQUNrwmf4k72ObU0_dZN2HGFxP...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JXRVIxQUMtQy0xNzhS&google_push=AYg5qPJeR0pmE5TlbLhg_qjRCaGh9Cpn0sF-NBy7As_0ql_GxfQUNrwmf4k72ObU0_dZN2HGFxPRfhQ3HMoqUW3DhSVh-nOroOg

170 B
188 B

39ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JXRVIxQUMtQy0xNzhS&google_push=AYg5qPJeR0pmE5TlbLhg_qjRCaGh9Cpn0sF-NBy7As_0ql_GxfQUNrwmf4k72ObU0_dZN2HGFxPRfhQ3HMoqUW3DhSVh-nOroOg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JXRVIxQUMtQy0xNzhS&google_push=AYg5qPJeR0pmE5TlbLhg_qjRCaGh9Cpn0sF-NBy7As_0ql_GxfQUNrwmf4k72ObU0_dZN2HGFxPRfhQ3HMoqUW3DhSVh-nOroOg
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Expires: 0

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame F7EB 0
12 B 41ms
37ms Image
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LyrFs59DdM3BHVkHpxkaP2JNEbFqtkBXOLYtNT8uBSFW4RU8bkwfQ_83v-5lHkFJ36bG2K

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H/1.1 200
OK bsevent.gif
tps20516.doubleverify.com/ Frame 6C05 807 B
1 KB 93ms
31ms Ping
image/gif 213.254.244.17
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20516.doubleverify.com/bsevent.gif?impid=3f1f8de4618c4e79beb89f593d7800a9&dvp_or2=1&cbust=1628016100783286
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal98.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.17 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:40 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
Vary: Accept-Encoding
Content-Type: image/gif
Access-Control-Allow-Origin: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 860
Expires: 8/2/2021 6:41:40 PM

GET
H3-29 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 6C05 9 KB
4 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal98.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

75cb0dd4f8464f2b110375047e4dd1f7f25a7bdbed5872873a70157a0c1ccd12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:16:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1516
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4105
x-xss-protection: 0
last-modified: Tue, 03 Aug 2021 14:15:06 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Tue, 03 Aug 2021 19:16:24 GMT

GET
H/1.1

200
OK

bsevent.gif
tps20516.doubleverify.com/ Frame 6C05
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=doubleverify_ddp&google_ula=7327243&google_cm&google_hm=**&google_redir=https%3A%2F%2Ftps20516.doubleverify.com%2Fbsevent.gif%3Fimpid%3D3f1f8de4618c4e7...
https://tps20516.doubleverify.com/bsevent.gif?impid=3f1f8de4618c4e79beb89f593d7800a9&dvpx_gfbc=1&cbust=1628016100784497&google_error=10

807 B
1 KB

54ms
31ms

Image
image/gif

213.254.244.17
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tps20516.doubleverify.com/bsevent.gif?impid=3f1f8de4618c4e79beb89f593d7800a9&dvpx_gfbc=1&cbust=1628016100784497&google_error=10
Requested by: Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.17 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:40 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
Vary: Accept-Encoding
Content-Type: image/gif
Cache-Control: max-age=0
Content-Length: 860
Expires: 8/2/2021 6:41:40 PM

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://tps20516.doubleverify.com/bsevent.gif?impid=3f1f8de4618c4e79beb89f593d7800a9&dvpx_gfbc=1&cbust=1628016100784497&google_error=10
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 344
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js Show response
pagead2.googlesyndication.com/bg/ Frame BC3F 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb87103f40756d26814cb4495c3fcd634c42b6994e19b8b27ce080a39e739b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 06:38:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 43377
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13261
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 03 Aug 2022 06:38:43 GMT

GET
H3-29 200 JTURjIg1_i6t8kCHKm45_c5H3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v15/ Frame E24F 19 KB
19 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_c5H3gnD_g.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@800&display=swap

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c623b34dcf729895c3bc9b6e261796bbad69555a21ad6d2f9b4e7bc27b6e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 12:00:02 GMT
x-content-type-options: nosniff
age: 24098
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19440
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:11:08 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 Aug 2022 12:00:02 GMT

GET
H3-29 200 impl_v77.js Show response
www.googletagservices.com/dcm/ Frame 6C05 37 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v77.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

550939b576247e119d734f7f75984c1db433a682a2491b23b6c1a6f1abba6394

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 02 Aug 2021 15:17:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 98646
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15569
x-xss-protection: 0
last-modified: Mon, 19 Jul 2021 19:48:56 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 02 Aug 2022 15:17:34 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3E0B 0
23 B 101ms
65ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 03 Aug 2021 18:41:40 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js Show response
pagead2.googlesyndication.com/bg/ Frame ADC3 35 KB
13 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb87103f40756d26814cb4495c3fcd634c42b6994e19b8b27ce080a39e739b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 06:38:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 43377
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13261
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 03 Aug 2022 06:38:43 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame E309 0
23 B 65ms
64ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 03 Aug 2021 18:41:40 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 62F5 6 KB
4 KB 16ms
16ms XHR
application/json 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_246&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_246.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e24ddc24bbecc3cf8e7cba86077b8bab2c4df4f2032f8e44023d6143d0a43310

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 03 Aug 2021 18:41:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4490
x-xss-protection: 0

GET
H/1.1 200
OK dv-measurements1664.js Show response
cdn.doubleverify.com/ Frame 8FE2 487 KB
88 KB 7ms
7ms Script
application/javascript 2a02:26f0:6c00:2b2::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements1664.js
Requested by: Host: www.obsev.com
URL: https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/?utm_source=lit_456&utm_medium=paid&utm_campaign=04rc_nitido26_336_all_bc_sc_7_29&utm_content=23849078729880628&utm_term=04rc_nitido26_336_all_bc_sc_7_29%20-%20Copy&fbclid=IwAR063I0-p-jyHmi9Fl3cfdbtcXXMpSlQ_ZZ9KaU4EezEHGYgvP30Z_YcGd
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2b2::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: a57681d4e98bfa8190ede2ae6bcc171ae9ed7a577c971e5d317b23fd7a4e6db2

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 03 Aug 2021 18:41:40 GMT
Content-Encoding: gzip
Last-Modified: Tue, 03 Aug 2021 07:05:04 GMT
Server: Microsoft-IIS/10.0
ETag: "0902de23588d71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 90126

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0F90 1 KB
749 B 7ms
6ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 03 Aug 2021 11:56:19 GMT
expires: Wed, 04 Aug 2021 11:56:19 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 24321
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 6C05 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1cb1e75cf53e2eafcd91c40dab566508f67d0d37e9da0bb4a2a54d62c3ab23b4

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 62F5 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_246.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Tue, 03 Aug 2021 18:41:40 GMT

POST
H/1.1 200
OK abt Show response
capi.connatix.com/tr/ Frame 57EC 0
294 B 119ms
118ms XHR
multipart/form-data 18.221.6.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/abt?v=125379
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.186 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-186.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 03 Aug 2021 18:41:41 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.obsev.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 B9689862.280410797;dc_ver=77.225;dc_eid=40004000;sz=300x250;u_sd=1;gdpr_consent=tcunavailable;gdpr=1;dc_adk=660351267;ord=u73boz;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2... Show response
ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/ Frame 1F63 11 B
568 B 109ms
41ms Script
text/javascript 142.250.74.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280410797;dc_ver=77.225;dc_eid=40004000;sz=300x250;u_sd=1;gdpr_consent=tcunavailable;gdpr=1;dc_adk=660351267;ord=u73boz;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2Cnull%5D;dc_rfl=1,https%3A%2F%2Fwww.obsev.com%2F$0;xdt=1;crlt=5Bv7cSKky-;cmpl=8;gcsr=a;osda=2;sttr=114;prcl=s

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f6.1e100.net

Software

cafe /

Resource Hash

f1e945400c04241ef089d71de3b0cf7e202431ac4685ada318714fe07ee9dcb0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js Show response
pagead2.googlesyndication.com/bg/ Frame 0C4F 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb87103f40756d26814cb4495c3fcd634c42b6994e19b8b27ce080a39e739b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 06:38:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 43378
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13261
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 03 Aug 2022 06:38:43 GMT

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame 8FE2 2 KB
1 KB 336ms
33ms Script
text/javascript 213.254.244.16
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&ttmms=156&ttfrms=21&brid=97&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D%403D6G%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D%403D6G%5D4%40%3ETar9EEADTbpTauTau56bbe%60g57dchh%606_76fc6d5hbagdb62b%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTauHHH%5D%403D6G%5D4%40%3ETau6%3FE6CE2%3A%3F%3E6%3FETau7%40C%3E6C%5C49%3A%3D5%5CDE2CD%5C2%3F5%5CH92E%5CE96J%5C%3D%40%40%3C%5C%3D%3A%3C6%5C%3F%40HTau&srcurlD=0&aUrlD=-1&ssl=https:&uid=1628016101140714&jsCallback=dvCallback_1628016101140693&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&htmlmsging=1&chro=0&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=1664&tgjsver=1664&lvvn=28&m1=13&refD=1&referrer=https%3A%2F%2Fde33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&fcifrms=21&brh=2&dvp_epl=384&noc=12&ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&adsrv=0&advid=3398311&turl=https://www.obsev.com/entertainment/former-child-stars-and-what-they-look-like-now/&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVPX_PP_IMP_ID=ABAjH0j6AFk9eCQMllMj-guEsdkb&DVP_DBM_1=3060631&DVP_DBM_2=15755259&DVP_DBM_3=42380503&DVP_DBM_4=343126892&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=123477524927&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=1937981863.8758428&dvp_tukv=224268196132.5234&dvp_uuid=23242894508.707935&dvp_strhd=0.20000076293945312&dvpx_strhd=0.20000076293945312&dvp_tuid=893137239850
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1664.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.16 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: cac3b4136cae19bf2678bb48781c4e96167f66bf01efb25af33f56e236509996

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:41 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=0
Transfer-Encoding: chunked
Expires: 8/2/2021 6:41:41 PM

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0F90
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEOlM-GejY2a7quvv-Yw79w8&google_cver=1&google_push=AYg5qPIfLMoCz4cey2_6N_Mb1ZMRL2kY0Oc8NvMetAFaxs4ZFl0FP6WDKJ...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPIfLMoCz4cey2_6N_Mb1ZMRL2kY0Oc8NvMetAFaxs4ZFl0FP6WDKJZmj2hyolI2o6OECQLgRuquwGU9Ba-MoA-Z8_vVL4I&google_hm=EZ9Q7Ry...

170 B
188 B

45ms
40ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPIfLMoCz4cey2_6N_Mb1ZMRL2kY0Oc8NvMetAFaxs4ZFl0FP6WDKJZmj2hyolI2o6OECQLgRuquwGU9Ba-MoA-Z8_vVL4I&google_hm=EZ9Q7RyCU3Gs6VZZXqhBJw

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPIfLMoCz4cey2_6N_Mb1ZMRL2kY0Oc8NvMetAFaxs4ZFl0FP6WDKJZmj2hyolI2o6OECQLgRuquwGU9Ba-MoA-Z8_vVL4I&google_hm=EZ9Q7RyCU3Gs6VZZXqhBJw
pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 0F90
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEOhkm3QOU3TkYOUdme06oxs&google_cver=1&google_push=AYg5qPIC9GF0oKMyJa5blE77khautQO4ODGfbWcWMIW8XmbjFH1JPU8nWnkWl_LVSDMh-xIEgixynguHH9W0eNZ2V5idhrxZZttR&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEOhkm3QOU3TkYOUdme06oxs&google_cver=1&google_push=AYg5qPIC9GF0oKMyJa5blE77khautQO4ODGfbWcWMIW8XmbjFH1JPU8nWnkWl_LVSDMh-xIEgixynguHH9W0eNZ2V5idhrxZZtt...

43 B
423 B

167ms
166ms

Image
image/gif

2606:4700::6812:d05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEOhkm3QOU3TkYOUdme06oxs&google_cver=1&google_push=AYg5qPIC9GF0oKMyJa5blE77khautQO4ODGfbWcWMIW8XmbjFH1JPU8nWnkWl_LVSDMh-xIEgixynguHH9W0eNZ2V5idhrxZZttR&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPIC9GF0oKMyJa5blE77khautQO4ODGfbWcWMIW8XmbjFH1JPU8nWnkWl_LVSDMh-xIEgixynguHH9W0eNZ2V5idhrxZZttR%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6791ae7b1b254339-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 414
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6791ae7a0fa84339-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEOhkm3QOU3TkYOUdme06oxs&google_cver=1&google_push=AYg5qPIC9GF0oKMyJa5blE77khautQO4ODGfbWcWMIW8XmbjFH1JPU8nWnkWl_LVSDMh-xIEgixynguHH9W0eNZ2V5idhrxZZttR&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPIC9GF0oKMyJa5blE77khautQO4ODGfbWcWMIW8XmbjFH1JPU8nWnkWl_LVSDMh-xIEgixynguHH9W0eNZ2V5idhrxZZttR%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control: no-cache, private
content-type: text/html
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0F90
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEFrHEX93rtl3kQyPC24q9Vg&google_cver=1&google_push=AYg5qPIjbgUgt5K5uDZhGDsR2pqyP-9eqB05wJMF-u05aL_zuvaCqVdTsr0Jo8zwatMEuLQS25JxoWj...
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=8&google_gid=CAESEFrHEX93rtl3kQyPC24q9Vg&google_cver=1&google_push=AYg5qPIjbgUgt5K5uDZhGDsR2pqyP-9eqB05wJMF-u05aL_zuvaCqVdTsr0Jo8zwatMEu...
https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=wLktaf3oSuaBxLoWL6OJr2EJjeU

170 B
188 B

42ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=wLktaf3oSuaBxLoWL6OJr2EJjeU

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=wLktaf3oSuaBxLoWL6OJr2EJjeU
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0F90
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESENPkY5J0wq_kX3ASEwcdk28&google_cver=1&google_push=AYg5qPKSZanvjWlx_DyImMhvONwkjWLgbncxgyAwbmDi97OKTpnttG-ODOUjaUX01pwESm6iqwNkSdr_XIhN7hDdQFX2...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESENPkY5J0wq_kX3ASEwcdk28&google_cver=1&google_push=AYg5qPKSZanvjWlx_DyImMhvONwkjWLgbncxgyAwbmDi97OKTpnttG-ODOUjaUX01pwESm6iqwNkSdr_XIhN7h...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKSZanvjWlx_DyImMhvONwkjWLgbncxgyAwbmDi97OKTpnttG-ODOUjaUX01pwESm6iqwNkSdr_XIhN7hDdQFX2XSWPxQlv&google_hm=4aGekuieRNGGK6PAFxBJBg==

170 B
188 B

40ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKSZanvjWlx_DyImMhvONwkjWLgbncxgyAwbmDi97OKTpnttG-ODOUjaUX01pwESm6iqwNkSdr_XIhN7hDdQFX2XSWPxQlv&google_hm=4aGekuieRNGGK6PAFxBJBg==

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKSZanvjWlx_DyImMhvONwkjWLgbncxgyAwbmDi97OKTpnttG-ODOUjaUX01pwESm6iqwNkSdr_XIhN7hDdQFX2XSWPxQlv&google_hm=4aGekuieRNGGK6PAFxBJBg==
date: Tue, 03 Aug 2021 18:41:41 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0F90
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEP2Bs998DaCJLQ_P0OdZwNY&google_cver=1&google_push=AYg5qPJ81b8gncQxX0ebhOqWLj4WAiIsVyNJMFxU3kPuTcNDQtmTF-INN4obl8f0v24AYtrd_GGFQKe6...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEP2Bs998DaCJLQ_P0OdZwNY&google_cver=1&google_push=AYg5qPJ81b8gncQxX0ebhOqWLj4WAiIsVyNJMFxU3kPuTcNDQtmTF-INN4obl8f0v24AYtrd_GG...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MzczNjY2NzYzMjkxMTQ2MTUw&google_push=AYg5qPJ81b8gncQxX0ebhOqWLj4WAiIsVyNJMFxU3kPuTcNDQtmTF-INN4obl8f0v24AYtrd_GGFQKe6...

170 B
188 B

39ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MzczNjY2NzYzMjkxMTQ2MTUw&google_push=AYg5qPJ81b8gncQxX0ebhOqWLj4WAiIsVyNJMFxU3kPuTcNDQtmTF-INN4obl8f0v24AYtrd_GGFQKe6eMYAjbeqpmtRZnuzaZkN

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MzczNjY2NzYzMjkxMTQ2MTUw&google_push=AYg5qPJ81b8gncQxX0ebhOqWLj4WAiIsVyNJMFxU3kPuTcNDQtmTF-INN4obl8f0v24AYtrd_GGFQKe6eMYAjbeqpmtRZnuzaZkN
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0F90
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESELEvz_qP795XqOp7P9EKkeM&google_cver=1&google_push=AYg5qPIkhjkNWaPQJStXgSB6lK30nq9dHz0v0zQ-gc7rDCbB8JdJowgp4KfasmrFJTAzg1bzyroDrJUVfX18FvxCSh4A6I8yH8Oz
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIkhjkNWaPQJStXgSB6lK30nq9dHz0v0zQ-gc7rDCbB8JdJowgp4KfasmrFJTAzg1bzyroDrJUVfX18FvxCSh4A6I8yH8Oz&google_hm=Pcm5C7I_jpG_7DaEbcYsZg==

170 B
188 B

39ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIkhjkNWaPQJStXgSB6lK30nq9dHz0v0zQ-gc7rDCbB8JdJowgp4KfasmrFJTAzg1bzyroDrJUVfX18FvxCSh4A6I8yH8Oz&google_hm=Pcm5C7I_jpG_7DaEbcYsZg==

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:40 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIkhjkNWaPQJStXgSB6lK30nq9dHz0v0zQ-gc7rDCbB8JdJowgp4KfasmrFJTAzg1bzyroDrJUVfX18FvxCSh4A6I8yH8Oz&google_hm=Pcm5C7I_jpG_7DaEbcYsZg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: a3ao7mv1de0mea58gbdtfcds1qag0l5m

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 0F90
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEPqAO0qIVwKaIzaITQMZO94&google_cver=1&google_push=AYg5qPKqltNtjZp4uL9GNqfwWg-g7VnGPPhDQHrByUr1YAlPI_ki-wwOKAwcoj_e_j4zget1yBW...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JXRVIxQUMtQy0xNzhS&google_push=AYg5qPKqltNtjZp4uL9GNqfwWg-g7VnGPPhDQHrByUr1YAlPI_ki-wwOKAwcoj_e_j4zget1yBWNS2lEiA_Ntk9Xx8Ch9ZFg0RO5

170 B
188 B

39ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JXRVIxQUMtQy0xNzhS&google_push=AYg5qPKqltNtjZp4uL9GNqfwWg-g7VnGPPhDQHrByUr1YAlPI_ki-wwOKAwcoj_e_j4zget1yBWNS2lEiA_Ntk9Xx8Ch9ZFg0RO5

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1JXRVIxQUMtQy0xNzhS&google_push=AYg5qPKqltNtjZp4uL9GNqfwWg-g7VnGPPhDQHrByUr1YAlPI_ki-wwOKAwcoj_e_j4zget1yBWNS2lEiA_Ntk9Xx8Ch9ZFg0RO5
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Expires: 0

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 0F90 0
12 B 39ms
38ms Image
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KXNsDCt3NA3RQqvmK0907zBNs4xCrljkSOU3c53xv3QIZURhgHTUJredmyXAmI9kwe_c2Q

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:41 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 42ms
41ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021072901&jk=2427807378415322&bg=!a2ilaCzNAAals0SOpbM7ACkAdvg8WsQO8PDRnCc-X20EptmAbCKY_XjeNzy2zat6qczHev9gql2a6wIAAAFdUgAAACpoAQcKASKJLGUrJLi8YfBAB-Tx4fsfeIpmuXF429Hcr_N0LJqP5phvX1ANKArfzV_2t3nxS9A_SyvjcrK8Kc-ApvmfBf5ME7ECo1b8ap02l94aXuvo7gJqkPvOI2tkwEKMqBfzQxa-utD59xlgkeMJ8bS0jZtW7t8Jw4AiMOeJnTPD7xBecPo-WfNy7lwC9i6gIoJAsBChk02sAgB6uMfJOtgNs3xA46BQfOlzFno1l3suTQCHcl85ixMPd8yImoUS8ynQ8KXh3icJjVs0jaB4o8oma58uaMH1zKtEzHZJztfHHVluf4TiLwE90Y_E5_X0mnFf4yDNLgRNjFoVGW6J0MS-YbToS_oJgHBc8JX6rDkiqjkTxkzAXormsw8-HsD7jommWCNbAZkCb1kgrj2QdenvxxmH7O22owtNGoKnJb7TC_gw0ZZv_GZlSkjSPldH25iyGeqfe-v8yN1VsmJ-fL8BLmv-9HSCNgwfkqaTKEUr_HTZQETM0pzpCUg_iAS_uyVMPIiOeS5qtyUlyHdrK_kIJjnHuOcthRlUbng1kL-Ead-IpUsJ8NDlHDdrmauX3TURJxojglRVv_QrwPxctsmtcJ6WOWMHNhnWlKcVB6-ZbzFz6WnFvorMo1CwZgTg1SESW8p5RXO9H41ZFSxOGFV1QklQZ34wM3WbIMApjrKABWVggYKev9uQul5VEb7IXdXr_Ynwvb1klkKqDKtyWQDBJp0riGSLqdsb65bAsydIxsYQ4ywQZ60MPqpZVweoFsnS-9iwjob7Nkfa-uhdque4Y3uf3HH6Kxja1TRV4JJf6wP4UUsU7jMLw8Okc4koffvDrx0gcdEPpt-YqLGPIBED1lZK-7aaNN5WNrdTaAY6YdHAShDXJyoS4uuT-lbhekMqsVlBKCL72XL5CXedP1jN_jbuxMS8-Wjf_eldOPWBJuufLbo_MIvLFw0MgXvMZstcIz83PDHoZfCKUATk72D3lFu4M7j9Eyrb7XDaNtDSFIkzyMyQSXjGfyylYhIHZ1H3z3vARam_vwwCaUxN7etB-m4M5V7_AimU8n6XiDkkME1Iy8FSNTFMroXC-yqY7YVsX0kanmk1ZR2Ti3AhJ6ZWkcG7zemTGUtu0zy9HMr22zcLFlqxd-22Rg4_I5gjOGblMkvdqFpLZg4kjXRGHx9vaMlB--G-QzO4VcGLi3eehyq2NO7rf-7KGwiPt12Vvnu2snha0yUL

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2CB8 0
20 B 42ms
41ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BH8Mj5I0JYfvNF9jN7_UP9uCVwAYAAAAAOAHgBAI&bg=!XV6lXhrNAAals0SOpbM7ACkAdvg8WnIrlfiG6b1hDM6Y-iz3ydXbTIKwnxJTdrzc3QEdkOZN506NdAIAAAF9UgAAAD9oAQcKAGDu5dZiMkTcFFTbqYnzPs7fVZU578hvhY8XAoR9WlotVZnUCasOperMNQ3BInyYKPI5rCk6I70BwVT7DYV3RX7JGCTtkn35AAOwXBSfRlGckhISFANRCjxYWe3HBmsM562ZArzV4VWWQRxUCaEKFpu50lXzYzBfZTONd6lGz9Hh74xCHHUJGTq16zm-gRzD3EXh4AaiAGz2WKP6X_fNX5oPQFoPIDuEQCv_WFfmjWUvlJNoI33nnLgHmbC6Pkmqwyq4EKQiL4wIcGoeMqGKse74JLC3teZXX8W2zUDjhLleoVfzSzuxj2cJxYg763J_U5p37KcLijH_UM7oXCIv0x-DI8fZIC8pwIwtWbN3FfbskNBS3MzTnBhhyKEGmTqxPeibUe6wxhyKen2PeltotCHbanAdtqZkt6h7yrhrEDQEUmjRNIX-vot0rao8OUHJN4MhSUdbdevVXDLxjRtQ6FeuYXTbbIJ7Tii9CAA7nAuyjB0v8IsQxvt2AyopA-6fv48jLHkPEp6PH1oPSXgDqsF-GCIfIdHj0ZZEHkOrQKDTzLheErCP9ytTWO74n2E-eCC4Vu6TjbIUAbra_IySKBZpU3Q91r5kfgqUv2T8VlVfu9mNGoeCFF3cfgRFPin39vyEJYFDjEH5-92bcEzx7GH1HHtBg37Ze7hst-1gjvLHeV-u0tZTWBPSOAnpyRIJLxxPe4pm1Sbm_b0NqNv1DwP9d4Jv_EGMcxMycPzFD2tVCmKIdASzB59xohEW9-uGobZXul4ITx4bfoalzTX_rADgG0HRYT8LD2LNPoaUY_W5Uf8Lmbl-cFIpaQltDOD3wbclLsUZAQQUqWffCS3j6bEldQ2sJ7uDiW8NEYC5hSAgrsrKPovOR8wCsNGBki9DFduK7FzRN53swYHLcNsAyr6d7aaig2zyROTa0QdvlDgzPW_VrXmo4i0Z6IgH7fXpqDtpYU78aiKTmeUfjjwZI1iHUVMa401U55vVox0jqiHwHE_m1mpYLul-6apdVmFr17C3HJkCIx56_5ATy0qA2yndh2dW10Yvu-RVbPsnkC_I

Requested by

Host: de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
URL: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BC3F 0
20 B 42ms
42ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BiuCK5I0JYemkF8fP7_UPw6SY8AgAAAAAOAHgBAI&bg=!Xl2lXRnNAAals0SOpbM7ACkAdvg8WiNJwgAv3gqfNpE3pPyLzKwfojm5FPshHWA5mg2lkCrph7pS_gIAAAFLUgAAACZoAQcKAAYD8FxghayZArtLc5ViZIIoTWeRvQZwRp8ZbNtHELNHhQNDuff9kjW6SE3MB7d-v40-xPVLMeU0e1TLvD94R_Fcas23MglkdoNcCUNrKiw4mJGnfmAE1BZxworwe0nyaQV4JgTz9GUCDKkTKpvYStDiIOc3JTJtC_4Ox9hXLS504nnVTu7hzz5pcGGCb352BWzsMbky_y9BvjKnebaboWa6-bUwk9cXOkjsFyJlhAIJ4Ue96biDPbi0LveyiLea3lU_Jfn7aHCNUbnlsVWLND485bOUsxIWQZ3y7HRtItplFxDSE0mj2I9kVg0ezlZlnyaRC0XRxyNKTMAxXhfqmBMvtqF0l6_QD-fsNt8BvFDWu_VlqM-up35BteqMH_C17GJPHYABN-jQp2rSsT9rLJqkO0mnasuTTwWabAcnB_PxKta_xSl_s1Magc2dIM8uPyb-AXDOjav5HJF8uSWp6l7x12F8-bM46Cv8OESfo6RZNkHAFt3QQiNECjcVowqVBeX-ZtSGwOgFcxPwaqiiTFBnWfEb8owoO1rIJEjrGx_73GKl3UnLj8RmoVuQ0sBczVJzCtcWp-kWFfJzH0etRCzGywyk9gq32NLTe5jrLKa7iST8RtXaBV6zuega521hGbXJgnokF4-X0kGdAO0YJgx8FdHbnnSSCPZIoguCoH2kjLQo-xh-xtjuNPuwf-DuLDbh8x-6whuNqQTBDQFATUHjbe2qH1kGkUN4_py8URRPCGyYZ-fBKWX88pRMcJ1zdqvLs09uIZah7mHO3cjThe6N2qZ0zMm8PkZweqcoPx1DZqr3vtw4ru4tI1iw2Wsv9LcJdwYjREdUpa9uYECV0uLF1t_aABPAX6ZFqfzmzLxZxmhffi5U-kpMLsPA_cQBjJJ5rc5UzDn9ZhR_qczZJHW-e5-2ABHl5jvgSz4FEVzlVlyyl4Q

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame ADC3 0
20 B 45ms
44ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BJTRQ5I0JYcWQGduKjuwP4puLoAcAAAAAOAHgBAI&bg=!cnGlcTXNAAals0SOpbM7ACkAdvg8WlNSprwv2B3eRWdInDof2ZIBlLa9iIkI-n9T2PUKbNxvvScQfAIAAAErUgAAAA1oAQcKAAMd5LiZAr7JMGwvPWc9qRKTJJGdjxRS2zM-VMpCUDaPfNxAUZ40Zi7zS9Q9kVTLxoK6ZVmDVq6PH2lz40X5oKjCn8mWnxMcP5N68sEATGRJQwNt6HEqFoCdjXoH0SBMHdtgBQyfnRi8vX0n6UBFSFw5GfPv2HZpEnXzMPjZCzBAWzJ30b8SVlcJRWrBkuQS3wCd7uqEsSzr2WweWrB9qI6LqHVrY7Z3Dvnse-mNMds_km2UBSk_vxEWhUQSAQMdselRnxgs6otg5qWk_bQrKqpcjT136H-8a7V-MINXI83a8H-kUxYEN4m8vAnuk-8O8K1fDHlxCfKmZNL3AVRPt2JKtfAnUck6nY8e3GoY-5nNPZjzsU6L6oiChuUq5uszPLw7Ulwz4D9MDobyAcu3LylVM0m_SjC--ADo0pzt7F_V5PNhbzIudolchsbIOUlYFPYl_abSw6PHmuaABxjSjwebRpAYVbFZ_LTLn-UfUTD3rO_5Uy90KXpvET84f46hyzLueGKK1M7_5fjhM2diut2qkmnes_IlciUYzB9majRMzSdcAJV6toq2n65y-yEy_RC52cMHZORgRwLY2de3YADCCMBZ3apNDNb0ciz5PcnI1V8lhz9-XMiozR177TTWdYXwvOHWBo9sNXP9k9Y_8Wq3Mk5GFPApM_wRLMSRvtWRTTKcny77Mn4JUzfJdBxlBN3jdIasur_dvLcQpZHmoJX7pUsUOqd5-UWjhsdwDZDMdsl3qLEewbZD2WnIKu0WK1qy4qoQGaqo7pUFluJCVeIZW6XUwyDdkq2PL4CaowLkHztzrN1Lx5-znvHtPJJR2zi5R46VxHgdk6wyvukaCJ6LWj92JKmCncIlI6XBQHgJ85sfu6Pnij86i3H9ITsrUlTJzPbN9Cs46WXEtBTU9co1u-Mke103r9abDphUEbQBVWeFDdc

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

event.png
tps20239.doubleverify.com/ Frame 8FE2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=doubleverify_ddp&google_ula=7327243&google_cm&google_hm=**&google_redir=https%3A%2F%2Ftps20239.doubleverify.com%2Fevent.png%3Fimpid%3D791f6e0863304433a...
https://tps20239.doubleverify.com/event.png?impid=791f6e0863304433a561c1547a64604f&gdpr=&gdpr_consent=&dvpx_gfbc=1&cbust=1628016101485407&google_error=10

67 B
348 B

90ms
29ms

Ping
image/png

213.254.244.16
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20239.doubleverify.com/event.png?impid=791f6e0863304433a561c1547a64604f&gdpr=&gdpr_consent=&dvpx_gfbc=1&cbust=1628016101485407&google_error=10
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.16 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:41 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=0
Content-Length: 98
Expires: 8/2/2021 6:41:41 PM

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://tps20239.doubleverify.com/event.png?impid=791f6e0863304433a561c1547a64604f&gdpr=&gdpr_consent=&dvpx_gfbc=1&cbust=1628016101485407&google_error=10
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 370
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E309 42 B
64 B 47ms
46ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssnzet2YQymufCzYn1wmtC5nMVD-tXlqpgqols6G4WnnBaCXGKjiVMm2C6DjCHKUfVcFySS1kyi7HadExgHro6ebRmg4GdgHh_o9uw-ffW80pJH457HYSAo2uRPpw&sai=AMfl-YSt4IEuR5ZeLHl6WOko0OoRlm-h0pOix6i7eDJ-9r2YaivKZoVWWsTPR7icNsgTynLT8VH21cdDxP7A-vMFcFU3P0J5EAVzHYfstLBUTdTG3SjIGO4r2Jc8RhI&sig=Cg0ArKJSzF_iwaNj_B_lEAE&cid=CAASEuRoHOcpiQSs1Bh2E55jdewiBg&id=lidar2&mcvt=1000&p=93,302,133,343&asp=93,302,133,343&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210802&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1352494781&rs=4&met=ie&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1628016100244&dlt=12&rpt=376&isd=0&lsd=0&msd=0&r=v&speed=1

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK g Show response
capi.connatix.com/rtb/ Frame 57EC 114 B
430 B 133ms
133ms XHR
multipart/form-data 18.221.6.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/rtb/g?v=125379
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.186 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-186.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: 28a6d7bd8f560a1d2766cccec474186e6b25eec9c211925c1dea958d5487fa42

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Tue, 03 Aug 2021 18:41:41 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.obsev.com
transfer-encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H2 206 0.mp4 Show response
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/ Frame 57EC 548 KB
548 KB 92ms
92ms XHR
video/mp4 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ddc168d627ad9837143cbd119bf525c1c637fd851b2b07392fa208b203cfa67c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=1159320-1720189

Response headers

date: Tue, 03 Aug 2021 18:41:42 GMT
last-modified: Tue, 27 Jul 2021 23:21:17 GMT
age: 105747
etag: "8ca2d7369b9eb9aa6376ae9d5a1c0247"
access-control-max-age: 86400
content-type: video/mp4
Content-Range: bytes 1159320-1720189/3904550
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
accept-ranges: bytes
access-control-allow-origin: *
Content-Length: 560870

OPTIONS
H2 200 0.mp4
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/ Frame 0
0 29ms
29ms Preflight 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/cf6cfc03-bc45-4476-aade-e3f0d78dd929/0.mp4
Protocol: H2
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://www.obsev.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

retry-after: 0
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Tue, 03 Aug 2021 18:41:42 GMT
access-control-max-age: 86400
cache-control: public,max-stale=31557600,stale-while-revalidate= 31557600, immutable,max-age=31557600
access-control-allow-origin: *
content-length: 0

POST
H/1.1 200
OK bsevent.gif
tps20516.doubleverify.com/ Frame 6C05 807 B
1 KB 30ms
29ms Ping
image/gif 213.254.244.17
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20516.doubleverify.com/bsevent.gif?impid=3f1f8de4618c4e79beb89f593d7800a9&pltfrm=Linux%20x86_64&cbust=1628016102784868
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal98.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.17 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:42 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
Vary: Accept-Encoding
Content-Type: image/gif
Access-Control-Allow-Origin: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 860
Expires: 8/2/2021 6:41:42 PM

POST
H/1.1 200
OK event.png
tps20239.doubleverify.com/ Frame 8FE2 67 B
491 B 30ms
30ms Ping
image/png 213.254.244.16
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20239.doubleverify.com/event.png?impid=791f6e0863304433a561c1547a64604f&gdpr=&gdpr_consent=&dvp_gdpr_Error=3&dvp_gdv2_Error=3&dvp_t1stMsgD=70&vdur=337&eoid=6&msrjs=1664&pltfrm=Linux%20x86_64&vit=2&isvelg=1&engms=1&engisel=1&ttfurm=2363&cbust=1628016103485377
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1664.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.16 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:43 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://de33618df54991e0fe74e5d932853ea3.safeframe.googlesyndication.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 8/2/2021 6:41:43 PM

GET
H2 200 auction Show response
tlx.3lift.com/vast/ Frame 57EC 23 B
397 B 31ms
31ms XHR
application/xml 18.196.0.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tlx.3lift.com/vast/auction?inv_code=obsev_prebid_preroll_ROS&format=REPLACE_ME&width=401&height=226&minDuration=REPLACE_ME&maxDuration=REPLACE_ME&contentLanguage=REPLACE_ME
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.196.0.40 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-0-40.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 721f657d81b06f6159e9efdc3f4558def22f165f3b8fcefe81530bb98d6ba0b3

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: https://www.obsev.com
date: Tue, 03 Aug 2021 18:41:43 GMT
access-control-allow-credentials: true
x-auction-status: 3
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
content-length: 23
content-type: application/xml; charset=utf-8

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
542 B 59ms
58ms XHR
application/json 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=j3v367e&fmt=json
Requested by: Host: 506.hostedprebid.com
URL: https://506.hostedprebid.com/8L6B/Axf3_K67O_jS5l_GgFd_U2ui/jita.js?dfp=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 18d2cd5a536781cf422ed594ed3de8d32537ac5591f2a9a1ea2bc58ae1513cc1

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.obsev.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Thu, 02 Sep 2021 18:41:44 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame DCEA 52 KB
17 KB 142ms
83ms Document
text/html 2.18.232.130
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-130.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.obsev.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: "5fc7ff8f-cf34"
Server: nginx/1.13.10
Access-Control-Allow-Origin: *
Content-Type: text/html
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Wed, 04 Aug 2021 18:41:46 GMT
Date: Tue, 03 Aug 2021 18:41:44 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2

200

pd Show response
eu-u.openx.net/w/1.0/ Frame 2433
Redirect Chain

https://eu-u.openx.net/w/1.0/pd?plm=10&ph=26ba2c35-e795-475f-bb65-56b378952c90&gdpr=0
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=26ba2c35-e795-475f-bb65-56b378952c90&gdpr=0

1006 B
851 B

31ms
30ms

Document
text/html

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=26ba2c35-e795-475f-bb65-56b378952c90&gdpr=0
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.211.0 /
Resource Hash: b42f16c81c99996cfb656aa310ae02229e5b2c5352bbd4b54a9f8e509589353a

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?cc=1&plm=10&ph=26ba2c35-e795-475f-bb65-56b378952c90&gdpr=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=e57c688b-c1a9-0c45-1f07-badf74935894|1628016104
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

vary: Accept, Accept-Encoding
set-cookie: i=e57c688b-c1a9-0c45-1f07-badf74935894|1628016104; Version=1; Expires=Wed, 03-Aug-2022 18:41:44 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1628016104|mOgeginskin0vNomiygu; Version=1; Expires=Wed, 18-Aug-2021 18:41:44 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.211.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 03 Aug 2021 18:41:44 GMT
content-type: text/html
content-length: 542
content-encoding: gzip
via: 1.1 google
alt-svc: clear

Redirect headers

set-cookie: i=e57c688b-c1a9-0c45-1f07-badf74935894|1628016104; Version=1; Expires=Wed, 03-Aug-2022 18:41:44 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.211.0
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=26ba2c35-e795-475f-bb65-56b378952c90&gdpr=0
date: Tue, 03 Aug 2021 18:41:44 GMT
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 8C5B 0
0 366ms
112ms Document
text/plain 67.202.110.23
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=anEIgw7emr6ykqaKkGJozW&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.23 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip23.67-202-110.static.steadfastdns.net
Software: 33XP003 /
Resource Hash

Request headers

:method: GET
:authority: ssc-cms.33across.com
:scheme: https
:path: /ps/?m=xch&rt=html&ru=deb&id=anEIgw7emr6ykqaKkGJozW&gdpr_consent=undefined&us_privacy=undefined
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

x-33x-status: 2000208
server: 33XP003
date: Tue, 03 Aug 2021 18:41:44 GMT

GET
H2 200 sync Show response
eb2.3lift.com/ Frame EF8A 1 KB
1 KB 124ms
39ms Document
text/html 76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 9c21e3e444b37e5eab3a73a268352a072cf462a8ad33d0458fba502aa34ecb4d

Request headers

:method: GET
:authority: eb2.3lift.com
:scheme: https
:path: /sync?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: tluid=4514043653703831010
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
content-type: text/html; charset=utf-8
content-length: 478
set-cookie: sync=CgoIgQIQiqfJ6rAvCgoIkQIQiqfJ6rAvCgoI4gEQiqfJ6rAvCgoIkgIQiqfJ6rAvCgoI5gEQiqfJ6rAvCgoIhwIQiqfJ6rAvCgkIOhCKp8nqsC8KCQgLEIqnyeqwLwoJCF8QiqfJ6rAvCgkIHxCKp8nqsC8=; Max-Age=7776000; Expires=Mon, 01 Nov 2021 18:41:44 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=4514043653703831010; Max-Age=7776000; Expires=Mon, 01 Nov 2021 18:41:44 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

GET
H2 200 showad.js Show response
ads.pubmatic.com/AdServer/js/ Frame B6CF 38 KB
14 KB 34ms
34ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 9005ef18fcfb3897cd13c7ec73f90d2b0da0cc7d6153be58cdbe90ad5e2741c8

Request headers

:method: GET
:authority: ads.pubmatic.com
:scheme: https
:path: /AdServer/js/showad.js
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

last-modified: Tue, 15 Jun 2021 06:07:52 GMT
etag: "13006b6-974e-5c4c7cb53d8cb"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 13946
content-type: text/html; charset=UTF-8
cache-control: public, max-age=91925
expires: Wed, 04 Aug 2021 20:13:49 GMT
date: Tue, 03 Aug 2021 18:41:44 GMT
vary: Accept-Encoding

GET
H2 204 index.html
cdn.districtm.io/ids/ Frame 6F2D 0
0 38ms
29ms Document
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/index.html
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: cdn.districtm.io
:scheme: https
:path: /ids/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Origin
access-control-allow-methods: GET, HEAD, POST, OPTIONS
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 6791ae8bb8371ea1-AMS

GET
H/1.1 204
No Content cs
sync.rtk.io/ Frame ADBC 0
0 443ms
101ms Document
text/plain 147.75.107.82
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.rtk.io/cs?ref=https%3A%2F%2Fwww.obsev.com
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 147.75.107.82 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash

Request headers

Host: sync.rtk.io
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.obsev.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

Server: nginx/1.20.1
Date: Tue, 03 Aug 2021 18:41:44 GMT

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame ED6A 281 B
554 B 130ms
29ms Document
text/html 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.42.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.obsev.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 23 Feb 2021 20:47:52 GMT
ETag: "402b0-119-5bc0708346e00"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 03 Aug 2021 18:41:44 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 68EC 0
0 340ms
113ms Document
text/plain 67.202.110.23
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=d808Gu7emr6ykqaKkGJozW&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.23 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip23.67-202-110.static.steadfastdns.net
Software: 33XP005 /
Resource Hash

Request headers

:method: GET
:authority: ssc-cms.33across.com
:scheme: https
:path: /ps/?m=xch&rt=html&ru=deb&id=d808Gu7emr6ykqaKkGJozW&gdpr_consent=undefined&us_privacy=undefined
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

x-33x-status: 2000208
server: 33XP005
date: Tue, 03 Aug 2021 18:41:44 GMT

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame D1C2 0
0 339ms
112ms Document
text/plain 67.202.110.23
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=cN-KiO7e0r6yoPaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.23 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip23.67-202-110.static.steadfastdns.net
Software: 33XP002 /
Resource Hash

Request headers

:method: GET
:authority: ssc-cms.33across.com
:scheme: https
:path: /ps/?m=xch&rt=html&ru=deb&id=cN-KiO7e0r6yoPaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

x-33x-status: 2000208
server: 33XP002
date: Tue, 03 Aug 2021 18:41:43 GMT

GET
H2 200 usersync.html Show response
cdn.undertone.com/js/ Frame BB60 8 KB
3 KB 51ms
37ms Document
text/html 13.224.96.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.undertone.com/js/usersync.html
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.96.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-96-105.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f0c6c17bbefb440a7e7ee03a4363aeba33a7c57345af065c670848e8fd40a4b5

Request headers

:method: GET
:authority: cdn.undertone.com
:scheme: https
:path: /js/usersync.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

content-type: text/html
x-amz-replication-status: COMPLETED
last-modified: Thu, 08 Jul 2021 07:16:59 GMT
x-amz-version-id: 6994YJvhVK.G.S8wNruUeW.ksGihHjjx
server: AmazonS3
content-encoding: gzip
date: Tue, 03 Aug 2021 00:53:28 GMT
etag: W/"71d386aa3a4939b04d8b4f9c237f4eaf"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 6b0e09b8a7d995016df1513b4b11c17e.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: 9pUsm5qstozXYzPudGaNwbpvcTZXUq2StsIOj-jlYQV6CIjjUlULyg==
age: 64097

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame B096 0
0 336ms
113ms Document
text/plain 67.202.110.23
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=c_qS1a7eOr6ykqaKkGJozW&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.110.23 Crown Point, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip23.67-202-110.static.steadfastdns.net
Software: 33XP004 /
Resource Hash

Request headers

:method: GET
:authority: ssc-cms.33across.com
:scheme: https
:path: /ps/?m=xch&rt=html&ru=deb&id=c_qS1a7eOr6ykqaKkGJozW&gdpr_consent=undefined&us_privacy=undefined
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

x-33x-status: 2000208
server: 33XP004
date: Tue, 03 Aug 2021 18:41:44 GMT

GET
H2 200 usersync.html Show response
ad-cdn.technoratimedia.com/html/ Frame A82B 17 KB
6 KB 185ms
62ms Document
text/html 152.199.22.191
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ad-cdn.technoratimedia.com/html/usersync.html?src=prebid_prebid_4.29.0
Requested by: Host: d19m55ur8rme4m.cloudfront.net
URL: https://d19m55ur8rme4m.cloudfront.net/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.22.191 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frd/E2F8) /
Resource Hash: 62f3a786e694b5c0ea068b3267e019ec7de62fb98fbebffdfbd425f1cd99a86e

Request headers

:method: GET
:authority: ad-cdn.technoratimedia.com
:scheme: https
:path: /html/usersync.html?src=prebid_prebid_4.29.0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.obsev.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.obsev.com/

Response headers

content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
age: 407
cache-control: max-age=900
content-type: text/html; charset=UTF-8
date: Tue, 03 Aug 2021 18:41:44 GMT
etag: "450f-5c7a90520f640"
expires: Tue, 03 Aug 2021 18:56:44 GMT
last-modified: Wed, 21 Jul 2021 21:40:33 GMT
p3p: CP="ALL DSP COR TAIa PSAa PSDa IVAa IVDa CONi OUR IND UNI"
server: ECAcc (frd/E2F8)
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-varnish: 172048058
content-length: 5566

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Dc2bfe861-921f-428a-b19b-26d308215252%26D%3D%26bidder%3Dpubmatic%26uid%3D%23PM_USER_ID
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Dc2bfe861-921f-428a-b19b-26d308215252%26D%3D%26bidder%3Dpubmatic%26uid%3D%23PM_USER_ID
https://prebid.a-mo.net/setuid?A=c2bfe861-921f-428a-b19b-26d308215252&D=&bidder=pubmatic&uid=174138C7-1149-463A-BC49-6E10DB7AC34B

0
120 B

110ms
108ms

Image
text/plain

147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=c2bfe861-921f-428a-b19b-26d308215252&D=&bidder=pubmatic&uid=174138C7-1149-463A-BC49-6E10DB7AC34B
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:43 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 4
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid?A=c2bfe861-921f-428a-b19b-26d308215252&D=&bidder=pubmatic&uid=174138C7-1149-463A-BC49-6E10DB7AC34B
date: Tue, 03 Aug 2021 18:41:43 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Dc2bfe861-921f-428a-b19b-26d308215252%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID
https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Dc2bfe861-921f-428a-b19b-26d308215252%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID&sovrn_retry=true
https://prebid.a-mo.net/setuid?A=c2bfe861-921f-428a-b19b-26d308215252&D=&bidder=sovrn&uid=864b059c1ca982e654d2591e

0
142 B

137ms
137ms

Image
text/plain

147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=c2bfe861-921f-428a-b19b-26d308215252&D=&bidder=sovrn&uid=864b059c1ca982e654d2591e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

Date: Tue, 03 Aug 2021 18:41:44 GMT
Server: nginx
Location: https://prebid.a-mo.net/setuid?A=c2bfe861-921f-428a-b19b-26d308215252&D=&bidder=sovrn&uid=864b059c1ca982e654d2591e
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap6ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Dc2bfe861-921f-428a-b19b-26d308215252%26D%3D%26bidder%3Dindex_rtb%26uid%3D
https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Dc2bfe861-921f-428a-b19b-26d308215252%26D%3D%26bidder%3Dindex_rtb%26uid%3D&s=191503&C=1
https://prebid.a-mo.net/setuid?A=c2bfe861-921f-428a-b19b-26d308215252&D=&bidder=index_rtb&uid=YQmN6MJp12DDSYPvnUNq9AAA%261196

0
118 B

108ms
105ms

Image
text/plain

147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=c2bfe861-921f-428a-b19b-26d308215252&D=&bidder=index_rtb&uid=YQmN6MJp12DDSYPvnUNq9AAA%261196
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:43 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 3
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:44 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://prebid.a-mo.net/setuid?A=c2bfe861-921f-428a-b19b-26d308215252&D=&bidder=index_rtb&uid=YQmN6MJp12DDSYPvnUNq9AAA%261196
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 321
Expires: Tue, 03 Aug 2021 18:41:44 GMT

GET
H2

204

verizon_video
prebid.a-mo.net/setuid/
Redirect Chain

https://pixel.advertising.com/ups/58474/sync?redir=true&gdpr=0&gdpr_consent=&uid=c2bfe861-921f-428a-b19b-26d308215252
https://pixel.advertising.com/ups/58474/sync?redir=true&gdpr=0&gdpr_consent=&uid=c2bfe861-921f-428a-b19b-26d308215252&verify=true
https://ups.analytics.yahoo.com/ups/58474/sync?redir=true&gdpr=0&gdpr_consent=&uid=c2bfe861-921f-428a-b19b-26d308215252&apid=UP735c5fff-f48a-11eb-b96a-02024cce8e0c
https://ups.analytics.yahoo.com/ups/58474/sync?redir=true&gdpr=0&gdpr_consent=&uid=c2bfe861-921f-428a-b19b-26d308215252&apid=UP735c5fff-f48a-11eb-b96a-02024cce8e0c&verify=true
https://prebid.a-mo.net/setuid/verizon_video?uid=UP735c5fff-f48a-11eb-b96a-02024cce8e0c&gdpr=0&gdpr_consent=

0
124 B

109ms
107ms

Image
text/plain

147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/verizon_video?uid=UP735c5fff-f48a-11eb-b96a-02024cce8e0c&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

Date: Tue, 03 Aug 2021 18:41:44 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://prebid.a-mo.net/setuid/verizon_video?uid=UP735c5fff-f48a-11eb-b96a-02024cce8e0c&gdpr=0&gdpr_consent=
Connection: keep-alive
Content-Length: 0

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3Dc2bfe861-921f-428a-b19b-26d308215252%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253Dc2bfe861-921f-428a-b19b-26d308215252%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID
https://prebid.a-mo.net/setuid?A=c2bfe861-921f-428a-b19b-26d308215252&D=&bidder=appnexus&uid=2238694250402211015

0
154 B

109ms
108ms

Image
text/plain

147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=c2bfe861-921f-428a-b19b-26d308215252&D=&bidder=appnexus&uid=2238694250402211015
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.obsev.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:43 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 4
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:44 GMT
X-Proxy-Origin: 159.48.55.4; 159.48.55.4; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: d497117d-45d1-49e9-80f2-69738faf6e05
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://prebid.a-mo.net/setuid?A=c2bfe861-921f-428a-b19b-26d308215252&D=&bidder=appnexus&uid=2238694250402211015
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame B6CF 2 KB
3 KB 64ms
62ms Script
text/html 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=48111719&p=159001&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 9e629cae6b71cd1e8b2416ada555b518c9533fc0632f0f91f53c69afb1833b6f

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 2433
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_
https://pm.w55c.net/ping_match.gif?scc=1&ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_
https://eu-u.openx.net/w/1.0/sd?id=537072979&val=TB7yBISA1MaZmg5

43 B
106 B

54ms
54ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537072979&val=TB7yBISA1MaZmg5
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=26ba2c35-e795-475f-bb65-56b378952c90&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.211.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
via: 1.1 google
server: OXGW/16.211.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:43 GMT
Server: PingMatch/v2.0.30-661-ga8ef792#rel-ec2-master i-09783869e9eb9ec2d@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security: max-age=604800; includeSubDomains
P3P: policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location: https://eu-u.openx.net/w/1.0/sd?id=537072979&val=TB7yBISA1MaZmg5
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 2433
Redirect Chain

https://x.bidswitch.net/sync?ssp=openx
https://x.bidswitch.net/ul_cb/sync?ssp=openx
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=openx&bsw_custom_parameter=83e71d96-ed50-4f15-993c-9f16f4e3f399
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=openx&bsw_custom_parameter=83e71d96-ed50-4f15-993c-9f16f4e3f399
https://x.bidswitch.net/sync?dsp_id=4&user_id=b0cc4dc1-346f-4211-8c0d-f0f5c51305e0&ssp=openx&expires=30&user_group=5&bsw_param=83e71d96-ed50-4f15-993c-9f16f4e3f399
https://us-u.openx.net/w/1.0/sd?id=537072968&val=83e71d96-ed50-4f15-993c-9f16f4e3f399

43 B
106 B

30ms
29ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072968&val=83e71d96-ed50-4f15-993c-9f16f4e3f399
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=26ba2c35-e795-475f-bb65-56b378952c90&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.211.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
via: 1.1 google
server: OXGW/16.211.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: //us-u.openx.net/w/1.0/sd?id=537072968&val=83e71d96-ed50-4f15-993c-9f16f4e3f399
date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 2433
Redirect Chain

https://ib.adnxs.com/getuid?https://eu-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://eu-u.openx.net/w/1.0/sd?id=537072399&val=2238694250402211015

43 B
106 B

29ms
29ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537072399&val=2238694250402211015
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=26ba2c35-e795-475f-bb65-56b378952c90&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.211.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
via: 1.1 google
server: OXGW/16.211.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:44 GMT
X-Proxy-Origin: 159.48.55.4; 159.48.55.4; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 15792fd9-d64b-40ff-a3db-e7e4caa4571f
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://eu-u.openx.net/w/1.0/sd?id=537072399&val=2238694250402211015
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

redir
rtb-csync.smartadserver.com/ Frame 2433
Redirect Chain

https://match.prod.bidr.io/cookie-sync/ox
https://match.prod.bidr.io/cookie-sync/ox?_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCalZFN0NFeHdBQUZrRHFuWmREZw&bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&b...
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABjVE7CExwAAFkDqnZdDg&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3...
https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp%2Cox&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AABjVE7CExwAAFkDqnZdDg&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_curre...

43 B
163 B

103ms
31ms

Image
image/gif

185.86.139.115
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AABjVE7CExwAAFkDqnZdDg&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=26ba2c35-e795-475f-bb65-56b378952c90&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.115 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
transfer-encoding: chunked
content-type: image/gif

Redirect headers

location: https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AABjVE7CExwAAFkDqnZdDg&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID
Date: Tue, 03 Aug 2021 18:41:44 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 2433
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=46386109-8de8-4200-8882-4b703fe6fbbf

43 B
106 B

30ms
30ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=46386109-8de8-4200-8882-4b703fe6fbbf
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=26ba2c35-e795-475f-bb65-56b378952c90&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.211.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
via: 1.1 google
server: OXGW/16.211.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Tue, 03 Aug 2021 18:41:47 GMT
Server: MT3 3820 7698daf master zrh-pixel-x31
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=46386109-8de8-4200-8882-4b703fe6fbbf
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 03 Aug 2021 18:41:46 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 2433
Redirect Chain

https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=f2UuwXEwe8BkYHzLeGQzyC0yLZ1kMiiaKmBF0xIG

43 B
106 B

40ms
39ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=f2UuwXEwe8BkYHzLeGQzyC0yLZ1kMiiaKmBF0xIG
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=26ba2c35-e795-475f-bb65-56b378952c90&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.211.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
via: 1.1 google
server: OXGW/16.211.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=f2UuwXEwe8BkYHzLeGQzyC0yLZ1kMiiaKmBF0xIG
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 2433
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=22
https://c1.adform.net/serving/cookie/match?CC=1&party=22
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=2417043623178615103

43 B
106 B

52ms
50ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=2417043623178615103
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=26ba2c35-e795-475f-bb65-56b378952c90&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.211.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
via: 1.1 google
server: OXGW/16.211.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
server: nginx
location: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=2417043623178615103
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 openx
match.adsrvr.org/track/cmf/ Frame 2433 70 B
264 B 50ms
49ms Image
image/gif 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/openx?oxid=36d057d2-682e-33b2-45d1-723710b46b69&gdpr=0
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=26ba2c35-e795-475f-bb65-56b378952c90&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 2433
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MWFiZjg0MTgtYTE1OS02ZDE2LTUwMzEtMjg4ZWRhNTZhNTA5
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MWFiZjg0MTgtYTE1OS02ZDE2LTUwMzEtMjg4ZWRhNTZhNTA5&google_tc=

170 B
188 B

38ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MWFiZjg0MTgtYTE1OS02ZDE2LTUwMzEtMjg4ZWRhNTZhNTA5&google_tc=

Requested by

Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=26ba2c35-e795-475f-bb65-56b378952c90&gdpr=0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

b7.80.fd9f.ip4.static.sl-reverse.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MWFiZjg0MTgtYTE1OS02ZDE2LTUwMzEtMjg4ZWRhNTZhNTA5&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 2433
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc=
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP6m-8BcfXyag9b1PMdvLsk&google_cver=1

43 B
106 B

34ms
28ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP6m-8BcfXyag9b1PMdvLsk&google_cver=1
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=26ba2c35-e795-475f-bb65-56b378952c90&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.211.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
via: 1.1 google
server: OXGW/16.211.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP6m-8BcfXyag9b1PMdvLsk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 65A2
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
https://eus.rubiconproject.com/usync.html?p=12776

281 B
554 B

59ms
38ms

Document
text/html

23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=12776
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.42.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://cdn.undertone.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cdn.undertone.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 23 Feb 2021 20:47:52 GMT
ETag: "402b0-119-5bc0708346e00"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 03 Aug 2021 18:41:44 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?p=12776
Date: Tue, 03 Aug 2021 18:41:44 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H/1.1

200
OK

sync
usr.undertone.com/userPixel/ Frame BB60
Redirect Chain

https://ib.adnxs.com/getuidnb?https://usr.undertone.com/userPixel/sync?partner=appnexus&uid=$UID
https://usr.undertone.com/userPixel/sync?partner=appnexus&uid=2238694250402211015

0
154 B

499ms
109ms

Image
text/plain

52.86.129.23
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partner=appnexus&uid=2238694250402211015
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.129.23 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
x-envoy-upstream-service-time: 1
server: istio-envoy
Connection: keep-alive
Content-Length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 03 Aug 2021 18:41:44 GMT
X-Proxy-Origin: 159.48.55.4; 159.48.55.4; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 39a72596-3f3b-4c19-b9ff-4659862659ae
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://usr.undertone.com/userPixel/sync?partner=appnexus&uid=2238694250402211015
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

sync
usr.undertone.com/userPixel/ Frame BB60
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&r=https://usr.undertone.com/userPixel/sync?partnerId=39&uid=
https://usr.undertone.com/userPixel/sync?partnerId=39&uid=7dbd30f5-6881-0fd1-2f54-6df0e7184b3b

0
308 B

488ms
108ms

Image
text/plain

52.86.129.23
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partnerId=39&uid=7dbd30f5-6881-0fd1-2f54-6df0e7184b3b
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.129.23 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
x-envoy-upstream-service-time: 0
server: istio-envoy
Connection: keep-alive
Content-Length: 0

Redirect headers

date: Tue, 03 Aug 2021 18:41:44 GMT
content-encoding: gzip
server: OXGW/16.211.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://usr.undertone.com/userPixel/sync?partnerId=39&uid=7dbd30f5-6881-0fd1-2f54-6df0e7184b3b
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H/1.1

200
OK

sync
usr.undertone.com/userPixel/ Frame BB60
Redirect Chain

https://pixel.advertising.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true
https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&apid=UP735c5fff-f48a-11eb-b96a-02024cce8e0c
https://ups.analytics.yahoo.com/ups/58293/sync?&gdpr=&gdpr_consent=&redir=true&apid=UP735c5fff-f48a-11eb-b96a-02024cce8e0c&verify=true
https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-30Ne9ypE2uFQo7qK1oNoocbGwaCS7AmR~A~UP735c5fff-f48a-11eb-b96a-02024cce8e0c

0
154 B

399ms
108ms

Image
text/plain

52.86.129.23
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-30Ne9ypE2uFQo7qK1oNoocbGwaCS7AmR~A~UP735c5fff-f48a-11eb-b96a-02024cce8e0c
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.129.23 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
x-envoy-upstream-service-time: 0
server: istio-envoy
Connection: keep-alive
Content-Length: 0

Redirect headers

Date: Tue, 03 Aug 2021 18:41:44 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://usr.undertone.com/userPixel/sync?partner=verizon&uid=y-30Ne9ypE2uFQo7qK1oNoocbGwaCS7AmR~A~UP735c5fff-f48a-11eb-b96a-02024cce8e0c
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

sync
usr.undertone.com/userPixel/ Frame BB60
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sirnsvg&ttd_tpi=1&gdpr=0&gdpr_consent=
https://usr.undertone.com/userPixel/sync?partner=ttd&uid=2a4c4438-9d13-4d78-bca2-c1a8f27fb040&ttl=1630608104

0
154 B

590ms
108ms

Image
text/plain

52.86.129.23
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partner=ttd&uid=2a4c4438-9d13-4d78-bca2-c1a8f27fb040&ttl=1630608104
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.129.23 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
x-envoy-upstream-service-time: 1
server: istio-envoy
Connection: keep-alive
Content-Length: 0

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://usr.undertone.com/userPixel/sync?partner=ttd&uid=2a4c4438-9d13-4d78-bca2-c1a8f27fb040&ttl=1630608104
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 247

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame BB60 0
239 B 31ms
30ms Image
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=12776
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Content-Type: image/gif

GET
H/1.1

200
OK

sync
usr.undertone.com/userPixel/ Frame BB60
Redirect Chain

https://cs.admanmedia.com/sync/undertone?url=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3Fpartner%3Dacuityads%26uid%3D%24UID
https://usr.undertone.com/userPixel/sync?partner=acuityads&uid=32a0c6872b8c92a96da8784d986fb1319fe40c5f

0
154 B

342ms
110ms

Image
text/plain

52.86.129.23
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usr.undertone.com/userPixel/sync?partner=acuityads&uid=32a0c6872b8c92a96da8784d986fb1319fe40c5f
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.129.23 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
x-envoy-upstream-service-time: 1
server: istio-envoy
Connection: keep-alive
Content-Length: 0

Redirect headers

Location: https://usr.undertone.com/userPixel/sync?partner=acuityads&uid=32a0c6872b8c92a96da8784d986fb1319fe40c5f
Date: Tue, 03 Aug 2021 18:41:44 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame BB60
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160318%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fusr.undertone...
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=174138C7-1149-463A-BC49-6E10DB7AC34B&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-KzHoBR5E2uUf2VLxTHM0zF6eS3b8YXQ-~A&gdpr=0&gdpr_consent=

0
128 B

33ms
30ms

Image
text/plain

185.64.190.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-KzHoBR5E2uUf2VLxTHM0zF6eS3b8YXQ-~A&gdpr=0&gdpr_consent=
Requested by: Host: cdn.undertone.com
URL: https://cdn.undertone.com/js/usersync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.undertone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:43 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Tue, 03 Aug 2021 18:41:44 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-KzHoBR5E2uUf2VLxTHM0zF6eS3b8YXQ-~A&gdpr=0&gdpr_consent=
Connection: keep-alive
Content-Length: 0

GET
H2 200 match Show response
c1.adform.net/serving/cookie/ Frame F6DF 35 B
467 B 71ms
70ms Document
image/gif 37.157.6.251
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?party=14&cid=174138C7-1149-463A-BC49-6E10DB7AC34B

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.251 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

s1.adform.net

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: c1.adform.net
:scheme: https
:path: /serving/cookie/match?party=14&cid=174138C7-1149-463A-BC49-6E10DB7AC34B
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: C=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Tue, 03 Aug 2021 18:41:44 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
set-cookie: uid=2706073492225668098; expires=Sat, 02 Oct 2021 18:41:44 GMT; domain=adform.net; path=/; secure; samesite=none
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

sync Show response
usr.undertone.com/userPixel/ Frame D706
Redirect Chain

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=8565681534129508188
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?p=160318&pmc=1&pr=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D53%26uid%3D174138C7-1149-463A-BC49-6E10DB7AC34B
https://usr.undertone.com/userPixel/sync?partnerId=53&uid=174138C7-1149-463A-BC49-6E10DB7AC34B

0
308 B

268ms
107ms

Document
text/plain

52.86.129.23
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usr.undertone.com/userPixel/sync?partnerId=53&uid=174138C7-1149-463A-BC49-6E10DB7AC34B
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.129.23 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Host: usr.undertone.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://ads.pubmatic.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
server: istio-envoy
set-cookie: UID_EXT_53=174138C7-1149-463A-BC49-6E10DB7AC34B; Path=/; Domain=undertone.com; Expires=Thu, 04-Aug-2022 00:30:56 GMT; SameSite=None; Secure;
x-envoy-upstream-service-time: 1
Content-Length: 0
Connection: keep-alive

Redirect headers

server: nginx
date: Tue, 03 Aug 2021 13:38:57 GMT
set-cookie: SPugT=1627997937; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 02-Sep-2021 13:38:57 GMT; path=/
location: https://usr.undertone.com/userPixel/sync?partnerId=53&uid=174138C7-1149-463A-BC49-6E10DB7AC34B
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

GET
H2 200 usersync.aspx Show response
dis.criteo.com/dis/ Frame C549 43 B
338 B 71ms
67ms Document
image/gif 178.250.0.163
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

:method: GET
:authority: dis.criteo.com
:scheme: https
:path: /dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache
pragma: no-cache
content-type: image/gif
expires: Tue, 03 Aug 2021 00:00:00 GMT
server: Microsoft-IIS/10.0
x-errorlevel: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1241
date: Tue, 03 Aug 2021 18:41:43 GMT
content-length: 43

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame B6CF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=F0E4xxFJRjq8SW4Q23rDSw%3D%3D
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

14 KB
14 KB

34ms
32ms

Image
text/html

2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
content-encoding: gzip
last-modified: Tue, 15 Jun 2021 06:08:03 GMT
server: Apache/2.2.15 (CentOS)
etag: "1300708-3945-5c4c7cc02bd56"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=152082
accept-ranges: bytes
content-type: text/html; charset=UTF-8
content-length: 5054
expires: Thu, 05 Aug 2021 12:56:26 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame B6CF
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=46386109-8de8-4200-8882-4b703fe6fbbf

0
128 B

33ms
30ms

Image
text/plain

185.64.190.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=46386109-8de8-4200-8882-4b703fe6fbbf
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:42 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Tue, 03 Aug 2021 18:41:47 GMT
Server: MT3 3820 7698daf master zrh-pixel-x15
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=46386109-8de8-4200-8882-4b703fe6fbbf
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 03 Aug 2021 18:41:46 GMT

GET
H/1.1

200
OK

/
pixel.onaudience.com/ Frame B6CF
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=174138C7-1149-463A-BC49-6E10DB7AC34B
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1
https://pixel.onaudience.com/?partner=147&mapped=2a4c4438-9d13-4d78-bca2-c1a8f27fb040&icm
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25&xl8blockcheck=1
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=eff6feb47e9f6f78faa585367bab9524

35 B
247 B

104ms
104ms

Image
image/gif

51.79.83.225
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.onaudience.com/?partner=161&icm&cver&mapped=eff6feb47e9f6f78faa585367bab9524
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.79.83.225 Beauharnois, Canada, ASN16276 (OVH, FR),
Reverse DNS: ns5000442.ip-51-79-83.net
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-length: 35
content-type: image/gif

Redirect headers

date: Tue, 03 Aug 2021 18:41:44 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://pixel.onaudience.com/?partner=161&icm&cver&mapped=eff6feb47e9f6f78faa585367bab9524
cache-control: no-cache
access-control-allow-credentials: true
content-type: text/html
content-length: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame B6CF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MTc0MTM4QzctMTE0OS00NjNBLUJDNDktNkUxMERCN0FDMzRC&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpubmatic
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpubmatic
https://x.bidswitch.net/sync?dsp_id=59&user_id=c76196ee-adb6-4a56-99bf-d655dbd32b29&ssp=pubmatic
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=

1 B
70 B

31ms
30ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug011:0:553
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=
date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame B6CF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEElHxlWVyQ7FpqVmeyvSYk0&google_cver=1
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=83e71d96-ed50-4f15-993c-9f16f4e3f399
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=83e71d96-ed50-4f15-993c-9f16f4e3f399
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=bda45212-bd6d-4c74-987b-756a7712f73f&user_group=1&ssp=pubmatic&bsw_param=83e71d96-ed50-4f15-993c-9f16f4e3f399
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=

1 B
70 B

31ms
31ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug017:0:501
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=
date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2 200 pubmatic
um.simpli.fi/ Frame B6CF 43 B
610 B 26ms
22ms Image
image/gif 159.253.128.183
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.253.128.183 Amsterdam, Netherlands, ASN36351 (SOFTLAYER, US),

Reverse DNS

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Mon, 02 Aug 2021 18:41:44 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame B6CF
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:46386109-8de8-4200-8882-4b703fe6fbbf&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=83e71d96-ed50-4f15-993c-9f16f4e3f399
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=&ssp=pubmatic&bsw_param=83e71d96-ed50-4f15-993c-9f16f4e3f399
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=

1 B
70 B

31ms
30ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug011:0:729
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=
date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame B6CF
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=8079986970567257559
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=pubmatic
https://x.bidswitch.net/sync?dsp_id=70&user_id=8079986970567257559&ssp=pubmatic
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=

1 B
181 B

30ms
30ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug011:0:324
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=
date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame B6CF
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=2a4c4438-9d13-4d78-bca2-c1a8f27fb040
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=83e71d96-ed50-4f15-993c-9f16f4e3f399
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=83e71d96-ed50-4f15-993c-9f16f4e3f399
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=bda45212-bd6d-4c74-987b-756a7712f73f&user_group=1&ssp=pubmatic&bsw_param=83e71d96-ed50-4f15-993c-9f16f4e3f399
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=

1 B
70 B

31ms
30ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug004:0:522
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=
date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame B6CF
Redirect Chain

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=2238694250402211015&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://p.rfihub.com/cm?in=1&pub=20513&ssp=pubmatic
https://x.bidswitch.net/sync?dsp_id=119&user_id=1871316022123385282&expires=30&ssp=pubmatic
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=

1 B
70 B

31ms
30ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug008:0:605
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=83e71d96-ed50-4f15-993c-9f16f4e3f399&gdpr=&gdpr_consent=&gdpr_pd=
date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2 200 174138C7-1149-463A-BC49-6E10DB7AC34B
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame B6CF 43 B
578 B 66ms
62ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/174138C7-1149-463A-BC49-6E10DB7AC34B?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame EF8A 70 B
264 B 68ms
64ms Image
image/gif 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=1&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2

200

xuid
eb2.3lift.com/ Frame EF8A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEEuBIA6EeG8uM87yY5_Ishw&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1

37 B
352 B

86ms
83ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEEuBIA6EeG8uM87yY5_Ishw&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 18:41:44 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Tue, 03 Aug 2021 18:41:44 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEEuBIA6EeG8uM87yY5_Ishw&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame EF8A
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDUxNDA0MzY1MzcwMzgzMTAxMA%3D%3D

170 B
188 B

41ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDUxNDA0MzY1MzcwMzgzMTAxMA%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS